Fraud Copilot AML Holds

When an institution enables Fraud Copilot, CoreWave screens portal postings and API money-movement requests before balances change.

If Fraud Copilot is disabled or was never explicitly enabled for an institution, the AML screening gate returns immediately and does not hold, delay, or alter portal postings or API transactions. The transaction-blocking switch is institution-scoped; it does not inherit a legacy global or appsettings enablement.

The screening gate uses the institution's active transaction rules. It checks:

• A single proposed inflow or outflow against the configured rule threshold.
• The proposed amount plus completed transactions on the account during the previous 24 hours. This catches attempts to split a large movement into smaller transactions.

When a rule matches, CoreWave creates a suspicious-transaction record, stops processing, and opens an approval named Release Fraud Copilot AML Hold.

Staff Setup

1. Open System Configuration > AI Settings and enable Fraud Copilot.
2. Open Fraud Monitor > Transaction Rules and configure the institution's inflow and outflow AML thresholds.
3. Grant approve-aml-held-transactions only to staff roles authorized to release held transactions.
4. Staff review holds from Operations > Approvals and supporting details from Fraud Monitor > Suspicious Transactions.

The suspicious-transaction screen shows the AML hold reference, approval ID, rule, amount, direction, and reason.

Use Reports > Regulatory Reports > AML Screening Report to export the Fraud Copilot hold audit trail, including source and destination accounts, screening reason, approval state, release time, execution time, and current hold status.

Portal Behavior

Portal postings use the existing posting workspace:

1. A staff member submits a posting.
2. If Fraud Copilot flags the posting, the UI displays a warning that no funds moved.
3. The posting group remains Pending Approval.
4. An authorized staff member approves the AML hold.
5. CoreWave resumes the staged posting group automatically.
6. If the institution configured ordinary posting approval, the group continues through that approval queue before balances move.

Staff do not need to edit JSON or resubmit the portal posting.

API Behavior

The AML gate applies to:

• POST /api/transfer/v1/localfundtransfer
• POST /api/transfer/v1/outwardtransfer
• POST /api/transfer/v1/fundstransfer
• POST /api/postings/v1/posttransaction
• POST /api/postings/v1/post

When a request is held, CoreWave returns 202 Accepted. No debit, credit, fee posting, lien update, or outward gateway call has occurred.

{
  "status": false,
  "message": "Transaction held for Fraud Copilot AML review. No funds moved.",
  "data": {
    "statusCode": "AML_HOLD",
    "amlHold": true,
    "approvalId": 842,
    "amlApprovalReference": "AML-26caaadad76043d596bd",
    "reason": "Fraud Copilot matched AML rule 'High Value Outflow' because the transaction amount 5000000.00 reached its outflow threshold 5000000.00."
  }
}

After authorized approval, retry the same request payload with amlApprovalReference:

{
  "debitAccount": "1000000001",
  "creditAccount": "1000000002",
  "amount": 5000000,
  "narration": "Supplier settlement",
  "postingsTransactionType": 3,
  "amlApprovalReference": "AML-26caaadad76043d596bd"
}

Rules:

• The approval reference is bound to the original payload and endpoint.
• A changed amount, account, reference, narration, fee, or beneficiary is rejected.
• A pending or declined approval cannot release funds.
• An approval reference is one-time use. It cannot be replayed after successful execution.
• API_BYPASS_APPROVALS does not bypass Fraud Copilot AML holds.

Integration Handling

Treat 202 Accepted with data.statusCode = "AML_HOLD" as a pending manual-review state:

1. Persist data.amlApprovalReference.
2. Notify the operations or compliance team.
3. Wait for authorized approval.
4. Retry the unchanged request with the stored reference.
5. Continue normal TSQ or reconciliation after a successful retry.