AML detection · coverage proof
Every AML vendor says they catch financial crime.
Regula tests every case its detection can decide on, 860,160 of them, exhaustively, with no sampling, and publishes exactly where the alerting reaches and where it does not.
The law this encodes
Not a customer list. The instruments the catalogue is built from, each one a real citation you can check.
38 provisions, each stored as a versioned rule the engine evaluates directly.
Coverage proof
| Outcome | Regions | Cases |
|---|---|---|
| Alerts | 64 | 792960 |
| Seen, below the alert line | 62 | 65856 |
| Nothing fires | 2 | 1344 |
The white band · 672 cases
A transfer under $1,000 with clean exposure is invisible to detection.
Every competitor tests a sample and reports a percentage. This is the whole space, drawn at true width, and the white band is the part where nothing fires.
The rest are measured, stored and shown to a reviewer, and none of them can move an alert on its own. That is a property of the engine, not an opinion about it, so it is published rather than described.
The size of the transfer. It cuts the space, and the Travel Rule threshold is its only cut point, but the rule doing the cutting is not alert-eligible, so no value it takes reaches an alert.
amount_usd
You decide whether that needs a manual control. Nobody else in this market will tell you it is there.
The console
Every module reads the same catalogue, so a revision to one obligation moves through all of them rather than being re-entered in each.
Catalogue
Provision reference, severity, evidence and version history, with a condition the engine checks against your data wherever the duty is observable. When the regulator revises one, the catalogue versions it and every module downstream follows.
The queue carries the transaction, the rule that fired and the draft internal SAR, exported as a goAML report that the FMU's own 5.0.2 schema validates before release.
| Created | Transaction | Risk | Status |
|---|---|---|---|
| 14:29:03 | 0x9b21…e08a | Critical | FILED |
| 14:31:47 | 0x7a3f…c41d | High | OPEN |
Form A7 Internal SAR · NOC Regulations 2025 Form A7
Transaction 0x7a3f…c41d moved 1500.00 USD-equivalent of USDT. Classified HIGH under NOC Reg. 11 (direct_illicit_exposure 0.25 >= 0.2).
goaml_export: available. Validated against FMU goAML schema 5.0.2 before release
goAML export: STR-F, schema-validated
available: true · goAML 5.0.2
Sanctions exposure to two hops, with the facts behind every score kept beside it. An unrated counterparty says so rather than defaulting to low.
Travel Rule
In force in Pakistan since August. Regula routes qualifying transfers, holds the payload, and records what the counterparty returned.
The package is recorded as evidence with its hash and the jurisdiction status, and it is not transmitted.
Travel Rule · counterparties
Every jurisdiction Regula routes against carries a cited legal source. Anywhere else, the transfer resolves as an unknown jurisdiction and the package is held as evidence, never sent on the assumption that a rule is in force somewhere nobody can cite.
Agentic AML
Point it at a gap and it drafts a detection rule, then hands that draft to the same analyser this page is built on and asks whether it closes the gap. Not a second, softer check, but the identical machinery. If cases stay open, it tries again.
Draft
A candidate rule for the gap you point it at.
Validate
Rejected unless every fact it names is one the engine observes.
Prove
Run against the same analyser this page is built on.
Retry
Cases still open come back as feedback, and it goes again.
A draft is a proposal, not a change: nothing is live until an officer approves it, an approved rule applies to transactions scored after it rather than backwards, and its thresholds are industry convention, and FATF publishes no numbers for these indicators.
License readiness
29 still to close before this application is complete.
Gaps, worst first
NOC Reg. 12
VA Act 2026 s.47(1)
NOC Reg. 11
FATF Recommendation 16
Next action
Reg. 99, reporting to the FMU
Every module is live. We’re onboarding a small number of design partners, so there is a working console to react to rather than a roadmap to take on trust.
Or read the raw proof: coverage-report.json · 860,160 cases · sha256 6c9f114