Segments
Parse alert and load policy
3sRule TM-SAN-001 resolved to typology "Sanctions nexus". Loaded the PL policy pack and the institution's escalation matrix.
Intake · 1 records
Retrieve KYC and relationship history
11sPulled the customer file, prior dispositions and the current risk rating.
KYC retrieval · 14 records
Reconstruct transaction history
27sAnalysed 2 alerted transactions against a trailing twelve-month baseline; tested for threshold proximity, velocity, round-value patterning and pass-through.
Transaction analysis · 342 records
Expand counterparty network to 1 hop
34sResolved 1 counterparties and tested for shared identifiers, device overlap, circular flow and undisclosed common control.
Counterparty network · 1 records
Screen subject and counterparties
19sScreened against consolidated sanctions lists, the global PEP register and internal watchlists; applied the institution's discriminator rules to each candidate.
Sanctions & PEP · 2 records
Adverse media sweep
22sSearched 42 languages across licensed and open sources, deduplicated by event and tested each candidate for homonym risk.
Adverse media · 1,840 records
Weigh evidence and reach disposition
16sAggregated 4 weighted findings; suspicion score 0.71 against the institution's thresholds.
Risk reasoning · 4 records
Draft regulator-grade narrative
14sComposed the six-part narrative with a source citation on every asserted fact.
Narrative drafting · 4 records
Self-check against the QA rubric
9sVerified every narrative assertion resolves to a retrieved record, checked policy citations and tested the disposition against the escalation matrix.
Self-QA · 4 records
Routed to a human
Screening match cannot be resolved on available data
Vostok Logistika TOV — alias match 0.93 at 93% — Strong alias overlap with a designated entity but a divergent registration number. Below the institution's auto-clear bar; mandatory human determination under the sanctions escalation policy.
EU consolidated list
Activity materially exceeds declared expectation
Alerted volume 15,800 EUR against a declared monthly expectation of 4,000 EUR (4.0×).
KYC profile CUS-664012
High pass-through ratio explained by the business model
100% of inbound value was disbursed within the alert window; pass-through is intrinsic to a logistics coordinator, whose settlement obligations are documented at onboarding.
Transaction ledger, 2 records
Counterparty risk flags reviewed and attributable
Flags on 1 counterparty resolve to cross-border or sector attributes already captured in the customer's risk rating.
Counterparty register
Subject
Oksana Petrenko (CUS-664012) is an individual customer of the institution since March 9, 2024, resident in Kraków, PL and recorded as logistics coordinator. The relationship carries a medium inherent risk rating, last reviewed September 19, 2025. Declared source of funds is salary, with an expected monthly throughput of 4,000 EUR. Identity was verified on March 9, 2024 by documentary + database.
Activity under review
Alert ALT-2026-88075 was generated by rule TM-SAN-001 — counterparty name matches a designated-party alias at 0.93 — covering 2 transactions totalling 15,800 EUR through the sepa channel between August 1, 2026 to August 29, 2026. 1 inbound and 1 outbound movements were reviewed in full, together with the customer's trailing twelve-month history and 1 counterparty resolved to 1 hop.
Findings
(1) Screening match cannot be resolved on available data. Vostok Logistika TOV — alias match 0.93 at 93% — Strong alias overlap with a designated entity but a divergent registration number. Below the institution's auto-clear bar; mandatory human determination under the sanctions escalation policy. [EU consolidated list] (2) Activity materially exceeds declared expectation. Alerted volume 15,800 EUR against a declared monthly expectation of 4,000 EUR (4.0×). [KYC profile CUS-664012]
Mitigating evidence
(1) High pass-through ratio explained by the business model. 100% of inbound value was disbursed within the alert window; pass-through is intrinsic to a logistics coordinator, whose settlement obligations are documented at onboarding. [Transaction ledger, 2 records] (2) Counterparty risk flags reviewed and attributable. Flags on 1 counterparty resolve to cross-border or sector attributes already captured in the customer's risk rating. [Counterparty register]
Screening
EU consolidated list: Vostok Logistika TOV — alias match 0.93 (score 0.93) — unresolved. Strong alias overlap with a designated entity but a divergent registration number. Below the institution's auto-clear bar; mandatory human determination under the sanctions escalation policy.
Disposition
The activity cannot be resolved at this level and is referred to a senior investigator for determination. Referral is mandatory under the institution's escalation policy on the following grounds: screening match unresolved on available data; sanctions alias match above the mandatory-referral threshold. This determination was produced by heelius-investigator-4.2 · policy-pack us-bsa-2026.08 with a calibrated confidence of 73% and is subject to the institution's quality-assurance sampling programme.
Correctly refused to clear on an unresolved alias match. Registration-number discriminator noted but appropriately not treated as dispositive.
MLRO office