01
KYC & relationship
Customer file, beneficial owners, declared source of funds, expected activity, prior dispositions and every open alert on the relationship.
18 records
Platform
It sits on the monitoring system you already run
Heelius does not replace your rules engine, your case manager or your screening vendor. It consumes the alerts they produce, investigates each one against your own records, and writes back a disposition with a narrative and a full evidence trail.
The investigation
Eight passes, the same order a good analyst works in
Heelius does not summarise an alert. It performs the investigation — retrieving the same records an L2 analyst would pull, in the same sequence, and showing its work at every step.
02
Transaction reconstruction
The alerted window plus a trailing twelve-month baseline, tested for threshold proximity, velocity, round-value patterning and pass-through.
347 txns
03
Counterparty network
Entity resolution out to three hops. Shared devices, common funding addresses, sequential registrations and circular flow between nominally unrelated parties.
3 hops
04
Sanctions, PEP & RCA
Consolidated list screening with discriminator logic — the agent states which identifiers diverge, and never clears on a name mismatch alone.
4 lists
05
Adverse media
42 languages, deduplicated by event, each candidate tested for homonym risk against date of birth, employer and biography.
1,840 articles
06
Weighted reasoning
Aggravating and mitigating findings scored against the institution's own thresholds. Unresolvable evidence routes to a human — it is never rounded to clear.
8 findings
07
Narrative drafting
Six sections in the conventional order — subject, activity, findings, mitigants, screening, disposition — with a source citation on every asserted fact.
6 sections
08
Self-QA
Every assertion is traced back to a retrieved record before the case is released. Unsupported prose fails the check and is redrafted.
100% traced
Narrative engine
Prose that cannot outrun its evidence
Narratives are assembled from retrieved records, not written from a summary. Every asserted fact carries the record it came from — so an examiner can walk any sentence back to the ledger it was drawn from.
Retrieved evidence
- F-15 cash deposits, 8,900–9,600 USD, none ≥ 10,000Deposit ledger
- F-23 distinct branches within 14 daysDeposit ledger — location
- F-3Declared monthly expectation 40,000 USDKYC profile CUS-448192
- F-434,000 USD to BR counterparty, +72hWire ledger
- F-50.71 fuzzy match discounted — DOB Δ 14yOFAC SDN + EU + OFSI
- F-65-year tenure, 2 prior alerts, 0 filingsCase history
Unsupported prose fails self-QA and is redrafted before release
Generated narrative · ALT-2026-88104
Activity under review
Alert ALT-2026-88104 was generated by rule TM-STR-004 covering eight transactions totalling 46,300 USD through the retail deposit channel between 20 and 25 August 2026. Five cash deposits ranging from 8,900 to 9,600 USD were placed across three distinct branches, none reaching the 10,000 USD currency-transaction reporting thresholdF-1F-2. The alerted volume represents 1.2× the customer’s declared monthly expectation of 40,000 USDF-3.
Findings
Within 72 hours of the final deposit, 34,000 USD was remitted to a Brazilian construction counterparty against an invoice reference that matches the supplier recorded at onboardingF-4. Sanctions screening returned a single 0.71 fuzzy candidate, discounted on a 14-year date-of-birth divergence and a non-matching jurisdiction under the institution’s two-discriminator ruleF-5.
8 citationsheelius-investigator-4.2policy-pack us-bsa-2026.08Confidence 68%
Integrations
Typed connectors, not screen scraping
Every record enters through a typed connector with a stable schema, which is what makes retrieval replayable and a case defensible a year later.
- Monitoring
- Actimize, Oracle Mantas, Verafin, Unit21, Hawk, Sardine, in-house rules engines
- Core & ledger
- Thought Machine, Mambu, Temenos, FIS, Marqeta, Galileo, direct database
- KYC & identity
- Alloy, Persona, Onfido, Sumsub, Smile ID, in-house CIP stores
- Screening
- Dow Jones, LSEG World-Check, ComplyAdvantage, Napier, OpenSanctions
- Virtual assets
- Chainalysis, TRM, Elliptic, node-level attribution
- Case management
- Hummingbird, Unit21, Salesforce, Jira, ServiceNow, or write-back over API
Who it is for
Shaped per segment, not per logo
Neobanks & payment facilitators
Alert volume scales with account growth while headcount does not. Heelius takes the L1 tier whole and gives the compliance team back its senior people for the escalations that actually carry filing risk.
Mobile money operators
Agent float, till networks, SIM co-registration and cross-border corridors — typologies that legacy tooling was never shaped for, at a per-alert price that works against a local compliance budget.
Remittance & MSBs
Corridor-level baselines, aggregated originator handling and beneficiary-side disbursement reconciliation, with narratives in the format each receiving regulator expects.
Virtual asset providers
On-chain attribution joined to the fiat relationship: bridge structuring, unhosted exposure, mixer hop distance and related-party settlement back to the registered UBO.
Where the model has to change
Two markets the incumbents were not built for
Legacy investigation tooling assumes a correspondent bank's data model and a Western analyst's budget. Both assumptions break in the places where alert volume is growing fastest.
Emerging markets
Mobile money and agent networks
Operators in Nairobi, Lagos, Dhaka and Manila carry the same FATF obligations as a tier-1 bank on a fraction of the compliance budget — and alert volumes that scale with subscriber counts, not revenue. Heelius investigates agent float velocity, SIM-cluster co-registration, device overlap between nominally independent tills and cross-border corridor anomalies.
- Agent and till-level typologies out of the box
- Device, SIM and handset entity resolution
- Local-currency thresholds and regulator narrative formats
- Runs at per-alert prices a 30-analyst team cannot match
Virtual assets
Stablecoin and on-chain flows
Chain analytics tells you an address is risky. It does not tell you whether your customer's use of it is suspicious. Heelius joins on-chain attribution to the fiat side of the relationship — bridge structuring below travel-rule thresholds, unhosted-wallet exposure, mixer hop distance, related-party settlement back to a registered UBO.
- Bridge and cross-chain hop tracing
- Travel-rule threshold structuring detection
- Unhosted wallet and mixer proximity scoring
- Fiat off-ramp reconciliation to the KYC record