AML
Natech's Anti-Money Laundering (AML) API is a comprehensive, production-grade platform that empowers financial institutions to detect, investigate, and report suspicious financial activity. Built on Natech's Poseidon core-banking ecosystem, the API combines everyday banking operations — account, customer, and transaction management — with advanced AML compliance capabilities such as real-time risk scoring, configurable rule engines, alert workflows, and watchlist screening.
Whether you are integrating an existing core-banking system or building a new compliance layer, the AML API provides the building blocks to satisfy Anti-Money Laundering Directives (AMLD), Know Your Customer (KYC) requirements, and institutional risk policies — all through a single, secure REST interface authenticated with JWT Bearer tokens.
Key Capabilities
Transaction Monitoring & Lifecycle
Create, commit, reverse, and query financial transactions end-to-end. Every transaction passes through a configurable scoring engine that evaluates it against institution-defined rules and assigns a risk score. Suspicious transactions are automatically flagged, and behavioural analytics endpoints let you retrieve periodic summaries, credit-amount breakdowns, and pattern-based analysis per customer.
Risk Scoring Engine
The scoring subsystem rates every transaction against a configurable set of rules and thresholds. Scores are stored per transaction and per CRM entry, with full CRUD and batch-action support. Transaction score results, rule-level breakdowns, and overview scores are exposed through dedicated endpoints.
Alert Management & Workflow Steps
When a transaction or customer triggers a rule, an Alert is created. Alerts follow a lifecycle — open, in-progress, closed as false positive, or closed as reported to authority. Each alert can have attachments, comments, and a full audit history. Investigation work is organised into Steps, which belong to configurable Workflow Templates. Steps can be assigned to individual users or groups, completed, reverted, and tracked through a complete history log.
Watchlist & Sanctions Screening
Screen customers against global watchlists — including sanctions lists, PEP (Politically Exposed Persons) databases, and adverse-media feeds. Screening results are retrievable, and sanction-list versions associated with each customer can be updated to track ongoing due-diligence cycles.
Customer 360° View
Manage the full customer lifecycle: personal and corporate profiles, addresses, identities, professions, tax residences, year-income records, and customer relations. Retrieve a customer's accounts, suspicion-status history, group memberships, and rule exceptions — all from a single controller. Slim customer pages are available for performance-sensitive list views.
Account & Beneficiary Management
Create, update, and delete accounts identified by IBAN. Attach or remove beneficiaries from any account. Manage the reference data that classifies accounts — account statuses and account types — through their own CRUD endpoints.
Configurable Rule Engine
Define, update, and query the AML rules that drive scoring and alerting. Rules can be assigned globally, per group, or as customer-level exceptions. Operators used in rule expressions are exposed through a dedicated read endpoint, and default customer rules can be toggled on or off.
Comprehensive Reference Data
Administer the lookup tables that underpin the entire AML domain:
| Domain | Entities |
|---|---|
| Geography | Countries, Provinces, Cities, AML Countries |
| Finance | Currencies, Branches, Products |
| Channels | Channels (online, mobile, ATM, branch …) |
| Customer classification | Customer Types, Customer Legal Types, Education Levels, Professions, Identity Types, Address Types, Onboarding Statuses, Business Types |
| Transaction classification | Transaction Types, AML Transaction Types, Transaction Types Config |
| Administration | Users, Groups, Tax Offices |
Health & Status Monitoring
Verify API availability and the health of downstream dependencies through dedicated health-check endpoints. A 204 response signals a healthy system; 503 indicates degraded service.
Authentication
All requests must include a valid JWT in the Authorization header:
Authorization: Bearer {token}
Tokens are issued by the institution's identity provider and must be included with every API call. The API uses the HTTP Bearer scheme as defined in the OpenAPI specification's security schemes.
Architecture at a Glance
┌──────────────┐ ┌──────────────────────────────────────────────┐
│ Client App │──JWT──▶│ AML API Gateway │
└──────────────┘ │ ┌──────────┐ ┌──────────┐ ┌─────────────┐ │
│ │Customers │ │Accounts │ │Transactions │ │
│ └────┬─────┘ └────┬─────┘ └──────┬──────┘ │
│ │ │ │ │
│ ┌────▼────────────▼───────────────▼──────┐ │
│ │ Scoring Engine │ │
│ │ Rules · Scores · Transaction Config │ │
│ └────────────────┬───────────────────────┘ │
│ │ │
│ ┌────────────────▼───────────────────────┐ │
│ │ Alert & Workflow Engine │ │
│ │ Alerts · Steps · Templates · Comments │ │
│ └────────────────┬───────────────────────┘ │
│ │ │
│ ┌────────────────▼───────────────────────┐ │
│ │ Watchlist & Screening Service │ │
│ │ Sanctions · PEP · Adverse Media │ │
│ └────────────────────────────────────────┘ │
│ │
│ Reference Data · Users · Groups · Health │
└──────────────────────────────────────────────┘
Getting Started
- Obtain a JWT token from your identity provider.
- Explore the API categories in the sidebar — each tag groups related endpoints.
- Try it out — every endpoint page includes an interactive API explorer with request/response schemas and code samples in 9 languages.
- Consult the Glossary for definitions of AML-specific terms used throughout the documentation.
Related Resources
- Glossary — Definitions for all AML domain terms are available in the sidebar.
- Developer Guide — Authentication, SDKs, error handling, and more are available in the Developer Guide section.