How We Built an AML System at Silent Eight: From Rules to AI
A note on attribution before you read it. I led this product as the AI/ML product manager for AML Transaction Screening at Silent Eight, from November 2022 to June 2023. Its end-clients included HSBC, Bank of America and Standard Chartered, and the “we” in this piece is that team, not Cone Red. It is here because the engineering lessons are the ones I still apply.
The problem
Anti-money-laundering compliance is the unglamorous backbone of every bank. Every transaction, every new customer, every wire transfer must be screened against sanctions lists, watched for suspicious patterns, and documented for regulators.
For decades, banks handled this with rule-based systems. If a name matched a watchlist entry within a certain Levenshtein distance (a measure of how many character edits separate two strings), the system flagged it. If a transaction exceeded a threshold, the system flagged it.
The problem: rule-based systems are blunt instruments. They catch the obvious cases, miss the subtle ones, and drown compliance teams in false positives. An analyst might review 100 flagged transactions in a day, and 98 of them are legitimate. The real threats (the ones using aliases, transliteration variants, and deliberately obscure structures) slip through.
At Silent Eight, the screening product’s solve rate stood at 45%, and integrating a new client took about 3 months.
What we built
We replaced the rule-based stack with an AI-driven AML platform covering five modules:
-
Transaction screening. Every transaction is screened against sanctions lists, PEP databases, and adverse media. The AI does not just match strings. It understands that “Muhammad” and “Mahmoud” and “Mohammad” are the same name in different transliterations. It understands that “Levin” and “Levine” might be the same person. This semantic name matching is where the biggest accuracy jump came from.
-
Transaction monitoring. The system watches for patterns across time: structuring (breaking large transfers into smaller ones to avoid thresholds), rapid movement through multiple accounts, unusual geographic flows. The AI models learn what normal looks like for each bank and flag deviations.
-
KYC (Know Your Customer). Onboarding workflows that verify customer identity, assess risk profiles, and continuously monitor for changes in status (a customer becomes a PEP, appears in adverse media, changes jurisdiction).
-
KYB (Know Your Business). Entity-level screening that traces ownership structures, identifies ultimate beneficial owners, and flags shell companies or high-risk jurisdictions in the ownership chain.
-
PEP screening. Continuous monitoring of customers against politically exposed persons databases, with risk scoring based on role, jurisdiction, and exposure.
The evolution: three generations
The system did not start as AI. It evolved through three generations, and the story of that evolution is the story of why AI matters in compliance.
Generation 1: Rules
The original system was pure rules. Levenshtein distance for name matching, regex patterns for transaction patterns, fixed thresholds for amount-based alerts. It worked, sort of. It caught the obvious cases. But the ones it missed were the dangerous ones: sophisticated actors using name variants, alias networks, and transaction structures designed to evade blunt matching.
The false positive rate was brutal. Compliance analysts spent most of their time clearing legitimate transactions that the rules flagged because a name was almost similar to a watchlist entry.
Generation 2: BERT transformers
The first AI layer was a BERT-based transformer model. This was before the GPT era: we were building on the first generation of transformer architectures that understood language semantically rather than just character-by-character.
The jump was significant. Name matching improved because the model understood that “Muhammad” and “Mahmoud” share semantic meaning even though they differ in characters. Transaction pattern detection improved because the model could learn what “normal” looked like for each bank and flag genuine anomalies instead of threshold violations.
Matching quality improved and false positives dropped. Analysts could focus on genuine investigations instead of clearing noise.
Generation 3: LLM and graph screening (solve rate 45% to 87%)
The current generation pairs LLMs with graph neural networks (GNNs) that understand context, aliases, and entity relationships at a level the earlier models could not.
The key breakthrough was not raw model size. It was the training approach: we taught the system to understand name networks. A person might appear in a sanctions list as “Mohammad bin Hassan,” in a transaction as “M. Al-Hassan,” and in a KYC record as “Mohammed Hassan.” A rule-based system sees three different names. A Levenshtein matcher sees moderate similarity. A semantic model with alias training sees one person.
The solve rate went from 45% to 87%. What the system cannot resolve with confidence, it flags as “low confidence, review recommended” rather than letting it pass silently.
Results
| Metric | Before | After |
|---|---|---|
| Solve rate | 45% | 87% |
| Client integration | ~3 months | 2-4 weeks |
| Go/no-go release decisions | Baseline | ~35% faster |
| Maintenance cost | Baseline | ~32% lower |
| Name variant matching | Levenshtein only | Semantic + alias networks |
| Transaction pattern detection | Fixed thresholds | Learned baselines per bank |
What we learned
The model is 20% of the work. The other 80% is data engineering, integration, and regulatory validation. Banks do not buy models. They buy systems that integrate with their core banking platform, produce audit trails regulators accept, and do not break at 3 AM. The AI is the flashy part. The plumbing is what makes it ship.
Semantic name matching is the highest-ROI AI application in compliance. Not chatbots. Not document summarization. The ability to understand that two different strings refer to the same person. That single capability, deployed across screening, monitoring, and KYC, accounts for most of the accuracy improvement.
False positives are the real cost driver. A system that catches nearly every threat but floods analysts with false alerts is worse than one that catches a little less with clean alerts. The AI’s job is not just to catch more. It is to catch more precisely.
Regulatory acceptance is a feature, not a hurdle. We designed the system from day one with explainability built in. Every flag comes with a reason: which name variant matched, which pattern triggered, which source was referenced. Regulators do not accept black boxes. They accept systems that can explain their decisions.
This system was built at Silent Eight, where I led the AI/ML AML product. Today I build production AI at Cone Red. If you are evaluating AI for compliance, AML, or banking operations, let’s talk.
Common Questions
- What AML systems did you build for banks?
- We built the full compliance stack: transaction screening (sanctions and watchlist matching), transaction monitoring (detecting suspicious patterns), KYC (Know Your Customer), KYB (Know Your Business), and PEP screening (Politically Exposed Persons). Each module replaced or augmented legacy rule-based systems with AI-driven matching and classification.
- What results did the AI-based AML system deliver?
- The solve rate rose from 45% to 87%. That gain comes primarily from semantic name matching: the AI understands that name variants like Muhammad, Mahmoud, and Mohammad refer to the same person. Client integration also dropped from about 3 months to 2-4 weeks, and MLOps rollback pipelines with acceptance-test-driven releases made go/no-go release decisions about 35% faster and cut maintenance cost by about 32%.
- What AI models power the AML system?
- The system evolved through three generations. Generation 1 was rule-based, using Levenshtein distance and regex patterns. Generation 2 used BERT-based transformers for semantic matching. Generation 3 pairs LLMs with graph neural networks (GNNs) to understand name aliases, transliteration variants, and contextual signals that rule-based systems cannot capture.
- How long does it take to deploy an AML system like this?
- At Silent Eight we cut client integration from about 3 months to 2-4 weeks. That covers data integration, model fine-tuning on the bank's specific transaction patterns, regulatory validation, and phased rollout.