Unit21 connects AI detection, investigations and regulatory reporting

Unit21 builds financial-crime software that connects detection, investigations and reporting. Its current AI offering goes beyond writing summaries: the company describes agents that query data, collect evidence, recommend dispositions and support changes to detection rules. The useful buyer question is how those actions fit within a controlled operating process. A system that can close a low-risk alert under configured conditions has a different responsibility from one that prepares a narrative for mandatory human review.

01 / ProductDetection and investigation can share an operating record

The AML transaction-monitoring product describes combining transactions, device information, behavioral signals and customer attributes. Teams can configure rules, receive recommendations, and assess changes with historical backtests and live shadow data. Graph-based rules add a way to examine relationships among entities rather than assessing every event independently.

Unit21’s AI agents work on investigation and detection tasks. The page describes generating SQL or Python for deterministic data queries, producing an evidence log and using analyst outcomes to recommend changes to decision criteria. These are vendor-described capabilities, not a claim that generated code is automatically correct. A query can execute successfully while answering the wrong question.

The case-management product brings alert enrichment, research, linked activity, recommendations and summaries into an investigation workflow. Its operational role is to retain what was examined and why the team acted. The public material includes permissions and quality-control workflows, which matter when different investigators need different access to customer records.

The Fraud Consortium adds intelligence based on member-confirmed activity. Unit21 says signals can enter onboarding and transaction workflows without exchanging raw personal data among members. This is a separate evidence source from the institution’s own observation. A network association should be interpreted with its context, freshness and dispute process rather than treated as an unquestionable verdict.

02 / AudienceRisk teams with a defined queue and a repeatable investigation

A fintech, bank or credit union with recurring alert types is a plausible fit. For example, a team may spend much of its time assembling the same transaction history before deciding whether a case should escalate. A sponsor-bank program may have a broader need for consistent oversight across partners. The right starting point depends on whether the present bottleneck is detection, evidence gathering or the transition into reporting.

The Feedzai blueprint provides context for connected risk operations and transaction decisions. The Quantexa blueprint discusses relationship-based investigation. Compare the systems around the work the analyst must complete and the data needed to explain a case, rather than assuming every platform’s use of AI describes the same operating method.

A team without consistent disposition labels should establish those definitions before training its evaluation around past cases. “Closed” can mean verified legitimate activity, duplicate work, insufficient evidence or a procedural decision. If all of those outcomes become one success label, neither an agent nor its reviewer has a reliable standard for what good investigation looks like.

03 / WorkflowA proposed pilot from an alert to a reviewed narrative

Consider a team investigating unusual transfers into and out of recently opened accounts. The following workflow is proposed, not tested by Sequenced. Select one alert family and preserve the existing detection rules during the first phase. The initial question is whether AI improves case preparation; changing detection at the same time would make it harder to explain why the queue changed.

Provide the agreed customer and transaction records with clear event identifiers. Have the agent produce the analysis it describes in the product page, then inspect the query logic on several difficult cases. Check date boundaries, duplicate transactions and reversal handling. A plausible narrative about rapid movement of funds can be wrong if a reversed transaction was counted as a completed transfer.

Compare each recommendation with the source-linked work log. Ask a reviewer to reconstruct the material statements without relying on the generated prose. Include a case with a benign explanation, a case with an unresolved relationship and a case missing essential information. The desired behavior is different in each: clear an explained pattern, escalate uncertainty or request the missing evidence.

Keep the initial live run at the human-decision stage. Unit21’s AI page describes multiple autonomy levels, including full human decisions and guarded automatic closure. Begin with the former while measuring disagreement and rework. Expansion to automatic closure should be a separate decision for a defined low-risk population, not a global setting enabled because a few summaries looked convincing.

For cases that require reporting, evaluate the regulatory-filing workflow independently. It describes human review before submission, direct routes for certain reports and an export route for others. Test whether the narrative accurately represents the transaction sequence, uncertainty and investigative steps. A polished report should not silently turn a suspicion into an established fact.

Finally, examine what returns to detection strategy. Unit21 describes rule recommendations informed by investigation outcomes. Keep those recommendations versioned and test them before release, using the monitoring product’s backtesting or shadow mode. A case-review correction should improve the right part of the process; it should not automatically become a broad blocking rule that affects unrelated customers.

04 / PricingEnterprise scope is broader than an analyst seat

The demo page provides a sales-led route. The reviewed materials do not publish a general seat price, event rate or included production allowance. The proposal should distinguish monitoring, agents, case management, consortium access and reporting, rather than assuming every capability is included in one undifferentiated subscription.

An institution retaining its existing case manager may evaluate the bolt-on agent route described by Unit21. A full-platform customer may run agents inside its native detection and investigation environment. Those deployment choices create different integration work. Ask which systems remain authoritative for alerts and case status, and what happens commercially when testing produces repeated agent runs on the same historical cases.

05 / DistinctionsAutonomy and report submission are different controls

Unit21’s public pages use different levels of language about human control. The agent page explicitly describes guarded automatic closure, while case-management material emphasizes human decisions and approvals. Read these together as a configuration question rather than flattening them into a universal promise. The exact action, queue and risk tier determine the control that the buyer must verify.

Regulatory filing has a more specific boundary. The product page says forms are reviewed before submission. It describes direct FinCEN SAR and CTR submissions, direct FINTRAC STR submissions, and validated XML export for goAML jurisdictions, with Malta and the Netherlands named as current configurations. Exporting a file for an institution’s portal is not the same operation as filing directly with the authority.

Consortium intelligence also changes the evidence available at onboarding, when the institution has little transaction history of its own. That can be useful, but a disputed network signal requires a different response from a transaction the institution directly observed. A sound investigation record identifies the source of each concern and preserves the difference between association, confirmation and the institution’s own conclusion.

06 / QuestionsThe work log is where the AI claim becomes testable

The product’s description of generated queries and structured work logs gives reviewers something concrete to inspect. Confirm whether the deployed configuration retains the query, input version, result and subsequent edits needed to reproduce a material conclusion. An explanation that links only to a changing dashboard may be less useful than a preserved record of what the agent actually saw.

Public pages do not settle all entitlements, jurisdictional reporting details or data-processing terms. Unit21’s efficiency and fraud-loss figures are vendor claims, not results observed by Sequenced. This review did not access a customer tenant or measure output accuracy. The proposed pilot is designed to resolve those operational uncertainties on the buyer’s own cases before extending authority or coverage.

07 / DecisionStart with the work whose evidence can be checked