Federated AML Investigation

Three synthetic banks and a federation layer

Each bank has transaction-monitoring and investigator roles. Six federation roles coordinate cross-bank analysis, screening, report drafting, auditing, and policy checks. The architecture explores signed messages and replay protection across those boundaries, with a trusted coordinator as a deployment assumption.

Budgeted aggregate queries

Cross-bank aggregate queries use Gaussian noise and a per-requester privacy-budget ledger. The simulation exercises query refusal when a budget is exhausted, making the tradeoff between shared information and privacy constraints visible.

Policy checks at message boundaries

Inter-agent messages route through Veea's Lobster Trap proxy with a custom AML policy pack. Checks cover redaction, declared purpose, and restricted content. Recorded verdicts and hash-chained logs help inspect how a request passed through the prototype.

Investigation reports as inspectable artifacts

Jupyter reports bring together the investigation question, released aggregate statistics, model outputs, and audit records. These artifacts make the reasoning easier to review. Re-running an LLM step can still change its output, so retaining the original evidence and execution record matters.

A seeded cross-bank scenario

The demo uses a five-entity structuring ring distributed across three synthetic banks. It illustrates how combining constrained cross-bank signals can reveal a pattern that is incomplete within an individual bank's view. The scenario is a demonstration of the workflow, with real-world detection performance still to be evaluated.

Adversarial probes alongside the workflow

A review surface exercises prompt injection, evidence fabrication, re-identification attempts, audit tampering, privacy-budget exhaustion, and sender impersonation. Showing verdicts and audit records helps identify which controls respond to a probe and where further evaluation is needed.

An interface for inspecting coordination

The prototype combines a swimlane view of the trust domains, message inspectors, and executed-notebook investigation reports. The interface makes coordination and evidence review part of the demonstration, alongside automated tests of the underlying workflows.