Integrations and platforms

KYC, AML and fraud testing

KYC, AML and fraud testing checks identity verification, sanctions and PEP screening, transaction monitoring, and fraud rules for neobanks, crypto exchanges, lenders, BaaS programmes, and KYC vendors. Buyers receive an onboarding and verification scenario suite, a sanctions and PEP screening test data set with results, a transaction monitoring rule test matrix, and a false positive and false negative rate report.

What KYC, AML and fraud testing covers

A defect in these controls fails in one of two directions: a sanctioned party or a structured deposit passes without an alert, or legitimate customers wait in a review queue that the compliance team pays to clear. Tests measure both directions on every release. Vendor due diligence evidence is on the KYC and AML segment page, and the rule texts are on the EU AML and KYC and FINTRAC pages. Clause references below were checked on 2026-09-16.

Onboarding and identity verification

The onboarding suite maps every result the verification provider returns (approved, referred, rejected, resubmission requested, and timeout) to one account state. Failure paths covered:

Timeout opens the account. The provider call times out, the default branch approves, and card top-ups run before a reviewer sees the case.
Late webhook overwrites a rejection. A customer rejected on an altered document resubmits, and the delayed approval webhook from an earlier session replaces the new rejection.
One identity, several accounts. One document number or one device opens accounts under different email addresses, a synthetic identity and first-party fraud pattern.
Automated decline with no review path. Under GDPR Article 22(3), when a solely automated decision is necessary for a contract or rests on explicit consent, the controller shall implement suitable measures, at least the right to obtain human intervention, to express a point of view, and to contest the decision. Tests follow the review request after an automated onboarding decline.

Sanctions and PEP screening

The screening data set holds synthetic names with transliterations, reordered tokens, diacritics, initials, and legal-form suffixes, each labelled with the list entry it should or should not match. Every record runs at the configured threshold and one step either side, per list version and engine release. The sanctions screening false positive guide shows the scoring method.

Ownership screening needs jurisdiction-specific cases. OFAC's 50 Percent Rule applies to entities owned 50 percent or more in the aggregate by one or more blocked persons (FAQ 399, 13 August 2014), so an entity with two blocked owners at 25% each is blocked. AMLR Article 20(1)(d), applicable from 10 July 2027, checks whether sanctioned persons control a legal entity or hold more than 50% of it, individually or collectively. A platform that applies the EU more-than-50% test to OFAC screening misses the entity held 25% and 25% by blocked persons.

List tests cover a designation, an amendment, and a delisting published during the day, PEP family members and close associates, and withdrawal addresses listed as digital currency addresses in OFAC SDN entries.

Transaction monitoring rules

For institutions regulated under 3 NYCRR Part 504, such as banks chartered and money transmitters licensed under the New York Banking Law, the transaction monitoring program includes detection scenarios with threshold values and amounts (504.3(a)(4)) and end-to-end, pre- and post-implementation testing, including, as relevant, data mapping, transaction coding, and detection scenario logic (504.3(a)(5)). The rule test matrix covers:

amounts one cent below, at, and one cent above each threshold, after currency conversion;
rolling windows across midnight, time zones, and daylight saving changes;
late, replayed, and partial transaction files;
transaction codes mapped to the wrong type, so a cash deposit coded as a transfer never reaches the cash rules.

Above-the-line and below-the-line testing runs a labelled synthetic population against the current threshold and the proposed one. Alerts just above the line show review work a change would remove; planted suspicious activity just below the line shows what the change would stop detecting.

For crypto exchanges, MiCA Article 92(1) requires persons professionally arranging or executing crypto-asset transactions to have effective arrangements, systems, and procedures to prevent and detect market abuse, so the matrix adds wash trade and layering scenarios.

Fraud rules

Fraud rule tests cover velocity, amount, device, and location rules on card, transfer, and instant payment flows. Common defects: the rule engine fails open on a timeout, a velocity counter keyed per card resets when the card is replaced, an amount rule reads the pre-conversion amount, and the API channel skips the step-up check that the app enforces. Each defect lets fraud losses through to the lender, BNPL provider, or card programme that funds the transaction.

False positive and false negative rates

The rate report runs a labelled synthetic population with planted structuring, rapid movement of funds, and mule account patterns, plus known true sanctions matches. Counts are reported per rule and threshold, with the denominator stated, next to the previous release. A change that removes false positives and adds any false negative on planted cases is flagged for sign-off.

Segments

Standards

Guides

Scenarios

Deliverables

Onboarding and verification scenario suite
An automated suite that moves synthetic customers through document capture, liveness, data checks, retries, and approve, refer, and reject decisions, and checks the account state after each decision, for engineering leads and compliance officers.
Sanctions and PEP screening test data set and results
A versioned set of synthetic names, legal entities, and list updates with the expected match for each record, plus the match score and decision per record, list version, and engine release, for compliance officers and model validators.
Transaction monitoring rule test matrix
A matrix per rule version with test values below, at, and above each threshold and time window, and the expected and actual alert for each value, for BSA officers, MLROs, and internal audit.
False positive and false negative rate report
A report of false positive and false negative counts per rule and per match threshold on a labelled synthetic population, with the denominator of each rate stated, for the compliance lead who approves a threshold change.

How KYC, AML and fraud tests fit your release process

On every pull request. Boundary cases from the transaction monitoring rule test matrix run as unit tests against the rule definitions. The name matching regression runs the screening data set against a pinned list snapshot and fails the build when an expected match crosses the threshold. Test identities, documents, and account data are synthetic.

Nightly. The onboarding suite runs against the verification provider's sandbox with forced outcomes and test documents. List ingestion runs on synthetic delta files with a designation, an amendment, and a delisting, and records the time from file load to the rescreening alert.

Before a rule, threshold, or engine change. The rate report compares the current and proposed configurations with above-the-line and below-the-line samples, and the change owner signs off in the report. The report is pre-implementation test evidence under 504.3(a)(5) and an input to the annual compliance finding that Part 504 institutions submit by April 15th of each year (504.4); it is not that finding.

After release. Post-implementation checks compare alert volume per rule from aggregated production counts with the pre-release run. A rule that produces no alerts where the run predicted alerts blocks the next threshold change until it is explained. When you want rates measured on production alerts, the run stays inside your environment, because GDPR Recital 26 treats pseudonymised data that can be attributed to a person as personal data.

Cadence and handover. Suites rerun for each list format change, vendor model version, new product or corridor, and rule change, and the FINTRAC two-year effectiveness review reuses the latest evidence. Suites, data sets, and matrices live in your repository, and each evidence file records the list version, engine version, configuration hash, and run date. Your team owns thresholds, risk appetite, alert disposition, suspicious activity report filing decisions, list subscriptions, and production access.

Sample deliverable

Sample, synthetic data

rule and threshold test matrixRule and threshold test matrix: transaction monitoring, disputes, collections, expense, market data, and claims rules

Rule and threshold test matrix: transaction monitoring, disputes, collections, expense, market data, and claims rules
Rule ID	Rule and reference	Test values below, at, and above the boundary	Expected outcome	Actual outcome	Result
TM-STR-01	Transaction monitoring structuring rule: open an alert when one customer makes two or more cash deposits on one business day, each below USD 10,000.00, that total more than USD 10,000.00. Built on 31 CFR 1010.313(b): multiple currency transactions shall be treated as a single transaction if the institution knows they are by or on behalf of any person and total more than $10,000 during any one business day	Below: two cash deposits totalling USD 9,999.99; at: two cash deposits totalling USD 10,000.00; above: two cash deposits totalling USD 10,000.01	The USD 9,999.99 and USD 10,000.00 totals open no structuring alert; the USD 10,000.01 total opens a structuring alert and a currency transaction report flag	The USD 9,999.99 and USD 10,000.00 totals opened no structuring alert; the USD 10,000.01 total opened a structuring alert and a currency transaction report flag	Passed, 3 of 3 test values, run 2026-09-14
SAN-SCORE-01	Sanctions name-match score threshold: open a screening alert and hold the payment when the name match score against a sanctions list entry is 85 or higher. Configured screening policy; no regulation sets the score	Below: match score 84; at: match score 85; above: match score 86, each for a synthetic customer name against a synthetic list entry	Match score 84 opens no alert; match scores 85 and 86 open a screening alert and hold the payment	Match scores 84 and 85 opened no alert and released the payment; match score 86 opened a screening alert and held the payment	Failed: the comparator uses greater than 85 instead of 85 or higher; defect DEF-2210, critical severity, blocks release
CBK-DL-13.1	Chargeback response deadline for Visa Dispute Condition 13.1 (Merchandise/Services Not Received): block submission of the response package after the network time limit. Visa Core Rules and Visa Product and Service Rules, 18 April 2026 edition, section 11.2.3, Table 11-2: the Dispute Response time limit is 30 calendar days from the Dispute Processing Date, with listed regional exceptions for some domestic transactions	Below: calendar day 29 after the Dispute Processing Date; at: calendar day 30; above: calendar day 31, all dates counted in UTC	Calendar days 29 and 30 accept the response package for submission; calendar day 31 blocks submission and marks the dispute case as expired	Calendar days 29 and 30 accepted the response package for submission; calendar day 31 blocked submission and marked the dispute case as expired	Passed, 3 of 3 test values, run 2026-09-14
COL-CALL-01	Regulation F call frequency: block a further collection call to a person about a particular debt after seven calls within seven consecutive days. 12 CFR 1006.14(b)(2)(i)(A) and (b)(2)(ii): subject to the exclusions in (b)(3), a debt collector is presumed to comply if it places a telephone call to a particular person about a particular debt not more than seven times within seven consecutive days, and is presumed to violate the rule if it places calls in excess of that frequency	Below: sixth call to one person about one debt within seven consecutive days; at: seventh call; above: eighth call	The sixth and seventh calls are placed; the eighth call is blocked by the dialer and rescheduled after the seven-consecutive-day period	The sixth and seventh calls were placed; the eighth call was blocked by the dialer and rescheduled after the seven-consecutive-day period	Passed, 3 of 3 test values, run 2026-09-14
EXP-RCPT-01	Expense policy receipt threshold: require a receipt before submission of a non-lodging expense of USD 75.00 or more. 26 CFR 1.274-5(c)(2)(iii)(A)(2): except as provided in (c)(2)(iii)(B), documentary evidence is required for any expenditure other than lodging of $75 or more, except that documentary evidence for transportation charges is not required if not readily available	Below: meal expense of USD 74.99; at: meal expense of USD 75.00; above: meal expense of USD 75.01	The USD 74.99 meal expense submits without a receipt; the USD 75.00 and USD 75.01 meal expenses are blocked until a receipt is attached	The USD 74.99 and USD 75.00 meal expenses submitted without a receipt; the USD 75.01 meal expense was blocked until a receipt was attached	Failed: the rule uses greater than USD 75.00 instead of USD 75.00 or more; defect DEF-2213, medium severity, fix scheduled for the next release and does not block this release
MD-ENT-01	Market data non-professional subscriber entitlement: grant the non-professional entitlement only to a natural person who is not registered or qualified in any capacity with the SEC, the CFTC, any state securities agency, or any securities exchange or association; not engaged as an investment adviser under Section 202(a)(11) of the Investment Advisers Act of 1940, whether or not registered; and not employed by an exempt bank or organization to perform functions that would require registration. Nasdaq Equity 7, Section 147(d)(4)(A), as quoted in SEC Release No. 34-94466 of 18 March 2022	Below: natural person with no registration and no adviser role; at: natural person acting as an unregistered investment adviser; above: subscriber account opened in a company name	Only the natural person with no registration and no adviser role receives the non-professional entitlement; the unregistered investment adviser and the company account receive the professional entitlement	The natural person with no registration and the unregistered investment adviser received the non-professional entitlement; the company account received the professional entitlement	Failed: the status attestation checks registration only, so subscriber counts reported to the exchange are wrong; defect DEF-2211, high severity, blocks release
CLM-AUTO-01	Claim auto-approval limit: approve a claim without adjuster review when the payable amount after the deductible is XTS 2,500.00 or less. Configured claims authority limit; no regulation sets the amount	Below: payable amount of XTS 2,499.99; at: payable amount of XTS 2,500.00; above: payable amount of XTS 2,500.01	The XTS 2,499.99 and XTS 2,500.00 claims are approved automatically and queued for payment; the XTS 2,500.01 claim goes to adjuster review with no payment queued	The XTS 2,499.99 and XTS 2,500.00 claims were approved automatically and queued for payment; the XTS 2,500.01 claim went to adjuster review with no payment queued	Passed, 3 of 3 test values, run 2026-09-14

Rule IDs, defect IDs, customers, claims, and run dates are synthetic, USD appears only where a regulation states the threshold in USD while configured limits use XTS (the ISO 4217 test code), and rule references were checked on 2026-09-16 against eCFR, the Visa Core Rules and Visa Product and Service Rules of 18 April 2026, and SEC Release No. 34-94466.

Questions

What are false positives in AML?

False positives in AML are sanctions screening or transaction monitoring alerts that review closes as legitimate activity or a different person. Reports calculate the false positive rate on two different bases: false positive alerts divided by all alerts, or false positive alerts divided by all legitimate customers or transactions screened. A false positive rate without its stated denominator cannot be compared across releases or vendors.

How to reduce false positives in transaction monitoring?

Transaction monitoring false positives fall when transaction codes and data mapping are corrected before any threshold moves, and when rules are split by customer type and product. Each threshold change needs above-the-line and below-the-line testing: alerts just above the current threshold show the review work removed, and activity just below the proposed threshold shows suspicious activity the change would stop detecting.

Scope your KYC, AML and fraud testing

Send your verification providers, screening lists, monitoring rules, and fraud controls, and we return a test scope that maps the four deliverables to your release process.

Scope your testing