Essay

Why fraud models should only propose. By Amir Shachar.

Read the essay
Skip to content
Riskernel

Payments, scams and platform abuse

Your rules fire every day. Do they fire on the right people?

Most fintechs write their first monitoring and fraud rules by hand, copy thresholds from a vendor default or another market, and adjust them when the alert queue gets too long. Real data cannot tell you how good they are: a cleared alert is not proof of innocence, and the schemes you know about are the ones you already caught. When you enter a new country, add a payment rail or launch a new card program, the rules are tuned on almost no history, and the misses only show up later, as losses or as an examiner's finding.

Built for Fintechs, wallets, neobanks and card issuers building or tuning their own AML monitoring and fraud rules, often while entering new countries or launching a new card program; MLRO, Head of AML, Head of Fraud, Head of Compliance

The problem in numbers

What the public record shows

Every figure links to the page it came from, with its date.

£28,959,426

FCA fine on UK digital bank Starling in 2024 for financial crime failings in its sanctions screening

fca.org.uk, 2024-10

£21,091,300

FCA fine on a UK digital bank in 2025 for inadequate financial crime systems and controls while its customer base grew almost tenfold, from around 600,000 to over 5.8 million

fca.org.uk, 2025-07

10th

FCA fine on a bank for financial crime control failings in four years, counted at that UK digital bank's decision in July 2025

fca.org.uk, 2025-07

What you get

The deliverables

You get a synthetic set of customers and transactions with planted laundering, mule and card-fraud cases and a hidden answer key, run through your own rules and thresholds, and a scored report of what they caught, what they missed and how many false alerts they raised.

A synthetic test book

Customers, accounts and transactions shaped like your business, with planted laundering, mule, account takeover and card-fraud cases.

A scored run of your rules

For each planted scheme: caught or missed, by which rule, and how many false alerts the same rules raised on the innocent customers.

A threshold sweep

How misses and false alerts change as key thresholds move, so you can pick settings on evidence rather than queue size.

A written test method

What was tested and how it was scored, ready to show a regulator, partner bank or program manager who asks how your monitoring was tuned.

How it runs

Agreed on a short call, set by the rule set and the schemes in scope, start to finish

Agreed on a short call, set by the rule set and the schemes in scope

  1. Scope
  2. Run
  3. Score and readout
Step 1

Scope

We agree the products, countries and schemes that matter to you, and how your rules take in data.

Step 2

Run

Your rules run on the synthetic test book, in your own system or from a rule export we run for you.

Step 3

Score and readout

Results are checked against the answer key and walked through with your AML and fraud leads.

Method

How the answer is produced

Truth known in advance

Because the schemes were planted, every miss is visible, including the ones a review of real alerts never shows.

Misses and false alerts together

A rule that catches everything by flagging everyone is not a good rule, so both sides are scored on the same data.

No customer data leaves

The test book is synthetic, so the work does not wait on data-sharing approvals. The answer key covers known kinds of scheme, not every possible scheme.

Amir Shachar
Amir ShacharFounder, Riskernel

Why Amir

Designed and led by someone who has built fraud models in production

The patents closest to this problem:

Amir is a named inventor on US 2024/0394713 A1 (Systems and methods for programmatically generating decision rules for alert detection engines using machine learning operations, filed at NICE Actimize; pending).

Amir is a named inventor on US 2024/0394713 (Systems and methods for programmatically generating decision rules for alert detection engines using machine learning operations, filed at NICE Actimize), which is about generating and checking the alert rules a monitoring team would otherwise write by hand.

View on Google Patents

Amir is a named inventor on US 12,626,151 B2 (Method and system for testing a classification machine learning (ML) model of a tenant of a service provider, in a cloud-based environment, filed at NICE Actimize; granted).

Amir is a named inventor on US 12,626,151 (Method and system for testing a classification machine learning (ML) model of a tenant of a service provider, in a cloud-based environment, filed at NICE Actimize), which tests a client's machine learning detection model before go-live; this proving ground applies a similar test-before-launch idea to hand-written rules.

View on Google Patents

These patents were filed at the companies named. They show the problems Amir has worked on; they are not Riskernel products.

Is this you

You probably need this if

  • Your alert queue keeps growing, and nobody can say which of those alerts were worth raising.
  • Your monitoring thresholds were copied from a vendor default or from another country, and have not been tested since.
  • You are entering a new country, adding a payment rail or launching a new card program with little transaction history.
  • You can say how many alerts your rules raise, but not how many bad actors they missed.
  • A regulator, partner bank or card program manager has asked how you tuned your monitoring parameters.

Questions

Before you reach out

How is this different from the AI Investigator Proving Ground?

The AI Investigator Proving Ground scores an AI agent that works alerts. This scores the rules and thresholds that raise the alerts in the first place. Many teams need the second long before they pilot the first.

Do you need our customer data?

No. The test book is synthetic. You may share anonymised summary statistics so it looks like your business.

Does it work with a vendor monitoring system?

Yes, as long as the synthetic data can be loaded into it or its rules can be exported and run alongside.

Does this replace our own tuning and validation?

No. It gives your team independent evidence. Decisions on rules and thresholds stay with you.