Trace suspicious money through the graph, with every claim checked against the records.
Typology Engine
Laundering hides in graph shape: a fan-out, a closed loop, a mule pool, a burst just under a reporting threshold. Each card holds a bounded Cypher pattern, the bounds around it, and the verdict the policy returns.
Funds leave an origin account, split across transit mules within a narrow time window, and reconsolidate into a destination account. Bounded multi-hop Cypher detects the fan-out and fan-in convergence.
1MATCH path = (origin:Account {id: $originId})-[:SENT]->(t1:Transaction)2 -[:RECEIVED]->(mule:Account)-[:SENT]->(t2:Transaction)3 -[:RECEIVED]->(dest:Account)4WHERE t1.timestamp <= t2.timestamp5 AND duration.inHours(t1.timestamp, t2.timestamp).hours <= 66 AND t2.amount >= t1.amount * 0.957RETURN path, sum(t1.amount) AS volumeTransferred8LIMIT 50;Product
Tripwire is a workbench: every screen answers to a query that ran, and every recommendation carries the records behind it.
Transfers are first class: an account SENT a transaction that another account RECEIVED. Every node, edge and path on screen is the output of an executed, bounded Cypher query. What you see is what the graph returned.
The agent picks among trace_funds, inspect_counterparties and detect_flow_patterns. Each returns records from the graph; the model only proposes what to run next.
Every cited transaction ID, account key, amount and timestamp is checked against what the tools returned. Unsupported claims are rejected before an analyst reads them.
Deterministic policy maps validated inputs to allow, review or a simulated block, and a failed model or provider falls back to the safe path.
Only explicit analyst confirmation promotes a suspected entity to confirmed memory. Dismissals stay on the record with their reasoning and full history.
Interactive Sandbox
Preset Cypher the workbench runs against the synthetic IBM AMLworld replay. Run one and watch the rows FalkorDB returns, transaction by transaction.
MATCH path = (origin:Account {id: 'B0412::A331992'})-[:SENT]->(t1:Transaction)
-[:RECEIVED]->(mid:Account)-[:SENT]->(t2:Transaction)
-[:RECEIVED]->(sink:Account)
WHERE t1.amount >= 100000.0
RETURN origin.id, t1.id, mid.id, t2.id, sink.id, t2.amount, t2.timestamp
LIMIT 5;Execute the query to see what the graph returns.
How it works
Score
AllowRisk score
0.12
Scored at its own timestamp, nothing later.
score as the transfer is read
Below the review threshold, the transfer runs.
illustrative
Step 01
A LightGBM model with past-only graph features scores each transaction at its own timestamp. A logistic regression baseline is evaluated on the same frozen rows, so the graph contribution is visible.
See the benchmarksTrace
at the anchorBounds: hops ≤ 2 · window ≤ 72 h · records ≤ 500 · 30 s
The walk starts at the alert transaction.
illustrative
Step 02
The investigation walks outward from the anchor transaction with bounded Cypher: counterparties, funds paths and flow patterns, capped by hops, time window, rows and duration.
Open an investigationVerify
0 of 3 checkedClaims from the draft report
Each claim in the draft is checked against the records the tools returned.
illustrative
Step 03
A tool-calling agent drafts the report. Deterministic validation re-checks every claim against the records the tools returned, and counter-evidence stays next to the supporting set.
Decide
Review requiredPolicy suggests: review
Case history
The record is append-only: nothing an analyst does is erased.
illustrative
Step 04
Policy maps the validated result to allow, review or a simulated block. The analyst confirms or dismisses, and the case keeps the decision, the reviewer and the evidence references.
Score
AllowRisk score
0.12
Scored at its own timestamp, nothing later.
score as the transfer is read
Below the review threshold, the transfer runs.
illustrative