Sphinx Rules Engine

Your rules.
Your decisions.

Transaction monitoring, fraud detection, and name screening, shaped around your procedures. Raise the right alert. Understand the context. Know what comes next.

See how it works

You write it. Sphinx builds it.

Sphinx runs on your rules so every decision stays yours.

Describe your rule

Flag business accounts sending 5 or more ACH payments totalling over $25,000 within 24 hours. Create a case for compliance review.

Transaction monitoring & fraud

A pattern is more than a payment.

Connect the rule, the customer, and the activity. Give your team the context behind every alert.

01 / 03

Define the pattern.

Set the payment rail, customer segment, and time window. Combine the conditions that should trigger a review.

Your procedures, translated into clear conditions.
Transaction ruleTM-012

ACH payment velocity

Draft
Customer segmentBusiness accounts
Payment railOutbound ACH
Lookback windowRolling 24 hours
When all conditions match
Payment count≥ 5
Total payment value> $25,000
Create a case for compliance review
02 / 03

See the activity in context.

Bring related payments together around the customer. See the amount and frequency that turned individual transactions into an alert.

One customer. A connected view of the activity.
Customer activity24 HOURS
MT

Meridian Trading

Business account · Wholesale trade

$32,400Outbound ACH value
6ACH payments
3Recipients

The combined activity meets both conditions in TM-012.

03 / 03

Trace the alert to the evidence.

Open the transactions behind the rule hit. Keep the matched conditions and supporting records together for the analyst.

Every alert comes with a reason to review.
Alert evidenceNeeds review

Meridian Trading

TM-012
6 payments ≥ 5$32,400 > $25,000
Linked ACH transactions · rolling 24 hours
TimeRecipientAmount
09:12Northline Supply$2,400
10:04Cedar Logistics$3,800
11:38Harbor Wholesale$5,200
13:16Cedar Logistics$6,100
14:42Northline Supply$6,900
16:05Harbor Wholesale$8,000
6 source records attached to the case

Name screening

A similar name. The same person?

Find potential matches, compare the details, and route the result under your screening policy.

01 / 03

Choose what you screen against.

Select the sanctions, PEP, and internal watchlist sources your program requires. Bring potential candidates into one review.

People and businesses, screened to your scope.
Screening scopeNS-004
Customer

Sofia Marin

Individual

Sources in your policy

Sanctions listsSelected jurisdictions
Politically exposed personsPEPs and related parties
Internal watchlistsYour institution’s records
Compare potential matches with the customer
02 / 03

Look beyond the name.

Combine face matching with aliases, dates of birth, and identifiers. Compare available photos side by side to assess potential matches with more context.

Missing information is not a mismatch.
Face matchingIllustrative comparison
Illustrative customer portrait, facing the camera
Customer record

Sofia Marin

Date of birth14 May 1990Identity documentVerified ID on file
Illustrative source portrait of the same fictional person, at a slight angle
Potential match

Sophia Marin

Date of birth14 May 1990Identity documentNot available
NameVariation
Date of birthAligned
Face matchingSimilar features
IdentifierUnknown

Visual evidence supports the review. Identity still needs verification.

03 / 03

Make the next step clear.

Apply your review criteria and hand the candidate to the right team. Keep the reasoning and unresolved questions with the case.

Your team keeps the final decision.
Screening reviewNS-004 / v3
Further review required

Sofia Marin / Sophia Marin

Why this candidate remains

The name and date of birth align, and face matching adds supporting evidence. The source identifier is still missing.

Assigned queueScreening team
Next actionVerify the underlying record
Comparison & source recordAttached to the review
Analyst reviews the evidence and decides

Connected to Sphinx OS

From alert to decision,
in one place.

Rules find the activity. Sphinx brings the investigation, the people, and the review together.

Start with the alert.

Capture the activity or identity match, the rule that fired, and the policy behind it.

Designed for your operation

Your controls.
A connected workflow.

Bring detection and investigation together, with the flexibility to work around your institution.

Rules that reflect your procedures

Make the conditions explicit. Keep thresholds, customer segments, and review criteria connected to your policy.

AI that explains the alert

Give analysts the supporting evidence and reasoning, with gaps and uncertainty clearly identified.

One place to take it forward

Move from a triggered rule to a case in Sphinx OS, or bring the investigation into your existing workflow.

See it with your team

Bring your rules.
We’ll connect the dots.

Explore transaction monitoring, fraud detection, and name screening with the workflows that matter to your institution.

Explore Sphinx OS