AI Financial Crime Typology / Scenario Coverage / SAR Evidence Architecture 解读

面向对象: Advanced AI PM / Senior BA / Product Architect / AML Technology Architect / Financial Crime Product Owner / Compliance Transformation Lead。 核心问题: 金融犯罪 AI 如果只优化 alert precision 或 SAR narrative speed, 会忽略更关键的问题: typology 是否被完整表达, scenario coverage 是否有证据, SAR evidence chain 是否能支撑人类合规决策。 学习目标: 能把 typology library、scenario inventory、red flag mapping、coverage matrix、alert-to-case-to-SAR traceability、evidence bundle、human compliance ownership 和 AI eval architecture 连接成一套可运营的控制系统。

重要说明: 本文是学习、架构训练和作品集材料, 不构成法律意见、合规结论、SAR filing decision、监管解释或模型验证报告。是否调查、升级、关闭 case 或提交 SAR, 必须由具备权限的人类 Compliance / BSA / AML owner 根据机构政策、司法辖区规则、事实证据和适用监管要求决定。AI 可以辅助识别、汇总、检索、解释和质检, 不能替代 SAR 决策责任。

---

Source Anchors

一句话:

AI financial crime architecture 的核心不是“模型发现更多可疑交易”, 而是证明 typology、scenario、red flag、evidence、case decision 和 SAR narrative 之间的 traceability 足够完整, 且最终判断仍由人类合规 owner 承担。

---

1. Thesis

Financial crime AI 应该从单点模型升级为 typology-driven control architecture。

传统项目常问 model precision、false positive reduction 和 SAR draft speed。高级 PM / BA / Architect 必须追问: 哪些 typologies 在 scope, 哪些 scenarios 覆盖它们, red flags 映射到什么 evidence, 哪些产品/渠道/客户/地区有 blind spot, alert 如何进入 case 和 SAR consideration, 谁拥有最终决定, audit 能否不依赖 AI summary 也 replay 全链路。

成熟架构中心从 model score 转成 coverage and evidence:

typology -> scenario -> red flag -> data signal -> alert -> case
  -> investigation evidence -> SAR consideration -> narrative bundle
  -> human decision record -> audit replay

---

2. Why It Matters

金融犯罪风险不是统一标签。同样是“异常转账”, 在不同背景下可能属于 structuring、mule account、elder exploitation、romance scam、trade-based money laundering、sanctions evasion、terrorist financing、cyber-enabled fraud、check fraud 或 funnel account。

如果没有 typology/scenario architecture, AI 系统容易产生三类失败:

SAR 质量也不是文学质量。好的 SAR evidence architecture 要支持 who、what、when、where、why、how、which red flags、which evidence、which uncertainty 和 who decided。

---

3. Architecture Model

参考架构:

source systems -> feature/event layer -> typology and scenario library
  -> detection and triage -> alert-to-case workflow
  -> SAR consideration -> evidence ledger and coverage dashboard

关键组件: core/card/ACH/wire/RTP/branch/digital/CRM/KYC/sanctions data, customer profile, counterparty graph, transaction sequence, red flag object, scenario rule, ML detector, LLM triage prompt, analyst workbench, supporting documentation index, trace id, model/rule/prompt version, human action and audit replay。

核心原则:

1. Typology library 是控制资产, 不是培训材料。
2. Scenario coverage 要可度量, 不是“我们有 AML 监控”。
3. LLM 不做 SAR decision; LLM 做 evidence organization、gap detection、narrative quality assist 和 reviewer support。
4. Supporting documentation 必须独立于 AI narrative 保存。
5. 每次 rule/model/prompt change 都要评估 coverage impact。

---

4. Typology / Scenario Library

Typology object:

Scenario object:

---

5. Coverage Matrix

Coverage matrix 把“我们监控金融犯罪”拆成可测试资产。

Coverage scoring:

coverage_score =
  typology_scope * data_availability * scenario_active * evidence_quality
  * review_capacity * QA_feedback * change_control

不要把 alert count 当 coverage。应该看 typology active coverage、scenario-to-risk assessment alignment、red flag evidence completeness、uncovered products/channels、scenario aging、QA defect by typology 和 SAR narrative evidence sufficiency。

---

6. SAR Evidence Chain

SAR evidence chain 不是“把 alert copy 到 SAR form”。

它应能重建: signal detected -> scenario triggered -> red flags observed -> analyst reviewed evidence -> additional research -> case disposition -> SAR filing considered -> authorized human decision -> narrative and supporting documentation assembled。

Evidence bundle:

架构判断:

• AI summary 是 derivative evidence, 不是 source evidence。
• SAR narrative draft 必须引用 supporting documentation index。
• Non-filing decision 也要有 rationale 和 evidence, 但不能变成模型自动豁免。
• SAR confidentiality 要进入 access control、logging、training 和 audit evidence。

---

7. Financial Retail Scenarios

---

8. PM / BA / Architect Implications

---

9. Artifacts

---

10. Control / Evidence Design

---

11. Interview Questions

1. 如何解释 typology、scenario、red flag、alert、case 和 SAR evidence 的区别?
2. 为什么 false positive reduction 不是 AML AI 的唯一目标?
3. 如何设计 typology/scenario coverage matrix?
4. LLM 在 SAR workflow 中可以做什么, 不能做什么?
5. 如何证明一个 SAR narrative 有足够 evidence?
6. 如何避免 AI 生成流畅但证据薄弱的 SAR draft?
7. 如何管理 FinCEN advisory 带来的新 typology / red flag 更新?
8. 如何处理 synthetic eval 与真实 case confidentiality 的冲突?
9. 如何设计 alert-to-case-to-SAR traceability?
10. 如何向高管解释 coverage gap 比低 precision 更危险?

30 秒回答:

我会把 AML AI 设计成 typology-driven evidence architecture。先定义 typology 和 scenario coverage, 再把 red flags 映射到可观察数据和 investigation questions。AI 可以辅助汇总、找缺口、草拟 narrative, 但 SAR decision 必须由授权合规人员负责。关键证据是 alert-to-case-to-SAR traceability, 而不是模型分数或漂亮文本。

---

12. Pitfalls

最终记忆句:

In financial crime AI, the mature architecture is not model-first. It is typology-first, coverage-aware, evidence-backed, human-owned, and audit-replayable.