Risk overview | Toden Docs

Compliance is Toden’s fraud and anti-money-laundering layer (FRAML). On top of KYC verification, it lets you keep watching the people and businesses you’ve onboarded: screen them against sanctions / PEP / adverse-media watchlists, score their activity in real time, and run a full investigation workflow from alerts through regulatory filings.

There are two sides to it:

The Identity Hub API: a server-to-server API you call to sync your users as monitored entities and to stream their events (transactions and actions) for scoring. See Identity Hub API and Event monitoring.
The dashboard: where your team manages monitoring on each Entity, understands changes in Risk Intelligence, resolves Review Queue items, and edits defaults in Rules & Policies.

Everything is environment-scoped (sandbox vs. production) and organisation-scoped, exactly like the rest of the platform; the API key you use decides which. See Environments.

Building blocks

Concept	What it is
Entity	A person (`INDIVIDUAL`) or company (`BUSINESS`) you monitor, keyed by your own `externalUserId`. Carries a KYC disposition, a risk tier, and (once resolved) a link to a global identity.
Screening	An ongoing check of an entity against a watchlist type (`SANCTIONS`, `PEP`, or `ADVERSE_MEDIA`) producing zero or more matches.
Event	A transaction or action you send for scoring (`POST /events`). The engine returns a decision and a risk score.
Signal	The stored, scored record of an event: the monitored activity stream you browse in the dashboard. (A separate device/session signal stream is store-only.)
Alert	An investigation item opened automatically when an event scores at or above the review threshold.
Investigation	An owned evidence and decision record that can group one entity’s related alerts and end in a disposition.
SAR / STR	A Suspicious Activity / Transaction Report drafted and filed from an investigation, exportable as goAML XML.

Risk & disposition vocabulary

An entity carries two independent axes:

Disposition is its KYC standing: PENDING, UNDER_REVIEW, APPROVED, REJECTED.
Risk tier is its monitoring risk posture: LOW, MEDIUM, HIGH, or UNSCORED.

Each event yields a decision (ALLOW, REVIEW, or BLOCK) and a risk score from 0 to 100.

The real-time decision lifecycle

An event flows through the system like this:

  your backend
      │  POST /api/identity/events
      ▼
   Event ───score──►  Signal        (every event; browsable stream)
                        │
                        │ decision ≥ review threshold
                        ▼
                      Alert          (OPEN: needs triage)
                        │  group an entity's alerts
                        ▼
                  Investigation      (OPEN → IN_REVIEW → CLOSED + disposition)
                        │  if reportable
                        ▼
                      SAR / STR      (DRAFT → FILED, exported as goAML XML)

Event → Signal happens on every ingested event; the signal is stored and scored.
Signal → Alert happens automatically when the composite score crosses your review threshold.
Alert → Investigation → SAR are manual compliance actions taken in the dashboard.

Permissions

Each Compliance area has its own permission key, so you can grant read access to one surface without the others. The server enforces these; the dashboard hides what you can’t use.

Key	Grants
`identity:read`	View individual entities, the compliance overview, and entity detail.
`business_identity:read`	View business entities.
`screening:read`	View screening results.
`signals:read`	View the monitored event/signal stream.
`alerts:read`	View alerts.
`alerts:manage`	Open an investigation from selected alerts.
`cases:read`	View investigations (the permission key retains its compatibility name).
`cases:manage`	Open, assign and decide investigations; draft, file or cancel SARs.
`monitoring:manage`	Edit monitoring rules (reading them is always allowed).

All investigation and SAR writes are audited server-side and appear in your organisation’s audit log (Dashboard → Audit logs).

Next steps

Identity Hub API: sync your users as monitored entities.
Event monitoring: stream events for scoring.
Fraud rules: configure how events are scored.
Screening: sanctions, PEP, and adverse-media checks.
Investigations and reporting: the investigation workflow.