> Toden documentation. For the full index fetch /llms.txt. Every page is available as Markdown by appending .md to its URL. Identity verification uses /api/kyc, Risk Intelligence uses /api/v1; they are separate contracts with different error shapes. Never invent an endpoint, field or enum value: read the API reference page for the operation first.

# Risk overview

> Monitor entities, screen against watchlists, and investigate suspicious activity (FRAML).

Compliance is Toden's **fraud and anti-money-laundering** layer (FRAML). On top of KYC verification, it lets you keep watching the people and businesses you've onboarded: screen them against sanctions / PEP / adverse-media watchlists, score their activity in real time, and run a full investigation workflow from alerts through regulatory filings.

There are two sides to it:

* **The Identity Hub API**: a server-to-server API you call to sync your users as monitored **entities** and to stream their **events** (transactions and actions) for scoring. See [Identity Hub API](/risk-intelligence/customers/identity-hub) and [Event monitoring](/risk-intelligence/monitoring/events).
* **The dashboard**: where your team manages monitoring on each Entity, understands changes in **Risk Intelligence**, resolves **Review Queue** items, and edits defaults in **Rules & Policies**.

Everything is **environment-scoped** (sandbox vs. production) and **organisation-scoped**, exactly like the rest of the platform; the API key you use decides which. See [Environments](/get-started/environments).

## Building blocks

| Concept           | What it is                                                                                                                                                                                |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Entity**        | A person (`INDIVIDUAL`) or company (`BUSINESS`) you monitor, keyed by your own `externalUserId`. Carries a KYC disposition, a risk tier, and (once resolved) a link to a global identity. |
| **Screening**     | An ongoing check of an entity against a watchlist type (`SANCTIONS`, `PEP`, or `ADVERSE_MEDIA`) producing zero or more **matches**.                                                       |
| **Event**         | A transaction or action you send for scoring (`POST /events`). The engine returns a **decision** and a **risk score**.                                                                    |
| **Signal**        | The stored, scored record of an event: the monitored activity stream you browse in the dashboard. (A separate device/session *signal* stream is store-only.)                              |
| **Alert**         | An investigation item opened automatically when an event scores at or above the review threshold.                                                                                         |
| **Investigation** | An owned evidence and decision record that can group one entity's related alerts and end in a disposition.                                                                                |
| **SAR / STR**     | A Suspicious Activity / Transaction Report drafted and filed from an investigation, exportable as goAML XML.                                                                              |

## Risk & disposition vocabulary

An entity carries two independent axes:

* **Disposition** is its KYC standing: `PENDING`, `UNDER_REVIEW`, `APPROVED`, `REJECTED`.
* **Risk tier** is its monitoring risk posture: `LOW`, `MEDIUM`, `HIGH`, or `UNSCORED`.

Each event yields a **decision** (`ALLOW`, `REVIEW`, or `BLOCK`) and a **risk score** from 0 to 100.

## The real-time decision lifecycle

An event flows through the system like this:

```
  your backend
      │  POST /api/identity/events
      ▼
   Event ───score──►  Signal        (every event; browsable stream)
                        │
                        │ decision ≥ review threshold
                        ▼
                      Alert          (OPEN: needs triage)
                        │  group an entity's alerts
                        ▼
                  Investigation      (OPEN → IN_REVIEW → CLOSED + disposition)
                        │  if reportable
                        ▼
                      SAR / STR      (DRAFT → FILED, exported as goAML XML)
```

* **Event → Signal** happens on every ingested event; the signal is stored and scored.
* **Signal → Alert** happens automatically when the composite score crosses your **review threshold**.
* **Alert → Investigation → SAR** are **manual** compliance actions taken in the dashboard.

## Permissions

Each Compliance area has its own permission key, so you can grant read access to one surface without the others. The server enforces these; the dashboard hides what you can't use.

| Key                      | Grants                                                                   |
| ------------------------ | ------------------------------------------------------------------------ |
| `identity:read`          | View individual entities, the compliance overview, and entity detail.    |
| `business_identity:read` | View business entities.                                                  |
| `screening:read`         | View screening results.                                                  |
| `signals:read`           | View the monitored event/signal stream.                                  |
| `alerts:read`            | View alerts.                                                             |
| `alerts:manage`          | Open an investigation from selected alerts.                              |
| `cases:read`             | View investigations (the permission key retains its compatibility name). |
| `cases:manage`           | Open, assign and decide investigations; draft, file or cancel SARs.      |
| `monitoring:manage`      | Edit monitoring rules (reading them is always allowed).                  |

All investigation and SAR writes are audited server-side and appear in your organisation's audit log (**Dashboard → Audit logs**).

## Next steps

* [Identity Hub API](/risk-intelligence/customers/identity-hub): sync your users as monitored entities.
* [Event monitoring](/risk-intelligence/monitoring/events): stream events for scoring.
* [Fraud rules](/risk-intelligence/monitoring/rules): configure how events are scored.
* [Screening](/risk-intelligence/screening/screening): sanctions, PEP, and adverse-media checks.
* [Investigations and reporting](/risk-intelligence/operations/investigations): the investigation workflow.