Screen, Detect and Investigate, Comply & Speak Up | Chapter 3 of 5 ‍

TL;DR Account takeover. Payment fraud. Money mule networks. Synthetic identity. These typologies don’t live in a PEP database or a sanctions list — that’s not what those tools are designed to catch. They show up in behaviour (transaction patterns, velocity anomalies, network relationships) that only becomes visible when data is connected across a customer’s full lifecycle. Most AML programmes are built to screen at onboarding and investigate after an incident, not to see what happens in between. With AUSTRAC’s 2026 reforms extending ongoing customer due diligence and suspicious matter reporting to Tranche 1 and Tranche 2 entities alike, that detection layer is now a compliance requirement.

The entity-first problem 

Traditional transaction monitoring generates alerts. An alert is a fragment. It tells you  something happened in a transaction. It doesn't tell you who the entity behind that  transaction is, what their full risk profile looks like, or whether this alert is one of twenty signals pointing to the same pattern. 

Compliance teams working from transaction alerts spend significant time on triage, reconstructing the entity picture from fragments distributed across multiple systems. With AUSTRAC setting strict deadlines for suspicious matter reports, that time is hard to spare. FraudNet takes the opposite approach. Its entity-first model means every transaction signal, every risk flag, every screening result from Vital4, rolls up under a single entity view. The alert is the starting point. The entity is the frame.

This matters in practice. Fraud, money mule activity, and synthetic identity don't produce a single obvious signal. They produce a pattern that only becomes legible when signals are connected — and that connection only happens when detection is built around  entities, not events. 

What AI-native detection changes 

FraudNet customers have seen up to 97% fewer false positives than with traditional rule-based tools. That number matters operationally because the bottleneck in most financial crime programmes isn't the technology — it's analyst capacity. When the alert queue is dominated by noise, genuine risk gets lost in volume. 

The no-code rules engine means compliance and fraud teams can build and adjust  detection logic without waiting for engineering. When a new fraud typology emerges, the response time from pattern identification to active monitoring is measured in hours, not weeks. AI-fabricated documents are a current example. In early 2026, Commonwealth Bank reported to police a suspected loan fraud of around $1 billion, and NAB referred a built on falsified financial statements to authorities. Both cases sit within the $4 billion in mortgage fraud the financial services sector believes Australia is facing, as outlined in Chapter 1.

FraudNet's Global Anti-Fraud Network enriches every decision with cross-industry signals: patterns that have fired elsewhere, across other entities, in other sectors. An account that looks clean in isolation may look very different when its behaviour is benchmarked against a network of comparable entities. Financial crime is rarely a one-institution problem. 

The handoff between screen and detect 

Vital4 tells you who an entity is. FraudNet takes that identity intelligence and operationalises it at speed and scale — integrating Vital4 data directly into its entity  screening workflow, then extending protection across the customer lifecycle.

“Vital4 tells you who the entity is. FraudNet tells you what  they’re doing — and every signal is connected back to the same  risk picture.” 

When detection surfaces something that requires action – an investigation, a suspicious matter report to AUSTRAC, a governance response – the third layer begins. What happens after the alert is  as important as the alert itself. That's where Veresure's investigation and compliance  capability takes over. 

Further reading 

Chapter 1 – The Detection Gap

Chapter 2 – Screen: Known to who?

You’re Reading: Chapter 3 – Detect: Beyond Onboarding

COMING SOON: Chapter 4 – Investigate, Comply & Speak Up - After the Alert

COMING SOON: Chapter 5 – The Integrated Stack: What Good Looks Like 

‍Download the complete series: The AUSTRAC Financial Crime Solution Series

Frequently asked questions 

What is entity-first detection in AML transaction monitoring? 

Entity-first detection groups every transaction signal, risk flag and screening result under  a single view of the customer, instead of treating each alert as a standalone event. An  alert on its own is a fragment. Grouped by entity, your team can see whether it is one of  twenty signals pointing to the same pattern, without rebuilding the picture across  multiple systems. That's how mule networks and synthetic identities, which rarely  produce one obvious signal, become visible. 

How can compliance teams reduce false positives in AML transaction  monitoring? 

By using AI-native detection that filters out noise before alerts reach an analyst. In most  financial crime programmes the bottleneck is analyst capacity, not technology. When  the queue is dominated by false positives, genuine risk gets lost in volume. Cutting that  noise lets your team focus on the cases that matter, and strengthens your ability to show AUSTRAC you can detect and act on suspicious activity.‍

Why are money mule accounts so hard to detect in transaction  monitoring? 

Because each transaction often looks normal on its own. Mule activity rarely trips a single rule. It shows up as a pattern: unusual velocity, funds moving in and out quickly, and links  between accounts that have no obvious connection. Spotting it takes entity-level context and network relationships, which a stream of isolated alerts doesn't provide. Connecting   signals across the customer lifecycle is what makes the pattern visible.

Should fraud and AML detection sit in the same system? ‍

Ideally they share the same view of the customer. Fraud and AML teams often work from  separate tools, so the same entity can trigger unrelated alerts that nobody connects.  Typologies like account takeover, money mules and synthetic identity cross both  disciplines. Bringing signals together under a single entity view means each team sees  the full risk picture, instead of rebuilding it from fragments across systems. 

What’s the difference between AML screening and transaction monitoring?

Screening checks who a customer is, comparing them against sanctions, PEP and adverse media data at onboarding and as those lists change. Transaction monitoring looks at what a customer does, analysing transactions, velocity and relationships for patterns that suggest fraud or money laundering. Screening cannot see behaviour that develops after onboarding, and monitoring cannot tell you whether a customer appears on a list, so a complete programme needs both, connected through a single view of the entity.

How does FraudNet work with Vital4 and Veresure?‍

Vital4 provides the screening layer, identifying who an entity is against sanctions, PEP and adverse media data. FraudNet integrates that data into its entity screening workflow and monitors behaviour across the customer lifecycle. When detection surfaces something that needs action, Veresure’s investigation and compliance capability takes over. The three layers were built to connect.