ALT-2026-05-018496 emitted → routed to Actimize case queueTYP-EFM-001 v1.0.0 evaluated 47,283 accounts in last batch; 9 alerts emittedTYP-FNL-001 v1.2.0 evaluation complete; 14 alerts emitted todaySAR-2026-05-1142; pattern matches TYP-EFM-001 (95.2%)FIN-2026-A002 detected · 847 KB · routed to AG-02SAR-2026-05-1141 pattern does not match existing typologies — flagged for clusteringML-2026-Q1-44 confidence improved from 0.71 to 0.78TYP-CMLN-003 v0.3.0 (SHADOW) emitted shadow alert SA-2026-05-3382; novel vs ActimizeBIND-0117)TYP-EFM-001 v1.0.0 against 90d historical: recall 94.2%, FP 0.018%TYP-HTR-001 calibration drift detected: FP trending 0.012% → 0.016% (7d)s3://themis-archive/typologies/retired/. Click any successor tag to open the active replacement in the library.
The Ingestion Agent watches 147 sources for changes via RSS feeds, scheduled crawls with hash comparison, and email parsing for subscription notifications. At 14:22 UTC yesterday, the FinCEN advisory feed produced a new entry not in the previous crawl.
The Parsing Agent reads the advisory narrative and produces a structured typology specification. Click "Run live" to actually run this against the LLM API and watch the agent produce the spec in real time.
typology_id: TYP-PIG-001
spec_version: 0.1.0
spec_status: DRAFT
name: "Pig Butchering — Online Trust Building to Crypto Investment Fraud"
provenance:
source_type: REGULATORY_ADVISORY
document_id: FIN-2026-A002
retrieved_at: 2026-05-15T14:22:18Z
narrative:
summary: |
Customer (typically 55+, recently widowed/divorced/isolated) makes
escalating wire transfers to crypto exchanges or new MSBs they have
no prior history with, after a new online relationship.
concepts:
- C.WIRE_OUTBOUND
- C.NEW_BENEFICIARY # NEW concept
- C.CRYPTO_EXCHANGE_BENEFICIARY # NEW concept (needs review)
- C.ESCALATING_AMOUNTS # NEW concept
- C.SOCIAL_ISOLATION_AGE
- C.RETIREMENT_WITHDRAWAL
- C.MSB_BENEFICIARY
behavioral_components:
- id: BC1
name: "Multiple wires to crypto/new MSB beneficiaries"
- id: BC2
name: "Escalating transfer amounts (linear regression)"
- id: BC3
name: "Customer demographic indicator (55+, marital change)"
- id: BC4
name: "Retirement fund withdrawal"
combination_logic:
expression: "BC1 AND BC2 AND (BC3 OR BC4)"
default_calibration:
wire_to_crypto_count_60d_min: 3
amount_growth_r_squared_min: 0.6
age_threshold: 55The Data Binding Agent resolves each abstract concept against the bank's data model. 6 of 8 concepts were reused from the binding registry. 2 concepts are novel and require Financial Crimes Compliance review before proceeding.
FCT_TRANSACTIONS WHERE txn_type IN ('WIRE_OUT_FED','WIRE_OUT_SWIFT')
txn_code IN ('IRA_DIST','401K_DIST') OR memo MATCHES retirement_pattern
CUSTOMER.age >= 55 AND marital_status_change_24m IN ('WIDOWED','DIVORCED')
beneficiary.entity_classification IN ('CRYPTO_EXCHANGE','VASP') OR name MATCHES known_crypto_list
LINEAR_REGRESSION(amount_usd ORDER BY txn_ts) slope > 0 AND R² ≥ 0.6
Two binding decisions and one calibration choice need your approval before TYP-PIG-001 can advance to shadow validation.
The system proposes binding this concept to a combination of beneficiary entity classification flags and a curated list of 247 known crypto exchanges (sources: FinCEN MSB registry + internal counterparty review).
This is a new statistical feature — linear regression on wire amounts in a 60-day window, requiring positive slope and R² ≥ 0.6. Validated against historical SARs: 87% of romance-investment SARs from 2025 would have triggered.
Proposed initial calibration. These thresholds will be re-tuned automatically during shadow operation based on observed alert distribution.
After approval, the Translation Agent generates the Spark SQL detection query and the Runtime Agent runs it in shadow mode — against live transactions, but not generating analyst-visible alerts. Shadow alerts will be compared daily against Actimize output to measure overlap, novelty, and calibration accuracy.
If shadow validation meets quality thresholds, the typology is promoted to PRODUCTION by joint approval of the MRM committee and FCC head. From that moment, alerts route to investigators via Actimize, MRM documentation is finalized and locked, and the typology becomes a permanent part of the typology library.
Wire payments to small electronics importers in Hong Kong, Singapore, and UAE for invoices that are systematically 30-45% above the corridor median price for the declared HS code (8517 — telephone/communication equipment).
- ICE HSI trend report (Q1 2026): mentions electronics over-invoicing as emerging TBML pattern
- FinCEN Trade-Based Money Laundering advisory FIN-2010-A001 (general framework)
- Egmont Group ML through trade — Hong Kong corridor sanctions risk noted
- Reference table: REF_HS_CORRIDOR_MARKET_PRICE (does not exist)
- Reference table: REF_ENTITY_REGISTRATION_HISTORY (partial — needs enrichment)
- Memo field NLP extraction for HS code (existing capability)
- 21 mapped SARs added to training set — will refresh existing typology calibration on next AG-08 cycle
- 2 novel patterns surfaced to clustering review by AG-05
- SAR-2026-05-1141 recommended for new cluster CL-2026-05-NEW-08 — monitor for similar patterns
- SAR-2026-05-1138 may justify new typology TYP-IRS-IMP-001 if more cases surface