Antifraud controls
Zyphe runs a set of complementary fraud and financial-crime checks across onboarding (KYC, KYB) and ongoing activity (AML screening, Transaction Monitoring). This page is the map of what exists; each row links to the page that explains how the check works and where you configure it.
Nothing here is a single “fraud score.” Each control produces its own evidence, and you combine them in a flow, a score, or a monitoring rule.
Onboarding: who the user is
| Control | What it catches | Where it lives |
|---|---|---|
| Document authenticity | Tampered IDs, screen or paper copies, fake layouts, MRZ/OCR mismatches, voided documents | Document verification |
| Liveness | Photos, videos, masks, and other presentation attacks | Liveness |
| Face match (liveness × document) | A live person who is not the portrait on the ID | Liveness — compared against the document portrait |
| Proof of address | Wrong document type, stale evidence, name mismatch | Proof of address |
| Device and location signals | GPS/IP country mismatch, VPN or proxy, blacklisted IP, device fingerprint | Geolocation |
Identity-document checks run on the capture or upload of a government ID. Corporate and supporting files collected in KYB are cross-checked against the official register and the uploaded evidence (see below), not through the same ID-capture pipeline.
Business verification: who the company is
| Control | What it catches | Where it lives |
|---|---|---|
| Register cross-check | Business information that does not match the official company register or the uploaded documents | KYB · KYB guide |
| UBO discovery | Hidden beneficial owners; incomplete or circular ownership chains | Ownership structure |
| UBO and director KYC | Unverified people behind the company | Each UBO or director runs a linked KYC flow |
| PEP and sanctions on the company and UBOs | Listed entities and politically exposed persons in the ownership chain | AML |
Ongoing risk: screening and payments
| Control | What it catches | Where it lives |
|---|---|---|
| AML screening | Sanctions, PEP, watchlists, adverse media, on onboarding and on a cadence | AML · Monitoring |
| Risk scoring | Weighted topics from screening, amplified by jurisdiction, position, and relationship | Risk scoring · Scoring |
| Transaction Monitoring | Payments that break your rules (amount, counterparty, country, keywords, timing) | Transaction Monitoring |
| Inconsistency review (AI agents) | Hits or fields that look like false positives, and alerts that need a first-line analyst | See AI agents |
Agents can also flag activity that does not fit the subject’s profile (for example a payment pattern that is inconsistent with declared or registered business activity). On Transaction Monitoring that review sits on raised alerts, not on every Allow.
AI agents as first-line analysts
Across KYC, KYB, and Transaction Monitoring, the optional AI agent is a first-line compliance analyst: it reads the case, proposes a verdict, and — depending on the mode — either waits for a human or acts under a deterministic guard.
The same three modes apply on every module:
| Mode | What the agent does |
|---|---|
| Disabled | The agent does not run. Operators review every hit or alert. |
| Suggest | The agent runs and surfaces a verdict and rationale. Clears stay suggestions; high-risk paths still reach the human queue. |
| Auto-pilot | The agent may enact the decision. A clear is enacted only when a non-AI guard also passes; anything the guard vetoes is escalated. |
Where you set the mode:
| Module | What the agent reviews | Where the mode is set |
|---|---|---|
| KYC (person AML) | PEP, sanctions, and adverse-media hits on a person | AML Agent Mode on the document-verification step. See AML Agent Mode. |
| KYB | Business-information fields vs documents vs the official register | KYB Agent Mode on the KYB step. See KYB Agent Mode. Company and UBO screenings use AML Agent Mode on the same step. |
| Transaction Monitoring | Raised rule alerts (first-line triage so analysts see exceptions) | Planned on Transaction Monitoring → Settings, using the same Disabled / Suggest / Auto-pilot values. Until the alert-queue ships, the mode is fixed to Disabled and is not shown in the dashboard. Rules still fire, and alerts still go to your webhook. |
Missing or unparseable configuration fails closed: the agent does not run.
How the pieces combine
A typical full-cycle setup:
Document verification (+ authenticity checks)
→ Liveness (+ face match)
→ optional Geolocation / Proof of address / Form
→ AML screening → Risk score
→ (businesses) KYB register cross-check + UBO unwrapping
→ ongoing: rescreening + Transaction Monitoring on each payment
Scores and monitoring rules are how you turn those signals into a policy (review, block, escalate). See Scoring and Transaction Monitoring.