Cooperative Bank
One million customers. Two hundred branches. Four source systems. One definitional layer beneath the existing AML stack. No system replaced.
A French regional cooperative bank serving more than one million customers across two hundred-plus branches and a multi-billion-euro loan book. Anti-money-laundering operations ran on a layered set of vendor systems — sanctions screening, rule-based transaction monitoring, and case management — that had grown by accretion. After the ACPR's April 2023 thematic review on automated AML surveillance, the bank's compliance leadership concluded the existing posture would not survive a near-term inspection. Stathon deployed at Vault Tier. Over twelve months, an event model consolidated transaction signals across the core banking system, the card backbone, the SWIFT/EBICS corporate channels, and the group's insurance entity into a single, customer-anchored stream. A probabilistic scoring layer was introduced beneath — not in place of — the existing rule-based monitoring. No system was replaced.
The institution.
A French regional cooperative bank operating a centralized core banking system in the COBOL-and-services-bus tradition characteristic of mutualiste banks at this scale. Card acceptance routes through GIE Cartes Bancaires with daily clearing. Corporate flows arrive via SWIFT and EBICS. The group's insurance entity runs on a separate policy-administration system with its own client-identifier scheme.
For AML/CFT, the bank operates a sanctions-screening platform widely deployed across French Tier-1 banks, a rule-based transaction-monitoring scenario engine running against the core banking general ledger, and a separate case-management front end where the AML analyst team works the queue.
What was absent was not a tool. What was absent was a layer at which a transaction observed at the card backbone, a customer profile maintained in the core, a beneficiary string on a SWIFT message, and a beneficial-owner declaration captured during onboarding could be understood as belonging to the same entity. None of the existing systems held the question — is this the same person, the same network, the same risk event?
Each system answered its own narrow question. The answers did not compose.
Volume. Latency. Definition.
The visible problem was alert volume and alert latency. The transaction-monitoring engine produced a high-volume daily alert queue, far in excess of what the analyst team could triage in any structurally meaningful order. Alerts that should have been correlated — across joint accounts, across spouse-and-firm structures, across the insurance relationship — were treated independently. Cases reached the déclaration de soupçon threshold late or not at all.
The April 2023 ACPR thematic review documented this pattern industry-wide: alert-treatment delays reaching 95 days, monitoring perimeters with known exclusions, scenario thresholds calibrated to global rather than client-level averages. The June 2024 ACPR sanction against BRED Banque Populaire codified the supervisory expectation against which a regional bank of this size would now be measured.
The existing platform was not under-tuned. It was unable, by construction, to represent the questions a 2024-vintage AML inspection would ask. Tuning a scenario engine to detect what its data model cannot articulate produces the same alerts at lower thresholds — not different alerts.
Stathon engagement assessment
The bank had received internal-audit findings flagging the same recurring failure modes the ACPR had begun citing in its decisions — accounts outside the monitoring perimeter, weak alert prioritization, slow examen renforcé cycles. Two prior remediation engagements with established consultancies had focused on scenario tuning and analyst process redesign; both reduced alert volume in the short term and produced negligible structural change. The bank's compliance leadership concluded that no further iteration of the existing pattern would address the supervisory exposure.
The customer in the core banking system, the cardholder in the card backbone, the policy holder in the insurance system, and the SWIFT beneficiary string were four representations of the same person. No system held that fact. Cross-system de-duplication relied on string matching on names and account numbers.
Sanctions alerts on the same resolved beneficiary across systems were treated as independent events. A single counterparty could trigger redundant alerts at the SWIFT gateway, the card backbone, and the corporate channel — examined separately, escalated separately, closed separately. Entity resolution did not exist at the alert layer.
Transaction signals from card, core, SWIFT, and insurance flows arrived in four schemas with four temporal cadences. The monitoring engine scored individual transactions against scenario thresholds. There was no consolidated, customer-anchored event stream against which patterns could be evaluated.
Beneficial-owner declarations captured at onboarding were not connected to transaction monitoring. Spouse-and-firm structures, joint-account correlations, and shared-mandate networks were invisible to the alert pipeline. The bank’s systems could not represent a network-level risk question.
The structural diagnosis
The bank's systems did not share a definition of customer, beneficiary, event, or risk relationship across the AML perimeter. Beneficial-owner graphs were maintained in onboarding but not connected to transaction monitoring. The customer in the core, the cardholder in the card backbone, the policy holder in the insurance system, and the SWIFT beneficiary string were four representations of the same person — and no system held that fact.
Three phases.
Vault-tier deployment from the beginning. Sovereignty over what is known, by whom, and when, was not a feature — it was the precondition for the bank's right to operate the system at all. French sovereign-cloud-qualified hosting. RBAC and audit governance reaching to the AI model layer. A chain of evidence sufficient for ACPR inspection.
Definition & Integration Spine
Weeks 1–14The first work was not integration — it was definition. By week 14, no AI capability was live. The integration spine ran. The entity graph held the bank's resolved customer perimeter. The event log had backfilled 18 months of historical transactions. Aegis was operational — already producing audit-grade access logs the bank had not previously held.
Stathon deployment record
Athena — First Live Capabilities
Months 4–13The first capability deployed in production. Athena’s probabilistic scoring engine was layered beneath — not in place of — the legacy scenario engine. Every alert produced by the legacy engine continued to be produced. What changed was that each alert was scored, ranked, and presented to analysts in priority order, with the scoring engine drawing on the entity graph to consolidate alerts referring to the same entity or network across the bank’s systems.
Internal model-validation approval required a 90-day parallel-run validation against the legacy queue order before the prioritization could alter the analyst’s working order. Both queues were maintained — analysts worked the legacy order, while the new prioritization ran in shadow and was reviewed weekly by the bank’s model-validation team. After approval, the prioritization layer cut over to live mode in October 2024.
The second capability. The legacy sanctions filter continued to produce its alerts against EU Regulations 269/2014 and 833/2014, UN, OFAC, HMT, and the DGT registre national des gels. The engagement added an entity-resolution pass that collapsed multiple alerts on the same resolved beneficiary into a single examination unit — preserving each underlying alert in the audit trail but sparing the analyst the redundant work.
Initial detection consistency on night-shift cross-border flows ran approximately 12 percentage points below the day-shift baseline — a cohort imbalance traced to the historical training set under-representing weekend SEPA Instant volumes. Resolved in a separate tuning cycle over six weeks in November–December 2024.
PSAN-related flows, included in the initial scoring track, were carved out into a separate pipeline in early 2025 after their velocity profile produced an unacceptable false-positive rate against the same threshold. The carved-out track now runs in advisory mode pending the post–1 July 2026 MiCA transition.
A cluster of three corporate accounts — opened within four months in three different branches across two regions — received cumulative inbound transfers of ~€1.2M from a single Limassol-incorporated entity. Individually, each account remained below the legacy engine's escalation threshold. The probabilistic scoring layer correlated the three through a shared signing-mandate beneficial owner. Consolidated alert raised within 11 minutes of the third deposit clearing. Déclaration de soupçon filed with Tracfin within 96 hours.
A cluster of seven recently opened personal accounts — holders aged 19 to 24, each receiving inbound card-fraud-victim funds — was flagged by a fan-in network pattern in the entity graph. The flag preceded the typical end-of-week ATM withdrawal cycle by approximately nine hours. Branch-level intervention was possible on five of the seven accounts before extraction. Pattern added to the bank's internal mule-typology library.
Expansion & Roadmap
Current · ongoingThree workstreams active. The entity perimeter is being extended to the group's life-product flows — historically outside the AML monitoring perimeter and a recurring grief category in recent ACPR decisions against insurer entities. The adverse-media context feed is in pilot under examen renforcé only. A CASP/PSAN flow scoring track is in design ahead of the 1 July 2026 PSAN-to-MiCA transition.
Entity graph and event schema integration completed for the group’s life-product flows. Scoring track in advisory mode pending the bank’s internal-validation review. Closes a perimeter gap repeatedly cited in ACPR decisions against insurer entities.
In pilot. Surfaces supplementary information to analysts during examen renforcé. Not currently used as a scoring input — a deliberate constraint pending an internal model-validation cycle on its precision profile.
In design ahead of the 1 July 2026 PSAN-to-MiCA transition deadline. Given the 339% YoY increase in PSAN-origin déclarations de soupçon in 2022–2023 and a further 112% in 2024, prioritized for full production by Q4 2026.
What changed.
Outcomes stated against the 12-month measurement window covering the closure of the parallel-run validation in October 2024 through October 2025. Each figure sourced from the bank's internal model-validation reports and the AML operations team's quarterly metrics review.
The decision cycle on prioritized alerts compressed from the days-and-weeks pattern characteristic of the pre-deployment queue to a near-real-time pattern measured in seconds — a structural shift, not a speed improvement. The bank's compliance function now sees alerts in the order in which they should be worked, not in the order in which the legacy scenario engine produced them.
The ~600–750 hours per month previously spent on triage were not eliminated. They were liberated from the lower-value end of the workflow and redeployed into examen renforcé, typology development, and the work the bank's compliance function had previously been unable to staff.
What this case revealed.
Tuning was not the answer
Two prior remediation engagements with established consultancies had focused on scenario tuning and analyst process redesign. Both reduced alert volume in the short term and produced negligible structural change. What two prior partners had described as a tuning problem — to be addressed with better thresholds and more analysts — was a definitional problem: a question of whether the bank’s own systems shared a common understanding of what counted as a customer, an event, or a network. Until that question was answered, no amount of tuning could produce the alerts an inspection would expect.
The probabilistic layer beneath, not in place of
The legacy rule-based scenario engine remained the source of truth for whether an alert existed. The probabilistic layer ranked which alerts deserved attention first. This was not a transitional arrangement. It is the architecture: the rule-based engine carries the regulatory burden of explicit detection logic; the probabilistic layer carries the operational burden of priority. Each does what it does well; neither is asked to do what it cannot.
Human-in-the-loop as architectural decision
From the engagement’s outset, examen renforcé and déclaration de soupçon drafting remained human. This posture was subsequently confirmed by the April 2025 update to the ACPR–Tracfin lignes directrices conjointes, which explicitly endorsed AI-supported alert detection while mandating human control for those activities. The constraint was architectural — not regulatory accommodation, not a transitional state.
Sovereignty as precondition
The Vault-tier configuration is not a stricter version of the same product. It is the same architecture configured for an environment in which sovereignty over what is known, by whom, and when, is not a feature — it is the precondition for the bank’s right to operate the system at all. Sovereign-cloud-qualified hosting, RBAC and audit governance reaching to the AI model layer, retention and lineage compliant with Article L.561-12 CMF, and a chain of evidence sufficient for ACPR inspection are not bolted-on properties. They are structural.
The bank received structural capacity, not software. The integration is not visible from the surface. Its absence would be.
Stathon deployment conclusion
Forward roadmap.
Adverse-media context pilot
Surfaced to analysts during examen renforcé as supplementary context. Not currently used as a scoring input — a deliberate constraint pending an internal model-validation cycle on its precision profile. The constraint is architectural, not transitional.
Insurance-entity perimeter extension
The entity perimeter is being extended to the group’s life-product flows — historically outside the AML monitoring perimeter and a recurring grief category in recent ACPR decisions against insurer entities. Entity graph and event schema integration completed; scoring track in advisory mode pending the bank’s internal-validation review.
PSAN/CASP scoring track for MiCA
Carved out from the main scoring pipeline in early 2025; runs in advisory mode pending the PSAN-to-MiCA transition. Given the 339% YoY increase in PSAN-origin déclarations de soupçon in 2022–2023 and a further 112% in 2024, this track is prioritized for full production by Q4 2026.
Deployment record.
Stathon · Definitional Infrastructure Company. Client identity withheld by agreement. Deployment metrics reflect production conditions as of May 2026.