Step 1
An alert becomes a case
A monitoring trigger or a request from an authorised body opens a case: amount, participants, transaction history. The case is assigned to an analyst, status — “In progress”.
Investigation of suspicious transactions and graph analysis of links
Anomalies in transactions rarely come alone. NeuroVision lays out an alert as a graph: customers, accounts, counterparties and shared details — so that an analyst sees the chain, ring or fan of transfers, and the responsible officer makes a decision based on the assembled case file.
Data is stored in Russia Russian software registry no. 19972 Cloud or your own perimeter
The alert is closed, the scheme remains: why investigate links after monitoring
Links are the main material of an investigation
Behavioural analysis finds an unusual transaction; the graph explains why it was needed and who else is in the scheme.
- 01
One transaction looks honest
A transfer of RUB 480,000 for “consulting services” is not suspicious in itself. What is suspicious is that an hour later the same money went on in three payments, and the recipients are registered at one address. This is visible only in the links.
- 02
The scheme is spread across customers
Transit, structuring and circular transfers are built from several customers and accounts. Different employees review the alerts for each — and no one sees the whole picture.
- 03
The decision must be justified
The responsible officer decides how to qualify the transaction, and the grounds must be recorded. The graph and the case file show what the decision is based on.
- 04
They will ask again years later
A request from Rosfinmonitoring or a Bank of Russia inspection may come years later. Investigation materials are stored together with the action log, and the case can be opened as the analyst saw it.
- 3 business days to report after a transaction is detected
- 5 years document retention after the relationship ends
- 0 the customer is not informed of the measures: the law does not allow informing them
Transaction link graph: customers, accounts, counterparties and shared details in one diagram
A graph node is a participant, a link is a payment or a shared attribute. Six kinds of links that make up the picture. How a payment gets into monitoring and why it receives a high risk — on the payment transaction monitoring page.
-
Payments between accounts
Who, to whom, how much and when. Link thickness is the amount, the arrow is the direction, time is the scale under the graph. You can see how many hours the money spent in the account.
-
Shared details
One address, phone, email or manager across different customers. The data comes from KYC questionnaires and registries by INN.
-
Devices and IPs
Logging in to internet banking from the same device or address by formally unrelated customers — a signal that one person controls the accounts. The data comes from your remote banking systems and processing.
-
Owners and managers
Founders, directors and beneficiaries of participating companies. Two “independent” firms with a common founder become one group. More — on the UBO page.
-
Lists and risk level
Matches with Rosfinmonitoring lists, sanctions and PEP, as well as the customer risk level — are marks on nodes. A node from a list colours the whole chain.
-
Behavioural profile
Behavioural analysis of transactions flags what is atypical for this customer: a new circle of recipients, night transfers, turnover above the usual. The graph shows who the deviation is connected with.
Chain, ring, fan, collector: shapes visible only on the graph
-
Chain
Money passes through 3–5 accounts in a row and does not stay anywhere. Detection of transaction chains starts from the first link: the graph completes the rest, even if they are in other alerts.
-
Ring
Payments return to the original customer through intermediaries. Turnover grows, while the group gets no more money. The ring is visible only when the last link closes.
-
Fan
One account sends money to dozens of recipients within a short time in amounts below your thresholds. This is a transfer pattern that a single-transaction rule misses.
-
Collector
The reverse shape: dozens of senders transfer to one account, which immediately forwards everything in a single amount. A typical trace of “managed” accounts.
-
Group with a common core
Companies with no shared payments but with one manager, address or device. If one of them is in a scheme, the rest are candidates for enhanced checks.
-
Bridge to a list
The customer is clean, but through one or two links is connected to a person from a list or a sanctions list. The graph shows the length and amounts of this path.
A shape on the graph is a reason for a check, not proof. The transaction is qualified by the responsible officer under your organisation’s internal control rules.
Investigation workflow: from the first alert to the responsible officer’s decision
Six steps an analyst goes through. Every action stays in the case log.
Step 2
The graph expands by 1–3 links
The analyst chooses the depth and period: starting from the alert participants, the graph adds related customers, accounts and counterparties.
Step 3
Shapes are highlighted
Chains, rings, fans and nodes from lists are marked in colour. The analyst hides unnecessary links and leaves a comment in the case explaining why.
Step 4
A check on the members
Unknown counterparties from the graph are checked against registries and lists right from the case — RUB 5 per registry, international screening — RUB 36.
Step 5
Document request
If a link cannot be explained, contracts and explanations are requested from the customer under your rules. Replies are attached to the case. The customer does not learn about the investigation itself.
Step 6
The decision and the file
The responsible officer sees the graph, comments and documents and makes the decision. The message template is filled with case data; the organisation sends it through its own channel.
Recording, reproducibility, five years of retention: what 115‑FZ and 860‑P expect from an investigation
The law does not require a graph. It requires that the grounds of a decision be recorded, transaction details be reproducible, and materials be kept for five years. The graph and the case file cover this in one action.
- The organisation documents the information obtained when applying internal control rules: a complex or unusual nature of a transaction, inconsistency with the purposes of activity, repeated transactions circumventing control (para. 2, Art. 7)
- The case stores the graph as of the time of the decision, the analyst’s comments and attached documents
- The transaction detection programme sets the procedure for enhanced checks, the grounds and the time limit for the responsible officer’s decision and the procedure for recording it (cl. 6.2)
- If it is decided not to submit the information, a reasoned justification is required (cl. 6.3). The decision time limit within the programme is set by your organisation
- Information on a suspicious transaction — no later than three business days after the day of detection (para. 3, Art. 7)
- At the request of the authorised body the organisation provides the information it has (subpara. 5, para. 1, Art. 7): the case export gathers it into one package
- Documents are kept for at least five years from the date the relationship with the customer ends (para. 4, Art. 7); transaction information is recorded so that its details can be reproduced (cl. 6.2, 860‑P)
- The customer and other persons are not informed of the measures taken (para. 6, Art. 7). Access to cases is role-based, every action is in the log
- A guide to Federal Law 115‑FZ (as amended on 4 August 2026) and Bank of Russia Regulation of 18 June 2025 no. 860‑P; the exact text is in ConsultantPlus. The mandatory control threshold and signs of unusual transactions — on the payment transaction monitoring page.
Case file: what is exported for a decision, an inspection and a Rosfinmonitoring request
Three sets of materials from one case. The composition is configured to your internal control rules and suspicious transaction report templates.
- Sample case summary
For a decision
For the responsible officer.
Summary
- participants and their risk level
- shapes found
- amounts and period
- matches with lists
Grounds
- analyst’s comments
- customer replies and documents
- conclusion and proposed decision
- Discuss templates
For a message
A draft from a template.
Fields from the case
- information on transaction participants
- scheme transactions with dates and amounts
- description of the grounds for suspicion
Templates
- suspicious transaction report
- SAR/STR for international procedures
- your forms
- How the log works
For an inspection and a request
Years later — the same as on the day of the decision.
Snapshot
- graph as of the decision date
- transaction table in CSV
- version of the rules that triggered the alert
Log
- who opened the case
- who changed the status and when
- who exported the materials
A shared address is not yet a scheme: how to tell a link from a coincidence
The graph finds links faster than a person and finds too many. Four common coincidences that the analyst marks as explained. How to handle a customer name matching a list — on the Rosfinmonitoring lists check page.
-
Business centre and mass address
What is visible: dozens of companies at one address.
How to check: whether there are payments, shared managers or devices between them. One address with no other links is noise. -
Outsourced accountant
What is visible: one phone, email or IP across different customers.
How to check: whether it matches the contact of the servicing company. A confirmed explanation is saved in the case and is not raised again. -
Payment aggregator and marketplace
What is visible: a node through which thousands of payments flow.
How to check: this is a hub by the nature of the business. Such nodes are marked and excluded from shape search so as not to link everyone with everyone. -
Family and salary
What is visible: regular transfers between individuals and a fan of payouts from one company.
How to check: amounts and frequency match the profile, the payment purpose is clear.
Who investigates links: bank financial monitoring, payment service, crypto platform, leasing
-
Banks
- Transit chains across legal-entity accounts
- Customer groups with a common core
- Materials for responding to a request
-
NBCOs and e-money operators
- Fans and collectors across wallets
- Devices and IPs in one graph
- Case file for a partner bank
-
Payment aggregators
- Merchants with shared details
- Circular refunds
- Hubs excluded from shape search
-
Crypto platforms and exchangers
- Linking a customer’s fiat payments with their crypto transactions
- Bridges to lists
- More — KYT for crypto
-
Leasing and factoring
- Buyer, supplier and lessee in one group
- Supply rings
- Participant checks against registries
-
How much the investigations module costs
The price depends on transaction volume, graph depth and installation option. We will calculate it for your flow. Check rates — on the price matrix.
Calculate the cost- 01
Investigations module — on request. Separately or together with transaction monitoring. NeuroVision cloud or installation in your perimeter.
- 02
Checking graph participants — RUB 5 per registry. An unknown counterparty is checked from the case. International screening against sanctions and PEP — RUB 36.
- 03
No subscription fee for checks. A demo on an anonymised sample of your transactions — on request.
Connection: transactions, KYC and lists in one graph
- API, Kafka, CSV
- ISO 20022
- KYC questionnaires and registries
- Webhook with the case outcome
Terms.
Cloud in Russia or your perimeter. Personal manager. Encryption and access control.
Discuss the connectionInvestigations glossary: node, link, transit account and ring
- Link graph
- A diagram where participants are nodes, and payments and shared attributes are the links between them.
- transaction graph
- Node
- A customer, account, counterparty, device or address on the graph.
- node
- Link
- A payment or a shared attribute of two nodes: address, phone, manager, device.
- edge
- Graph depth
- How many links from the alert participants the graph shows.
- hops
- Pass-through account
- An account where money does not stay: it arrived and immediately went on.
- pass-through account
- Ring
- Payments that return to the original participant through intermediaries.
- circular flow
- Fan and collector
- Sending from one account to many recipients and the reverse — collecting from many into one.
- fan-out / fan-in
- Case
- An investigation card: participants, transactions, graph, comments, status and log.
- case
- Responsible officer
- A special officer responsible for internal control rules who decides how to qualify a transaction.
- MLRO
- SAR / STR
- A report on suspicious activity or a transaction in international practice.
- suspicious activity report
Read also
175 16
KYC, AML and Digital Identification
KYT (Know Your Transaction): What It Is, How Transaction Monitoring Works, and Where the Travel Rule Fits In
154 28
KYC, AML and Digital Identification
Financial Monitoring and AML/CFT in Simple Terms: What It Is, Who It Applies To, and How It Works
384 22
KYC, AML and Digital Identification
Fintech Compliance Under Federal Law 115-FZ: How to Build a KYC and AML Loop Without Overloading the Team
126 29
KYC, AML and Digital Identification
115-FZ: What Businesses Are Required to Do and How to Meet the Law’s Requirements
Questions about investigating suspicious transactions
It is a review of an alert or a request, after which the responsible officer decides whether a transaction is suspicious. The analyst opens up the participants’ links, checks counterparties, requests documents and records the grounds. NeuroVision shows the links on a graph and gathers the materials in one case.
Monitoring checks every transaction and raises an alert. An investigation starts after the alert: it finds out whether the transaction is part of a scheme, who else is involved and what supports the conclusion.
The graph connects payments by accounts and time. If money passes through several accounts in a row and does not stay anywhere, the whole chain is visible, even when its links ended up in different alerts and with different employees.
Transactions from core banking or processing, customer data from KYC and registries, and optionally devices and IPs from remote banking. The more shared attributes are connected, the more links you see.
The responsible officer of your organisation under the internal control rules. The service does not qualify transactions itself: it shows links, highlights shapes and gathers the grounds.
Yes. The message and SAR/STR are filled with case data: participants, transactions, grounds. The template is configured to your forms. The organisation sends the information through its own channel.
The law requires documents to be kept for at least five years from the date the relationship with the customer ends. The retention period for cases in NeuroVision is set by the contract, or by your infrastructure when installed in your perimeter.
No. The law prohibits informing customers and other persons of the measures taken. A document request is worded under your rules, and access to cases is limited by roles.
Find the customer in the console, open the related cases and export the case file: summary, graph, transaction table and log. What to include in the reply is decided by the responsible officer.
Fraudulent transaction patterns — drops, fans of transfers after a theft — are visible on the graph in the same way. But transfers without the customer’s consent are governed by 161‑FZ, and there is transaction fraud monitoring for them.
Let’s discuss investigations in your financial monitoring unit
Tell us how many alerts a month your team reviews and where transactions come from — we will show the graph in a demo and propose a connection scheme.
Can't put your request into words? Book a call and our team will contact you at a convenient time
Book a call
The company is included in the register of IT companies and the register of personal data operators of the Russian Ministry of Digital Development.
Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.
