Before You Connect

What you need to get started

Connecting Your Bank

The Connection Wizard

1. Log in to the Command Center. Navigate to Settings → Bank Connections → Add Connection. The Connection Wizard opens.
2. Select your core banking system. BankGuard lists FIS Horizon, Fiserv DNA, Jack Henry SilverLake, and Generic (for any RDBMS). If your system is not listed, choose Generic and configure column mappings manually.
3. Choose your integration depth. See the depth comparison table below.
4. Enter your connection details (host, port, database, credentials). Credentials are encrypted with AES-256-GCM before storage.
5. Click Test Connection. BankGuard performs a schema discovery to verify it can read the required tables. You will see either a green confirmation or a specific error.
6. Name this connection (e.g., "FIS-Prod-Primary") and click Save & Activate.

Integration Depth Comparison

Understanding Fraud Scores

What BankGuard returns for every transaction

Field Explanations

recommended_action — What BankGuard recommends the bank do: APPROVE / STEP_UP / DECLINE. For Intercept depth, this becomes APPROVE / BLOCK.

scores — Five independent engine scores, each 0.0–1.0. Higher = more suspicious. Fraud score: probability of fraudulent activity based on transaction patterns and velocity. Risk score: customer-level risk profile. Compliance score: BSA/AML flag probability. Retention: customer churn/distress signal. Predictive anomaly: statistical deviation from this account's historical baseline.

rules_applied — Any declarative rules that fired. Rules can elevate the ML recommendation but not lower it (unless configured with override_ml: true).

feature_contributions — SHAP-based explanation showing the features that most influenced the fraud score. Positive contribution = pushed score higher (toward fraud). Available in Case Detail view.

Default Action Thresholds

Thresholds are configurable per institution.

Case Management

Working your fraud queue

When BankGuard recommends STEP_UP or DECLINE, a case is automatically created in the Case Queue. Cases are the primary workflow surface for fraud analysts.

The Case Lifecycle

Priority and SLA

Working a Case

1. Open the Cases view. Cases are sorted by SLA urgency (time remaining). Red = SLA at risk.
2. Click a case to open Case Detail. You'll see: the transaction data, all five engine scores, the SHAP feature contributions bar chart, any rules that fired, and the event timeline.
3. Click Assign to Me (or assign to another analyst).
4. Review the evidence. Use the Notes field to document your reasoning.
5. Set a Disposition: TRUE_POSITIVE (confirmed fraud), FALSE_POSITIVE (legitimate transaction), SUSPICIOUS (uncertain, keep open), or INCONCLUSIVE.
6. TRUE_POSITIVE and FALSE_POSITIVE dispositions automatically send feedback signals to the ML engines.

SAR and CTR Drafting

Regulatory document workflow

SAR Workflow

1. With a case open (must be TRUE_POSITIVE or SUSPICIOUS disposition), click Draft SAR.
2. BankGuard sends the case context (transaction details, account history, scores, analyst notes) to an LLM and generates a FinCEN-format SAR narrative covering the 5W+H framework: Who, What, Where, When, Why, and How.
3. The draft appears in the Documents tab of the case. Review it carefully — the AI draft is a starting point, not a finished document.
4. Edit the narrative as needed in the document editor.
5. Click Mark as Reviewed when the document is complete.
6. File manually through your FinCEN BSA E-Filing portal. Return to BankGuard and click Mark as Filed to close the loop.

CTR Workflow

Identical to the SAR workflow, initiated with Draft CTR from a HIGH-value cash transaction case.

Document Status Flow

The Rules Engine

Declarative fraud logic on top of ML scoring

Rules let you encode your institution's specific fraud policy as declarative logic. Rules fire before the ML score is returned — if a rule fires, its action is merged with the ML recommendation (most severe wins).

Available fields: transaction.amount · transaction.channel · transaction.type · account.balance · account.age_days · customer.risk_tier · features.tx_count_1h · features.sum_24h · features.avg_amount_30d

Building a Rule

1. Navigate to Rules → New Rule.
2. Name the rule and add condition rows (field + operator + value). Nest with AND/OR groups.
3. Set the action (APPROVE / STEP_UP / DECLINE) and priority (lower number = higher priority).
4. Save as Inactive. Use Simulate to run it against the last 30 days of historical data before activating — the simulation returns how many transactions would have been hit and an estimated false-positive rate.
5. When confident, set status to Active.

Graph Intelligence

Entity relationships and fraud ring detection

The entity graph tracks relationships between accounts, customers, merchants, devices, and IP addresses. Shared connections between fraud-confirmed entities and new accounts are a powerful leading indicator.

How the Graph Is Built

• › Every scored transaction updates the graph: account ↔ merchant (TRANSACTED_WITH), account → device (USED_FROM), account → IP (USED_FROM)
• › PII nodes (phone, email, address) are SHA-256 hashed — raw values are never stored
• › Edge weights decay over time: a 30-day-old connection has half the weight of a current one

Using the Graph

Quick Reference

Keyboard shortcuts, dispositions, and common questions

Keyboard Shortcuts

Case Disposition Quick Reference

Common Questions

Checker Map: Docker

What bankguard-check.js verifies in the Docker deployment model

Each numbered badge shows which section of the System Integrity Checker is responsible for that component. A clean run means every badge-annotated component reported healthy.

Checker Map: PM2

What bankguard-check.js verifies in the PM2 / bare-metal deployment model

This is the live deployment on the AnswerPoint VPS. The numbered badges match exactly the five sections reported in the checker's terminal output. If a badge-annotated component is failing, its checker section will report FAIL or WARN.

System Integrity Check

Verify that every BankGuard service, NATS connection, and engine is operating correctly

Running the Checker

The System Integrity Checker is a Node.js script included with every BankGuard installation. Run it after deployment or when troubleshooting connectivity issues:

For automated pipelines, add --json for structured output, or --quiet to suppress display and rely on the exit code (0 = all pass, 1 = failure, 2 = checker error).

What the Checker Verifies

Common Failures and Fixes