Build a TM ruleset. See the false-positive cost before you ship it.
Configure threshold and behavioural transaction-monitoring rules across six families — velocity, structuring, geographic anomaly, behavioural, sanctions-adjacency and counterparty network. Each rule is modeled against a synthetic 100,000-transaction population so you can see the true-positive / false-positive trade-off before the ruleset hits production. Export the whole stack as an AP2 v1.0 mandate that an agentic payment runtime can enforce.
U.S. BSA 31 CFR §1020.210 requires every covered institution to have a risk-based AML programme that includes a transaction-monitoring function. FinCEN's 2026 AML/CFT Priorities name corruption, cyber-enabled crime, fraud, transnational crime, drug trafficking, human trafficking and proliferation finance — TM rules are how each one becomes detectable. The EU AML Single Rulebook (Regulation 2024/1624) harmonises the equivalent obligation across member states from 2027.
Compose the ruleset
Toggle rules on/off and adjust thresholds. The synthetic population (§2) refreshes the per-rule alert volume and precision in real time. Each rule emits its own clause in the AP2 mandate.
Base rate & population mix
A realistic suspicious-activity base rate sits around 0.1%–0.5% of total daily transactions for a mid-sized institution. Move the slider to stress-test your ruleset against books with different illicit-activity prevalence.
Ruleset performance
Combining all active rules (deduplicated alerts on the same tx): per-day true positives, false positives, missed suspicious activity, and the analyst workload required to clear the queue.
Analyst load: —
AP2 output
The chosen ruleset, the calibration metrics, and an MCP tool definition the agent can use to score a candidate transaction.
Compose with
Pair with #23 — AP2 AML Mandate Builder to wrap this ruleset inside a multi-domain AML mandate (customer risk + sanctions + travel rule). The Tool Chain Composer shows where T116 sits in the 259-tool AML cluster.