Coverage note · Financial Crime & AML · AML · Streaming
AEGIS Live — Real-Time Streaming AML
Real-time AML surveillance that scores live Bitcoin transactions the instant they arrive — a streaming graph + ML ensemble, explained alerts, and drafted SARs.
Key metrics
1. Fast-path p95 in single-digit milliseconds (CI-gated); detection PR-AUC measured on a synthetic AMLSim-style typology set (Elliptic-swappable). Sanctions exact-hits are ground truth; live risk scores are predictions pending review.
The problem
Money laundering is confirmed retrospectively — live blockchain data never arrives with a "laundered: yes/no" label. So a credible system does what every real production AML stack does: it scores in real time, and humans confirm later. Live red flags are predictions; only sanctions exact-hits are ground truth.
The hard part is the combination: resilient live ingestion, an event bus that survives bursts, a sliding-window graph, a graph/ML ensemble, on-chain sanctions screening, and a GenAI SAR layer — all inside a low-latency budget, on free infrastructure.
Architecture
- 01
Resilient WS ingestion
BTC mempool + exchange ticker, per-feed reconnect, exponential backoff, heartbeat.
- 02
Event bus
Bounded queue with drop-oldest backpressure and adaptive sampling when it backs up.
- 03
Rolling graph
Sliding-window in-memory transaction graph (NetworkX); nodes age out.
- 04
Live feature builder
Strict train↔live parity — the live builder and the model share one FEATURE_NAMES list.
- 05
Ensemble scoring
Sanctions screen (exact + N-hop) | LightGBM | IsolationForest anomaly → a human-readable reason.
- 06
Alert engine
Threshold + dedup + rate-limit.
- 07
Explain + SAR
Subgraph explanation + LLM-drafted SAR (LiteLLM; deterministic template fallback).
- 08
WebSocket hub → Wall
Pushes to the Surveillance Wall UI; Postgres/SQLite store underneath.
Key tradeoffs
LightGBM + set-lookup sanctions on the fast path; heavier graph work off the hot loop.
WhyA single-digit-millisecond p95 budget, measured and CI-gated. Latency is a feature here.
One FEATURE_NAMES list shared by the live builder and the trained model, enforced by a parity CI gate.
WhyTrain/serve skew is the silent killer of streaming ML — the gate fails the build on drift.
Honest labels — only sanctions exact-hits are "confirmed"; everything else is "risk / suspected".
WhyLive data has no laundering label; claiming otherwise would be dishonest.
Graceful degradation everywhere: feed down → demo source, model missing → heuristic, LLM down → template SAR, Postgres unset → SQLite.
WhyA live wall must always have motion; nothing takes the system fully down.
Eval results
p50/p95/p99 measured and displayed; a CI gate enforces the budget.
Synthetic AMLSim-style typologies — fan-in/out, peeling, pass-through — in live-parity features; Elliptic-swappable for labeled history.
Live builder and model share FEATURE_NAMES; the parity gate fails the build on drift.
Production proof
The artifact that keeps the numbers honest: the eval harness and monitoring gates that run in CI, not a one-off notebook result.
Eval / CI gates + nightly lists
CI · PASSINGaegis/eval/gates.py runs in CI on every push; a GitHub Action refreshes the OFAC sanctions list nightly.
Demonstrates the rare full stack — live ingestion, backpressure, a streaming graph, a graph/ML ensemble, sanctions screening, and a GenAI SAR layer — shipped as one low-latency system, solo, for $0.
Request coverage
I am focused on finance AI: credit risk, RegTech, AML, and agentic investment research. Open to roles, mentorship, and collaborators in fintech, quant, and bank AI.
Related notes