# Compliance (FRAML)

Compliance is Myaza Trust's **fraud and anti-money-laundering** layer (FRAML). On top of KYC verification, it lets you keep watching the people and businesses you've onboarded: screen them against sanctions / PEP / adverse-media watchlists, score their activity in real time, and run a full investigation workflow from alerts through regulatory filings.

There are two sides to it:

- **The Identity Hub API**: a server-to-server API you call to sync your users as monitored **entities** and to stream their **events** (transactions and actions) for scoring. See [Identity Hub API](https://trust.myaza.co/documentation/identity-hub/markdown) and [Event monitoring](https://trust.myaza.co/documentation/monitoring-events/markdown).
- **The dashboard**: where your team manages monitoring on each Entity, understands changes in **Risk Intelligence**, resolves **Review Queue** items, and edits defaults in **Rules & Policies**.

Everything is **environment-scoped** (sandbox vs. production) and **organisation-scoped**, exactly like the rest of the platform; the API key you use decides which. See [Environments](https://trust.myaza.co/documentation/environments/markdown).

## Building blocks

| Concept | What it is |
|---|---|
| **Entity** | A person (`INDIVIDUAL`) or company (`BUSINESS`) you monitor, keyed by your own `externalUserId`. Carries a KYC disposition, a risk tier, and (once resolved) a link to a global identity. |
| **Screening** | An ongoing check of an entity against a watchlist type (`SANCTIONS`, `PEP`, or `ADVERSE_MEDIA`) producing zero or more **matches**. |
| **Event** | A transaction or action you send for scoring (`POST /events`). The engine returns a **decision** and a **risk score**. |
| **Signal** | The stored, scored record of an event: the monitored activity stream you browse in the dashboard. (A separate device/session *signal* stream is store-only.) |
| **Alert** | An investigation item opened automatically when an event scores at or above the review threshold. |
| **Investigation** | An owned evidence and decision record that can group one entity's related alerts and end in a disposition. |
| **SAR / STR** | A Suspicious Activity / Transaction Report drafted and filed from an investigation, exportable as goAML XML. |

## Risk & disposition vocabulary

An entity carries two independent axes:

- **Disposition** is its KYC standing: `PENDING`, `UNDER_REVIEW`, `APPROVED`, `REJECTED`.
- **Risk tier** is its monitoring risk posture: `LOW`, `MEDIUM`, `HIGH`, or `UNSCORED`.

Each event yields a **decision** (`ALLOW`, `REVIEW`, or `BLOCK`) and a **risk score** from 0 to 100.

## The real-time decision lifecycle

An event flows through the system like this:

```
  your backend
      │  POST /api/identity/events
      ▼
   Event ───score──►  Signal        (every event; browsable stream)
                        │
                        │ decision ≥ review threshold
                        ▼
                      Alert          (OPEN: needs triage)
                        │  group an entity's alerts
                        ▼
                  Investigation      (OPEN → IN_REVIEW → CLOSED + disposition)
                        │  if reportable
                        ▼
                      SAR / STR      (DRAFT → FILED, exported as goAML XML)
```

- **Event → Signal** happens on every ingested event; the signal is stored and scored.
- **Signal → Alert** happens automatically when the composite score crosses your **review threshold**.
- **Alert → Investigation → SAR** are **manual** compliance actions taken in the dashboard.

## Permissions

Each Compliance area has its own permission key, so you can grant read access to one surface without the others. The server enforces these; the dashboard hides what you can't use.

| Key | Grants |
|---|---|
| `identity:read` | View individual entities, the compliance overview, and entity detail. |
| `business_identity:read` | View business entities. |
| `screening:read` | View screening results. |
| `signals:read` | View the monitored event/signal stream. |
| `alerts:read` | View alerts. |
| `alerts:manage` | Open an investigation from selected alerts. |
| `cases:read` | View investigations (the permission key retains its compatibility name). |
| `cases:manage` | Open, assign and decide investigations; draft, file or cancel SARs. |
| `monitoring:manage` | Edit monitoring rules (reading them is always allowed). |

All investigation and SAR writes are audited server-side and appear in your organisation's audit log (**Dashboard → Audit logs**).

## Next steps

- [Identity Hub API](https://trust.myaza.co/documentation/identity-hub/markdown): sync your users as monitored entities.
- [Event monitoring](https://trust.myaza.co/documentation/monitoring-events/markdown): stream events for scoring.
- [Fraud rules](https://trust.myaza.co/documentation/monitoring-rules/markdown): configure how events are scored.
- [Screening](https://trust.myaza.co/documentation/screening/markdown): sanctions, PEP, and adverse-media checks.
- [Investigations and reporting](https://trust.myaza.co/documentation/investigations/markdown): the investigation workflow.