Workspace/Hawk AI
← All platforms

Hawk AI

AI-enabled AML and screening

Hawk, often listed as Hawk AI, offers AML transaction monitoring, customer risk rating, customer and payment screening, and fraud tools. Its AI overlays and agents can complement an existing control stack. That makes replacement versus augmentation a central purchasing decision.

Our assessment

Documented detection, review, and filing tools. Identity capture and merchant underwriting still need a separate design.

Best fit and limitations

A good evaluation candidate for a payments firm or bank seeking configurable AML with AI assistance. Test the overlay route if replacing the current case and reporting system is costly.

  • A screening or customer risk product is not an identity document verification product.
  • Direct FinCEN filing and goAML export are documented; confirm report formats and submission support for each jurisdiction.
  • Vendor false-positive claims require a matched local benchmark with missed-risk testing.

Tools 7

Transaction MonitoringAML detection
+
  • Rules supported by anomaly and false-positive detection
  • Monitoring logic controlled by the risk team
Source 1
Customer Risk RatingLifecycle risk assessment
+
  • Onboarding and periodic customer risk reviews
  • Event-driven reassessment through API-connected workflows
Source 2
Customer + payment screeningMatching and review
+
  • Fuzzy matching with configurable fields and weights
  • Retain prior decisions until material source changes
Source 3
AI OverlayExtend existing monitoring
+
  • Apply AI to an existing AML environment
  • Evaluate additional detection and triage without a full replacement
Source 1
SAR / CTR FilingRegulatory reporting
+
  • Prefilled reports, validation, and two-person approval
  • Direct FinCEN filing and export for goAML workflows
Source 4
Customer Screening AgentScreening investigation
+
  • Collect evidence and assess policy relevance
  • Escalate uncertain hits with reasoning and source context
Source 3
AML Investigative AgentPolicy-based AML investigation support
+
  • Collect case evidence and analyze behavior and typologies
  • Recommend next steps or run permitted routine actions
  • Update summaries and confidence as analysts add findings
Source 7

AI capabilities

Detection models + AML and screening agents

Hawk's AML Investigative Agent assembles evidence, updates summaries, and recommends or performs permitted routine steps. Customer Screening Agent separately evaluates hits under the institution's policy.

Assemble AML investigation evidenceReview screening hitsRecommend or run permitted investigation steps
What to validate

Set automated actions and human checkpoints per agent. Confirm source access, model approval, and low-confidence escalation.

Source 7

Implementation

Integration checklist
  • Define whether Hawk owns detection, screening, cases, or only AI review.
  • Map customer and payment APIs to the current system of record.
  • Run historical replay and live shadow evaluation before enabling decision actions.
Commercial scope

Quote required. Ask for separate prices for monitoring, screening, customer rating, overlays, agent use, and external data.

Questions for the demo
  1. Can the agent work on alerts from our existing platform?
  2. Which cases must escalate, and what evidence is retained?
  3. How does a list change reopen a previously cleared match?

Engineering

Hawk monitoring deliveryChecked 2026-09-18Hawk deployment optionsChecked 2026-09-18Hawk filing routeChecked 2026-09-18Customer case retrieval and incomplete dataChecked 2026-09-18AML agent connectivity and controlChecked 2026-09-18Customer screening agent boundaryChecked 2026-09-18
Your systemInputs & context
Hawk AIChecks & signals
Your controlsDecision & review
Illustrative integration boundary. Confirm the actual interfaces and decision authority.
Inputs
Transaction data through a REST JSON API or batch integration · Real-time REST/JSON or batch transaction data · GET /v2/customer-checks/{caseId} with internal UUID and api-key header · Existing case systems, institution policies, connected public data, and analyst findings · Screening hits, KYC evidence, and institution policy
Outputs
Monitoring results usable by a configured intervention flow · FinCEN submissions and goAML export files · Correlation and tenant IDs, customer risk factors, screening hits, lifecycle status, and processing status · Source-linked investigation summaries, confidence scores, and recommended steps · Cited, confidence-scored clearance or escalation rationale
Webhooks
Not verified in public documentation.
Decision timing
Real-time and batch are described. Millisecond response language is a vendor claim, not a tested SLA.
Deployment
Containerized Kubernetes architecture with multi-cloud deployment · SaaS · Private cloud · Overlay on an existing stack or integration with Hawk AML
Dependencies
Four-eyes report approval before filing · Self-service data connections through MCP servers · Institution-defined automation and human oversight · API or MCP connections and institution-approved LLMs · Configured confidence thresholds and checkpoints
Verified details 21
  • Inputs

    Transaction data through a REST JSON API or batch integration

    Source Checked 2026-09-18
  • Inputs

    Real-time REST/JSON or batch transaction data

    Source Checked 2026-09-18
  • Outputs

    Monitoring results usable by a configured intervention flow

    Source Checked 2026-09-18
  • Decision timing

    Real-time and batch are described. Millisecond response language is a vendor claim, not a tested SLA.

    Source Checked 2026-09-18
  • Deployment

    Containerized Kubernetes architecture with multi-cloud deployment

    Source Checked 2026-09-18
  • Deployment

    SaaS

    Source Checked 2026-09-18
  • Deployment

    Private cloud

    Source Checked 2026-09-18
  • Outputs

    FinCEN submissions and goAML export files

    Source Checked 2026-09-18
  • Country scope

    United States

    Source Checked 2026-09-18
  • Dependency

    Four-eyes report approval before filing

    Source Checked 2026-09-18
  • Inputs

    GET /v2/customer-checks/{caseId} with internal UUID and api-key header

    Source Checked 2026-09-18
  • Outputs

    Correlation and tenant IDs, customer risk factors, screening hits, lifecycle status, and processing status

    Source Checked 2026-09-18
  • Inputs

    Existing case systems, institution policies, connected public data, and analyst findings

    Source Checked 2026-09-18
  • Outputs

    Source-linked investigation summaries, confidence scores, and recommended steps

    Source Checked 2026-09-18
  • Deployment

    Overlay on an existing stack or integration with Hawk AML

    Source Checked 2026-09-18
  • Dependency

    Self-service data connections through MCP servers

    Source Checked 2026-09-18
  • Dependency

    Institution-defined automation and human oversight

    Source Checked 2026-09-18
  • Inputs

    Screening hits, KYC evidence, and institution policy

    Source Checked 2026-09-18
  • Outputs

    Cited, confidence-scored clearance or escalation rationale

    Source Checked 2026-09-18
  • Dependency

    API or MCP connections and institution-approved LLMs

    Source Checked 2026-09-18
  • Dependency

    Configured confidence thresholds and checkpoints

    Source Checked 2026-09-18
Illustrative contract

An example for your internal adapter. This is not a vendor endpoint, request, or response.

json
{
  "contract": "internal-risk-review/v1",
  "vendorId": "hawk-ai",
  "internalCorrelationId": "example-001",
  "vendorRecordId": null,
  "control": "AML detection",
  "evidence": [],
  "status": "pending",
  "decision": "review",
  "requiresHumanReview": true
}
Integration limits
  • Illustrative internal integration contract. This is not a vendor request, response, endpoint, or SDK example.
  • Empty country, deployment, or provider lists mean not verified in this review. A documented country refers to the specific product noted in its source, not universal platform coverage.
  • The public architecture describes Kubernetes and Kafka. Authentication, field schemas, retry semantics, and webhooks need the product-specific integration documentation.
  • Regional deployment support depends on the selected cloud and contract; no country matrix is supplied here.
  • The United States entry refers only to the named FinCEN filing route. It is not a complete country-availability list for Hawk.
  • 200 means all data sources are available; 206 can omit unavailable-source fields. Also handle 401, 404, and 429. A partial response is not a clear screening result.
  • The page describes stateless, zero-retention architecture; confirm which data and service components that statement covers.
  • The page describes processing within the customer's VPC/tenant. It does not publish region or model-provider choices.

Sources 7

Hawk product portfoliohawk.ai2026-09-18 · Reviewed
Product
Customer risk ratinghawk.ai2026-09-18 · Reviewed
Product
Customer Screening Agenthawk.ai2026-09-18 · Reviewed
Product
SAR and CTR filing controlshawk.ai2026-09-18 · Reviewed
Product
Customer case API contractdocs.hawk.ai2026-09-18 · Reviewed
Documentation
Hawk platform integration architecturehawk.ai2026-09-18 · Reviewed
Product
AML Investigative Agenthawk.ai2026-09-18 · Reviewed
Product

Source review dates are shown above. Product claims come from public sources. Fit, limits, and evaluation questions are our analysis. This is not a hands-on performance test. Methodology · Changelog