Unit21
Fraud and AML operating platform
Unit21 now presents a wider financial crime platform than a simple no-code monitoring tool. Its documented portfolio includes AML and real-time monitoring, sanctions and payment screening, customer risk, case management, regulatory filing, consortium data, device intelligence, and AI agents.
Our assessment
Much broader than legacy monitoring-only positioning. Still validate identity verification and merchant underwriting separately.
Best fit and limitations
A useful shortlist candidate for fintechs, payment firms, and institutions that want risk teams to control monitoring and case workflows. Test whether the broader suite can reduce operational handoffs.
- Published breadth does not establish which features are included or generally available in your contract.
- Regulatory filing support needs a jurisdiction-by-jurisdiction submission test.
- No reviewed evidence establishes complete document IDV, business registry verification, or merchant credit underwriting.
Tools 8
AML + real-time monitoringDetection+
- Rules and AI detection over transaction and entity data
- Historical backtesting and live shadow evaluation
Graph-based rulesConnected risk+
- Find linked entities using shared attributes
- Investigate networks and potential money mules
Sanctions + payment screeningScreening+
- Configurable matching and risk review
- Payment-party screening before settlement
Case management + customer riskInvestigator workspace+
- Alert-to-case workflows with evidence
- Dynamic risk profiles informed by behavior
Regulatory filing + AI agentsReporting and review+
- Assist case review and narrative preparation
- Portfolio lists SAR, STR, CTR, 314(a), and goAML support
Rule Writer AgentReviewed rule generation+
- Map a natural-language request to the tenant's rule schema
- Ask for missing thresholds or populations
- Return editable logic, variables, and an explanation before publication
Rule RecommendationsEvidence-based rule tuning+
- Use Insights Agent to review labeled alert context
- Use Optimization Agent to propose and backtest a rule change
- Keep publication with the human reviewer
Unit21 MCPPermission-scoped AI retrieval+
- Search documentation and retrieve permitted organization context
- Run accessible reporting dashboards after admin enablement
AI capabilities
Investigation agents + reviewed detection assistance
Unit21 combines evidence collection and narrative drafts with rule generation and backtested tuning proposals. MCP separately provides permitted read access. Analysts approve filings and rule publication.
What to validate
Human approval before filing or publishing rules. MCP needs organization enablement and the user's read permissions.
Implementation
Integration checklist
- Supply clean entity, transaction, device, and outcome data with stable keys.
- Backtest existing rules and compare alert-to-case behavior before migration.
- Validate webhook actions, idempotency, access roles, and full case exports.
Commercial scope
Quote required. Separate event volume, monitoring, screening data, cases, filings, consortium, device intelligence, and agents.
Questions for the demo
- Which agent actions are automatic, and which require approval?
- Can graph-based detection find a known mule ring in our test data?
- Show a complete report from source events through submission acknowledgment.
Engineering
- Inputs
- Transaction and entity data · Entities representing users/businesses; transaction and action events; optional instruments · Mapped source records in the sandbox · Entity/transaction rules with mapped dispositions; at least five true and five false positives · Event submitted to RTR Evaluate and configured ordered rule nodes
- Outputs
- Malta STR and Netherlands UTR export files · Role-permitted MCP retrieval and dashboards · Validated goAML exports for Malta STR and Netherlands UTR · Monitoring alerts and backtest results · Data available for monitoring and rule logic · Activated production environment and production API key · Proposed changes and backtests on up to 100 true and 100 false positives from 365 days · One Flow decision: Allow, Deny, or Step-Up Authentication
- Webhooks
- Alert and case payload fields are customizable. This announcement does not state signing or replay guarantees.
- Decision timing
- New recommendations can take up to one hour, depending on volume.
- Deployment
- Deployment options not verified.
- Dependencies
- Organization enablement and agent read permission for remote MCP · Country scope applies only to the named export formats; the customer submits the file · MCP needs org-admin enablement plus user read access; revocation removes access · Send entity updates when records change · Send authorization, reversal, and status-change events separately even when they relate to one transaction · Business review of stored fields, dashboard visibility, and rule inputs · Unit21 implementation activation before switching the data pipeline · Human review, validation, and shadow tests before publishing · Real-Time Rules entitlement and configured Flow
Verified details 26
- Outputs
Malta STR and Netherlands UTR export files
Source Checked 2026-09-18 - Outputs
Role-permitted MCP retrieval and dashboards
Source Checked 2026-09-18 - Outputs
Validated goAML exports for Malta STR and Netherlands UTR
Source Checked 2026-09-18 - Webhooks
Alert and case payload fields are customizable. This announcement does not state signing or replay guarantees.
Source Checked 2026-09-18 - Country scope
Malta
Source Checked 2026-09-18 - Country scope
Netherlands
Source Checked 2026-09-18 - Dependency
Organization enablement and agent read permission for remote MCP
Source Checked 2026-09-18 - Dependency
Country scope applies only to the named export formats; the customer submits the file
Source Checked 2026-09-18 - Dependency
MCP needs org-admin enablement plus user read access; revocation removes access
Source Checked 2026-09-18 - Inputs
Transaction and entity data
Source Checked 2026-09-17 - Outputs
Monitoring alerts and backtest results
Source Checked 2026-09-17 - Inputs
Entities representing users/businesses; transaction and action events; optional instruments
Source Checked 2026-09-18 - Outputs
Data available for monitoring and rule logic
Source Checked 2026-09-18 - Dependency
Send entity updates when records change
Source Checked 2026-09-18 - Dependency
Send authorization, reversal, and status-change events separately even when they relate to one transaction
Source Checked 2026-09-18 - Inputs
Mapped source records in the sandbox
Source Checked 2026-09-18 - Outputs
Activated production environment and production API key
Source Checked 2026-09-18 - Dependency
Business review of stored fields, dashboard visibility, and rule inputs
Source Checked 2026-09-18 - Dependency
Unit21 implementation activation before switching the data pipeline
Source Checked 2026-09-18 - Inputs
Entity/transaction rules with mapped dispositions; at least five true and five false positives
Source Checked 2026-09-18 - Outputs
Proposed changes and backtests on up to 100 true and 100 false positives from 365 days
Source Checked 2026-09-18 - Decision timing
New recommendations can take up to one hour, depending on volume.
Source Checked 2026-09-18 - Dependency
Human review, validation, and shadow tests before publishing
Source Checked 2026-09-18 - Inputs
Event submitted to RTR Evaluate and configured ordered rule nodes
Source Checked 2026-09-18 - Outputs
One Flow decision: Allow, Deny, or Step-Up Authentication
Source Checked 2026-09-18 - Dependency
Real-Time Rules entitlement and configured Flow
Source Checked 2026-09-18
Illustrative contract
An example for your internal adapter. This is not a vendor endpoint, request, or response.
{
"contract": "internal-risk-review/v1",
"vendorId": "unit21",
"internalCorrelationId": "example-001",
"vendorRecordId": null,
"control": "Detection",
"evidence": [],
"status": "pending",
"decision": "review",
"requiresHumanReview": true
}Integration limits
- Illustrative internal integration contract. This is not a vendor request, response, endpoint, or SDK example.
- Empty country, deployment, or provider lists mean not verified in this review. A documented country refers to the specific product noted in its source, not universal platform coverage.
- The public docs URL redirected to a login service during this review. No protected API payload, authentication, webhook, or deployment specification was inferred.
- Malta FIAU and Netherlands FIU-Nederland paths are export-only: the customer submits the files. Remote MCP follows existing user roles. This September 8 update predates the September 16 Rule Writer release; use the later source for current availability.
- CTR failure email notifications cover rejects, warnings, and submission failures.
- These are baseline product-level data categories, not verified API field names.
- This public support guide is dated July 2022; confirm the current field schema during implementation.
- Sandbox schema agreement is a separate step from production credential setup.
- Instrument/action rules are roadmap scope. Published performance applies to the sampled history.
- An application must connect the returned decision to its own enforcement path.
Sources 10
Source review dates are shown above. Product claims come from public sources. Fit, limits, and evaluation questions are our analysis. This is not a hands-on performance test. Methodology · Changelog