Financial Crime
Fraud and AML rules that catch more fraud and stop fewer good customers
For the Head of Fraud or MLRO at a UK payment firm, bank, or fintech. Since the Payment Systems Regulator (PSR) made reimbursement of authorised push payment (APP) scams mandatory, firms bear the cost of the fraud they fail to stop, and every genuine customer a rule turns away is a cost as well. We work both ends: designing and tuning the rules so they catch more and block less, then reviewing them rule by rule, with a written record of exactly where your rules stand across all four financial-crime domains. When the FCA asks whether the rules are adequate and defensible, the answer is already written down. The first step is five rules in one week for £2,500 + VAT.
Written and tuned by practitioners who have done this work inside banks and payment firms.
Rule scorecard
ScoringDocumented rationale
Why the rule exists
Tested
Back-tested pre-deploy
Monitored
FPR / hit-rate tracked
Owned
Accountable individual
Change-controlled
Changes reviewed, recorded
Mapped to obligation
PSR / SYSC / MLR 2017
A rule passes only when every dimension is evidenced. Missing evidence is reported as “cannot attest” — never as a pass.
The shift
Fraud is now a P&L line
Mandatory APP reimbursement turned fraud losses into a direct cost the business carries — and a question the board and the regulator now ask about the controls.
The gap
Nobody owns the full picture
Compliance sees the law, the fraud team sees the rules, data sees the gaps — and no single document connects the three. When a rule is challenged, there is no single place to show why it exists and that it works.
The standard
Same rule, same verdict
Score the same rule twice and the verdict is the same both times, with the same reasoning written down. A reviewer wants a consistent answer with the working behind it, not a persuasive one.
How a rule is judged
Six dimensions decide whether a rule is defensible
We score every rule the way a reviewer would. A rule passes only when each dimension is positively shown. Where the record is missing, we report it as “cannot attest” — never as a pass. A missing record is not the same as a safe rule.
01
Documented rationale
Is there a written, approved reason this rule exists: the typology it targets, and the basis for its thresholds?
02
Tested
Was the rule back-tested against confirmed fraud before deployment, and is that evidence retained?
03
Monitored
Is performance tracked closely enough to show the rule still works? Hit rate, false-positive rate, alert volume.
04
Owned
Is there a named, accountable individual responsible for the rule and its outcomes?
05
Change-controlled
Are changes to the rule reviewed, impact-assessed, and recorded?
06
Mapped to obligation
Does the rule trace to the regulation it implements: PSR reimbursement, the Money Laundering Regulations (MLRs), and the financial-crime expectations of SYSC, the FCA’s systems and controls sourcebook?
Coverage across all your rules
All four financial-crime domains, one connected picture
Fraud does not stay in one domain, and neither should the review. We check your rules against recognised UK typologies in every domain, so the verdict covers the whole rule set and not one corner of it.
APP scams
Authorised push payment fraud: purchase, investment, romance, impersonation, CEO and invoice, advance-fee, and mule-receiving patterns.
AML transaction monitoring
Placement, layering, structuring, rapid movement, and the typologies behind suspicious-activity detection.
Card fraud
Card-not-present (CNP) fraud, account takeover, card testing, and the card-present vectors firms must cover.
Application & mule fraud
Synthetic and stolen-identity applications, first-party fraud, and money-mule account behaviour.
What the engagement delivers
A diagnosis to act on, and a record that stands up
The diagnosis names every gap. Closing the gaps is a build we also do. A rule we built is then reviewed by your second line or a third party, not by us. Either way, you get a clear statement of where your rules stand and the record behind it.
Rule scorecard
Every rule scored on six dimensions, with one clear verdict per rule, from fully documented to cannot attest, and the gaps in between named.
Coverage map
Every rule checked against the recognised UK fraud typologies in all four domains, so what is not being caught is named, one by one.
Estimated false-positive reduction
Where aggregate alert figures are shared (not transaction data), an estimate of the false positives and analyst hours a tuning pass could remove.
Regulator-ready documentation pack
A frozen, dated record mapping each rule to the obligation it implements, written so it can go in front of a reviewer without further work — that is what regulator-ready means here. Whether a finding is accepted is for the FCA, the Financial Ombudsman, or a court. The document to reach for the moment someone says prove it.
How engagements are priced
Start small, on a fixed price you can approve yourself
Most firms start with the snapshot. It is deliberately scoped to be approvable by the person who feels the problem — no data, no system access, and a fixed fee small enough to approve without a procurement exercise.
Start here
Rule review snapshot
£2,500+ VAT, fixed
- Five rules, scored across the six dimensions
- One week, from brief to written verdict
- Named gaps and the exposure they create
- No production data, no system access
Then
Full rule-set diagnosis
Scoped on the rule count
- Every rule scored, one by one
- Coverage mapped across recognised UK typologies
- Estimated false-positive reduction
- The full documentation pack
Ongoing
Retained review
Monthly or quarterly
- Rule review on a set cycle
- Typology and obligation updates
- Record and change-control refresh
- Support when a rule is challenged
- Rules we built are reviewed by your second line or a third party, not by us
The returns that report it
The same alerts are counted twice, and the two counts should agree
The annual financial crime return under SUP 16.23 and the APP scams performance data the PSR publishes are built from the numbers your detection rules produce. We build those returns reconciled to the monitoring and case systems, reproducible months later, and with “not recorded” kept apart from “recorded as none”. How the returns are built.
No production data
A review with no security project in front of it
The diagnosis works from structured descriptions of the rules and, optionally, aggregate performance counts — alerts, hits, false positives. No transaction data, no customer data, no live system access. That keeps it outside the need for a data protection impact assessment (DPIA), so the answer arrives quickly. Any estimate is computed on the figures provided and labelled as such — it is an advisory diagnostic, not an independent audit of a live system.
Start with the free check
See where your rules stand in 60 seconds — no data, no sign-up
The free check gives a headline score across your rules, or a verdict on one rule. The full rule-by-rule diagnosis and the documentation pack come as one engagement. Every enquiry is treated in confidence.