AML/CFT Compliance Engine for Exchange Offices
ForexFox embeds a two-tier compliance firewall directly into every transaction. SYSTEM rules enforce inviolable legal limits with immediate hard blocks. STRATEGY rules handle business-level escalations with nuanced verdicts — pending approval, flag, or inform — without stopping operations unnecessarily.
Smooth alert — the transaction continues.
Hard stop before execution.
Key technical highlights
Two-tier rule architecture: SYSTEM rules (root-managed, hard_block) and STRATEGY rules (admin-managed, configurable actions).
Five verdict levels: PASS, HARD_BLOCK, PENDING, FLAG, INFORM — mapped to distinct operational responses.
Rolling-period scope: rules can track cumulative amounts over 1 to 90-day windows per client.
Trigger logic AND/OR: combine amount threshold and frequency checks in a single rule.
required_fields enforcement: contextually force KYC data collection at transaction time based on risk.
Automatic audit trail: every evaluation is written to compliance_audit_logs with full decision payload.
A two-tier rule engine built for regulated exchange environments
ForexFox separates compliance logic into two layers. SYSTEM rules are managed by root and always result in a HARD_BLOCK — no override possible. STRATEGY rules are configured by admins and produce graded verdicts: pending approval, flag for review, or inform without blocking. This architecture lets compliance teams set inviolable legal limits while preserving operational flexibility for business-level thresholds, without conflating the two in a single flat rule list.
Rolling-period tracking for cumulative risk detection
Compliance rules in ForexFox support multiple scopes: per-transaction, per-day cumulative, rolling 30-day window, and lifetime client total. Daily and monthly totals are maintained in dedicated tables (tx_daily_totals, client_lifetime_totals) updated atomically at each transaction. This lets you detect structuring patterns — repeated sub-threshold transactions — and trigger escalations based on cumulative exposure rather than individual transaction size.
Required-field enforcement linked to risk context
When a transaction triggers a rule, ForexFox can automatically surface a required_fields list to the operator interface — document type, document number, address, tax ID number — without the operator needing to remember which threshold applies. This reduces incomplete KYC records by enforcing data completeness at the moment of risk, rather than retrospectively. Fields are configured per rule, so a low-risk threshold might only request a document type, while a high-risk rule forces a full address and tax residency record.
Full audit trail for supervision and regulatory review
Every compliance evaluation writes a record to compliance_audit_logs — user, client, rule triggered, amount, daily and monthly totals at the time of evaluation, and the full decision payload. Approvals carry their own history: who submitted, who decided, the decision reason, and the timestamp. This produces an end-to-end audit trail that covers both the automated decision and any human override, ready for supervisory review or regulatory inspection.
Use cases by role
One platform, benefits tailored to each role.
Compliance Officer
Design, activate, and tune AML/CFT controls without touching the codebase.
- Build rules that trigger on per-transaction amount, daily cumulative, 30-day rolling total, or lifetime volume.
- Combine amount and frequency conditions with AND/OR trigger logic for complex scenarios.
- Force required identity fields (document type, address, tax ID) contextually when a client crosses a threshold.
- Publish rule sets by country or branch for multi-jurisdiction compliance coverage.
Branch Manager
Maintain operational throughput while preserving full escalation control.
- Configure inform and flag actions for soft monitoring without blocking the counter.
- Route pending-approval transactions to an admin queue for decision, with traceability.
- Review daily compliance statistics and approval resolution rates per branch.
- Access audit logs for every triggered rule, per client, with the exact amount and verdict.
IT / System Administrator
Manage rule sets programmatically via the unified API without downtime.
- Create, update, or delete rules through the unified-rules endpoint with atomic rule + policy creation.
- Use the /compose endpoint to create a rule set and a first rule in a single API call.
- Clean up orphaned rule sets automatically with the /cleanup endpoint.
- Query rule set stats (active rules count, policy count) for governance reporting.
Related APIs
Unified compliance rules
Full lifecycle management of AML/CFT rules with amount and frequency triggers.
Rule-set orchestration
Group rules into named sets per country or branch for controlled rollout.
Pending approval queue
Fetch and decide on transactions held in pending_approval status.
Approval decision
Approve or reject pending transactions with reason and full audit record.
Acknowledgements
Track operator acknowledgements linked to compliance events and transactions.
Talk to a ForexFox specialist
See how this solution fits your operational constraints and compliance requirements.