Security, data and compliance in AML & SAR Automation Hub

How AML & SAR Automation Hub protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person can see and do follows their role; approving a SAR is separate from drafting one.

Restricted SAR information

Access to SARs and the fact that one was filed is limited to the roles you choose, supporting SAR confidentiality.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, change, decision and export is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• Bank Secrecy Act (31 U.S.C. 5311 et seq.)
• FinCEN SAR rules (31 CFR 1020.320 for banks)
• FinCEN Customer Due Diligence Rule (31 CFR 1010.230)
• FFIEC BSA/AML Examination Manual
• USA PATRIOT Act Section 314 information sharing
• Interagency Guidance on Model Risk Management (SR 11-7)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for institutions outside the US.
• Dedicated environment: A single-tenant environment for institutions whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for scenario tuning support and platform administration.

Limitations

• The Hub does not file reports itself. A person at your institution reviews, approves and submits each SAR through BSA E-Filing.
• Detection depends on the completeness and quality of the transaction and customer data you provide. Scenarios and thresholds are tuned to your data during implementation and should be reviewed periodically.
• It is not a sanctions screening engine. It uses results from the screening system you already have.
• It is designed for US Bank Secrecy Act requirements and FinCEN reporting. Suspicious-activity reporting in other countries is not included.
• It does not file Currency Transaction Reports or other BSA reports besides SARs.
• It does not perform customer onboarding or identity verification; it uses the due-diligence data your onboarding process produces.
• Scenario thresholds and model changes are your institution's decisions; the Hub records and tests them but does not approve them.
• Real-time blocking of payments is not included; monitoring works on transactions after they are recorded.