Multi-Agent Orchestration in Stockholm, Sweden

Fintech / Financial Services

A Stockholm-based neobank (1.2M customers across Sweden, Norway, and Finland, primarily consumer lending and BNPL products, SEK 8.5B in annual transaction volume, 180 employees) faced escalating anti-financial-crime (AFC) demands as it grew across Nordic markets. The problems: (1) Transaction monitoring was generating unsustainable alert volumes. The rule-based system (a legacy vendor platform configured at founding and progressively tuned) generated 4,200+ alerts per month. The AFC team (12 analysts) could investigate 2,800 — the remaining 1,400 entered a growing backlog. Finansinspektionen had signalled concerns about the backlog during a periodic review. False positive rate: 96.8% — meaning of every 100 alerts investigated, only 3.2 were genuine suspicious activity. Each false positive investigation consumed 35-55 minutes of analyst time. (2) KYC processes were slow and inconsistent. Customer onboarding KYC: 4-7 minutes per customer (automated checks via BankID plus manual document review for enhanced due diligence cases). Ongoing KYC refresh: 2,400 customers per month required periodic review based on risk classification — the team was consistently 6+ weeks behind schedule. Cross-border KYC was particularly challenging: Norwegian customers required BankID Norge verification (different from Swedish BankID), Finnish customers required Finnish Trust Network verification, and each jurisdiction had slightly different AML requirements. (3) Suspicious Activity Reporting (SAR) was slow and resource-intensive. When a genuine suspicious activity was identified, preparing the SAR for Finanspolisen (Swedish Financial Intelligence Unit) took 4-8 hours per report. The analyst had to: compile transaction history, document the suspicious pattern, cross-reference against sanctions lists (EU, UN, OFAC), check adverse media, and draft the narrative. 156 SARs filed annually — consuming approximately 780 analyst hours. (4) Regulatory reporting was manual and error-prone. Quarterly Finansinspektionen reporting (AML statistics, risk assessments, compliance metrics) consumed 2 full analyst weeks per quarter. The neobank also reported to Norwegian Finanstilsynet and Finnish Finanssivalvonta — each with different reporting formats, timelines, and requirements.

We built a 5-agent AFC orchestration system over 12 weeks. (1) Transaction Monitoring Agent: replacing rule-based alerting with intelligent, contextual analysis. The agent: ingesting real-time transaction data across all products (consumer loans, BNPL transactions, account-to-account transfers — processing 850,000+ transactions monthly), applying ML-enhanced detection models trained on the neobank's historical true positives (3 years of investigation outcomes — 486 confirmed suspicious cases), contextualising each transaction against customer profile (BankID-verified identity, income declaration, employment status, typical transaction patterns, geographic patterns), cross-referencing against sanctions lists (EU Consolidated List, UN Security Council, OFAC SDN — with entity resolution handling Nordic name variations and transliterations), and producing risk-scored alerts with detailed rationale — each alert including the specific suspicious indicators and confidence level. Alert volume: reduced from 4,200/month to 1,100/month while maintaining detection rate (zero reduction in true positives). False positive rate: reduced from 96.8% to 82% — meaning 18% of alerts now required genuine investigation (vs. 3.2% previously). (2) Investigation Agent: automating the investigation workflow for medium and low-risk alerts. The agent: compiling comprehensive customer dossiers (transaction history, KYC data, previous alerts and outcomes, peer group comparison), conducting automated investigations for lower-risk alerts (structured analysis following the same methodology as human analysts — transaction pattern analysis, counterparty identification, source-of-funds assessment), generating investigation reports in Finanspolisen-ready format, and escalating to human analysts only alerts requiring judgment — complex typologies, politically exposed persons (PEPs), or novel suspicious patterns. Of 1,100 monthly alerts: 380 auto-resolved by the Investigation Agent (with human spot-check review), 720 escalated to human analysts with pre-compiled dossiers — reducing per-investigation time from 45 minutes to 12 minutes. (3) KYC Agent: automating customer due diligence across Nordic markets. The agent: performing automated KYC at onboarding (BankID verification for Sweden, BankID Norge for Norway, Finnish Trust Network for Finland — unified workflow despite different underlying identity providers), conducting ongoing KYC refresh (risk-based scheduling — high-risk customers annually, medium-risk every 2 years, low-risk every 5 years), monitoring for KYC trigger events (significant transaction pattern changes, adverse media mentions, sanctions list additions, PEP status changes), and generating Enhanced Due Diligence (EDD) packages for high-risk customers — pre-compiled dossiers that analysts review and approve. KYC onboarding time: reduced from 4-7 minutes to under 90 seconds for standard customers. Ongoing KYC backlog: eliminated within 6 weeks of deployment. (4) SAR Preparation Agent: automating Suspicious Activity Report generation. The agent: compiling all relevant evidence (transactions, KYC data, investigation findings, sanctions screening results, adverse media), structuring the SAR narrative per Finanspolisen requirements (specific format requirements for Swedish SARs under Lag 2017:630), cross-referencing with prior SARs filed for the same customer or connected entities, and generating draft SARs for analyst review and submission. SAR preparation time: reduced from 4-8 hours to 45 minutes (analyst review of AI-generated draft). (5) Regulatory Reporting Agent: automating compliance reporting across three Nordic regulators. The agent: aggregating AFC statistics (alert volumes, investigation outcomes, SAR counts, KYC completion rates) across all three markets, generating quarterly reports in regulator-specific formats (Finansinspektionen, Finanstilsynet, Finanssivalvonta — each with different templates, metrics definitions, and submission requirements), producing internal board reports on AFC effectiveness (trends, benchmarks, resource utilisation), and maintaining audit trails for regulatory examinations. Quarterly reporting: automated from 2 weeks to 2 days (including human review). The orchestrator coordinating agents with human gates for: SAR filing (analyst review and approval before submission to Finanspolisen), EDD decisions (analyst approval of risk classifications for high-risk customers), model performance review (monthly human review of detection model performance metrics), and regulatory report submission (compliance officer sign-off).

Alert volume: reduced from 4,200/month to 1,100/month — 73.8% reduction while maintaining full detection of genuine suspicious activity. The Investigation Agent auto-resolved 380 of those 1,100 alerts, meaning human analysts reviewed 720/month (vs. 2,800 previously investigated + 1,400 in backlog). False positive rate: reduced from 96.8% to 82% — the remaining alerts were 5.6 times more likely to be genuine. Investigation time: reduced from 45 minutes to 12 minutes per alert (pre-compiled dossiers). Total analyst hours on alert investigation: from 2,100 hours/month to 144 hours/month. KYC onboarding: under 90 seconds (from 4-7 minutes). Ongoing KYC backlog: eliminated — from 6+ weeks behind to current. SAR preparation: 45 minutes per report (from 4-8 hours). Regulatory reporting: 2 days per quarter (from 2 weeks). Finansinspektionen response: positive feedback during subsequent review — the regulator specifically noted the improved alert management, eliminated backlog, and comprehensive documentation. The AFC team (12 analysts) was not reduced — instead, analysts were redirected to: complex investigation work (the 18% of alerts that were genuinely suspicious), proactive risk assessment (typology development, emerging threat analysis), and cross-border financial crime patterns. Annual value: SEK 18.5M in operational efficiency (analyst time savings), SEK 4.2M in reduced compliance risk (backlog elimination, regulatory confidence), and improved customer experience (faster onboarding, fewer false friction points). Total: SEK 22.7M (approximately €1.95M). Development cost: SEK 3.1M (approximately €267K). Payback: under 8 weeks.