ComplyAdvantage detects the risk, Forest governs the decision

A payment goes out to an account abroad. In a fraction of a second, it's screened: the beneficiary's name, the intermediary bank's, the reference text, all checked against global sanctions lists. A name surfaces. The payment is held. And now an analyst has to decide: true positive or namesake? Block, release, escalate?

That scene plays out thousands of times a day at a fintech. Detection takes only a fraction of a second. The speed at which a decision is made depends on the queue, the available analyst, the internal rule, and the audit trail it leaves behind. That's where time is lost, and that's where the regulator looks.

How ComplyAdvantage detects risk fast enough for instant payments

ComplyAdvantage was founded in 2014 in London on a simple premise: traditional anti-money laundering and countering the financing of terrorism (AML/CFT) systems run on static data that is updated too late. More than ten years on, the company has become a leader in the sector, with more than 3,000 customers across 75 countries – Santander, Allianz, Just Eat, Nissan Financial Services, Zendesk, Aljazeera, and more.

Its business is financial crime risk intelligence. Screening customers and companies against sanctions lists, politically exposed persons (PEPs), and adverse media. Real-time payment screening, fast enough to sit inside a transaction's authorization flow at industry-leading speed. Transaction monitoring built on an extensive library of AML/CFT typologies, scaling to billions of transactions. Ongoing monitoring that re-evaluates a customer's risk profile over time. Its core argument comes down to the data: sanctions changes hit its pipeline in under a minute and are usable within hours, whereas much of the market still waits 1 to 2 days.

ComplyAdvantage doesn't stop at supplying the data: its Mesh platform adds an AI-driven automation layer that pre-reviews part of the caseload, filtering out routine false positives so analysts spend their time on the matches that matter. That automation runs where ComplyAdvantage is strongest: inside the AML and screening domain, on the alerts it generates.

Where Forest picks up: the bottleneck lives after detection

Every source describing the AML pain says the same thing: the problem was never detecting, it's handling what gets detected. Legacy screening systems generate a massive volume of alerts, the overwhelming majority of which are false positives, especially for common names, transliterations, and partial matches. Each alert demands a decision, a justification, a trace.

Risk data, however fresh, doesn't close a case on its own. It has to be routed to the right person, given the context to decide, run through the business rules that say what passes and what escalates, and all of it kept as a trail a regulator can read back. That's orchestration work, distinct from detection itself, and it's often where teams drown.

How Forest turns a ComplyAdvantage alert into one decision, one trace

That's exactly Forest's ground. When a ComplyAdvantage alert comes in, it lands in a workflow the compliance team has defined: depending on the score, the match type, and the jurisdiction, it's cleared on its own or routed to an analyst. An obvious namesake closes without pulling anyone in. A real signal escalates, with the risk profile already attached and the context already assembled, to the person responsible for deciding.

And every decision leaves a record-level trace: who saw what, who approved, on what basis, when. That's the material a regulator like France's Autorité de contrôle prudentiel et de résolution (ACPR) asks for, produced automatically by the workflow instead of being reconstructed afterward in a spreadsheet.

This is also where the line between the two layers is clear. Mesh automates decisions inside the AML and screening domain; Forest orchestrates them across the whole operation, where a ComplyAdvantage alert sits next to signals from the rest of the stack, an action has to be taken on core systems, and one audit trail has to span all of it. The two reinforce each other: Mesh clears the routine AML caseload, Forest runs the wider case around it. And when an agent handles part of that work, Mesh automation or any other, Forest governs it under the same permission model and audit log as a human analyst: a role, precise rights, a trace of every action. Humans and agents work the same flow, under the same rule, in the same log, with governance in one place.

That's the direction Forest is heading, and one we already deploy with clients through partners like ComplyAdvantage: industry-leading risk intelligence, orchestrated into processes the teams pilot themselves, under control and fully evidenced.

Why ComplyAdvantage intelligence needs Forest orchestration to hold up

ComplyAdvantage solved the speed problem: seeing risk fast, on current data, in a world of instant payments. And clearing a growing share of the manual reviews that follow. But an alert that lands in a queue no one prioritizes, or a decision made without a usable trace, weakens the protection that detection brought. The higher the detection volume, the more important alert handling becomes.

That's Forest's job: turning a stream of alerts into decisions made by the right people or the right agents, under the right rules, with what it takes to prove it. Detection says what's at risk. The infrastructure decides who rules on it, how, and keeps the memory of it.

If your analysts spend more time triaging alerts than investigating them, that's precisely the kind of process we help set right. Show us how yours run.

Forest is the operational infrastructure for regulated fintechs. Compliance, ops, and support teams work on your systems alongside your AI agents, under one permission model and one audit trail. On your own infrastructure. Learn more at forest.app.