AML & financial crime
Forest is the orchestration layer above your AML detection engines. Unify alerts, triage false positives, investigate cases, and prepare SAR filings in one workflow your team owns.
Forest is where your team and your AI agents own the AML lifecycle. Detection engines feed the inbox. Investigation builds the case. Reporting closes the loop. The trail your regulator expects is part of the work, not a quarterly export.
One inbox, every alert source
Transaction monitoring hits, sanctions matches, adverse media flags aggregate into one queue on Forest. Your team stops logging into five tools to see what needs attention.
AI agents triage the noise
Forest runs AI agents (Kolar and your own) that pre-process alerts and resolve homonym false positives. Analysts spend their time on real risk, with human-in-the-loop where regulation requires.
Investigation, end-to-end
Linked transactions, network view, EDD documentation, evidence collection on one case. Every step logged and timestamped for the regulator.
SAR filing as a workflow
Forest assembles the suspicious activity report from the case file and routes it to Tracfin via ERMES, with tipping-off controls regulation requires.
Human-in-the-loop on high-risk AI actions
AI proposes, your MLRO decides. On Forest, every AI agent action runs with human-in-the-loop approval, under the same RBAC and audit trail as your humans.
5-year evidence chain, retained
Every alert, decision, and SAR logged with the full causal chain inside your own infrastructure, for the 5-year retention regulators expect. One-click filtered export when ACPR asks.

Why Forest
Every alert, one queue
Forest brings transaction monitoring, sanctions, and adverse-media alerts into one inbox. Your team stops switching between detection tools, and nothing falls through the cracks.
Analysts work real risk, not noise
Forest runs AI pre-processing to clear homonym false positives before they reach an analyst, under human-in-the-loop governance. Your team spends its hours on real risk.
Every decision stands up to the ACPR
Every alert, decision, and SAR logs with the full causal chain inside your own infrastructure, retained for 5 years. The audit is a filtered export, not a fire drill.
Vendor agnostic
Frequently asked questions
You still have question ?
Book a conversation with a forest expert
What is an AML workflow on Forest?
An AML workflow is the end-to-end process your team runs from detection to filing: alert intake, triage, case investigation, EDD, MLRO decision, SAR preparation, regulatory submission, retention. On Forest, every step is a configurable task and every action logs to the case.
How is Forest different from ComplyAdvantage, Sardine, or Hawk AI?
Forest does not detect, your engines do. Forest is the operational layer above them: alert aggregation, AI triage, case investigation, SAR filing, audit trail. Most customers keep their detection engines and use Forest to orchestrate the work that follows.
How do I file a SAR through Forest?
Your MLRO approves the case in Forest. Forest assembles the suspicious activity report from the case file, routes it to Tracfin through ERMES, and applies the tipping-off controls regulation requires. The full filing chain is logged for the 5-year retention regulators expect.
How does Forest support AI governance in AML?
AI proposes, your MLRO decides. On Forest, AI agent actions run under human-in-the-loop approval where your policies require it. Every reasoning step, every decision, every override is logged in the same audit trail as your humans. Forest gives you the evidence layer; your legal counsel maps that evidence to the obligations your jurisdiction puts on AI use in AML.
How does Forest meet AMLR and DORA retention requirements?
Forest logs every alert, decision, and SAR with the full causal chain inside your own infrastructure for the 5-year retention regulators expect. DORA operational-resilience evidence comes from the same trail. Filtered exports run in one click.
How do you ensure customer data never leaves our environment?
The Forest backend runs inside your infrastructure, alongside your databases. Customer and transaction data travels to a detection engine only at the point where its service is called, and the response logs back to the case. Data stays in your systems of record.
Can I run Forest above multiple TM engines at once?
Yes. Forest aggregates alerts across engines (Sardine for one rail, Hawk AI for another, an in-house model for a third) into one queue, with the source tagged on each case. Add or swap an engine as a configuration change.

