Glossary

Adverse media. News or public records linking someone to crime. Screened alongside sanctions and PEP lists.

Agent. A shop or person who turns cash into mobile money and back (cash-in, cash-out). A common exit point for launderers.

Air-gapped. An install with no internet connection. Updates and usage move as signed files.

Alert. A flag raised when rules fire on an event. Needs a person to look at it. Sentinel groups a customer's alerts while one is open.

AML / CFT. Anti-money laundering and countering the financing of terrorism. The whole discipline.

API, API key. The API is how software talks to Sentinel. A key is the password a service or person uses. Keys start with snt_live_, belong to one organisation, and are shown once. Scopes and test keys are planned.

Audit log. A permanent record of every action. Hash-chained means each entry includes a fingerprint of the one before, so editing or deleting history is detectable.

Backtest. Running a rule against past data to see what it would have flagged.

Case. One investigation, grouping related alerts, evidence, notes and an outcome.

CDD / EDD. Customer due diligence, the standard checks, and enhanced due diligence, the extra checks for higher-risk customers such as PEPs.

Connector. A ready-made link that pulls events from a rail or data from a provider.

CTR. Cash Transaction Report. Filed for cash transactions over a set amount, whether suspicious or not.

Decision. Sentinel's answer for an event: allow, review or block.

Disposition. How an alert ends: false_positive, escalated or reported. One person proposes it and a second approves.

Entity. Anything Sentinel tracks: a person, business, wallet, account, card, device or agent.

Entity graph, network graph. The map of how entities are connected.

Event. Something that happened: a transfer, card payment, cash-out, login or profile change.

Evidence pack. A signed PDF showing that the AML programme works, for regulators, auditors and partners.

False positive. An alert that turns out to be innocent.

Fan-in, fan-out. Many senders into one account, or one account sending to many. Typical of mules.

FIU. Financial Intelligence Unit. The government agency that receives STRs and CTRs.

Four-eyes. Two different people must agree before a serious action: closing an alert, activating a rule, and later closing a case or filing a report.

Freeze. Blocking outgoing money from an account while it's investigated.

goAML. Software from the UN that many FIUs use to receive reports. Sentinel produces reports in its format.

Idempotency key. A unique ID per transaction, so retries are never counted twice.

Install. One running copy of Sentinel on your infrastructure.

KYC. Know Your Customer: collecting and checking who a customer is.

Layering. Moving money around to hide where it came from. The middle stage of laundering, after placement (getting dirty money in) and before integration (spending it as if clean).

Licence, tier. What you've paid for: a monthly transaction limit and a set of modules, in a signed file.

MLRO. Money Laundering Reporting Officer. The person legally responsible for the AML programme and for filing reports.

Mule. Someone whose account is used to receive and pass on dirty money, sometimes without knowing.

Narrative. The written explanation in a case or STR of what happened and why it's suspicious.

On-prem. Running on your own servers.

p99 latency. How fast decisions are for 99% of events. "p99 under 300 ms" means 99 in 100 answers arrive within 0.3 seconds.

PEP. Politically exposed person: senior officials and their close family and associates.

Precision. The share of a rule's alerts that turn out to be real.

Rail. A network money moves on: mobile money, cards, bank transfers, instant payments, stablecoins.

Risk score. A number from 0 to 100, adding up the weights of the rules that fired.

Round-tripping. Moving money out and back in, for example wallet to bank to wallet, to blur the trail.

Rule, typology, typology pack. A rule is a condition plus a weight. A typology is the real-world pattern it targets. A pack is a maintained set of rules.

Sandbox. A practice environment with synthetic data. Nothing real happens there. Somu Labs doesn't host one yet; run Sentinel locally instead.

Sanctions. Government bans on dealing with certain people, companies or countries.

Screening. Checking names against sanctions, PEP and adverse media lists.

Shadow mode. A rule or connector runs and scores live, but doesn't affect decisions yet.

SIM swap. A fraudster takes over someone's phone number to get into their wallet, then drains it.

STR. Suspicious Transaction Report, filed with the FIU when activity is suspicious. Some countries call it a SAR.

Structuring. Splitting money into amounts just under a reporting threshold to avoid a report.

Tipping off. Telling someone they're being investigated or reported. Illegal in most countries.

Webhook. An automatic message Sentinel sends to another system when something happens.