Financial-crime teams live inside three specific failure modes. Each one compounds the others.
A single screening threshold trades recall for precision blindly. Turn it up and you flood analysts with false positives. Turn it down and you miss real matches. The score can’t tell you the difference between a disqualified non-match and a genuinely underdetermined one — so neither can the analyst.
Three shell companies between a sanctioned individual and a customer are invisible to string-match tools. Resolving the ultimate beneficial owner requires traversing a graph — not iterating a list. Without the relationship layer, multi-hop ownership structures simply don’t exist in the system.
A customer was cleared on Tuesday. The sanctions list updated on Wednesday. Was the clearing decision still defensible? Without session pinning, re-running the query against the current graph doesn’t reproduce the original decision — and your regulator knows it.
Coherence and certainty returned as two independent axes — not collapsed into a single threshold score. Your team can distinguish a disqualified non-match (coherence fails) from a genuinely underdetermined one (certainty insufficient) and act accordingly.
Register a standing query against a customer’s resolved entity at onboarding. When the graph or the watchlists evolve, the query re-evaluates automatically and fires an alert with a full evidence payload — no re-running the workflow from scratch.
Resolve the ultimate beneficial owner through three, four, or more layers of ownership — with confidence-weighted edges at each hop. The UBO is returned with the same coherence and certainty scores as any other entity resolution.
Append-only evidence, session-pinned investigations, and a tamper-evident audit stream. Every match, no-match, hold, or release decision points back to the evidence that produced it — reproducible against the graph version pinned at decision time.
A standing query registers once at onboarding. When the graph evolves — new sanctions designations, new adverse-media mentions, new beneficial ownership filings — the query re-evaluates automatically and fires only when the evidence warrants it.
Each alert ships with the evidence payload that triggered it — not just a score, but the mentions, sources, and coherence/certainty breakdown the analyst needs to adjudicate the case.
"Continuous re-screening as the graph and the watchlists evolve — without re-running the workflow from scratch."
Customer "Nikolai Reeves" onboarded. Entity resolved to graph cluster #C-2914. Standing query #KYC-4891 registered against SDN, PEP, and adverse-media corpora.
OFAC SDN list updated — 3,847 entities added or amended. Graph advanced to v2.1.8. Standing query #KYC-4891 re-evaluated automatically against the new graph state.
Match detected: cluster #C-2914 now resolves against SDN entry at certainty 0.87. Alert #ALT-0291 fired with full evidence payload — 11 mentions across 3 sources.
Analyst reviewed the 11 mentions. Decision: ACCOUNT FROZEN pending review. Decision recorded with the full evidence basis — reproducible against graph v2.1.8.
Every structural decision in Kloom — append-only evidence, session pinning, tamper-evident audit — exists to make each adjudication reproducible and defensible. Not as a reporting feature. As a core property of the architecture.
New observations never overwrite or invalidate old ones. Every claim the system makes about an entity points to a document, passage, and confidence score — permanently.
Every adjudication is pinned to the graph version current at decision time. Re-run it six months later and you get the same result — against the same evidence basis. That is what makes it replayable to a regulator.
Stream routing is automatic, determined by the mission’s legal basis at creation time: missions tagged for regulated workloads (KYC, sanctions) write to the forensic stream, which captures full payloads suitable for regulator-facing reconstruction; general-purpose missions write to the lean operational stream. Cryptographic hash-chaining over the forensic stream is deployment-configurable for WORM-grade tamper evidence where the regulatory regime requires it.
Kloom deploys as a self-hosted service stack — API process, standing-query evaluator, webhook delivery, and reprocess worker — onto infrastructure the operator controls, alongside a PostgreSQL instance they manage. Customer data never leaves the operator’s network perimeter. Kloom integrates with the operator’s existing IdP for authentication and RBAC, and emits structured logs into their observability stack.
Phased name-matching pipeline — shortlist, cluster, assemble — with cross-script and transliteration support. Coherence and certainty on separate axes.
standalone libraryAppend-only record of every mention. Blocking evidence and resolving attributes returned in the response envelope — no second call.
Deterministic session pinning. Reproducible decisions without a snapshot copy.
Continuous reshaping as evidence arrives — no destructive merges, every split and merge recomposable.
A demo runs against representative data from your screening environment — sanctions lists, adverse-media corpora, or a sample of your KYC population — and returns resolved entities you can audit end to end.