Rules raise alerts
Fast in-and-out money, many new senders, cash split under Rs 1M, dormant accounts waking up, income mismatch, shared devices.
R1R2R3R4R5R6NET
AI analyst for financial crime teams · Sri Lanka
Catch the mule network.
File the STR.
MuleTrace is an AI analyst for compliance teams at digital-first banks, finance companies and payment apps. It sorts your alerts, follows scam money across accounts and drafts the suspicious transaction report, with every sentence cited.
Sign in with any Google account, or use the demo without one. Synthetic data only.
The problem
Scam money moves in minutes.Small teams can’t keep up.
Scammers recruit people with “easy income” offers to rent out their bank accounts. Victims’ money lands in those accounts, splits across others and is withdrawn before anyone looks.
Fast
Instant transfers move money through several rented accounts before a daily alert review even starts.
Thin teams
Digital banks and finance companies often run compliance with a handful of people facing hundreds of alerts a week.
Paperwork
Every real case still needs a suspicious transaction report for the FIU, written by hand from scattered records.
What is a money mule? A money mule is a person whose bank account is used to receive and pass on stolen or scam money, often for a small fee. Mule accounts hide where the money came from and make it hard to recover.
The analyst’s day
Five screens.One decision at a time.
Everything an analyst needs to go from alert to approved report, in the order they need it.
01
Start the day with the cases that matter.
Rules raise the alerts. Gemini reads each case overnight and sorts the queue into likely suspicious, needs a look and likely false positive, with a one-line reason for each.
Alert queue sorted overnight
12of 300 alerts need you today (illustrative)
ACC-408179 new senders in 2 hours; 94% moved out within 30 minutes.LikelyACC-40822Same device as ACC-40817. Pays the same cash-out account.LikelyACC-31205Cash deposits of Rs 950k–990k, just under Rs 1M.LookACC-18733Wedding gifts from long-standing family accounts.Likely FPSynthetic demo data. No real customers.
02
One page per customer, every claim linked.
Profile and timeline on the left, the AI assessment in the middle, the rules that fired on the right. Every statement links to the transactions behind it. Dismiss needs a reason.
Case ACC-40817 Likely suspicious
- Occupation
- Student
- Declared income
- Rs 25,000 / month
- Account age
- 41 days
- Devices
- 2 (1 shared)
AI assessment
Nine first-time senders paid the account within two hours TXN-20931TXN-20947. Most of the money left within 30 minutes TXN-20952.
- R1Rapid pass-through: 94% out in 30 min
- R29 new senders in 24 h
- R6Device DEV-118 shared with ACC-40822
Draft STREscalateDismiss
Synthetic demo data. No real customers.
03
See the ring, not just the account.
A graph two hops out from the subject shows who paid in, where the money went and which accounts share a device. Linked accounts can be pulled into the case with one click.
Follow the money 2 hops
Confirmed mule at another institutionThe aggregator matched a hashed ID in the shared network.
Synthetic demo data. No real customers.
04
A report in the FIU structure, every sentence cited.
Gemini drafts subject details, transactions, grounds for suspicion and action taken. Code checks every citation and removes any sentence it cannot verify. The analyst edits and approves.
STR draft · Grounds for suspicion v2 · draft
Between 09:12 and 11:05 the account received nine transfers from nine first-time senders, totalling Rs 840,000 TXN-20931TXN-20947.
Within 30 minutes, 94% of these funds were sent on to four accounts, one of which shares a device with the subject TXN-20952DEV-118.
Dropped by citation check: The customer is known to be part of an organised gang. (no source)
ApproveEditExport PDF
Synthetic demo data. No real customers.
05
Who suggested what, and who decided.
Every AI suggestion, analyst decision and report edit is recorded with a time and a name. Approved reports are locked; a change creates a new version.
Audit log append-only
- Gemini triaged ACC-40817 as likely suspicious
- Analyst escalated the case
- Gemini drafted STR v1; 1 sentence dropped
- Analyst edited Grounds for suspicion (v2)
- Analyst approved STR v2; PDF stored
Synthetic demo data. No real customers.
How it works
Rules find it.Gemini explains it. You decide.
Clear, testable rules raise the alerts. Gemini does the reading and writing. The analyst makes every call.
Deterministic
Gemini triages
Each case gets a risk level, a likely scam type and a short cited reason, before the analyst arrives.
ACC-40817Job-scam muleLikelyACC-18733Wedding giftsFPFollow the money
A graph shows where the money came from, where it went and who else is in the ring.
Follow the money 2 hops
Cited STR
Gemini drafts the report in the FIU’s structure. Every sentence cites a record. The analyst approves.
Nine first-time senders paid in Rs 840,000 TXN-20931.
The shared network
A mule ring doesn’t stayinside one bank.
A victim pays an account at one bank, the money hops to a finance company and leaves through a third. Each institution sees only its own slice.
- Shared signals, not shared dataMembers would share one-way hashes of confirmed mules’ ID, phone, device and account numbers. Raw customer data stays inside each institution.
- Earlier warningWhen your customer pays an account confirmed as a mule elsewhere, the case jumps to the top of the queue with a clear badge.
VictimMule accountConfirmed mule elsewhere
6plain, testable rules plus one network check
4STR sections, drafted in the FIU structure
5screens from alert to approved report
0reports filed by the AI. A person approves every one
Built for regulators
The AI drafts.A person decides.
MuleTrace is designed so you can show an examiner exactly what the AI did, what your analyst did and why.
Human approval on everything
MuleTrace never dismisses a case or files a report on its own. The analyst approves every decision and every STR.
Every sentence cited
A sentence without a valid source is removed and listed.
Full audit log
AI suggestions, decisions and edits, with who and when.
Locked reports
Approved STRs can’t be changed; edits create a new version.
Data residency plan
Production is designed to run Gemma in-country or on your own servers.
Fails safe
If the AI is unavailable, cases fall back to a rules-only priority, clearly labelled. Nothing blocks the analyst.
Built on Google
Gemini for the reading.Google Cloud for the rest.
MuleTrace runs on Google Cloud in the Mumbai region (asia-south1), with Gemini 2.5 Flash on Vertex AI.
- GGemini 2.5 Flash triage, Q&A, STR drafts
- VVertex AI model hosting
- RCloud Run API
- JCloud Run Jobs overnight triage
- SCloud Scheduler 02:00 Colombo
- FFirestore decisions & audit
- CCloud Storage approved STR PDFs
- HFirebase Hosting web app
- AFirebase Authentication Google sign-in
- BCloud Build images
- LCloud Logging structured logs
- gGemma in-country option
FAQ
Commonquestions.
Last updated 13 October 2026
What is MuleTrace?
MuleTrace is an AI analyst for compliance teams at Sri Lanka's digital-first banks, finance companies and payment apps. It sorts alerts, follows scam money across accounts and drafts the suspicious transaction report (STR) for the Financial Intelligence Unit. A person approves every decision.
Who is MuleTrace for?
Small financial crime and compliance teams, typically two to five people, who handle hundreds of alerts a week without the investigation tools a large bank has. It is designed as an add-on that takes alerts from the monitoring you already run.
Does the AI file reports or close cases on its own?
No. MuleTrace never files an STR or dismisses a case by itself. Gemini drafts and suggests; the analyst edits, decides and approves, and every step is written to the audit log.
How do I know the STR draft is accurate?
Every sentence in a draft must cite the transaction, device or record it is based on. Code checks each citation against the case evidence and removes any sentence with a missing or unknown source, then lists what it removed so the analyst can see it.
Is MuleTrace live with real customer data?
Not yet. MuleTrace is a working prototype that runs on synthetic data for three fictional institutions. We are now looking for pilot partners in Sri Lanka.
Which Google technology does it use?
Gemini 2.5 Flash on Vertex AI for triage, the case assistant and STR drafts, with Cloud Run, Firestore, Cloud Storage, Firebase Hosting and Firebase Authentication. For production, the same prompts are designed to run on Gemma inside the institution's own environment.
Run a piloton your own alerts.
We are looking for a small number of Sri Lankan institutions to try MuleTrace on their own historical alerts. Tell us about your team and we will set up a walkthrough.