JUMP TO CONTENT

Wise Data Science

Scaling Fincrime Operations: Lessons in Building LLM-powered Automations at Wise


Authors: Volodymyr Panov, Data Scientist and Kristjan Erik Liive, Data Scientist

Introduction

Growth is a double-edged sword. Platform convenience and speed and other qualities that attract millions of new users, inevitably draw the attention of risky actors. At Wise, managing such risk creates a distinct operational challenge: scaling our defenses without compromising the user experience.

Every financial institution operates within a risk appetite, which dictates when and how automated systems flag suspicious activity. When a system triggers an alert, it enters a manual queue for a human review. If the volume of these alerts outpaces human capacity, an operational backlog forms. Backlogs delay legitimate false-positive transfers - hurting the customer experience - and limit organization's ability to produce additional alerts to tackle incremental risks.

To balance demand and supply loops, organizations traditionally face a choice: hire more line operations specialists or increase the efficiency of the existing team. Wise does both: the team is growing and by integrating LLMs directly into financial crime prevention workflows, we increase human throughput while maintaining strict risk tolerances.

LLMs and Financial Crime prevention

To understand where LLMs fit into a compliance operations framework, it helps to review the mechanics of modern financial crime. Consider a classic fraud scenario: a scam actor manipulates a victim to pay them £500 for non-existent concert tickets in London. The illicit funds must then be laundered through the financial system via a traditional three-stage process:

  • Placement: The criminal introduces the illicit cash or digital payments into the formal financial system.

  • Layering: The money moves rapidly through various banks, entities, and cross-borders to distance it from the original crime and obscure the crime trail.

  • Integration: The laundered funds re-enter the economy as seemingly legitimate assets, completing the cycle.

At Wise we screen every transfer, the typical operational workflow starts when a user initiates a transfer. Machine learning models score the transfer and user attributes. If an anomaly is detected, an alert creates a manual investigation case to study the suspicion. If the risk is confirmed, an external regulatory report is filed.

We integrate LLM-powered solutions into this pipeline to support various stages of case processing - from improving model-decision explainability to scanning for complex relationships and narratives in transfer histories.

 LLM Applications in Compliance Operations

 Translating Context

One of the valuable roles for LLMs in our stack is acting as a translator between complex tabular ML algorithms and human investigators. Wise utilizes a mathematical framework called SHAP to interpret machine learning model outputs. SHAP is excellent for quantifying the precise incremental influence of individual features on model score output but its outputs are strictly mathematical and produce no explicit narrative.

By feeding raw transaction features and SHAP values into an LLM, we automatically translate these complex calculations into natural, conversational language. This gives compliance agents a clear, immediate explanation of exactly why an alert was generated.

This translation capability also solves the "cold start" problem for investigators. When an operational case lands on an agent's screen, they parse through historical raw data before they can make a decision on the alert. To bypass this friction, we use LLMs to perform pre-case summarization. By combining customer profiles, raw transactional histories, and internal risk appetite guidelines, the LLM provides agents with a concise operational summary.

The system uses human feedback to measure success and optimize prompt instructions on good cases only.

Detecting Transactional Anomalies

Beyond alert summarization, LLMs are among the tools we use to actively scan account and transaction history characteristics for structural and behavioral patterns called "red flags". It is important to emphasize that a red flag is a suggestion of risk, not definitive proof. 

Examples of red flags:

  • Pass-Through Activity: Funds are routed through an intermediate account, entering and exiting in nearly identical amounts to act purely as a temporary bridge that obscures the link between the original sender and ultimate recipient.

  • High Velocity: Funds received into an account are moved out almost immediately, characterized by rapid turnover, concentrated bursts of speed, or fast multi-party transfers regardless of total volume.

  • Structuring: A single large sum is intentionally split into smaller, sequential transactions specifically designed to stay below monitoring or regulatory reporting thresholds.

When our LLM detects these red flags, it surfaces them to the human investigator, who confirms the finding or marks it as a false positive. This continuous loop generates real-time feedback that allows us to continuously optimize our underlying data structures and prompts.


Augmenting Regulatory Reporting

Once an investigator confirms suspicious activity, they face a mandatory legal obligation: filing a Suspicious Activity Report (SAR). Writing these reports is traditionally a time-consuming manual analytical task. Every SAR must comprehensively answer six core questions:

  • Who is involved? (Identifying primary targets, beneficial owners, and transacting accomplices).

  • What happened? (Detailing the exact volumes, instruments, and movement of money).

  • When did it occur? (Specifying exact operational timeframes and dates of detection).

  • Where did it take place? (Mapping customer nationalities, locations, branch sites, and bank account jurisdictions).

  • Why is it suspicious? (Articulating the specific red flags, profile deviations, and patterns of potential illegality).

  • How was it executed? (Describing the precise step-by-step mechanism, money flow, and illicit typologies used to carry out the activity).

Our automation platform ingests the investigator’s core notes alongside enriched transactional data, account details, and information national registries. The LLM synthesizes this information into a structured, regulatory-compliant SAR draft. The human investigator reviews the draft, makes adjustments, and finalizes the submission.

Engineering Realities and Practical Takeaways

Transitioning LLM-powered systems from experimental scripts to a production-grade compliance engine revealed several crucial engineering and operational lessons:

Start Simple and Avoid Over-Engineering

Data scientists, being technical enthusiasts at heart, often have an urge to implement highly complex, cutting-edge architectures right out of the gate. When we first tackled automated report writing, we built a multi-layered multi-agent system. It performed poorly, ran slowly, introduced excessive token costs, and was incredibly difficult to debug. Errors compound so we quickly learned that a simplified, well-structured LLM pipeline is far superior to an over-engineered multi-agent framework.

Human Judgment is Not a Perfect Ground Truth

While human-in-the-loop validation is vital, human judgment can introduce its own complications. When reviewing automated SAR drafts, investigators frequently make minor, stylistic changes based on personal writing style rather than only necessary factual corrections. This introduces unnecessary noise to the optimisation objective. Additionally, when regulatory compliance guidelines change, human teams require significant retraining and adjustment periods. Automated systems can adapt to new prompts or guidelines near-instantly. By tracking agent edit rates and differentiating between minor synonym adjustments and high-importance factual corrections, we keep text-generation aligned.

Prioritize a "Golden Data Set" Early

A golden data set is a human-reviewed, high-quality collection of sample cases that serves as an optimization ground truth. In financial operations, a true ground truth dataset is rarely available out of the box because historical event logs and outcomes are often incomplete or split across disparate data silos. Hand-picking cases manually is slow and rarely yields more than a few hundred samples. The most effective strategy is to gather such data directly from production by capturing the workflows of your most experienced, highly qualified teams as they complete tasks in real-time.

Fixing Gaps or Finding Rules? The Optimizer Dilemma

Model prompting serves to align a model's outcome conditional probability distribution with some business objective. These target outcomes are typically defined by a singular performance metric or qualitative rubric. Prioritizing the refinement of prompts and evaluation frameworks is the most efficient strategy for organizations to enhance performance before investing in the infrastructure required for complex fine-tuning.

Consider a standard text classification objective. While basic prompting provides a sufficient heuristic to cover most common clean-cut samples, you will inevitably reach a plateau where manual prompt iterations yield only marginal gains. This is precisely where frameworks like DSPy GEPA shine. By employing a "teacher" LLM, these systems utilize scalar metrics and qualitative business feedback to evolve prompt candidates based on the underlying “student” model's performance on a holdout set. Integrating automated optimization allows bypassing the most repetitive prompt development struggles, such as initial drafting and routine adjustments.

Conclusion & Takeaways

Deploying production-grade LLM applications within a regulated framework is a continuous development loop that requires:

  • Rigid Schema Mapping: Comprehensive planning of data inputs and outputs to reduce the risk of unexpected generations.

  • Intentional System Architecture: Design choices that prioritize specific task coverage and operational efficiency over architectural complexity.

  • Clean Ground Truth: Datasets that capture not just final but also intermittent human-reviewed labels and outcomes.

  • Statistical Validation: Rigorous performance backtesting against human-reviewed ground truth to ensure consistent statistically significant results across time.

  • Process Guardrails: Strict operational boundaries and deterministic rules that limit LLM actions to authorized, policy-compliant workflows.

Ultimately, LLM-powered applications serve as a force multiplier for operational throughput under professional oversight. By systematically automating repetitive analytical burdens, we empower human investigators to pivot toward more complex, higher-risk investigations. This synthesis of machine intelligence and human expertise is what transforms scaling challenges into a more robust, resilient, and safer global cross-border financial system.


More Data Science projects


List #1

Related blogs

Working globally, staying local: Life at Wise in Japan

Teaser

People profile

Content Type

Blog

Publish date

03/02/2026

Summary

"When you join, you’ll see your own growth mirrored by the growth of the company. You won't just be watching change happen; you’ll be a direct part of it." Ataro Shoji (He/Him) Payment

Teaser

Ataro Shoji, our Payment Operations Senior Specialist, highlights how collaborating across time zones allows us to build 'Money Without Borders' while enjoying an inclusive, mission-driven culture 🌏

Read more

by

Verona Hasani

by

Verona Hasani

Expanding in Hyderabad

Teaser

People profile

Content Type

Blog

Publish date

06/27/2025

Summary

We sat down with SK Saraogi, Head of Expansion APAC, to discuss our strategic expansion into Hyderabad, India 🇮🇳Read more to discover why Hyderabad is the perfect location for our second glo

Teaser

We sat down with SK Saraogi, Head of Expansion APAC, to discuss our strategic expansion into Hyderabad, India 🇮🇳 Read more to discover why Hyderabad is the perfect location for our second global hub in APAC, offering unique opportunities for innovation, growth, and an incredible talent pool 🚀

Read more

by

Verona Hasani

by

Verona Hasani

From Agent to Team Lead: A Journey in Fraud Prevention

Teaser

People profile

Content Type

Blog

Publish date

06/06/2025

Summary

Driven by a passion for growth and team development, discover how Anna Pavlics advanced from Agent to Team Lead in Wise's Fraud Prevention team 🚀 "We put tremendous effort into bui

Teaser

Driven by a passion for growth and team development, discover how Anna Pavlics advanced from Agent to Team Lead in Wise's Fraud Prevention team 🚀

Read more

by

Verona Hasani

by

Verona Hasani

From Support agent to leadership: A decade of growth

Teaser

People profile

Content Type

Blog

Publish date

02/18/2025

Summary

Head of Servicing Scale and Experience, Ian Rynne, discusses his journey from starting as a Customer Support agent to becoming the Head of Servicing Scale and Experience at Wise. 

Teaser

Head of Servicing Scale and Experience, Ian Rynne, discusses his journey from starting as a Customer Support agent to becoming the Head of Servicing Scale and Experience at Wise.

Read more

by

Verona Hasani

by

Verona Hasani

Life in the heart of Austin

Teaser

Our culture

Content Type

Blog

Publish date

05/15/2024

Summary

My name is Cynthia. I'm a fraud agent at Wise, based in the Austin office. We strive to prevent fraudulent activity on the Wise platform. It can be tricky, as Wise supports many diff

Teaser

We spoke to Cynthia, a fraud agent based in the Austin office, to find out more about what life is like at Wise in Austin.

Read more
Keeping Tampa Bay Beautiful

Teaser

Environment Social Governance

Content Type

Blog

Publish date

01/24/2024

Summary

Wise’s volunteer day is not just a perk; it’s a celebration of community, camaraderie, and making a difference.Meet Claire Adelman, Customer Support Training Specialist, and Javier Perdo

Teaser

Wise’s Volunteer Day is not just a perk; it’s a celebration of community, camaraderie, and making a difference. Meet Claire and Javier, both showcasing the true spirit of Wise in Tampa.

Read more
Life as a Due Diligence Agent: Delis

Teaser

People profile

Content Type

Blog

Publish date

11/24/2022

Summary

Hi! My name is Delis and I’m a Due Diligence Agent (CDD) in our Tallinn team, focusing on business verification. What this means is that I onboard high risk businesses by assessing their r

Teaser

Hi! My name is Delis and I’m a Due Diligence Agent (CDD) in our Tallinn team, focusing on business verification. What this means is that I onboard high risk businesses by assessing their risk level, investigating business activity and determining business structure.

Read more
Life as a Due Diligence Agent: Rza

Teaser

People profile

Content Type

Blog

Publish date

11/24/2022

Summary

Hi! My name is Rza Mustafayev and I’m a Due Diligence Agent in our Latin America & Middle-East and Africa Region, focusing on personal and business customers. What this means is that I:Rev

Teaser

Hi! My name is Rza Mustafayev and I’m a Due Diligence Agent in our Latin America & Middle-East and Africa Region, focusing on personal and business customers.

Read more
View all
Search

Browse Jobs