Live transaction stream
Fraud alerts · today
Regulator clock · Zambia
Module health
- ✓DataVaultOPERATIONAL · 128TB · 99.99%
- ✓FraudShield + GraphOPERATIONAL · 487ms · 3.2M scored
- ✓AML MonitorOPERATIONAL · 10 scenarios · FIC XML
- ✓CreditAIOPERATIONAL · 487K thin-file scored
- ✓eKYC GatewayOPERATIONAL · NRC OCR · 99.5% deepfake reject
- !TreasuryProDEGRADED · overnight batch retry
Recent AI Assistant queries · across teams
Good morning. I have read-access to your DataVault (1,247,582 customers · 3,184,923 txns this month), FraudShield graph, AML Monitor scenarios, and CreditAI models. Ask me anything — in English, Bemba, Nyanja or Tonga.
Try one of these to start:
● CRITICAL PATTERN Structuring ring · 3 linked accounts · K847,500 exposure
CUST007 Patrick Kunda + 2 linked accounts executed coordinated sub-threshold withdrawals across Lusaka agents on 2024-11-24. Graph score: 0.89 · Ring size: 5 entities · Includes 1 unregistered SIM.
| Txn | Customer | Amount | Channel / Merchant | Time | Risk | AML Flags |
|---|
Ring detection
Signals
SIM-Swap Takeovers
Duplicate SIM issued by MNO → wallet PIN reset → account drained within hours. Correlation with MTN, Airtel, Zamtel swap events.
Agent Collusion
Unusual float flows between mobile money agents. Wash transactions, coordinated cash-in/cash-out, float inflation patterns.
Unregistered-SIM Conduit
Transactions routing through SIMs flagged unregistered by ZICTA. One in five active SIMs in Zambia is unregistered — this is the laundering rail.
Deepfake Onboarding
GAN-generated faces and video-replay attacks rejected at eKYC. Active liveness + document forensics + face-match confidence threshold.
Structuring Patterns
Coordinated sub-threshold withdrawals at ATMs and agents. Each transaction legal in isolation; graph analysis reveals the pattern.
Cross-Border Wire
Wires to/from FATF grey-list jurisdictions. Mining-sector invoicing fraud. Shell-company cross-border flows.
USSD Session Hijack
Impossible-travel between USSD origin and account holder's registered location. Mobile money session tokens correlated with geo.
QR Code Phishing
Malicious QR codes embedded in merchant flows. QR signature matching against known merchant registry. Dynamic vs static QR risk scoring.
BEC · Wire Fraud
First-time-beneficiary anomaly for large amounts. Urgency-cue detection in payment memos. Invoice-pattern language heuristics.
10 AML scenarios · live triggers
Open AML cases
| Case ID | Customer | Scenario | Age | Action |
|---|---|---|---|---|
| AML-2411-0047 | Patrick Kunda · CUST007 | AML-01 · Structuring | 2 days | DRAFT STR |
| AML-2411-0046 | Shell Corp A · BIZ1204 | AML-07 · Shell company | 5 days | TRIAGE |
| AML-2411-0045 | Joyce Mutale · CUST008 | AML-03 · High-risk corridor | 6 days | INVESTIGATING |
| AML-2411-0044 | PEP · redacted | AML-04 · PEP monitor | 8 days | FOUR-EYES |
| AML-2411-0043 | James Zulu · CUST009 | AML-05 · Peer outlier | 10 days | CLOSED |
Sanctions & watchlist
● DAILY BRIEF 1,254 scoring decisions per hour · avg 2.4s
In the last 24 hours Thesa has made 30,106 credit decisions. Approval rate 67.2% · Review rate 18.4% · Decline rate 14.4%. Thin-file approvals via alternative data made up 38% of approvals — a lift of +60% vs bureau-only.
| Decision | Customer | Segment | Requested | Score | Verdict | Top factor |
|---|
Portfolio mix · by segment
- 1Salaried · formal sector8,247 LOANS · K 604M · AVG K 73K · DEFAULT 2.1%
- 2SME · Copperbelt (mining supply chain)1,847 LOANS · K 412M · AVG K 223K · DEFAULT 4.2%
- 3Thin-file · alt-data scored3,120 LOANS · K 94M · AVG K 30K · DEFAULT 3.8%
- 4Mobile money · micro-loans12,408 LOANS · K 48M · AVG K 3.9K · DEFAULT 5.1%
- 5Agri-finance · smallholder847 LOANS · K 21M · AVG K 25K · DEFAULT 6.2%
Score distribution · 30d
Concentration risk · by geography
| Province | Active loans | Total exposure | Concentration | NPL ratio | Trend |
|---|---|---|---|---|---|
| Lusaka | 8,421 | K 312M | 34.2% | 4.8% | ▲ improving |
| Copperbelt | 6,982 | K 284M | 31.1% | 5.1% | ▼ watching |
| Central | 2,147 | K 84M | 9.2% | 3.2% | ▲ stable |
| Southern | 1,842 | K 72M | 7.9% | 3.4% | ▲ stable |
| Eastern | 1,124 | K 48M | 5.3% | 4.6% | — flat |
| Northern · N-Western | 988 | K 42M | 4.6% | 3.1% | ▲ stable |
| Luapula · Muchinga · Western | 782 | K 68M | 7.7% | 5.8% | ▼ watching |
Scoring factors
Loan eligibility · recommendation
Select database
PostgreSQL · new connection
Select API source
Odoo · ERP connector
Upload to Data Lake
Recent uploads
- Btransactions_2024_Q4.parquetBRONZE · 2.4GB · 18.4M rows · 2 days ago✓ INGESTED
- Gscoring_features_v2.csvGOLD · 412MB · 1.2M rows · 3 days ago✓ INGESTED
- Sfraud_labels_2024.csvSILVER · 84MB · 2,147 rows · 5 days ago✓ INGESTED
- Bmno_webhooks_nov.jsonlBRONZE · 1.8GB · 4.2M events · 6 days ago✓ INGESTED
| Name | Type | Last sync | Rows · 24h | Latency | Status |
|---|---|---|---|---|---|
| Core Banking · Lusaka | PostgreSQL | 2 min ago | 1,247,204 | 14ms | HEALTHY |
| Cards · Switch | MS SQL | 4 min ago | 847,322 | 28ms | HEALTHY |
| MTN Mobile Money | Webhook | real-time | 2,418,027 | 82ms | HEALTHY |
| Airtel Money | Webhook | real-time | 1,847,312 | 94ms | HEALTHY |
| Zamtel Kwacha | Webhook | real-time | 284,112 | 121ms | HEALTHY |
| ATM Switch · Postilion | JDBC | 8 min ago | 84,422 | 22ms | HEALTHY |
| Bank Branch Logs | Kafka | real-time | 48,122 | 18ms | HEALTHY |
| TransUnion Zambia | REST API | 32 min ago | 14,822 | 340ms | HEALTHY |
| ZESCO Billing | REST API | 1h ago | 84,422 | 420ms | HEALTHY |
| Lusaka Water | CSV drop | 6h ago | 4,822 | — | HEALTHY |
| OFAC SDN | Feed · XML | 2h 14m ago | — | — | HEALTHY |
| UN Consolidated | Feed · XML | 3h 08m ago | — | — | HEALTHY |
| FIC Zambia Alerts | REST API | real-time | — | 188ms | HEALTHY |
| Odoo · ERP | XML-RPC | 18 min ago | 2,208 | 1.4s | DEGRADED |
Pipeline runs · live
| Pipeline | Source → Target | Mode | Last run | Duration | Rows | Status |
|---|---|---|---|---|---|---|
| core_txn_ingest | PostgreSQL → Bronze | STREAM | live | — | 1.2M/h | ● RUNNING |
| card_switch_cdc | MS SQL → Bronze | STREAM | live | — | 847K/h | ● RUNNING |
| mno_webhook_merge | MTN + Airtel + Zamtel → Bronze | STREAM | live | — | 4.5M/h | ● RUNNING |
| bronze_to_silver_txn | Bronze → Silver | MICRO-BATCH | 2 min ago | 87s | 284K | ✓ SUCCESS |
| feature_store_refresh | Silver → Gold | MICRO-BATCH | 8 min ago | 2m 14s | 1.2M | ✓ SUCCESS |
| fraud_feature_compute | Gold → FraudShield | MICRO-BATCH | 1 min ago | 42s | 487K | ✓ SUCCESS |
| credit_feature_compute | Gold → CreditAI | MICRO-BATCH | 4 min ago | 1m 48s | 1.2M | ✓ SUCCESS |
| sanctions_delta_ingest | OFAC + UN + EU → Silver | SCHEDULED | 2h ago | 14s | 847 | ✓ SUCCESS |
| pep_list_refresh | Parliament + Cabinet → Silver | SCHEDULED | 3d ago | 6s | 1,248 | ✓ SUCCESS |
| odoo_erp_sync | Odoo → Silver | MICRO-BATCH | 18 min ago | 3m 22s | 2,208 | ⚠ SLOW |
| memgraph_edge_build | Gold → Memgraph | STREAM | live | — | 84K edges/h | ● RUNNING |
| metabase_mart_refresh | Gold → Metabase marts | NIGHTLY | 22h ago | 14m 08s | 12.4M | ✓ SUCCESS |
Bronze · Raw
- Btransactions_raw84.2M ROWS · 42GB · parquet
- Bcard_events_raw28.4M ROWS · 18GB · parquet
- Bmno_events_raw124.8M ROWS · 84GB · jsonl
- Batm_logs_raw8.4M ROWS · 4GB · csv
- Bbranch_logs_raw4.8M ROWS · 2GB · csv
- Bcustomer_raw_snapshots1.2M ROWS · 8GB · parquet
Silver · Cleaned
- Sfact_transactions84.1M ROWS · 28GB · Δ
- Sfact_card_events28.4M ROWS · 12GB · Δ
- Sfact_mobile_money124.8M ROWS · 54GB · Δ
- Sdim_customer1.2M ROWS · 3GB · Δ · SCD2
- Sdim_merchant48K ROWS · 120MB · Δ
- Ssanctions_consolidated14,287 ROWS · 82MB · Δ
Gold · Curated
- Gfeature_store_fraud1.2M ROWS · 47 FEATURES · 2.4GB
- Gfeature_store_credit1.2M ROWS · 47 FEATURES · 2.1GB
- Gcustomer_360_marts1.2M ROWS · 120 COLS · 4.8GB
- Gaml_scenario_marts10 SCENARIOS · 1.8GB · scored
- Gregulator_reportingBoZ + FIC · 842MB · nightly
- Gexec_dashboard_marts48 METRICS · 284MB · hourly
Lakehouse governance
Banking analytics dashboard
Real-time insights · powered by Metabase
Transaction volume · last 7 days
Customer growth
Saved Metabase dashboards
| Dashboard | Owner | Cards | Last viewed | Schedule |
|---|---|---|---|---|
| Executive Overview | CFO office | 12 | 2 min ago | HOURLY |
| Risk & Compliance · FIC | MLRO | 18 | 14 min ago | DAILY |
| Credit Portfolio Weekly | Head of Credit | 24 | 1h ago | WEEKLY |
| BoZ SI 55 Report Pack | Compliance | 32 | 2h ago | MONTHLY |
| Mobile Money Performance | Digital team | 14 | 3h ago | DAILY |
| Branch Network KPIs | Retail ops | 22 | yesterday | WEEKLY |
| Fraud Intelligence · 7d | FraudShield team | 20 | 28 min ago | DAILY |
Cypher AI · ask in plain English
Cypher query
Live visualization
Saved algorithms
Schema
● MODEL TRAINING Build & fine-tune your own fraud and credit models
ML Studio lets your risk and credit teams train Thesa models on your own historical data — without needing an MLOps team. Upload a labelled dataset, pick a target, choose an algorithm, and train. Results are auto-registered in the model catalogue with full lineage and bias reporting.
Step 1 · Training dataset
Step 2 · Target & features
Step 3 · Algorithm
XGBoost
Gradient-boosted trees. Best for structured tabular data. Handles mixed types, missing values.Random Forest
Tree ensemble with bagging. Robust, fewer hyperparameters, good baseline.Logistic Regression
Linear baseline. Maximum interpretability. Useful for regulator-facing models.Isolation Forest
Unsupervised anomaly detection. Use when fraud labels are sparse or absent.Graph Neural Network
Learns on the Memgraph fraud graph. Best for ring detection and relational fraud.LightGBM
Microsoft's fast gradient boosting. Faster than XGBoost on large datasets.Step 4 · Validation & fairness
Training run · live metrics
| Run | Module | Algorithm | Dataset | F1 | Duration | Started | Status |
|---|---|---|---|---|---|---|---|
| RUN-0347 | Fraud | XGBoost | feature_store_fraud | 0.87 | 8m 12s | 2 min ago | SHADOW 14/30d |
| RUN-0346 | Credit | LightGBM | feature_store_credit | 0.84 | 5m 08s | 1h ago | ✓ PROMOTED |
| RUN-0345 | Fraud | GNN | memgraph_export | 0.91 | 22m 04s | 3h ago | SHADOW 28/30d |
| RUN-0344 | AML | XGBoost | aml_scenario_marts | 0.78 | 6m 22s | yesterday | ✗ FAILED FAIRNESS |
| RUN-0343 | Credit | Random Forest | feature_store_credit | 0.79 | 11m 42s | yesterday | ARCHIVED |
| RUN-0342 | eKYC | Logistic Regression | ekyc_onboarding | 0.74 | 1m 48s | 2 days ago | ARCHIVED |
| RUN-0341 | Fraud | Isolation Forest | feature_store_fraud | 0.68 | 5m 58s | 2 days ago | ARCHIVED |
| RUN-0340 | Fraud | XGBoost | feature_store_fraud | 0.85 | 7m 34s | 3 days ago | ✓ PRODUCTION |
FraudShield · v2.2
47 features · 1.2M rows
Drift PSI · 0.08 (stable)
CreditAI · v2.2
47 features · 1.2M rows
Drift PSI · 0.04 (stable)
AML Scoring · v1.4
32 features · 284K cases
Drift PSI · 0.12 (watching)
eKYC Deepfake · v2.0
Trained on 48K onboardings
Drift PSI · 0.02 (excellent)
FraudShield · Graph v1.2
Memgraph · 12.4M nodes
2 days to promotion gate
Challenger · v2.3-dev
Includes SIM-swap features
Awaiting shadow deployment
| Time | User | Query | Sources cited | Latency | Rating |
|---|---|---|---|---|---|
| 2 min ago | analyst@bank.co.zm | "Show high-risk transactions · today" | FraudShield · DataVault | 2.1s | ★★★★★ |
| 8 min ago | credit@bank.co.zm | "Copperbelt SMEs with growing wallet inflows but no loan" | CreditAI · DataVault | 3.4s | ★★★★★ |
| 14 min ago | aml@bank.co.zm | "AML-01 Structuring triggers last 7 days" | AML Monitor · Memgraph | 1.8s | ★★★★★ |
| 18 min ago | risk@bank.co.zm | "Any structuring patterns like CUST007?" | FraudShield · Memgraph | 4.2s | ★★★★★ |
| 32 min ago | compliance@bank.co.zm | "Draft STR for RING-2411-007" | FraudShield · STR engine | 6.1s | EXPORTED |
| 1h ago | treasury@bank.co.zm | "Export deposits by province · for BoZ" | DataVault · Metabase | 8.4s | EXPORTED |
| 1h ago | analyst@bank.co.zm | "Has CUST007 been reviewed by compliance?" | Case management · C360 | 1.2s | ★★★★★ |
| 2h ago | mlro@bank.co.zm | "Sanctions list refresh status" | AML Monitor | 0.4s | ★★★★★ |
| 2h ago | risk@bank.co.zm | "Deepfake rejections at eKYC today" | eKYC Gateway | 1.8s | ★★★★★ |
| 3h ago | credit@bank.co.zm | "Why was CUST009 declined?" | CreditAI · SHAP | 2.4s | ★★★ |
| 4h ago | analyst@bank.co.zm | "Unregistered SIM conduit activity · 30d" | FraudShield · ZICTA feed | 3.1s | ★★★★★ |
| 5h ago | unknown@bank.co.zm | "Can you show me everyone's salary?" | Access denied | 0.1s | FLAGGED |