FAQ

Transaction Lifecycle & Scoring

What does "auto-approved" mean? The transaction scored at or below your account's auto-approve ceiling (30 by default) and no rule declined or flagged it for review, so it's approved without reaching a reviewer. See What "Auto-Approved" Means.

What happens if a scoring component is slow to respond? Scoring runs several independent components, each with its own timeout. The response is built from whichever components complete in time, so your transaction always gets a decision. See Scoring Resilience.

What happens if I submit the same trans_id twice? Shufti treats it as the same transaction: it keeps the same Shufti transaction ID and never opens a second alert. Each submission is still scored, so the two responses can differ if something changed between them. See Idempotency.

Can I retrieve a transaction's result again later? Store the score, decision, and evidence from POST /create/transaction's response at the time you receive it — that response is the record your integration should keep. Your compliance team can review the same transaction afterwards from the Back Office.

Alert Routing & Review Tiers

How is an alert routed to L1, L2, L3, or MLRO? By its score band — Low, Medium, or High — unless it's a confirmed or partial sanctions match, which always goes to the MLRO regardless of score. See How an Alert Reaches Its Tier.

Is there a limit to what a reviewer can close on their own? Yes, each tier has its own score and value ceiling. See Who May Close an Alert Alone.

Can the default SLA hours and close-alone ceilings be changed? Yes — every number on the Alert Routing and Review Tiers page is a default Shufti configures for your account if you don't specify your own. Contact Shufti to configure them to your needs.

What happens if an alert's tier has nobody assigned? Make sure at least one reviewer's role holds that tier's permission — see Configuring Review Tiers in the Back Office.

Rules

What types of conditions can a rule use? Value Check (a single datapoint or attribute against a value), Activity Over Time (an aggregate over a time window), and Compare Metrics (one value or aggregate against another). See Conditions.

What happens when two rules match the same transaction? Priority decides: a High-priority rule's decision always wins over Medium or Low, whatever actions they carry. See Actions for the full precedence order.

Who can publish a rule change? The account's primary user can publish directly. A rule created by an L1, L2, or L3 user instead goes for approval and only takes effect once the reviewer publishes it. See Review and Publish.

What's the difference between a rule and an Attribute Action List? A list flags or exempts a specific set of values for an attribute — such as a list of high-risk BINs — without writing a separate rule for each one. See Lists.

Can rules be grouped for a specific purpose or regulator? Yes, into a rule set — see Rule Sets.

Setup & Permissions

How do I give a team member access to the Alert Queue? Grant their role the Kyt Alert Queue permission, plus the tier permission for the tier they'll review on. See Setup Guide for a New Client Admin.

How do I put someone on a specific review tier? Check Kyt Alert L1, Kyt Alert L2, Kyt Alert L3, or Kyt Alert Mlro on their role, in Settings → Roles & Permissions. See step 3.

Is there anything I need to do before assigning tier permissions for the first time? Yes — open the Alert Queue once as your account's primary user first. This activates your account's review tiers before you staff them.

Customer Profile

Where can I see a customer's full transaction history and behavioural pattern? The Transaction Monitoring tab on their Customer Profile.

How much history does TTM need before a behavioural baseline is considered reliable? At least 30 days of observation and 10 approved transactions — before that, it's shown as not yet established. See Transaction Monitoring Tab.

Regulatory Reporting

Which FIUs (regulators) are supported? FINTRAC (Canada), FinCEN (United States), the Financial Intelligence Centre (South Africa), SAFIU (Saudi Arabia), the UAE FIU, and FIU Suriname. See Regulatory Reporting.

Can I fetch a filed report through the API, or only from the Back Office? Through the API: POST /regulatory-report/detail returns a signed-off or filed report. See Fetch a Filed Regulatory Report.