Where a Language Model Belongs in a Sub-50ms Risk Pipeline, and Where It Does Not

What runs in production today

StealthIQ runs Claude in production across its risk and compliance platform, on Claude via Amazon Bedrock. An asynchronous SAR narrative generator takes an alert once it has been dispositioned as suspicious and ingests transaction histories, entity risk scores and graph network analysis to produce an audit ready regulatory narrative formatted to FinCEN guidelines. A contextual alert triage agent retrieves relevant media hits and registry data on a politically exposed person or sanctions alert, evaluates entity alignment, and returns a bulleted justification summary with a recommended disposition score. Compliance analysts use both daily. This is a production deployment, not a pilot or a proof of concept, and the sub fifty millisecond scoring engine remains untouched by any language model.

Discovery first, then a calibrated curriculum

Week one established what would actually be taught. Working sessions covered current and intended Claude usage, target workflows, output schemas, analyst review points and known failure modes, alongside a review of customer supplied non sensitive prompt samples, schemas and typologies. Three priority workflows were confirmed in writing as the teaching cases, recorded with the participant roster, schedule and success measures in a calibration memo the customer accepted.

Twelve hours, six sessions, exercises inside the session

Instruction ran remotely to a cohort of five to ten named participants from engineering, product and operations. Hands on exercises were worked inside session time rather than scheduled as separate labs, which is what keeps attendance and completion aligned in a team with live operational duties.

• Claude fundamentals for risk and compliance operations, including the boundary between deterministic rules, the existing ensemble scoring, and language model judgment.
• Prompt engineering for investigative accuracy on synthetic and de-identified case text: typology handling, ambiguity and refusal behaviour, and reducing unsupported or over confident output in analyst facing text.
• Structured outputs and tool use: schema conformant JSON for the downstream case manager, alert engine and filing path, tool definitions, multi step orchestration, and retrieval over policy and typology libraries.
• Document and entity analysis at scale: long document analysis for KYC and onboarding packets, entity and counterparty extraction, adverse media and sanctions hit disposition support, and citation and traceability for every extracted fact.
• Evaluation and quality control: test sets from de-identified cases, scoring rubrics for factuality and completeness, regression testing, human in the loop review design, and false positive against false negative trade offs.
• Safe deployment in a regulated environment: minimization of customer data in prompts and logs, prompt injection and untrusted input handling including adversarial content in transaction memos and uploaded documents, audit trail and explainability expectations, and cost and latency management.

No customer data, written into the contract

Kriv AI did not request, receive, access, store or process customer personally identifiable information, nonpublic personal information, account or transaction records identifying real individuals, or cardholder data, and held no access to production systems, data stores or credentials at any point. Every teaching example ran on synthetic or de-identified data the customer supplied or approved, and all exercise work was executed by StealthIQ participants inside StealthIQ's own environment. The engagement also explicitly excluded model risk management documentation, any determination of the regulatory sufficiency of a filing or alert disposition, and any modification, benchmarking or validation of StealthIQ's existing models. Those remained StealthIQ's responsibility and the contract said so.