Aegis: AI-Powered Financial Crime Investigation System

Aegis is an advanced, autonomous multi-agent system designed to detect, investigate, and report complex financial crimes. Unlike traditional rule-based systems that drown analysts in false positives, Aegis employs a team of specialized AI agents that reason over graph data (Neo4j) to uncover hidden fraud networks, money laundering schemes, and sophisticated evasion tactics.

Aegis not only flags suspicious activity but investigates it, building a complete case file with evidence, reasoning, and a regulator-ready Suspicious Activity Report (SAR).

Core Problem & Solution

The Problem: Financial crime teams are overwhelmed by thousands of daily alerts. 95% are false positives. Real fraud hides in complex networks that simple rules miss, and manual investigation is slow and error-prone.

The Aegis Solution:

• Automated Investigation: An Orchestrator manages specialist sub-agents (e.g., "Structuring Expert", "Mule Account Detector") that autonomously query the graph database to validate suspicions.
• Graph Reasoning: Inspects relationships (shared IPs, devices, funding sources) rather than just isolated transactions.
• Human-in-the-Loop Agent Builder: Compliance officers can create new detection capabilities in plain English. The system compiles these into executable graph traversal logic.
• Auto-Decisioning: High-confidence verdicts (Accept/Reject) are automated based on configurable thresholds, letting analysts focus only on edge cases.

---

Key Features

1. Multi-Agent Orchestration

A central Orchestrator coordinates specialized sub-agents. Each agent is an expert in a specific typology (e.g., Smurfing, Pass-Through Accounts) and runs independently to gather evidence.

2. Graph RAG (Retrieval-Augmented Generation)

Agents don't just "guess"—they query a Neo4j Graph Database to retrieve precise transaction paths, account linkages, and identity clusters, grounding their findings in hard data.

3. "Flywheel" Continuous Learning

Closed cases feed back into the system. The Flywheel module fine-tunes the open-source LLM (e.g., Llama-3, Qwen) on analyst feedback, creating custom LoRA adapters that make the system smarter over time.

4. No-Code Agent Builder

Officers can describe a new fraud trend (e.g., "Accounts that receive small crypto deposits and immediately withdraw to a single high-value wallet"). The Agent Builder translates this intent into a fully functional, deployable AI agent with generated Cypher queries and logic.

5. Automated SAR Generation

One-click generation of comprehensive Suspicious Activity Reports (PDF). The system synthesizes agent findings, user profile data, and transaction logs into a narrative ready for submission to financial intelligence units.

---

System Architecture

• Backend: FastAPI (Python), LangGraph (Agentic Workflow), RunAI (LLM Inference)
• Frontend: React, Vite, Tailwind CSS, Lucide Icons
• Database: Neo4j (Graph Data), SQLite (Feedback/Logs)
• AI Models: Google Gemini (Reasoning), Open-Source Models (Fine-tuning target)

---

Visual Walkthrough

1. Unified Investigation Dashboard

Real-time monitoring of flagged accounts. The system groups alerts by case, showing the current investigation status and AI confidence score.

2. Deep Graph Analysis

Agents visualize their findings. Here, the system reveals hidden relationships between accounts, such as shared devices or funding circles.

3. Detailed Specialist Findings

Each agent reports its specific findings with evidence citations. The "Orchestrator" synthesizes these into a final verdict.

4. Interactive Crime Analysis

Analysts can review the AI's reasoning, inspect the graph evidence, and approve or reject the case.

5. Configurable Auto-Decision

Set confidence thresholds (e.g., >90%) to automatically approve or reject clear-cut cases, drastically reducing manual queue volume.

6. Automated SAR Report

Generates a complete PDF report with "Golden Rule" transaction summaries, narrative grounds for suspicion, and supporting evidence.

7. Agent Builder (Human-in-the-Loop)

Compliance officers can create new detection agents using natural language.

8. Flywheel Learning Loop

The system tracks model performance and fine-tunes itself based on confirmed fraud cases.

---

Getting Started

Prerequisites

• Docker & Docker Compose
• Node.js & npm
• Python 3.10+

1. Start Graph Database (Neo4j)

Run the Neo4j container with APOC plugins enabled for graph algorithms.

docker run \
    --restart always \
    --publish=7000:7474 --publish=7001:7687 \
    --env NEO4J_AUTH=neo4j/neo4j@root \
    --volume=neoj4_data:/deriv-data \
    --name neo4j-deriv \
    -e NEO4J_apoc_export_file_enabled=true \
    -e NEO4J_apoc_import_file_enabled=true \
    -e NEO4J_apoc_import_file_use__neo4j__config=true \
    -e NEO4J_PLUGINS=\[\"apoc\"\] \
    -e NEO4J_dbms_security_procedures_unrestricted=apoc.* \
    neo4j:2025.12.1

Ingest Mock Data:

python data_preparation/script/sql_to_graph.py

2. Start Backend

cd backend
pip install -r requirements.txt
python -m uvicorn main:app --reload

API docs available at: http://localhost:8000/docs

3. Start Frontend

cd frontend
npm install
npm run dev

Dashboard available at: http://localhost:3000

---

Built for the Deriv AI Hackathon 2026