Omnichannel Orchestrator
Entity Map
Every entity on one canvas. Accounts, identities, customer identification numbers, movements, sessions, devices, phones, emails, and the relationships between them, drawn automatically as a connected graph. No more guessing which version of the data is in use. One picture, complete and always current, that anyone on the team can read. The Frame Orchestrator builds and maintains it.
Frame Integrator
This is fraud orchestration at the data layer: connect a new source in any format or schema, and the platform normalizes it on ingestion. No migration project. No waiting on engineering. Whether your source sends a full snapshot or just what changed, the data lands clean and ready to use. Coverage spans online banking, mobile, IVR, call center, ATM, branch, P2P, CNP, and POS, alongside onboarding and KYC, online fraud detection, AML monitoring, and device, network, and threat intelligence. Historical and real-time, structured and unstructured.
Flows
The signals that matter rarely live in one place. Flows let you read from any entity and build new attributes, apply formulas, and compute the metrics your rules depend on by connecting nodes on a canvas. The logic that catches today's scam is yours to build, and yours to change.
New entities in minutes
A new market, a new payment rail, or a new attack pattern only needs a new entity. Define it, relate it to the rest, and it is live, accepting data and visible on the map immediately. No multi-component rebuilds. No long timelines. Detection logic adapts as tactics change because the underlying architecture was designed to extend.
Account Intelligence
Acoru monitors accounts and all their associated events, not just transactions: logins, sessions, device changes, profile and limit edits, payee additions, transfer attempts, contact center interactions. These events update the account's risk state and cascade to linked accounts and entities. When signals appear in sequence, Acoru flags the destination as a potential mule and surfaces additional victims.
Detection Management
Build once, reuse everywhere
Signals and actions are separate. A signal is a fact: a risky device, a dormant account, a new payee. An action is what your strategy does about it. Build a signal once and reuse it across workflows, rather than rewriting the same logic in each rule. The platform ships a library of predefined signals, and your team tunes the thresholds.
Visual rule builder
Rules, conditions, and execution policies are built visually in the Risk Engine, with no programming skills required. Analysts combine attributes, signals, and thresholds and apply them to any entity: accounts, identities, devices, sessions, or transactions. The effect shows immediately.
Decisions on a canvas
Workflows assemble those signals into decisions: trigger, conditions, branches, and actions such as a hold or challenge. Priority governs the order, so a decision is always predictable. Signals and workflows are both versioned, so a review months later shows the exact logic that produced the result.
From idea to production model
AI Studio lets your team develop, deploy, and monitor models inside the platform, from proven machine learning to transformer models such as Acoru’s Large Account Model. Fraud analysts and data scientists work directly in an embedded environment on real production data, without moving it outside your infrastructure. Models train on the Frames the Frame Orchestrator produces: data already unified, normalized, and enriched with fraud, behavioral, and account-relationship signals. That cuts the path from idea to production model from weeks to hours. Teams see which models are live, which policies use them, and what each one prevents.
Inspector
Inspector brings classifications, alerts, policies, and signals together. Dashboards, real-time alerts, and investigative tools span every channel and source in a single console, so analysts see why an alert fired and what to do next.
Every alert the Risk Engine produces lands in one place, and Acoru does not ask you to abandon the case management system your team already uses: its alerts open, update, and close cases inside your existing workflows. Investigation outcomes feed back into the Risk Engine.
Link analysis puts relationships on a graph: accounts, identities, devices, IPs, phones, and the movements between them. Analysts expand one hop at a time, trace the shortest path between two entities, and surface the shapes that signal organized fraud, such as funds cycling back to their origin or many accounts behind a single device.
Every classification carries the behavioral sequence and rule triggers that produced it, with links to the evidence. Every event, score, policy, and model execution generates a signed audit trail, exportable for internal or regulatory audit.
AI Assistant and AI Workforce
The AI Assistant works alongside investigators across the Platform: account risk queries in plain language, investigation summaries, rule and model assistance, audit-ready reporting. Every response traces to the behavioral sequence behind the classification.
The AI Workforce brings agentic AI to fraud operations. It runs multi-step workflows without an analyst driving each step: monitoring behavior over time, identifying coordinated activation patterns across accounts, and assembling investigation evidence so analysts open a case with the work already done. Every action runs inside boundaries the institution defines, and every decision is logged and accountable.
Rule changes, model adjustments, and remediation recommendations are versioned artifacts requiring human-in-the-loop (HITL) approval before anything reaches production.
Deployment
Acoru runs on-premises, in your private cloud, or in a hybrid environment, single- or multi-tenant. The institution decides where Acoru runs and who operates the infrastructure.
On-premises, in your private cloud, or in a hybrid environment, single- or multi-tenant. The institution decides where Acoru runs and who operates the infrastructure.
Where intelligence is shared with other institutions, sharing is designed for data minimization and data protection: only what each purpose needs is exchanged, protected by safeguards proportionate to that purpose and limited to what is legally permissible in each jurisdiction.
Ingestion runs through plug-in connectors for the solutions you already run, or through API integrations. Scores, alerts, and executed policies are pushed through queues or standard connectors into your existing case management or SIEM, or queried on demand.
Consortium Manager
Fraud crosses institutional boundaries: scam victims, mule and laundering accounts, and the patterns behind them are rarely confined to one bank. The Consortium Manager lets banks create or join a consortium and exchange intelligence, such as patterns, signals, and account classifications. The Data Ciphering Suite protects what is shared with safeguards proportionate to each purpose, including privacy-enhancing technologies, and limits sharing to what is legally permissible in each jurisdiction.
