Fraud & AML decision engine

Every decision, with its reasoning attached.

Krino scores every incoming event against rules your own team wrote, in milliseconds, and puts anything suspicious in front of your analysts as a case. You see exactly which rule contributed what — so you can answer an auditor, a disputing customer and a regulator with more than a number.

See it on your data How it works

Self-hosted — data never leaves Rule changes — no release cycle Device intelligence — included

tx-88214 · card_payment 34 ms

Disposable email provider+40

Datacenter IP egress+30

6 cards on one device in 24h+22

Basket above customer average—

92 Block and reviewthreshold: 60 · case opened

The status quo

Why does changing one rule take weeks?

Fraud patterns change in a week. If changing a rule waits on a software release, that week is a loss.

Rules live in the codebase

The risk team spots a pattern, explains it to an engineer, joins the backlog and waits for a release. The gap between noticing and stopping is measured in weeks.

The score is a black box

The vendor returns a number. When a customer asks why they were declined, or an auditor asks for the reasoning, that number is all you have.

Your data leaves

Transaction and customer records land in someone else's cloud. Under most regulatory regimes that is a file of its own.

The path

How a transaction moves through Krino.

Event arrives

A payment, a login attempt, a signup — one API call, in your own data model with your own field names.

Signals are derived

Email, phone, IP and device signals come from lists held inside your infrastructure. Nothing is queried outside.

Rules run

The scenario's rules are evaluated together and each adds its score. Around 34 ms.

A decision returns

Approve, review, block-and-review or decline — with the contribution of every rule in the same response.

Capabilities

From detection to filing, in one product.

Rule engine

Your risk team builds rules on screen: compose the conditions, set the score, publish. Velocity rules, lists, fuzzy matching and threshold-based outcomes included.

Device intelligence

Browser fingerprinting, datacenter and VPN egress detection, disposable email providers, phone line type. All offline, no extra contract.

Sanctions screening

Name screening against consolidated sanctions and PEP lists. Tolerates accent, spelling and transliteration differences — refreshed on a schedule.

Case management

Decisions about the same customer collect into one file, route to a queue, get annotated, and record when they were reported to a regulator.

Rule list showing each rule's name, description, score and active state — **Rule engine** · every rule's score and rationale on screen

Case queue with status, outcome, date and assigned analyst columns — **Case management** · queue, status and assignment in one table

Measurement

What if I moved the threshold?

Krino re-reads past decisions at new thresholds and shows how many would have landed differently. Not a forecast — a replay of decisions already made. The same screen shows how often each rule fired and how often it actually changed the outcome; a rule that fires constantly but is never decisive is adding noise to every score.

Analytics screen with threshold simulation histogram and rule performance table — **Threshold simulation** · 240 decisions, four outcomes, three thresholds

Difference

Why Krino?

	Typical approach	Krino
Changing a rule	Engineer plus a release, days to weeks	Risk team, on screen, immediately
Data model	The vendor's schema; your fields don't fit	You define your own tables and fields
Where data lives	The vendor's cloud, often another jurisdiction	Your own servers — nothing leaves
Decision rationale	A score comes back; the detail is closed	Which rule, how many points — one by one
Device intelligence	Separate product, separate contract	Included
Sanctions screening	Separate product, usually priced per query	Included, matched locally
Investigation workflow	Spreadsheets, email, a separate ticket tool	In the product, with an audit trail
Testing before release	Hope	Shadow mode against live traffic

Integration

Two endpoints. One afternoon.

You send the transaction, you get the decision. The reasoning comes back in the same response.

Asking for a decision

POST /api/decisions
{
  "object_type": "card_payment",
  "scenario_id": "019f8e68-…",
  "trigger_object": {
    "object_id": "tx-88214",
    "updated_at": "2026-08-06 10:00:00",
    "basket_total": 12500.00,
    "customer_no": "4471",
    "client_ip": "203.0.113.45"
  }
}

What comes back

{
  "decision": {
    "outcome": "BlockAndReview",
    "score": 92
  },
  "rule_executions": [
    { "rule_name": "Disposable email",
      "outcome": "hit", "score": 40 },
    { "rule_name": "Datacenter IP",
      "outcome": "hit", "score": 30 }
  ],
  "execution_time_ms": 34
}

When you would rather not wait on the decision, send events separately and receive the outcome over a signed webhook. Details in the documentation.

Pricing

One plan, one price.

No per-transaction fee, no module-by-module upsell. It installs on your own infrastructure; the licence is a flat monthly figure.

Self-hosted

$1,499 / month

Unlimited rules, scenarios and users. Onboarding support and version upgrades included.

See what's included

Everything included

Rule and scenario engine
Device intelligence
Sanctions and PEP screening
Case management
Shadow test runs
Scheduled runs
Webhooks and API
Version upgrades

Let's see it on your data.

The best demo is the one built from last month's transactions. Send an anonymised sample; we'll set up your rules in Krino and put the results side by side with today's process.

muhammet.sahin@dakicksoft.com Read the docs