AI agent charts, alert investigation over MCP, and everything else we shipped in October
October was about making investigations easier to see and easier to connect.
AI agent summaries now come with charts, so an investigator can read the shape of the activity before reading a single sentence. Alerts can be opened from Claude or any MCP client with a pasted link. Rules learned two new tricks: flagging the people connected to a risky party, and watching what happens after a key event like a password reset. And for compliance teams heading into exam season, we added OFAC screening reports and a full set of CTR metrics.
Here's everything that shipped.
AI agent output gets charts, not just a wall of text
AI agent summaries now include charts and visualizations alongside the written narrative.
When an agent reviews an alert, it pulls together a lot of activity: transaction volumes, counterparties, timing. Until now, all of that came back as text, and the investigator had to rebuild the picture in their head. Now the picture comes with it: the key patterns in the activity are visible at a glance, and the narrative is there for the detail.
This is the first step. More visualization types are on the way in future releases.
Investigate alerts from Claude or any MCP client
In August, we launched the Unit21 MCP server. In September, it learned to filter and query reports. In October, it can read alerts.
Investigators can now paste a Unit21 alert link or alert ID into Claude or any other MCP client and pull in the full alert:
- The alert itself
- Its AI agent outputs
- Its narratives, notes and comments
- Its snapshot files
No exports, no copying and pasting between tabs. From there, an investigator can summarize the alert, ask follow-up questions, or compare it against other context in the AI assistant they already use.
Access runs through a new read-only alerts capability and follows each user's existing alert permissions. If a user can't see an alert in Unit21, they can't see it over MCP either.
Rules that see connections and sequences
Risk rarely sits with one party or one moment. Two rule updates this month help detection follow it.
Relationships in rules
Rules can now use the relationships already defined in Unit21 to flag associated parties. When a business trips a rule, its beneficial owners can be flagged too. When an account looks suspicious, so can the other holders on that shared account.
Those connected parties are usually where an investigation goes next. Now your rules bring them into view automatically, instead of analysts tracing the connections by hand.
Forward date anchoring for real-time rules
Real-time rules have always looked back from the transaction in front of them. Now they can also anchor to an earlier event and aggregate everything that happens after it.
That matters because so much fraud is a sequence: something happens, then the money moves. A few patterns this makes possible:
- Account takeover: a login followed immediately by a password change, paired with device signals
- Post-reset cash-out: a large transfer right after a password reset
- Ignored warnings: fraud that continues after a customer was already warned
Anchoring to the triggering event lets you catch these sequences in real time, before the funds are gone.
Reporting that's ready for your next exam
Regulators and auditors don't just ask what your program does. They ask you to prove it. Two new additions to Reporting & Dashboards make that easier.
OFAC screening reports
Orgs with watchlists now have an OFAC Screening tab on Reporting & Dashboards, with downloadable OFAC validation reports from the last six months.
Each month, OFAC SDN individuals and entities are run through Unit21's sanctions screening. The report shows, for every record, how many matches it produced, the strongest match and which sanctions programs those matches came from.
The result is a self-serve, trust-but-verify record that known sanctioned names are being caught, ready to hand over for model validation or an exam.
CTR metrics
Program Efficiency now has a CTR section that sits alongside SARs under a new collapsible Filings section. It covers:
- Total CTRs, on-time (15-day) filings and failed or rejected filings
- CTRs created over time and per agent
- CTRs completed per agent and average time per agent
- An Alert to CTR conversion KPI
Every chart drills down into the matching CTRs. BSA teams can track deadlines, spot bottlenecks by agent and report on CTR performance from the same dashboard they already use for SARs.
More worth knowing about
- Network Analysis is 10x faster. In our testing, a network that previously took 22 minutes to load now finishes in about a minute and a half. Large networks no longer sit "In Progress" or time out, so investigators can rely on it mid-investigation. Nothing changes about how you request it.
- AI Recommendations tab on the rules dashboard. All of your rule recommendations from the Optimization & Insights agent now live in one tab at the top of the rules dashboard, and the ones that don't fit your program can be dismissed.
- Deadline filter. Every alert, case and filing table with filters now includes a Deadline filter, so teams can surface the work that's due first.
Filing upgrades across FinCEN, FINTRAC and goAML
- FinCEN SARs auto-attach a transactions CSV built from the SAR's linked transactions, with a prompt to regenerate it if those transactions change.
- Edit transactions on a SAR: add or remove up to 1,000 transactions on an existing SAR.
- Download the filed FinCEN SAR XML straight from the export menu, so you always have the exact submission on hand.
- goAML queues and reviewers: goAML filings now support queues, reviewers and classified queues, the same way SAR filings do.
- Filters for FINTRAC STR and goAML filing lists: filter by ID, status, dates, creator, reviewer, queue and more.
Coming soon
- Search by SSN and EIN. Look up records directly by Social Security Number or Employer Identification Number.
- Search on custom data fields. Pick up to five custom data fields to make searchable, so the data your team relies on is easy to find.
Kunal Datta is the Chief Product Officer at Unit21. Prior to Unit21, he led the Product team for Checkout at Fast, and prior to that, led the Product teams responsible for automating aerial wildfire safety inspections at Pacific Gas & Electric.
He has a background leading Product teams using AI to automate processes at regulated entities, as well as financial products, machine learning products, web applications, mobile applications, hardware products, and data products. Kunal is a Fulbright Scholar and studied Civil and Environmental Engineering and Music Science Technology at Stanford University.
