Corelation KeyStone integration: act on fraud from the case
An analyst at a credit union is looking at a card that was just used three times in a row somewhere it has never been used before. The alert and evidence are in Unit21. The card needs to be blocked before a fourth charge goes through.
So the analyst opens a second system, finds the member and the card, and blocks it by hand. That gap between seeing fraud and stopping it is where money gets lost, and mistakes happen.
The Unit21 Corelation integration closes that gap. It brings member data into Unit21 for fraud and BSA/AML monitoring and lets analysts act back in KeyStone without leaving the case. Here is how it works, what it changes for your team, and how to get it set up.
How the Corelation KeyStone integration works
The integration has two halves: data coming in from KeyStone, and actions going back out.
Data in: the Unit21 AML Extract
Corelation builds and supports a dedicated extract for Unit21, called the Unit21 AML Extract. Your own KeyStone administrator or data team configures it inside your environment, so there are no custom extracts for anyone to build or maintain.
- What it sends: entities, joint account holders, accounts, cards, and transactions.
- How often: about every five minutes, which gives Unit21 a near real-time view of member activity.
- How much: after a one-time historical load, only new records and changes move each cycle. Files stay light, nothing is missed, and nothing is sent twice.
KeyStone data lands in the same Unit21 workspace as your other sources, linked to one member record. Joint ownership comes with it, so an alert on one member shows every account and card that member touches.
Actions out: write-backs through the KeyBridge API
This then saves the analyst from opening a second system. From inside a Unit21 alert or case, next to the evidence that justified the decision, an analyst can:
- Block a card
- Activate a card
- Place a stop payment
- Place a check hold on an account
Unit21 authenticates to KeyStone through Corelation's KeyBridge API, sends the request, and records the result in the case: what was sent, what came back, who clicked, and when. If KeyStone rejects a request, the analyst sees it in the case instead of finding out later.
From alert to action to filing in one record
The point of the integration is that a case never has to leave Unit21 to be resolved. A typical one runs like this:
- Detect. A rule your team wrote fires on KeyStone activity. Rules are self-service, and the Rule Writer agent can draft one from a plain-language description. Your team tests it against historical data to see who it would have flagged, then publishes it the same day.
- Investigate. AI Agents for fraud and AML investigations triage the alert, pull the member's history and linked accounts, and draft a summary before an analyst opens it. A person makes every decision.
- Act. The analyst blocks the card or places the hold in KeyStone from the case, in one click.
- Document and file. The action is already in the audit trail. If the activity warrants it, the case moves through AML case management to a SAR or CTR e-filed with FinCEN, with most fields filled in from the case.
Why acting from the case matters for credit unions
Most credit unions miss catching fraud due to the lag and friction of manually jumping between multiple systems. When blocking a card or placing a hold takes one click instead of a second login and a manual lookup, teams eliminate significant friction and delays, accelerating response times when catching fraudulent activity.
It also changes what you can show an examiner. The record of what you did starts the moment the analyst acts, tied to the alert and evidence behind it, instead of whenever someone remembers to note it somewhere else.
KeyStone fraud detection use cases, day-to-day
- Account takeover: someone logs in, adds a new payee, then tries to move a large sum minutes later. Unit21 catches the pattern, and the analyst stops the payment, blocks the card, and calls the member.
- P2P and instant payments: a transfer that doesn't match how this member normally moves money. The analyst places a stop payment and reviews it with the member.
- Elder financial exploitation: a long-standing account suddenly has a new payee or a large withdrawal. The alert gives someone time to reach out before the money is gone.
- Check fraud: a deposited check that doesn't fit the account's pattern. The analyst places a check hold in KeyStone without a separate login.
- Money mules: funds moving quickly in and out of a new or dormant account. The case links related members and accounts so the analyst can investigate, place holds, and file.
- BSA/AML compliance: structuring, unusual cash activity, and patterns across members. One workflow carries it from alert to case to SAR or CTR.
Credit unions already running Unit21 on Corelation
Directions Credit Union, a $1 billion credit union with 23 locations across Ohio and Michigan, runs Unit21 on Corelation. It replaced nightly batch detection and a homegrown system with rules its own team builds and tunes.
"I have true control of our fraud strategy and systems. Unit21's customizability allows me to create and test a rule in one day and deploy it that very same day."
- Jonathan Pollock, Chief Risk Officer, Directions Credit Union
Getting started on KeyStone
If your credit union runs KeyStone, the integration is ready to set up:
- Your Unit21 implementation team works with your KeyStone administrator to configure the Unit21 AML Extract.
- Your data team walks through field mapping with Unit21.
- KeyBridge credentials are set up for write-backs, and everything is validated in sandbox before it touches production.
Frequently asked questions
Is the KeyStone integration real-time?
Data from KeyStone arrives about every five minutes, which is near real time and fast enough for most fraud and BSA/AML monitoring. For decisions inside a member's digital banking session, such as a login or a payment, Unit21 also connects to digital banking platforms and returns a decision in under 150 milliseconds.
Who sets up the Unit21 AML Extract?
Your KeyStone administrator or data team configures it in your environment, with Corelation's support and Unit21's implementation team. You don't need to build or host a separate data pipeline.
Which actions can analysts take in KeyStone from Unit21?
Today, analysts can block a card, activate a card, place a stop payment, and place a check hold. Each action is sent through the KeyBridge API and logged in the Unit21 case with the request, the response, and the user who took it.
Does this cover BSA/AML as well as fraud?
Yes. The same KeyStone data powers fraud rules, AML transaction monitoring, case management, and SAR and CTR filing, so one team or two can work from one platform.
Talk to your Unit21 or Corelation representative to get started, book a demo, or meet us at the Corelation Executive Forum, October 21 to 23. You can also read the full announcement in our press release.
Read the full announcement in our press release to see the depth of the Unit21 + Corelation integration.
Kunal Datta is the Chief Product Officer at Unit21. Prior to Unit21, he led the Product team for Checkout at Fast, and prior to that, led the Product teams responsible for automating aerial wildfire safety inspections at Pacific Gas & Electric.
He has a background leading Product teams using AI to automate processes at regulated entities, as well as financial products, machine learning products, web applications, mobile applications, hardware products, and data products. Kunal is a Fulbright Scholar and studied Civil and Environmental Engineering and Music Science Technology at Stanford University.
