Architecture overview

High-level architecture

The Guardline Suite is organized into independent modules built on a shared services layer, the Guardline Core. Each module has its own frontend and backend and is deployed as a standalone application. Communication between the modules and the Core follows an internal messaging model, where each module requests services from the Core and receives responses asynchronously or synchronously depending on the operation.

Modules

Onboarding Platform (ONP) manages the registration flow for end users. The institution configures the steps of the journey (data collection, document verification, biometrics, list lookups) and ONP orchestrates the execution, delegating risk assessments and scoring to the Core.

Fraud Prevention Platform (FPP) lets analysts and managers monitor transactions in real time. Transactions go through the Core’s decision engine, which applies the rules configured by the institution and returns a decision (approve, reject, or refer for manual review).

Case Management Platform (CMP) centralizes investigation and case management. Cases can be created automatically by the decision engine or manually by analysts. CMP records every action in the Core’s audit trail.

Guardline Core

The Core provides cross-cutting services consumed by all modules:

• Decision Engine: executes the rules, flows, and policies configured by the institution. It receives requests from the modules and returns structured decisions.
• Authentication: manages identity and access for internal users, including SSO via SAML and OpenID Connect.
• List Management: maintains internal lists (configured by the institution) and consumes external lists (PEP, OFAC, UN) with real-time updates.
• Audit Trail: records every operation on the platform in an immutable log, accessible to the institution for audit and compliance purposes.
• Notifications: distributes alerts and communications to internal users according to configured rules.
• Scoring: calculates risk scores based on models and parameters defined by the institution.

External services

The platform consumes third-party services at two points:

• ONP integrates with verification providers (biometrics, document verification, registration data validation) according to the journey configured by the institution.
• The Core queries public sanctions and PEP lists (OFAC, UN, among others), keeping them updated in real time.

Regulatory compliance

The architecture was designed for compliance with the following regulations:

• Brazil: BACEN Circular 3.978 (AML/CFT procedures, KYC, monitoring, and communication to COAF), COAF resolutions, LGPD (Brazil’s data protection law)
• International standards: FATF recommendations for the prevention of money laundering and terrorist financing

The decision engine is configurable per jurisdiction, allowing the institution to define specific rules per country or operation.