FPP Integration

Overview

The Fraud Prevention Platform (FPP) is the Guardline Suite module responsible for transaction evaluation, for fraud prevention and for anti-money laundering (AML). Integrating with the FPP lets the institution’s system submit transactions for evaluation, receive decisions (approve, block, or raise an alert), and track the alerts raised by the rules engine and by behavioral analysis (UBA). The functional model of AML is described in the AML section.

Evaluation flow

The typical evaluation flow for a transaction follows these steps:

1. The institution’s system sends the transaction data to the FPP.
2. The rules engine evaluates the transaction based on the configured policies and on behavioral analysis.
3. The FPP returns the fraud decision (approve, block, or alert) along with the score and the breakdown of the rules that contributed to the score, and notifies the institution via webhook. Fraud alerts are handled in the FPP workbench.
4. In the AML domain, the same transaction is evaluated right after, outside the call. An AML alert of medium or high severity is dispatched by the FPP to the CMP, which opens or updates the case.

Integration modes

The FPP supports three integration modes, which can be combined according to the needs of the operation:

Synchronous: the institution sends the transaction and receives the decision in the same call. The contractual SLA for this mode is 300ms at the 95th percentile (P95). This is the recommended mode for transactions that need a real-time decision before the transaction is completed.

Asynchronous: the institution sends the transaction and receives an acknowledgement of receipt. The evaluation is processed in the background and the result is delivered via webhook. Recommended for scenarios where the decision does not need to be immediate.

Batch: the institution sends sets of transactions to a queue, which processes them in business date order, with per-item state and a rejection report. Recommended for initial load, history and reprocessing in AML, with two-phase replay: the history builds the behavioral baseline and then the transactions are scored.

Transaction types

The FPP accepts any monetary transaction (transfers, payments, withdrawals, Pix, TED, boletos) as well as customer events that may indicate risk (registration data changes, device changes, changes in access patterns). The institution defines which events to submit according to its risk policy.

Evaluation response

Each evaluation returns three elements:

• Decision: approve, block, or alert.
• Score: numeric score calculated by the rules engine.
• Breakdown: details of the rules that contributed to the score, with the weight and justification of each one.

This breakdown lets the institution understand the factors that led to the decision and feed its internal review processes.

Notifications

The institution receives webhook notifications about the main events related to fraud transaction evaluation: evaluation results, blocks, and alerts raised. Which events to receive is configured during integration setup. AML alerts go to the Decision Desk, and not to the fraud integrator.

All notifications include an HMAC signature for authenticity validation, as described in the integration concepts.