Skip to content

Suspicious-activity monitoring

Ongoing monitoring for suspicious activity across two fronts: payment fraud / AML transaction monitoring and network/application security. As a PSP, detecting and acting on suspicious activity is a core, continuous obligation — not a one-time check.

Two kinds of monitoring — don't confuse them

This page is about whether activity is legitimate (fraud, abuse, intrusion). For whether services are up and healthy (uptime, logs), see Operations & observability. The onboarding-time risk checks (AML, KYC, sanction screening) are the entry gate; the monitoring here is the ongoing obligation after a merchant goes live — see Digital Onboarding.

Not yet documented

This page is a structure to fill in. The controls below are placeholders; confirm what is actually in place with risk/compliance and engineering.

Payment fraud & transaction monitoring

Detecting suspicious payment patterns and meeting AML obligations on live transaction flow.

To confirm

  • What transaction patterns are monitored (velocity, amount spikes, unusual MCC activity, high chargeback rates, mismatched geographies)?
  • Is monitoring rule-based, model-based, or provided by an external tool / the acquirer-processor (Silverflow)?
  • What are the thresholds and who reviews alerts?
  • Reporting: how is a suspicious transaction escalated and reported (in Switzerland, to MROS — the Money Laundering Reporting Office)?

Network & application security monitoring

Detecting abnormal or malicious traffic against the platform (the API, portals).

To confirm

  • Is there a WAF, rate limiting, or bot/abuse protection in front of the API and portals (e.g. at nginx, the host, or a CDN)?
  • How is anomalous API traffic detected (failed-auth spikes, scraping, injection attempts)?
  • Where do security alerts go, and who responds?
  • Is there an intrusion-detection capability on the backend host?

Roles & escalation

Who owns monitoring, who triages alerts, and how incidents are escalated.

To confirm

  • Who is responsible for fraud/AML monitoring vs. security monitoring?
  • What is the escalation path and response-time expectation?