S-1041·AML Investigator·ALT-24093 · Ankit Verma
● Critical Priority · Due in 38 minAgent Autonomous Recommendation
Escalate STR and apply debit freeze
Write action: total debit freeze on A/c ****7712 · Escalate Suspicious Transaction Report (STR Form 2) to MLRO
Typology
Money mule / rapid pass-through syndicate
Inflow Velocity
37 UPI credits · 29 distinct payers · ₹6.75L in 48h
Outflow Pattern
3 IMPS + 2 ATM cash withdrawals in Kolkata (3.5h)
Home Branch
MP Nagar, Bhopal (A/c opened Nov 2025 via eKYC)
Risk Categorisation
High Risk · PMLA Category III · Declared income ₹15,000/mo
Statutory Notice
MHA NCRP Cyber Crime Portal token NCRP-20260918-447192
At Stake / Exposure
₹6,75,400
Verified Findings & Evidence Trail
- 1Velocity breach: ₹6,75,400 received via 37 UPI credits from 29 unrelated VPAs across 7 states within 48 hours; declared profile is student/unemployed with expected monthly throughput under ₹15,000.TXN-00031KYC-3350VPA-CLUSTER-88
- 2Immediate fund dissipation: 94.2% of credited funds siphoned within 210 minutes through 3 outbound IMPS transfers to newly added beneficiaries and 2 ATM cash withdrawals at terminal ATM-KOL-7892 (Park Street, Kolkata).TXN-00070TXN-00074EJ-ATM-KOL-7892
- 3Statutory Cyber Cell Freeze Notice: Received formal freeze requisition from Indian Cyber Crime Coordination Centre (I4C) via NCRP Portal under Acknowledgement Token NCRP-20260918-447192, citing victim complaint of task-based fraud.NCRP-LIEN-4471SEC-106-BNSS-NOTIF
- 4Geolocation & Device Anomaly: UPI credits initiated via Bhopal ISP IP block 103.21.x.x, while IMPS transfers and ATM cash withdrawals executed concurrently from Kolkata (distance 1,280 km in under 2 hours without transit plausibility).DEV-GEO-LOG-902SWITCH-IP-441
- 5Structuring pattern under PML Rule 3(1)(B): Multiple credits split into sub-₹50,000 tranches (₹49,500, ₹48,900, ₹49,999) to evade automated Cash Transaction Report (CTR) trigger rules.STR-EVAL-PMLAAML-RULE-C04
- 6Watchlist & Adverse Media: CKYC identifier cross-referenced with Central KYC Registry; mobile number 98260***** flagged in 3 previous cyber complaints across Gujarat and Maharashtra state police portals.CKYC-882190I4C-MULE-REG
Execution Trace7 tool calls
Deterministic audit trail- 01get_alert(ALT-24093)240ms
- 02get_customer_profile(C-3350 · eKYC Tier-2)180ms
- 03get_transactions(C-3350 · 90d window · 142 txns)490ms
- 04analyze_velocity(threshold: ₹50K · window: 48h)310ms
- 05query_ncrp_portal(token: NCRP-20260918-447192)820ms
- 06screen_watchlists(Ankit Verma · CKYC cross-match)410ms
- 07draft_str(FIU-IND Form 2 · grounds: Rule 7(1))640ms