אוטומציית הצטרפות לקוחות KYC/AML בשירותים פיננסיים עם n8n ו-Claude מדריך שלב אחר שלב

קליטת מועמד

{
  "application_id": "app_01HXYZ...",
  "received_at": "2026-05-03T09:14:22Z",
  "signature": "sha256=...",
  "channel": "web" | "mobile" | "advisor_assisted",
  "applicant": {
    "legal_first_name": "Maria",
    "legal_last_name":  "Hernandez Lopez",
    "date_of_birth":    "1986-08-14",
    "ssn_tokenized":    "tok_4f2c...",
    "citizenship":      ["US"],
    "tax_residency":    ["US"],
    "address": {
      "line1": "1422 Oak Ridge Dr",
      "city":  "Austin",
      "state": "TX",
      "postal_code": "78704",
      "country": "US"
    },
    "occupation":      "Software Engineer",
    "employer":        "Acme Software Inc",
    "annual_income_band": "100k-150k",
    "net_worth_band":     "250k-500k",
    "source_of_funds":    "employment_income",
    "investment_objective": "growth",
    "pep_self_declaration": false
  },
  "consent": {
    "kyc_screening": true,
    "credit_check":  false,
    "consent_signed_at": "2026-05-03T09:13:58Z",
    "ip_address_hash": "ipha_..."
  }
}

אימות תעודה + Liveness

CREATE TABLE id_verification (
  application_id     text PRIMARY KEY,
  provider           text NOT NULL,        -- persona | onfido | jumio
  provider_inquiry   text NOT NULL,
  document_type      text NOT NULL,        -- passport | drivers_license | id_card
  document_country   text NOT NULL,
  document_authentic boolean,              -- holograms / templates
  mrz_valid          boolean,
  nfc_chip_read      boolean,
  liveness_passed    boolean,
  face_match_score   numeric(5,2),
  poa_match          boolean,
  poa_doc_age_days   int,
  result             text NOT NULL,        -- approved | review | declined
  raw_payload_s3_key text NOT NULL,
  completed_at       timestamptz NOT NULL,
  created_at         timestamptz DEFAULT now()
);

-- Quick decision view that the routing node reads
CREATE VIEW id_decision AS
SELECT application_id,
       (document_authentic AND mrz_valid AND liveness_passed
        AND face_match_score >= 90 AND poa_match) AS straight_through,
       result
FROM   id_verification;

סינון סנקציות + PEP

{
  "method": "POST",
  "url": "https://api-worldcheck.refinitiv.com/v2/cases/screeningRequest",
  "headers": {
    "authorization": "Bearer {{ $credentials.worldcheck.token }}",
    "content-type": "application/json"
  },
  "body": {
    "groupId":  "{{ $env.WC_GROUP_ID }}",
    "entityType": "INDIVIDUAL",
    "providerTypes": [
      "WATCHLIST",   // sanctions
      "PEP",
      "MEDIA"
    ],
    "secondaryFields": [
      { "typeId": "DATE_OF_BIRTH",
        "value":  "{{ $json.applicant.date_of_birth }}" },
      { "typeId": "COUNTRY",
        "value":  "{{ $json.applicant.citizenship[0] }}" }
    ],
    "name": "{{ $json.applicant.legal_first_name }} {{ $json.applicant.legal_last_name }}"
  }
}

מודל סיכון של Claude

You are a KYC/AML risk-tiering engine for a US broker-dealer
operating under FINRA Rule 3310 and FinCEN BSA CIP/CDD rules.

You are NOT the final decision maker. You assign a risk tier
and write a justification that a registered compliance principal
will read before approving, escalating, or declining.

CDD POLICY (editable per firm):
- Geographies LOW: US, Canada, UK, EU/EEA, Australia, Japan
- Geographies MEDIUM: most LATAM, GCC, Eastern Europe
- Geographies HIGH: FATF call-for-action + black-list
  (currently: DPRK, Iran, Myanmar). Auto-route to EDD.
- Customer LOW: salaried, employer matches public records,
  source of funds = employment income, age 25-65
- Customer HIGH: cash-intensive business, NGO, complex trust,
  shell-company patterns, age <21 with >$50k initial deposit

SCREENING RULES:
- OFAC SDN exact-match (score >=95) -> tier=BLOCK
- OFAC SDN partial (80-94) with DOB+country match -> tier=BLOCK
- PEP tier 1 (head of state, minister) -> tier=EDD always
- PEP tier 2-3 -> tier=EDD if combined with HIGH geography
- PEP tier 4 (RCA, distant family) -> tier=STANDARD with note
- Adverse media on financial crime / terrorism -> tier=EDD
- Adverse media older than 7 years & resolved -> mention but do not escalate

OUTPUT — strict JSON, no prose outside the schema:
{
  "tier": "low" | "standard" | "edd" | "block",
  "dimensions": {
    "geography_risk":   0-100,
    "customer_risk":    0-100,
    "product_risk":     0-100,
    "screening_risk":   0-100,
    "behavioural_risk": 0-100,
    "funding_risk":     0-100
  },
  "composite_score":  0-100,
  "justification":    "3-5 sentences citing the strongest signals.
                       Cite policy lines by phrase, not line number.",
  "sar_flags": [
    "structuring_pattern" |
    "identity_inconsistency" |
    "high_risk_geography_funding" |
    "pep_undisclosed" |
    "sanctions_partial_match" |
    "source_of_funds_implausible"
  ],
  "edd_documentation_required": [
    "source_of_wealth_letter" |
    "employer_verification" |
    "bank_reference" |
    "tax_return_2y" |
    "trust_deed"
  ],
  "recommended_action": "auto_approve" | "analyst_review" |
                        "bsa_officer_review" | "decline"
}

Hard rules:
- If sanctions exact match: tier=block, sar_flags must include
  sanctions_partial_match (or exact), recommended_action=decline.
- Never invent screening hits. If the input has no PEP record,
  do not write one.
- Never store SSN or full DOB in the justification text.
- Cite the specific data point that drove each dimension score.

{
  "method": "POST",
  "url": "https://api.anthropic.com/v1/messages",
  "headers": {
    "x-api-key": "{{ $credentials.anthropic.apiKey }}",
    "anthropic-version": "2023-06-01",
    "content-type": "application/json"
  },
  "body": {
    "model": "claude-sonnet-4-5",
    "max_tokens": 1200,
    "system": "{{ $json.kycSystemPrompt }}",
    "messages": [
      {
        "role": "user",
        "content": "Application (PII redacted to fields the model needs):n{{ JSON.stringify($json.applicantRedacted) }}nnID verification result:n{{ JSON.stringify($json.idVerification) }}nnScreening hits:n{{ JSON.stringify($json.screeningHits) }}nnPlaid signal:n{{ JSON.stringify($json.bankSignal) }}"
      }
    ]
  }
}

ניתוב + טריאז' SAR

{
  "channel": "#bsa-alerts",
  "blocks": [
    {
      "type": "header",
      "text": { "type": "plain_text",
                "text": ":rotating_light: SAR trigger — application app_01HXYZ" }
    },
    {
      "type": "section",
      "fields": [
        { "type": "mrkdwn",
          "text": "*Tier*nBLOCK" },
        { "type": "mrkdwn",
          "text": "*Trigger*nsanctions_partial_match + identity_inconsistency" }
      ]
    },
    {
      "type": "section",
      "text": { "type": "mrkdwn",
                "text": "*Why blocked:* OFAC SDN match score 92 with DOB+country corroboration; address-of-record points to high-risk jurisdiction; declared occupation does not match Plaid income signal. Account locked, funding frozen, SAR draft generated for BSA review." }
    },
    {
      "type": "actions",
      "elements": [
        { "type": "button", "text": { "type": "plain_text",
          "text": "Open case" }, "style": "danger", "action_id": "open_case" },
        { "type": "button", "text": { "type": "plain_text",
          "text": "View SAR draft" }, "url": "https://internal.firm.com/sar/{{caseId}}" }
      ]
    }
  ]
}

You draft a SAR narrative that a BSA officer will review,
edit and file in FinCEN BSA E-Filing.

Format:
1. Who - subject identifiers (case file ID, NOT raw SSN)
2. What - the suspicious activity in plain English
3. When - dates and timestamps
4. Where - branch / channel / jurisdiction
5. Why - why is this suspicious
6. How - the mechanism / typology

Rules:
- 5W1H, no jargon, no marketing language
- Cite exact dollar amounts and dates from the evidence JSON
- Reference each underlying record by its case-file ID
- Identify the typology (structuring, layering, smurfing, etc.)
  if recognisable; otherwise say "typology not yet determined"
- Do NOT speculate about criminal intent
- Do NOT include raw SSN, full account numbers, or full DOB
- 350-700 words, examiner-ready prose

סנכרון CRM + יומן ביקורת

{
  "method": "PATCH",
  "url": "https://firm.my.salesforce.com/services/data/v59.0/sobjects/Account/External_Application_Id__c/app_01HXYZ",
  "headers": {
    "authorization": "Bearer {{ $credentials.salesforce.token }}",
    "content-type": "application/json"
  },
  "body": {
    "FirstName":  "Maria",
    "LastName":   "Hernandez Lopez",
    "PersonBirthdate": null,                              // never write full DOB
    "PersonMailingPostalCode": "78704",
    "Lifecycle_Stage__c":     "Active",
    "KYC_Risk_Tier__c":       "low",
    "KYC_Composite_Score__c": 22,
    "KYC_Justification__c":   "{{ $json.risk.justification }}",
    "Sanctions_Hits_Json__c": "{{ JSON.stringify($json.screening.hits) }}",
    "ID_Verification_S3_Key__c": "kyc-evidence/app_01HXYZ/persona.json",
    "EDD_Required__c":        false,
    "Last_KYC_Review__c":     "2026-05-03",
    "Next_Periodic_Review__c":"2027-05-03"
  }
}

-- Append-only table. INSERT-only role. No UPDATE / DELETE grants.
-- Hash chain so any tampering breaks the chain.

CREATE TABLE kyc_audit_log (
  id              bigserial PRIMARY KEY,
  application_id  text NOT NULL,
  step            text NOT NULL,            -- intake | id_verify | screen | risk | route | crm
  actor           text NOT NULL,            -- system:n8n | user:jdoe | system:claude
  action          text NOT NULL,            -- e.g. risk.tier=edd, screen.hit_logged
  evidence_s3_key text,
  prompt_sha256   text,
  output_sha256   text,
  prev_hash       text NOT NULL,            -- previous row's row_hash
  row_hash        text NOT NULL,            -- sha256 of (everything above)
  occurred_at     timestamptz NOT NULL DEFAULT now()
);

REVOKE UPDATE, DELETE ON kyc_audit_log FROM PUBLIC;
GRANT  INSERT, SELECT ON kyc_audit_log TO kyc_writer;

-- View FINRA examiners get (read-only, includes hash verification)
CREATE VIEW kyc_audit_examiner AS
SELECT id, application_id, step, actor, action,
       evidence_s3_key, occurred_at,
       (encode(digest(
          id || application_id || step || actor || action ||
          coalesce(evidence_s3_key,'') ||
          coalesce(prompt_sha256,'')   ||
          coalesce(output_sha256,'')   ||
          prev_hash || occurred_at::text,
          'sha256'),'hex') = row_hash) AS hash_valid
FROM   kyc_audit_log;