WO2016138183A1

WO2016138183A1 - Distributed money laundering detection system

Info

Publication number: WO2016138183A1
Application number: PCT/US2016/019425
Authority: WO
Inventors: Simon Byford MOSS; Thomas C. Fountain
Original assignee: Pneuron Corp.
Priority date: 2015-02-24
Filing date: 2016-02-24
Publication date: 2016-09-01

Abstract

A computer implemented distributed processing method for reducing false positive identifications of suspicious financial transactions comprises identifying, with a transaction monitoring system, a transaction occurring within a transaction processing system of a financial institution as suspicious. The method further comprises creating a case, using an internal data gathering object network, assigning, using a preliminary screening object network, a preliminary score to the case based on application of a set of one or more preliminary scoring rules to preselected factors of the acquired internal data. The method also comprises acquiring, using an external data gathering object network, external data related to the case and assigning, using a secondary screening object network, a secondary score to the case based at least in part on the preliminary score and the acquired external data.

Description

DISTRIBUTED MONEY LAUNDERING DETECTION SYSTEM

RELATED APPLICATIONS

[001] This application claims priority to United States Provisional Patent Application Serial No. 62/120,372.

BACKGROUND

[002] Corporations and financial institutions operate in an information environment where data sources, software applications, technology and analytics solutions, and source systems are often siloed and cannot readily interact with one another, both within and outside of a given enterprise. However, the information and analysis needed to address a new and immediate intelligence need of the business are often distributed across those siloed source systems.

[003] These corporations and financial institutions are commonly required to provide regulatory, audit and corporate surveillance and diligence to identify and interdict corporate malfeasance, fraud and money laundering. This is a complex problem distributed across the potentially siloed systems, but effective solutions are required by law.

[004] The TMS models can generate a large number of alerts (in the tens of thousands in some institutions), all of which have to be investigated through the AML and Fraud

Departments. This investigation, though tracked in the CMS, is largely a process of accessing large amounts of distributed data located in various sources (both internal and external to the institution) and can be subjective and inconsistent. Current processes take approximately 20-30 minutes to perform for each alert. Over 90% of these alerts are false positives, according to ACAMS, the Association of Certified Anti-Money Laundering Specialists. False positives are activities that look suspicious but are in reality innocuous.

[005] Institutions to date have tried to address issues with false positives by reducing the volume of alerts from the TMS by changing the thresholds of the models being used. This approach reduces the volume of false positive alerts but also increases the risk that the institution encounters, as potential exposures are now not being identified nor analyzed. [006] As companies and enterprises grow and become more complex, so does the cost, delay, risk, and repetition of current Fraud and AML analysis approaches. A new approach to solving these distributed business problems is needed.

SUMMARY

[007] A computer implemented distributed processing method for reducing false positive identifications of suspicious financial transactions, is presented. The method comprises a step of identifying, with a transaction monitoring system that includes a set of one or more transaction monitoring rules, a transaction occuring within a transaction processing system of a financial institution as suspicious. The method also comprises a step of creating a case within a case management system that includes the transaction. The method also comprises a step of acquiring, using an internal data gathering object network, internal data related to the transaction from one or more internal data sources of the financial institution. The method also comprises a step of assigning, using a preliminary screening object network, a preliminary score to the case based on application of a set of one or more preliminary scoring rules to preselected factors of the acquired internal data. The method also comprises a step of determining, using the preliminary screening object network and based at least in part on the preliminary score, whether the case requires further processing. The method also comprises a step of acquiring, using an external data gathering object network, external data related to the case from one or more external data sources external to the financial institution. This method step of acquiring includes retrieving, over an electronic communication network and using a first data access object that is part of the external data gathering object network, information related to the case from a politically exposed person database at a first location. This method step of acquiring also includes retrieving, over an electronic communication network and using a second data access object that is part of the external data gathering object network, information related to the case from one or more electronic news sources at a second location. This method step of acquiring further includes retrieving, over an electronic communication network and using a third data access object that is part of the external data gathering object network, information related to the case from a sanctions list at a third location. The method also comprises a step of assigning, using a secondary screening object network, a secondary score to the case based at least in part on the preliminary score and the acquired external data. The method also comprises a step of determining, using the secondary screening object network, whether the secondary score of the case exceeds a threshold score that indicates that the case involves money laundering. The method also comprises a step of presenting a visual representation of the acquired internal and external data upon which the secondary score is based. Finally, the method also includes, upon receiving an overriding determination that the case does not involve money laundering, the steps of identifying one or more factors of the transaction that indicate that the identification by the transaction monitoring system is a false positive; and modifying the transaction monitoring rules of the transaction monitoring system based at least in part on one or more of the identified factors.

[008] The computer implemented distributed processing method for reducing false positive identifications of suspicious financial transactions step of acquiring internal data related to the transaction may also include one or more actions selected from the group consisting of: using a data access object that is part of the internal data gathering object network to access a customer information file; using a data access object that is part of the internal data gathering object network to access a know your customer software application; using a data access object that is part of the internal data gathering object network to access an account management system; using a data access object that is part of the internal data gathering object network to access the transaction processing system; using a data access object that is part of the internal data gathering object network to access a customer due diligence system; using a data access object that is part of the internal data gathering object network to access an enhanced due diligence system; and using a data access object that is part of the internal data gathering object network to access an internal blacklist.

[009] The created case of the computer implemented distributed processing method for reducing false positive identifications of suspicious financial transactions, may also include a further selected set of transactions in addition to the transaction. The further selected set of transactions may be selected based on a time period determined from the time the transaction occurred. If the further selected set of transactions is selected based on this time period, the preliminary screening object network may evaluate the case against rules that are based on information selected from the group consisting of: a past alert within the time period; a past case within the time period; a past suspicious activity report filed within the time period; variation from average balance within the time period; and the type of alert generated by the transaction monitoring system.

[0010] Additionally, the further selected set of transactions may be selected based on an entity involved in the transaction. If the further selected set of transactions is selected based on this entity, the preliminary screening object network may evaluate the case against rules that are based on information selected from the group consisting of: a past alert for the entity; a past case for the entity; a past suspicious activity report filed for the entity; variation from average balance for the entity; and the type of alert generated by the transaction monitoring system.

[0011] In the computer implemented distributed processing method for reducing false positive identifications of suspicious financial transactions, the visual representation of the acquired internal and external data may be an interface that permits drill-down to the source of the acquired internal and external data.

BRIEF DESCRIPTION OF THE DRAWINGS

[0012] FIG. 1 is a block diagram overview of a system according to the present invention.

[0013] FIG. 2 is a block diagram overview of the system showing the presentation layer in further detail.

[0014] FIG. 3 is a block diagram overview of the system showing the server layer (cortex) and its component web service layer in further detail.

[0015] FIG. 4 is a block diagram overview of the system showing the server layer (cortex) and its component server runtime layer in further detail.

[0016] FIG. 5 is a block diagram overview of the system showing the data layer in further detail.

[0017] FIG. 6. is a block diagram of a generic independent processing object.

[0018] FIG. 7 is a network diagram showing an exemplary independent processing object network. [0019] FIG. 8A shows an example graphical user interface of a design studio.

[0020] FIG. 8B shows an example configuration dialog box available to the network designer in a design studio.

[0021] FIG. 8C shows an example options menu available to the network designer for effecting connections between independent processing objects in a design studio.

[0022] FIG. 9 A illustrates a first step in the addition of a new independent processing object instance to an independent processing object network in a design studio.

[0023] FIG. 9B illustrates a second step in the addition of a new independent processing object instance to an independent processing object network in a design studio.

[0024] FIG. 10 is a flowchart of the process of message passing between independent processing object instances in an independent processing object network.

[0025] FIG. 11 is a flowchart of the process of enforcing sequential dependencies between independent processing object network segments.

[0026] FIG. 12 is a flow diagram depicting a process that can be used to work with one or more clusters as part of a realm.

[0027] FIG. 13 shows a block diagram of an exemplary computing environment.

[0028] FIG. 14 shows an independent processing object network for creating account statistics based on an identified transaction.

[0029] FIG. 15A shows an independent processing object network for creating statistics based on an transaction monitoring system alerts.

[0030] FIG. 15B shows an independent processing object network for creating statistics based on an identified counterparty to a transaction.

[0031] FIG. 16 shows an independent processing object network for creating a suspicious transactions case risk score and recommendation. [0032] FIG. 17A is a process block diagram depicting the steps in a computer implemented distributed processing method for reducing false positive identifications of suspicious financial transactions.

[0033] FIG. 17B is a process block diagram depicting sub-steps of a step in the process of FIG. 17 A.

[0034] FIG. 18 shows an independent processing object network for adjustment of previously determined risk score.

[0035] FIG. 19 shows a graphical user interface presenting a visual representation of internal and external data on which a suspicious transaction case recommendation is based.

[0036] FIG. 20 is a perspective view of machine-readable storage devices.

DETAILED DESCRIPTION

[0037] Implementations of the inventive system and method allow the creation, deployment, and operation of a non-invasive business software solution through the use of a set of discrete independent processing objects. The independent processing objects execute with the support of a specialized runtime server called a cortex. There are many types of independent processing objects, each type at execution performing a discrete information processing function. For each instance of an independent processing object, the performance of its information processing function may be influenced by a number of configurable properties. Instances of these configured independent processing objects can be interconnected by users into networks such that the aggregate discrete information processing functions of the independent processing objects in the network create a business solution capable of handling complex structures and functionality. This interconnected independent processing object network can incorporate independent processing objects operating in differing machines, different domains, or even different networks, at physically separate or otherwise siloed locations. Thus, the information processing function of an independent processing object can be brought to and operate locally (e.g. within the same machine, domain, or local network) with each siloed information source, minimizing latency, while still remaining part of an overall distributed solution. [0038] System Overview

[0039] FIG. 1 is a block diagram overview of a system 100 for the operation of independent processing objects according to the present invention. The system 100 is presented in conceptual view of three primary layers: presentation layer 101, server layer 102 (or "cortex"), and data layer 103. The presentation layer 101 contains the primary graphical user interfaces between users and the system 100. The server layer 102 contains the primary support functions of the system 100. Server layer 102 further contains web service layer 104, which provides services necessary to enable communications of server layer 102 with external entities, including presentation layer 101, and server runtime layer 105, which hosts operating independent processing objects and provides services necessary to the performance of the information processing functions of hosted independent processing objects. The data layer 104 contains configuration data for the system 100.

[0040] FIG. 2 is a block diagram overview of system 100 showing presentation layer 101 in further detail. The primary user interface services of system 100 are included in presentation layer 101 : the design studio 201, the enterprise control manager (ECM) 202, the administrative control module 203, and the performance monitoring suite 204. Each of these interfaces may be one or more graphical user interfaces or terminal interfaces, and may be presented as web applications or system applications. User inputs in the presentation layer are provided to the web service layer 104 within server layer 102.

[0041] Design studio 201 is a graphical user interface that enables network designers to create, modify, deploy, and manage independent processing object networks, data source connections, and hosts within a private network or within a cloud computing environment. The design studio 201 may be configured to run on a web server in server layer 102 and operate in a thin client configuration.

[0042] Enterprise control manager 202 is a graphical user interface that enables users to configure a suite of intelligence visualization tools (widgets) with access to independent processing object network output data within system 100. Users may, through enterprise control manager 202, filter or modify independent processing object network output data to perform "what-if analyses and recast results instantaneously; or directly edit independent processing object network inputs in order to apply real-time changes to business functions, use cases, and intelligence. Enterprise control manager 202 also includes report creation toolsets. The enterprise control manager 202 may be configured to run on a web server in server layer 102 and operate in a thin client configuration.

[0043] Administrative control module 203 is a user interface that enables administrators to create, modify or delete system 100 users, to control access and authorization, configure user privileges, create and manage groups, set up host servers and their properties, set up virtual machine realms and their properties, and define aliases for connecting to data sources, file systems and other locations. Administrative control module 203 also can be used to configure data sources and pre-defined SQL queries which may be used to populate widgets displayed in enterprise control manager 202. Administrative control module 203 may be configured to run on a web server in server layer 102 and operate in a thin client configuration.

[0044] Performance monitoring suite 204 is a set of application/network performance monitoring tools enabling users to view performance metrics of system 100 in operation.

Performance monitoring suite 204 may be any of a number of commercially available application performance management tools. Performance monitoring suite 204 may be configured to run on a web server in server layer 102 and operate in a thin client configuration.

[0045] FIG. 3 is a block diagram overview of system 100 showing web service layer 104 of server layer 102 in further detail. Web service layer 104 includes a web server and servlet container, e.g. Eclipse Jetty, which manages various servlets, including the cluster monitor 301, file cache 302, and create XML message 303 servlets.

[0046] Web service layer 104 further includes a core engine 304 or web service framework including an XML based web services protocol stack, e.g. Apache Axis2, which supports the operation of various services, including license service 305, message service 306, monitor service 307, lock service 308, independent processing object configuration service 309, and logging service 310. License service 305 checks permissioned use of system 100 against externally assigned licensing limits. Message service 306 retrieves and passes messages between independent processing objects within server layer 102, sends messages to other server layers (cortex) 102 operating on other hosts, and receives messages from such other server layers (cortex) 102 and passes them to independent processing objects within server layer (cortex) 102. Monitor service 307 collects statistics about the performance of all elements of an instance of a server layer 102, in order to enable reporting on execution time and resource consumption. Lock service 308 prevents resource contention deadlocks, and allows access to a shared resource such as memory to only one system 100 component at any given time. When any one system 100 component accesses a shared resource, lock service 308 prohibits any other system 100 component from using that resource until the first system component has completed its use of that resource. Independent processing object configuration service 309 accepts requests to change a configuration of an independent processing object instance, and writes that change down to data layer 103. Logging service 310 captures alerts, alarms, and other system

notifications within a server layer 102. Based on predetermined configuration by the

administrator, logging service 310 then either reports the alarm, alert, or other notification to a predetermined destination, or packages the entire alert, alarm, or other notification and directs it to a predetermined location.

[0047] FIG. 4 is a block diagram overview of system 100 showing server runtime layer 105 of server layer 102 in further detail. Server runtime layer 105 hosts a execution manager 401 which manages a pool of available threads for the execution of individual independent processing object instances 402. Server runtime layer 105 also runs several services 403-406 that enable the execution of the independent processing object instances 402. These services include the business logic service 403, the message cache service 404, the data access logic service 405, and the database connection pool service 406.

[0048] At server runtime layer 105 startup, independent processing object configuration service 309 retrieves through database connection pool service 406 all configuration properties of all independent processing object instances configured to run within this instance of the server runtime from data layer 103, where configuration data for every independent processing object instance 402 is maintained, and caches them in an independent processing object configuration data store in local memory. This eliminates the latency of retrieving properties from the configuration database 103 at runtime. [0049] Message service 306 handles all message routing within server layer 102. It further handles all message routing among cortexes (server layers) either through a web service with self-describing XML messages or by passing them through a third party JMS service.

[0050] Execution manager 401 provides an execution platform for runtime operation by allocating an execution thread to an individual independent processing object instance 402 when a message is received from message service 306 for that distinct independent processing object instance 402. When a message is received for a specific independent processing object instance 402, the execution manager 401 also retrieves that instance's 402 configured properties from the independent processing object configuration data store cached in local memory by independent processing object configuration service 309, then passes both those configured properties of the independent processing object instance 402 and the incoming message to the allocated execution thread for execution. Once execution of independent processing object instance 402 on the message concludes, execution manager 401 de-allocates the processing thread for use by other executing independent processing object instances 402.

[0051] FIG. 5 is a block diagram overview of system 100 showing data layer 103 in further detail. Data layer 103 includes a configuration database 501, which stores configuration data for system 100, such as the parameters of operation for server layer 102, and the configuration properties of each individual independent processing object instance 402. The configuration database 501 may be implemented using any of a variety of commercially available database management systems, including Oracle, Microsoft SQL, and MySQL systems.

[0052] Configuration database 501 contains the full record of all independent processing object network design information within system 100. For each individual independent processing object instance 402 in system 100, configuration database 501 contains its unique name, configured properties, and full connection set. Configuration database 501 is therefore the complete description of the total topology of each independent processing object network within system 100. As each individual independent processing object instance 402 is selected, configured, and connected with other independent processing object instances 402 to form independent processing object networks, configuration database 501 is dynamically updated.

[0053] The Independent Processing Object [0054] FIG. 6. is a block diagram of a generic independent processing object 600. Independent processing object 600 is a type of software object with the dual purposes of (1) abstracting both specification of complex functionality either natively or in conjunction with connection to existing software systems; and (2) implementing and executing that functionality. Independent processing object 600 has two key features: (1) independent processing object 600 acts as a container for, and executes with software processing unit (SPU) 601, a designated information processing function; and (2) independent processing object 600 is uniformly interoperable with other independent processing objects.

[0055] Independent processing objects 600 are generally of specific types, differentiated by the designated information processing function contained. Software processing unit (SPU) 601 is a software virtual equivalent of a processing unit that is highly specialized to efficiently perform a particular information processing function. SPU 601 commonly has a variety of configuration options for its particular information processing function (e.g. algorithms from which a network designer may choose, data sources, etc.). The network designer's selected configuration options for each instance of an independent processing object 600 are stored as configuration instructions in configuration database 501.

[0056] Independent processing object 600 may receive inputs in the form of a self-describing XML message whose contents contain information for processing by an instantiated independent processing object's 600 configured SPU 601. XML messages act as triggering events to indicate to execution manager 401 to launch an instance of an independent processing object 600. When an incoming message arrives at execution manager 401 of a server layer 1 02 hosting the message's target independent processing object, execution manager 401 allocates a processing thread to and launches an instance of that target independent processing object. At this instantiation of an independent processing object 600, the configuration instructions are retrieved from the independent processing object configuration service 309, where such instructions are cached after retrieval from configuration database 501 at server startup, and are applied to the SPU 601, dictating the SPU' s 601 exact operation. In execution, the instance of the independent processing object 600 receives these XML messages, processes them through its configured SPU 601, and produces a revised XML message with appropriate transformation, addition or deletion of XML fields. [0057] The structure of the XML message is conceptually straightforward: a message metadata header describing the syntax and semantics of the accompanying data payload, and the data payload of various tagged field names and their respective values. As a message is received by a downstream destination independent processing object in a network, the message elements are parsed and passed to the receiving logic in the destination independent processing object. This message-based integration allows very broad flexibility to interconnect highly disparate technologies.

[0058] In addition to the core information processing function executed by SPU 601, independent processing object 600 may perform a number of support functions directed towards uniform interoperability. Independent processing object 600 may have: an XML translator 602; a state indicator 603; an event subscription service 604; an event broadcast service 605; a message receptor 606; a message constructor 607; a message transmitter 608; and a metadata-based rules matrix 609. The many types of independent processing objects that perform different information processing functions all share this common prototypical construction.

[0059] Messages directed to an instance of independent processing object 600 are received by message receptor 606 and passes them to XML translator 602. Notification messages of internal system events (such as independent processing object failed processing because source system is unreachable) events broadcast partially or entirely system-wide are received by event subscription service 604. Event subscription service 604 determines if the event is relevant to the instance of the independent processing object 600, and if relevant, passes the notice message to XML translator 602. XML translator 602 parses the incoming message from message receptor 606 or event subscription service 604, identifying the metadata components of the header and the data payload.

[0060] The parsed metadata of the header is passed to metadata-based rules matrix 609. Metadata-based rules matrix 609 examines the parsed header information, applying

predetermined rules that impute meaning to the XML tags delimiting the header information and the data payload. XML translator 602 then converts the parsed data payload to the appropriate code (e.g. byte code, binaries) for processing in SPU 601 based on the meanings determined by metadata-based rules matrix 609. XML translator 602 passes the data payload code to the appropriate inputs of SPU 601. SPU 601 executes its configured information processing function on the parsed data payload.

[0061] The results of the primary information processing function are expressed as some combination of state setting, message construction, message transmission, and/or event broadcast. If the results of the configured information processing function generates data to be passed as a payload, the results are passed to message constructor 607. Message constructor 607 assembles the results from SPU 601 into a new outgoing message with appropriate metadata header and data payload. When the new outgoing message is complete, message constructor 607 passes the new outgoing message either to event broadcast service 605, or to message transmitter 608, as determined by SPU 601.

[0062] New outgoing messages passed to event broadcast service 605 are delivered to message service 306 for broadcast across part or all of the system. New messages passed to message transmitter 608 are delivered to message service 306 for direction to a subsequent independent processing object in a network. SPU 601 also may indicate the state of the instance of independent processing object 600 at any time by recording that state to state indicator 603, which maintains that state until subsequently updated. For example, on failure of processing, SPU 601 may set state indicator 603 to "independent processing object failed." Such an event also may be broadcast through event broadcast service 605 for retrieval at the server layer 102 for possible follow up action by an error handling system.

[0063] Types of Independent Processing Obj ects

[0064] Each independent processing object 600 performs a unique information processing function and produces a specific type of output. Independent processing objects may, for convenience, be conceptually grouped into logical categories that represent commonly grouped functions within an independent processing object network for convenience. These groupings can, for example, be used to categorize independent processing objects in menus for selection when creating an independent processing object network. The five logical groupings are analytics, cloud services, data interaction, messaging, and output independent processing objects. The information processing functions of analytics independent processing objects are those that provide data processing of one type or another, such as matching algorithms, Boolean logic, predictive modeling, etc. The information processing functions of cloud services independent processing objects provide access to and interaction with scale-out processing infrastructures such as cloud services, as well as manage optimization of their use in conjunction with independent processing object networks. The information processing functions of data interaction independent processing objects provide uni- or bidirectional data transfer between independent processing object networks and a wide variety of data sources or applications. The information processing functions of messaging independent processing objects manipulate, augment, append or route messages passed between independent processing objects. The information processing functions of output independent processing objects deliver results to various destination systems. Specific independent processing object types are described below for convenience. It would be readily apparent for one of ordinary skill in the art to develop additional independent processing objects.

[0065] Adapter. A data interactions independent processing object, the Adapter independent processing object caches large data sets for processing with one operation to avoid repeated query demand on the underlying relational database. This allows users to cache large data sets for offline operations. By configuring the Adapter independent processing object to use a database query or a web service, the user can access and cache data sets locally. The cached data sets are available within the cache directory located on the independent processing object server, and are broken down into the header file and the data file respectively for every single fetch. The cached data sets are easily accessed within a Matching Pro or Analytic independent processing object by using the call function. The Adapter independent processing object also can configure the refresh time interval for the data fetch. This feature allows the user to easily control the data access time and fetch interval for caching the data. When solving problems that require large data sets, users may wish to avoid repeatedly querying production data sources. Since database access can be costly and consume significant processing resources, configuring an Adapter independent processing object to cache during off hours/low usage times reduces the stress on the database. In addition, the Adapter independent processing object is useful to cache data provided by external web services.

[0066] Analytic. An analytics independent processing object, the Analytic independent processing object executes a selected analytical, mathematical and statistical algorithms in real- time against data in the independent processing object network. This allows network designers to apply existing or imported analytical routines to the contents of incoming messages. The Analytic independent processing object works across a range of data types, most typically the integer and floating point values used in mathematical analyses. When configuring the independent processing object, network designers may select from available embedded algorithms, such as the Apache Math Library, to provide routines appropriate for the required analyses. Network designers also may import existing algorithms (e.g. in the form of Java jar files) or custom build routines using built-in editing tools in design studio 201. A diagram editor for constructing analytic functions is accessible from a configuration dialog box for the Analytic independent processing object. It includes a sets of constructs such as If / While loops or 'declare a variable', 'set a variable', etc. for selection and configuration by the network designer. As a result, the network designer can map out the processing sequence of the desired analytic function. Configuration of the Analytic independent processing object to execute the required analyses consists of selecting fields from incoming XML messages and directing those fields to appropriate inputs of the selected algorithm.

[0067] Case. An analytics independent processing object, the Case independent processing object creates multiple message routing paths based on defined conditions within the XML data in messages. This allows network designers to route messages based on the result of multiple evaluation criteria. Used as a 'case' statement, this independent processing object is typically used for branching to other independent processing objects based on the evaluation of one or more data elements and conditions within the data set. Messages are routed along multiple branches of a network from a Case independent processing object depending on the conditions within a given business problem. Complex decision trees are implemented by chaining a series of Case independent processing objects together. Within the configuration of the Case independent processing object, multiple outgoing branches are made active by providing overlapping case criteria.

[0068] Check Transaction. A messaging independent processing object, the Check

Transaction independent processing object checks to determine if all messages marked by the Start Transaction independent processing object have been processed. This allows network designers to implement sequential dependencies between independent processing objects or networks within a project. Used in conjunction with the Start Transaction independent processing object, the Check Transaction independent processing object continuously checks to see if all message activity within the network (or other defined set or subset of independent processing objects) has concluded. Once the message activity has concluded, the Check

Transaction independent processing object outputs a message to any successively connected independent processing objects or networks. The Check Transaction independent processing object provides sequential processing capability for independent processing objects or networks where strict execution order must be maintained. Such sequential processing is a common requirement in applications where items like summary statistics are only computed after all prerequisite processing has completed. The Check Transaction independent processing object also is used to help eliminate unknown or random wait times between parallel processing activities in a broader set of networks.

[0069] Compare. An analytics independent processing object, the Compare independent processing object is used to create two alternate paths within an independent processing object network by configuring an if/else statement. This allows network designers to route messages based on the result of specified evaluation criteria. Used as an 'if/else' statement, this independent processing object is used for branching to other independent processing objects based on the evaluation of a condition statement that results in a true or false result for each message. Thus, the Compare independent processing object directs messages and data through different paths within an independent processing object network based on the evaluation of one or more data elements within the data set. Messages are routed along a "true" or "false" branch of a network from a Compare independent processing object depending on the conditions within a given business problem. Complex decision trees are implemented by chaining a series of Compare independent processing objects together.

[0070] Complete Message. A messaging independent processing object, the Complete Message independent processing object enables individual networks in an independent processing object cluster to receive notification upon completed processing of a Unit of Work (a JMS message). This allows network designers to mark units of work complete in a multi-node clustering scenario. Clustering is a highly useful construct that offers both parallel processing opportunities for large workloads and a higher degree of resiliency in mission-critical scenarios. The Complete Message independent processing object is a critical component of the system's 100 clustering infrastructure and ensures that no workload is lost in the event of node failure. These processing nodes of a cluster include one or more independent processing objects and receive dispatched units of work from the Dispatcher independent processing object. To ensure against loss of active units of work, all dispatched messages are written to a durable message table where they are retained until "retired" by the destination node. In the event of a lost node, unfinished units of work are re-queued from the durable table to a still active node. The

Complete Message independent processing object is placed at the terminating point of each node's independent processing object chain and signals the Dispatcher independent processing object to retire the specified unit of work. This functionality may alternatively be implemented within message service 306.

[0071] Custom. The Custom independent processing object allows developers to create new independent processing object types by placing custom logic within a standard independent processing object shell that maintains interoperability with all other independent processing objects. The Custom independent processing object can become any of the five logical groupings of independent processing object types. It allows network designers to create a custom-designed independent processing object that contains user-specified processing logic and user interface components. The custom independent processing object is essentially an execution shell that shares the same interoperability as all other independent processing objects, but allows customization of internal behaviors to specific, user defined functionality.

[0072] Data Type. A data interaction independent processing object, the Data Type independent processing object casts incoming XML fields to a specified data type. This allows network designers to cast the data type of an incoming XML element to a different data type. Casting allows a user to convert the data type for an extracted data attribute to meet the specific requirements of subsequent independent processing objects in a network. The Data Type independent processing object enables translation of XML element data types for consistency when receiving and processing messages and their associated fields between independent processing objects. An independent processing object extracts the elements in their native form from databases, files and third party services. The data is passed to subsequent independent processing objects in the native data type format, which may be inconsistent with various independent processing objects' required fields' data types. If the data types are not consistent when processing, the independent processing objects will not be able to interpret and process the messages, and an exception will occur. By configuring the Data Type independent processing object to enact the required translation, the relevant fields are re-cast for proper processing. For example, if the extracted data attribute is an integer and the matching algorithm requires a string, the Data Type independent processing object is inserted into the network between the data extraction and matching network segments to accomplish the required translation of the extracted data from an integer to a string.

[0073] DB Stream. A data interaction independent processing object, the DB Stream independent processing object streams file content into a relational database column.

[0074] Dispatcher. A messaging independent processing object, the Dispatcher independent processing object acts as a central controller in dispatching and monitoring Units of Work (JMS Messages) to sub-networks. This allows network designers to create clusters of defined sets of independent processing object instances that provide for both parallel processing and/or increased availability of distributed networks. Clustering is a highly useful construct that offer both parallel processing opportunities for large workloads and a higher degree of resiliency in mission-critical scenarios. The Dispatcher independent processing object is the critical component of the system's 100 clustering infrastructure and ensures sustained performance of work across various processing and environmental scenarios. The Dispatcher independent processing object employs various dispatching algorithms to vector incoming units of work among two or more worker nodes, i.e., a cluster, in response to conditions including escalation of workload or failure of an active node. Further, the Dispatcher independent processing object is responsible for re-queuing work in the event of node failure and subsequent cluster reformation. This functionality may alternatively be implemented within message service 306.

[0075] Document. A data interaction independent processing object, the Document independent processing object indexes documents and retrieves the file name for each document containing a specific search string. It can be used to both create an index of a file, set of files in one directory, or set of files across multiple directories and create cached copies of files that have content that matches specified search criteria. Those cached files are then available for processing by subsequent steps in the independent processing object network where targeted content can be parsed out of the source files for further processing.

[0076] File. A data interaction independent processing object, the File independent processing object is used to access files and retrieve specific contents for further processing within an independent processing object network. Significant content may be stored outside of relational databases, in files available on the network or file servers (for example, CSV files, or other structured or semi -structured file types). During the design process, network designers configure the parsing behavior of the File independent processing object to extract specific content of value for use by downstream processing independent processing objects.

[0077] File Writer. A data interaction independent processing object, the File Writer independent processing object is used to write results of independent processing object processing directly to a standard file format.

[0078] Filter. A data interaction independent processing object, the Filter independent processing object filters fields from XML messages and passes only the selected fields forward in the network. This allows network designers to eliminate specified fields from an incoming XML message before that message is propagated through the network. Use is desirable in cases where sensitive information is required for processing in one portion of a network, but should be eliminated from visibility in other parts of the network or prevented from propagating to other hosts. Data privacy laws also may require such use. Additionally, the Filter independent processing object provides a convenient mechanism to reduce XML message size when fields are no longer needed, potentially improving both processing times and network bandwidth demands during execution.

[0079] FTP. A data interaction and output independent processing object, the FTP independent processing object allows interaction with an FTP server to retrieve or store information. The FTP independent processing object sends files to or receives files from a remote server using the File Transfer Protocol.

[0080] FIDFS Read. A data interaction independent processing object, the FIDFS Read independent processing object is used to read files from an FIDFS (Hadoop) file system. [0081] HDFS Write. A data interaction independent processing object, the HDFS Write independent processing object is used to write files into an HDFS (Hadoop) file system.

[0082] HTTP. A data interaction independent processing object, the HTTP independent processing object retrieves from or posts information to a specified uniform resource locator (URL) using HyperText Transfer Protocol. The HTTP independent processing object retrieves an HTTP response as a file.

[0083] HTTP Get. A data interaction independent processing object, the HTTP Get independent processing object works as an HTTP proxy that enables the capture of individual HTTP requests. Each request is sent in a message with the request details.

[0084] HTTP Send. A data interaction independent processing object, the HTTP Send independent processing object serves as proxy to send created XML messages to a specified URL for further processing.

[0085] HUD. An output and data interaction independent processing object, the HUD (Heads Up Display) independent processing object allows network designers to include direct end user interaction with a running independent processing object network in the form of a configurable application that appears to the end user within its own window. With this capability, information is extracted from a running network and displayed in various forms to the user. Alternatively the network receives information from an end user who then interacts with buttons, dialog boxes, etc. of the displayed window. The HUD independent processing object is used also to present recommendations developed within a processing network for ultimate agreement or

disagreement by a user.

[0086] JMS Listener. A messaging independent processing object, the JMS Listener independent processing object provides the ability to listen to a JMS queue. The JMS Listener independent processing object retrieves messages from a specified JMS topic to provide a point of entry into an independent processing object network from a JMS messaging system. By specifying the appropriate JMS connection, the independent processing object network is able to retrieve messages from enterprise-class messaging infrastructures. [0087] JMS Publisher. A messaging independent processing object, the JMS Publisher independent processing object provides the ability to place an XML message onto a JMS queue. The JMS Publisher independent processing object posts information in the form of JMS messages on a specified JMS topic to provide an outbound path for messages destined for other resources in the broader environment. By specifying the appropriate JMS connection, the independent processing object network is able to send messages through enterprise-class messaging infrastructures.

[0088] Mail. An output independent processing object, the Mail independent processing object sends messages to a remote user(s) at specified email address(es) using the Simple Mail Transport Protocol (SMTP). The Mail independent processing object requires the user, or designer, to provide an SMTP server and login information. A Mail independent processing object can be configured in any portion of a network. For example, a Mail independent processing object is configured to send an e-mail alert to a user when the error branch of

Compare independent processing object is triggered. In another example, a Mail independent processing object sends an email of the results of a network, e.g. a bank account low balance alert.

[0089] Matching Pro. An analytics independent processing object, the Matching Pro independent processing object provides complex matching algorithms that can be used to identify and consolidate duplicate records or match records from different databases. This allows network designers to match records or fields from multiple record sets using a variety of matching algorithms. The Matching Pro independent processing object effects a two-step process of data scrubbing and matching between data sets. Alternatively, the data scrubbing and matching functions occur separately as the information processing functions of a data scrubbing independent processing object and a matching independent processing object, respectively.

Network designers can configure scrubbing algorithms to remove special characters, title abbreviations (Mr., Ms., Jr., etc.), or other abbreviations contained within the data elements of all data sets. A diagram editor for constructing composite matching processes is accessible from a configuration dialog box for the Matching Pro independent processing object. It includes a sets of constructs such as If /While loops or 'declare a variable', 'set a variable', etc. for selection and configuration by the network designer. The network designer thereby maps out the processing sequence of the desired matching function. The network designer also selects one or more of the matching algorithms and weighting sequences available within the Matching Pro independent processing object matching library to apply within that processing sequence the match elements between the data sets, and generate a message indicating a match if a match confidence threshold is met.

[0090] The network designer user may choose to apply any one or more data scrubbing or matching processes to the provided match record sets at runtime, including: name & address cleanse, unique identifier match, perfect name match, alias matching, Jaro-Winkler distance algorithm, Phonetic match, deterministic matching, probabilistic matching, or other custom matching rules. In the design studio, the Matching Pro independent processing object is associated with a graphical diagram editor (accessible through the icon for that independent processing object instance) with various configurable primitives to construct analytical routines, including the ability to retrieve data, create new variables, perform analytical routines, and store results in said new variables.

[0091] New Message. A data interaction independent processing object, the New Message independent processing object generates a new XML message when defined criteria are satisfied by the content of an incoming XML message. This allows network designers to create a new XML message with user tags defined within the configuration properties of the New Message independent processing object instance. The New Message independent processing object thus allows network designers to create new messages or manipulate existing messages to, for example, remove tags and data elements which might be of a sensitive nature. The sensitive data can be used within a network for calculations or other models and logic, and then removed so that only results oriented data is passed through the network.

[0092] Persist. A data interaction independent processing object, the Persist independent processing object is used to save a message to a database table for future processing. This allows network designers to store XML messages passed through it into the configuration database 501. This enables storage of messages that may be needed at a later time for audit or other purposes.

[0093] Predictive. An analytics independent processing object, the Predictive independent processing object enables users to import and execute a Predictive Model Markup Language (PMML)-compliant predictive model within a network. This allows network designers to incorporate and apply predictive analytics models (such as logistic regression) in the independent processing object network by converting a PMML-compliant predictive model into a runtime executable. At design time, the predictive model is imported and associated with the Predictive independent processing object instance in configuration database 501. Also at design time, the Predictive independent processing object decomposes predictive model and creates an executable representation of the model logic (e.g. a Java jar file), which then executes as the statistics engine SPU 601 of the Predictive independent processing object at run time.

[0094] Print. An output independent processing object, the Print independent processing object displays the contents of an XML message to the independent processing object system's server console. This allows network designers to direct the full contents of an XML message to the system console for viewing and/or printing. The Print independent processing object requires no configuration, and is added at any point in a network to gain visibility to the contents of messaging passing that point in the design.

[0095] Project. The Project independent processing object is a special general independent processing object that serves as a container for all independent processing objects within a specified "project" and provides parent context.

[0096] Query. A data interaction independent processing object, the Query independent processing object provides ability to create and execute a SQL database query against a defined data source. This allows network designers to execute a SQL database query against a defined data source. By configuring specific queries, a network designer is able to target and retrieve only the specific data required for the target solution. The data source need not be located on the same physical computing device as the Query -type independent processing object, but may access the data source through an electronic communication network. The object accesses the data source with an appropriately credentialed alias. Within the configuration properties of the Query independent processing object, a database source property indicates the specific connection alias that is used to properly target the desired source database. This alias is a pre- configured, credentialed connection to a specific database set up by a privileged user. The database connection pool 406 within runtime layer 105 establishes, in the database query case, an API data access connection (such as a JDBC connection) to the target source database which is the conduit for the passing of the configured SQL query logic and returned results set.

[0097] Within the configuration properties of the Query independent processing object, a query statement property indicates the specific SQL query that will be executed against the target source database. Queries may be simple or complex, involving joins, database functions, or advanced conditions. At design time, the network designer has the option of importing an existing SQL statement directly into the Query statement property or using the embedded visual query building tool, where designers can visualize the tables and fields accessible for the given alias and through point-and-click operations visually construct the intended SQL query.

[0098] Record. A data interaction and output independent processing object, the Record independent processing object records and stores events for auditing. The Record independent processing object stores elements from XML messages in the configuration database 501 or other database. The Record independent processing object provides network designers with the ability to store XML message contents at any point in their network design, to serve, e.g., audit or solution debug purposes. The Record independent processing object stores selected contents of XML messages in a database for subsequent review in history and hi story values tables. The history table is updated with one row for each XML message received. The data stored in the history table includes the message id, timestamp and name of the Record independent processing object. The data elements from each XML message are written to the history_ values table. There is one entry for each data element.

[0100] Remove Persistent. A data interaction independent processing object, the Remove Persistent independent processing object deletes a message previously stored by a Persist independent processing object from a database table. This allows network designers to remove messages originally stored by the Persist independent processing object from the message history tables when the stored message content is no longer needed (e.g., after debug or audit has concluded).

[0101] Rules. An analytics independent processing object, the Rules independent processing object allows network designers to apply business logic rules to the contents of incoming messages. The Rules independent processing object incorporates a business logic development and integration engine, such as the Drools runtime rules engine, for performing deduction, rewriting, and further inferential-transformational tasks. When configuring the independent processing object in design studio 201, network designers import a RulesML compatible model which is decomposed and re-constituted as one or more JAVA jar files, available for execution by the specific Rules independent processing object instance at run time.

[0102] SAS. An analytics independent processing object, the SAS independent processing object allows network designers to import existing SAS (Statistical Analysis System) PMML models for analysis. During the import process, the SAS model is converted into a runtime executable which is stored within a dedicated independent processing object type. This allows the SAS model to be applied without the dependency of an underlying SAS database. Rather, units of work (payload of an XML message, cache files, etc.) serve as inputs to the SAS independent processing object which perform the requisite computations. The SAS independent processing object can be used in any part of a network and additionally replicated where needed to facilitate parallel processing.

[0103] Save. A data interaction independent processing object, the Save independent processing object stores the complete XML message received to a local directory. The Save independent processing object can be used multiple times and in any location within a network. The Save independent processing object provides a simple and convenient way to export individual messages outside the independent processing object environment.

[0104] Schedule. A data interaction independent processing object, the Schedule independent processing object provides ability to configure time intervals and recurring events for executing independent processing objects or an independent processing object network.. This allows network designers to configure start times, time intervals and recurrent events for executing independent processing objects or an independent processing object network (such as starting an independent processing object on the 3rd of each month at 9:00pm).

[0105] Sequence. A messaging independent processing object, the Sequence independent processing object allows network designers to set and increment a message counter within an independent processing object network. The Sequence independent processing object counts messages passed to it and passes the message count along in the message payload to other independent processing objects.

[0106] Service. A data interaction and output independent processing object, the Service independent processing object connects to a web service defined by a Web Service Description Language (WSDL) specification. This allows network designers to initiate web service requests and receive web service responses from applications using Simple Object Access Protocol (SOAP) and HTML. The Service independent processing object retrieves information from web services and adds the information to the independent processing object network's XML messages for additional processing. In one example, a Service independent processing object interacts with a web service, such as SalesForce.com, SAP or Oracle to retrieve customer information. In another example, the Service independent processing object retrieves the current stock price for a specific stock symbol. Web services use XML to code and decode data, and SOAP to transport the data. SOAP is an XML-based protocol that allows applications to exchange information over HTTP. WSDL describes a web service and advertises the functions it supports. The Service independent processing object interrogates the WSDL file to display the methods supported by the web service.

[0107] Sniffer. A data interaction independent processing object, the Sniffer independent processing object monitors a URL and performs an action if activity at the URL is detected. This allows network designers to monitor specific ports for HTTP activity and bring the HTTP request into the system 100 environment. The Sniffer independent processing object thus enables system 100 to respond to HTTP requests with specifically configured actions that key off the content of the HTTP request. An example is to monitor for an end user-initiated action to open a customer service record. A Sniffer independent processing object detecting the act of opening that customer record could then automatically launch a distributed analytics solution independent processing object network to gather data specific to that customer, perform integrative analysis and provide it to the end user, rather than requiring the end user to manually gather that secondary information. [0108] Solr. A data interaction independent processing object, the Solr independent processing object provides direct search interface into an Apache Solr content management and search repository.

[0109] Start Transaction. A messaging independent processing object, the Start Transaction independent processing object flags network messages as transactions for tracking network start. This allows network designers to implement sequential dependencies between independent processing objects or independent processing object networks. Used in conjunction with the Check Transaction independent processing object, Start Transaction initiates internal message tracking that tags all active messages as elements of a sequential independent processing object network. As new messages are created, they are tagged with an ID associated with the Start Transaction independent processing object. As these messages progress through an independent processing object network, existing messages are destroyed and new ones created. The Start Transaction independent processing object provides sequential processing capability for independent processing objects or networks where strict execution order must be maintained. Such sequential processing is a common requirement in applications where items such as summary statistics can only be computed after all prerequisite processing has completed.

Through the same message tracing mechanisms, the Start Transaction independent processing object also can be used to help account for unknown or random wait times between parallel processing activities in a broader set of networks by providing the ability to track the execution of concurrent logic paths, and in conjunction with the Check Transaction independent processing object, signal completion only when the last of possibly several execution paths has completed processing.

[0110] Stored Procedure. A data interaction independent processing object, the Stored Procedure independent processing object calls a stored procedure within a defined data source. This allows network designers to run a stored procedure in a database, where a data source definition for that database has been created in the system 100. Database administrators and programmers often create stored procedures to maximize database efficiency or ensure accuracy and consistency of configured queries. These procedures may be configured for particular functions, calculations or results. Typical uses for stored procedures include data validation (integrated into the database) or access control mechanisms. Stored procedures also can consolidate and centralize logic that was originally implemented in applications. Extensive or complex processing that requires execution of several SQL statements is often moved into stored procedures, and applications call the procedures.

[0111] Update. A data interaction and output independent processing object, the Update independent processing object executes a database insert, delete or update statement against a defined data source.. This allows network designers to execute a SQL database statement to insert new records, update existing records or delete records within a defined data source.

Running an independent processing object network that processes data, executes analytics or otherwise produces results and intelligence creates information that can be maintained in a database. The Update independent processing object inserts these results (or deletes or updates them) into any database where a database source definition has been created in system 100 and where the user has privileges to create or update records.

[0112] Variable Cache. A data interaction independent processing object, the Variable Cache independent processing object inserts pre-defined user variable values into an outgoing XML message. These values can be viewed and changed in the ECM. This allows network designers to retrieve user-defined variables from a specified storage location, and place them in a cache location in local memory for direct use throughout an independent processing object network. These variables represent weights in a calculation that is repeated numerous times or numerous other values useful in broader networks. Further, the values and value ranges of those variables can be exposed within the enterprise control manager 202, providing a dynamic editing ability for the values of those variables. Thus, the Variable Cache independent processing object 703 enables network designers to create a set of shared "global variables" for use across all independent processing objects as an efficient way to share key parameters across a network without requiring additional data transmission in the message structure.

[0113] Variable. A data interaction independent processing object, the Variable independent processing object creates a new element in a message by adding a field to the outgoing XML message. This allows network designers to create a new data element with an initial value or edit an existing element to a new value in an XML message. This element is used in subsequent calculations or events within an independent processing object network, for the purpose of storing calculations or results, or for creating temporary data used for analytics. The Variable independent processing object also can be used in conjunction with the Compare independent processing object to conditionally identify different XML messages. For example, if a message goes through the "True" branch of the Compare independent processing object instance, a Variable independent processing object instance can be configured to tag that message accordingly. A second Variable independent processing object instance could similarly be placed on the "Else" branch to identify messages going down that branch.

[0114] Wrapper. A cloud services independent processing object, the Wrapper independent processing object encapsulates existing third party or customer written Java libraries, classes and methods into an independent processing object for use within a network. This allows network designers to encapsulate existing applications or Java libraries containing classes and methods into an independent processing object for use within a network. By encapsulating Java programs in this manner, system 100 allows the user to execute that function or program in multiple parallel streams, and distribute the program functions across the client infrastructure.

Applications with limited performance when encapsulated in this manner can scale horizontally to take advantage of clustering and demand resiliency models offered by system 100. For example, an existing application that is running synchronously and has performance throughput bottlenecks may be encapsulated by a Wrapper independent processing object. By encapsulating the application, the processing time is significantly reduced by replicating that wrapped application and deploying those multiple instance to various physical or virtual machines.

[0115] Additional particular information processing functions encapsulated with independent processing object-type characteristics and functionality are also independent processing objects.

[0116] For ease of reference within some of the following figures, instances of each of the aforementioned types of independent processing objects may be represented in the figures by a corresponding iconic representation, as described by the following table:

TABLE 1

[0117] These iconic representations are exemplary, for the reader's reference, and do not act to limit any characteristic of the represented independent processing objects.

[0118] Independent Processing Obj ect Networks

[0119] FIG. 7 is a network diagram showing an exemplary independent processing object network 700. Instances of an independent processing object hosted within server layer 102 can act alone as independent functions or services, be overlaid on top of existing applications or data, or can be connected via XML messages in real time to other independent processing object instances, as seen with independent processing object instances 701-720, to form a network 700, all as directed by the network designer in the design studio 201. Network 700 of

intercommunicating independent processing object instances 701-720, is configured and linked together such that the aggregate discrete information processing functions of the independent processing object instances 701-720 create a more complex business solution, i.e., a report, an application, a workflow, an entire operating model. Such networks readily combine synchronous and/or asynchronous functions, schedules and events.

[0120] In the example network 700, the network operates to generate a global "golden copy" of customer account data for an enterprise with operations in the US, the UK, and Australia. The various independent processing object instances 701-720 are interconnected in order to identify required data at distributed sources and databases; to run name derivations, fuzzy name, deterministic or probabilistic matching and other reconciliation functions to allow data consistency and cleanup, and identify U.S. citizenship status; and to measure customer activities globally and convert to standard U.S. dollar notional value. The example network 700 represents a subset of a complete IRS FATCA solution. The example network 700 shown is approximately the first half of the solution (excluding the retrieval of underlying customer data from disparate US, UK, and AU locations), performing matching activities to yield a single customer master database and the action of maintaining into an external database for subsequent independent processing object and/or external system analysis. Further analyses may include use of predictive modeling against the results to identify flight risk, peer profile metrics, or propensity analysis. Each of these further analyses may be accomplished with the construction of an additional independent processing object network. The outputs of any of these analyses may be provided to reports or other applications, IRS reporting templates, or other independent processing object instances or independent processing object networks.

[0121] Instance of trigger independent processing object "Start" 701, when activated manually by a user, passes a message to the next downstream independent processing object instance, configured instance of query independent processing object "Get US Accounts" 702, triggering its operation. Instance of trigger independent processing object "Start" 701 could be replaced with an instance of a Schedule independent processing object configured to initiate the network 700 on a given schedule.

[0122] "Get US Accounts" 702 is configured to execute a query against a database that retrieves a listing of US accounts, and include the retrieved information in the data payload of a new message. "Get US Accounts" 702 passes its new message to the next downstream

independent processing object instance, configured instance of Variable Cache independent processing object "Load Matching Thresholds" 703, triggering its operation.

[0123] "Load Matching Thresholds" 703 is configured to retrieve matching threshold values previously selected by the network designer from their storage location, and place them in a cache location in local memory for direct use by all other independent processing objects in this network 700. After thus retrieving and caching the threshold variables, "Load Matching

Thresholds" 703 then creates a new message with the data payload of the message from "Get US Accounts" 702, creating an outgoing message essentially the same as that it received from "Get US Accounts" 702. "Load Matching Thresholds" 703 passes its new message to the next downstream independent processing object instance, configured instance of Matching Pro independent processing object "Make US Data Clone" 704, triggering its operation.

[0124] "Make US Data Clone" 704 is configured to perform a data cleanup on the retrieved US account records in the incoming message's data payload. "Make US Data Clone" 704 retrieves the matching thresholds from the incoming message's data payload, and matches elements from the US account records, linking the records when the matching thresholds are met. The resulting links between US account records are added in new fields to the data payload of the message from "Load Matching Thresholds" 703. "Make US Data Clone" 704 creates a new message with the combined data payload, and passes it to the next downstream independent processing object instance, configured instance of Matching Pro independent processing object "Full Name Matching" 705, triggering its operation.

[0125] "Full Name Matching" 705 is configured to evaluate whether the linked US account records in the data payload of the message received from "Make US Data Clone" 704 matches any record from the two other geographies, UK and Australia. "Full Name Matching" 705 executes a call function composing and passing messages to both "Get UK Intermediate Info"

706 and "Get AU Intermediate Info" 707, each configured instances of Adapter independent processing objects, and triggering their operation.

[0126] "Get UK Intermediate Info" 706 and "Get AU Intermediate Info" 707 are configured to retrieve (through appropriate aliases) the account record set from targeted UK source database, and a targeted Australian database, respectively, and cache them within local memory. "Get UK Info" 706 is identical to "Get Australia Int. Info" 707 with the exception that different source systems, one holding UK account information, and the other holding Australian account information, are the targeted source system. Depending on the targeted source system, the structure of the query statement property may differ between the two independent processing object instances. The account record sets are being retrieved and cached by these instances 706,

707 to accelerate data access during the record matching processes to be executed by "Full Name Match" 705. When either independent processing object instance 706, 707 successfully caches its retrieved records set, that independent processing object creates a new message with a pointer to its cached records set, and passes it back to configured instance of Matching Pro independent processing object "Full Name Matching" 705, already in operation.

[0127] When both "Get UK Intermediate Info" 706 and "Get AU Intermediate Info" have returned pointers to the cached UK and Australian records sets, "Full Name Matching" 705 commences analytical and matching logic sequence. Thus, "Full Name Matching" 705 passes a message on to "US Account" 708 of every individual US record, and of each individual UK or Australian record found to be a match to a US account. The match threshold variables loaded in "Load Match Threshold" 703 and applied here by "Full Name Matching" 705 may be set low, allowing low confidence matches to pass through the Network 700 for further evaluation. For each US record: (1) "Full Name Matching" 705 compares the full name data of the US record with the full name data for each record of the UK records set, and where a UK record is determined to be a match to the US record, "Full Name Matching" 705 creates a new message with the complete individual UK record and US record and passes it to configured instance of Case independent processing object "US Account" 708, triggering its operation; (2) "Full Name Matching" 705 compares the full name data of the US record with the full name data for each record of the Australian records set, and where an Australian record is determined to be a match to the US record, "Full Name Matching" 705 creates a new message with the complete individual Australian record and US record and passes it to configured instance of Case independent processing object "US Account" 708, triggering its operation; and (3) "Full Name Matching" 705 creates a new message with the complete individual US record and passes it to the next downstream independent processing object instance, configured instance of Case independent processing object "US Account" 708, triggering its operation.

[0128] "US Account" 708 provides a routing function to control the flow of processing within the Network 700. "US Account" 708 examines the record passed to it by "Full Name Matching" 705 to determine if it is a US account, based on the setting of one or more key values in the record. (Note that the UK or Australian records may be UK or Australian records for a US account). "US Account" 708 creates a new message with the individual record of the message from "Full Name Matching" 705, creating an outgoing message essentially the same as that it received from "Full Name Matching" 705. In the "True" case (that the record is a US account), "US Account" 708 passes its new message to the first independent processing object instance, of the top execution path, configured instance of Variable independent processing object "Initialize DOB Score" 709, triggering its operation. In the "False" case (that the record is NOT a US account), "US Account" 708 passes its new message to the first independent processing object instance, of the lower execution path, configured instance of Case independent processing object "UK Account" 712, triggering its operation.

[0129] "Initialize DOB Score" 709 is configured to create a new message adding in a new field a confidence score value for the Date of Birth of the individual US record passed to it by "US Account" 708. This variable is a placeholder for a score applicable to foreign accounts, as appended to foreign account records by "Match Date of Birth" 716. "Initialize DOB Score" 709 passes its new message to the next downstream independent processing object instance, configured instance ofVariable independent processing object "Initialize Address Score" 710, triggering its operation.

[0130] "Initialize Address Score" 710 is configured to create a new message adding in a new field a confidence score value for the Address of the individual US record passed to it by "Initialize DOB Score" 709. This variable is a placeholder for a score applicable to foreign accounts, as appended to foreign account records by "Match Address" 717. "Initialize Address Score" 710 passes its new message to the next downstream independent processing object instance, configured instance of variable independent processing object "Initialize Passport Score" 711, triggering its operation.

[0131] "Initialize Passport Score" 711 is configured to create a new message adding in a new field a confidence score value for the passport information of the individual US record passed to it by "Initialize Address Score" 710. This variable is a placeholder for a score applicable to foreign accounts, as appended to foreign account records by "Match Passport" 718. "Initialize Passport Score" 711 passes its new message to the next downstream independent processing object instance, configured instance of Update independent processing object "Update Gold Copy" 720, triggering its operation.

[0132] "UK Account" 712 provides a further routing function to control the flow of processing within the Network 700. "UK Account" 712 examines the record passed to it by "US Account" 708 to determine if it is a UK account, based on the setting of one or more key values in the record. "UK Accounts" 712 creates a new message with the individual record of the message from "US Account" 708, creating an outgoing message essentially the same as that it received from "US Account" 708. In the "True" case (that the record is a UK account), "UK Account" 712 passes its new message to configured instance of Query independent processing object "Get UK Accounts" 713, triggering its operation. In the "False" case (that the record is NOT a US account, and by process of elimination, is therefore an Australian account), "UK Account" 712 passes its new message to configured instance of Query independent processing object "Get AU Accounts" 714, triggering its operation.

[0133] "Get UK Accounts" 713 is configured to execute a query against a database that retrieves (through an appropriate alias) from targeted UK source database all UK account data associated with the record passed to it by "UK Account," based on the setting of one or more key values in the record. "Get UK Accounts" 713 includes the retrieved information in the data payload of a new message along with the US record, and passes its new message to the next downstream independent processing object instance, configured instance of Matching Pro independent processing object "Match National ID" 715, triggering its operation.

[0134] "Get AU Accounts" 714 is configured to execute a query against a database that retrieves (through an appropriate alias) from targeted Australian source database all Australian account data associated with the record passed to it by "UK Account," based on the setting of one or more key values in the record. "Get AU Accounts" 714 includes the retrieved information in the data payload of a new message along with the US record, and passes its new message to the next downstream independent processing object instance, configured instance of Matching Pro independent processing object "Match National ID" 715, triggering its operation.

[0135] "Match National ID" 715 evaluates how well the national identifier (e.g. Social Security number) of any of the UK or Australian account records in the data payload of the message received from "Get UK Accounts" 713 or "Get AU Accounts" 714, respectively, matches the national identifier of the US record. "Match National ID" 715 compares the national identifier of the US record to the national identifier of each individual record of the received UK or Australian records, generating a national ID match score for each individual received record. "Match National ID" 715 creates a new message with the complete received records and US record, and appends the associated national ID match score to each individual received record in a new field. "Match National ID" 715 and passes the new message to configured instance of Matching Pro independent processing object "Match Date of Birth" 716, triggering its operation.

[0136] "Match Date of Birth" 716 evaluates how well the date of birth of any of the UK or Australian account records in the data payload of the message received from "Match National ID" 715 matches the date ofbirth of the US record. "Match Date of Birth" 716 compares the date ofbirth of the US record to the date ofbirth of each individual record of the received UK or Australian records, generating a date ofbirth match score for each individual received record. "Match Date of Birth" 716 creates a new message with the complete received records and US record, and appends the associated date of birth match score to each individual received record in a new field. "Match Date of Birth" 716 passes the new message to configured instance of Matching Pro independent processing object "Match Address" 717, triggering its operation.

[0137] "Match Address" 717 evaluates how well the address of any of the UK or Australian account records in the data payload of the message received from "Match Date of Birth" 716, matches the address of the US record. "Match Address" 717 compares the address of the US record to the address of each individual record of the received UK or Australian records, generating an address match score for each individual received record. "Match Address" 717 creates a new message with the complete received records and US record, and appends the associated address match score to each individual received record in a new field. "Match Address" 717 passes the new message to configured instance of Matching Pro independent processing object "Match Passport" 718, triggering its operation.

[0138] "Match Passport" 718 evaluates how well the passport of any of the UK or Australian account records in the data payload of the message received from "Match Address" 717, matches the address of the US record. "Match Passport" 718 compares the passport information of the US record to the passport information of each individual record of the received UK or Australian records, generating a passport match score for each individual received record. "Match Passport" 718 creates a new message with the complete received records and US record, and appends the associated passport match score to each individual received record in a new field. "Match Address" 718 passes the new message to configured instance of Matching Pro independent processing object "Compare Thresholds" 719, triggering its operation.

[0139] "Compare Thresholds" 719 determines whether the National ID, Date of Birth, Address, and Passport match scores of each UK or Australian account records in the data payload of the message received from "Match Passport" 718, are sufficient, in comparison with the match threshold values loaded to cache in local memory by "Load Match Thresholds" 703 to justify including it in the network output gold copy database. "Compare Thresholds" 719 compares each of the National ID, Date of Birth, Address, and Passport match scores of each UK or Australian account record to the appropriate threshold value cached in local memory. If, for an individual UK or Australian record, each match score meets or exceeds the respective threshold variable for each match score, "Compare Thresholds" 719 creates a new message with that individual UK or Australian record, and passes the message to configured instance of Update independent processing object "Update Gold Copy" 720, triggering its operation.

[0140] "Update Gold Copy" 720 operates to insert each record it receives from either "Initialize Passport Score" 711 or "Compare Thresholds" 719 as a new record in a database. No further processing is required in the independent processing object network, so "Update Gold Copy" 720 need not pass messages to subsequent independent processing objects, although it may be configured to pass its input messages on to other independent processing objects, if desired.

[0141] Integrated Develop, Deploy, and Run

[0142] FIG. 8A shows an example graphical user interface 800 of design studio 201. The graphical user interface 800 allows network designers to configure instances of independent processing objects and arrange them in networks, establish sources and targets within an environment (data sources, directories, web sites, etc.), set network level properties, and set various permissions for access and usage. Icons 801-820 of independent processing objects are placed onto the working area or "canvas" 821 in the graphical user interface 800 to represent individual independent processing object instances. Within canvas 821, the network designer constructs and configures independent processing object networks. Existing example independent processing object network 700 is represented by the icon network 822 displayed within canvas 821, and is ready to be edited or expanded. New independent processing object instances to be added to the network 700 are selected from independent processing object type tiles 823-833 in a palette 834 of available independent processing object types and dragged, placed, or "dropped" onto the canvas 821. The palette 834 may be broken by tabs,

horizontal/vertical rules, or the like, into categories 835-839, which as a practical matter often correspond to the broad categories previously described (i.e. type of information processing function). Each time a selected independent processing object type is "dropped," a new instance of that selected independent processing object type is created in configuration database 501 and represented by an icon, e.g., "Load Match Threshold" independent processing object icon 803, on canvas 821. Each independent processing object instance may be configured (to determine its behaviors), and connected (to other independent processing object instances) to indicate destinations for the independent processing object instance's outputs, by manipulating its associated icon, e.g., "Load Match Threshold" independent processing object icon 803, placed on the canvas 821 in the graphical user interface 800.

[0143] Access to modify the configuration properties of any instance of an independent processing object may be obtained both at time of placement of its icon, e.g., "Get UK

Accounts" independent processing object icon 813, or by interaction with its icon, e.g., "Get UK Accounts" independent processing object icon 813. Referring now to FIG. 8B, for example, a configuration dialog box 840 is available to the network designer after rightclicking on a selected icon, e.g., "Get UK Accounts" independent processing object icon 813. Most independent processing object types have distinctly configurable properties, and the properties dialog may have few or many individual properties to be configured. Depending on the type of property, configuration of the independent processing object property may be achieved by entering a distinct value into a text box, such as with Name property 841 and ClassName property 842, visually pointing and clicking from a drop-down list as with Category property 843, Project property 844, and HostName property 845, loading from a source file as in Image property 846, or dragging and dropping sub-components that are individually configured (not shown). Many of these properties are general properties common to all independent processing object types.

Additional properties (such as those shown in the table) at the bottom of the configuration dialog box 840 may be more specific to the particular independent processing object type, although they may be similarly configurable. Any modification of the configuration properties of an instance of an independent processing object via its icon, e.g., "Get UK Accounts" independent processing object icon 813, is immediately promulgated to the configuration database 501 when the network designer selects Update button 847. Alternatively, selecting cancel button 848 does not promulgate the entered field values to the configuration database 501, leaving the configuration of the independent processing object instance unchanged.

[0144] The set of configurable properties for each type of independent processing object is a distinct and pre-established set, and the configuration process is limited to those specific items. In addition, many independent processing objects types are highly customizable, and the tools presented to the network designer through the configuration dialog box are sophisticated.

However, just as in simpler cases, relevant variables for each of these matching algorithms and weighting sequences may be defined or manipulated in configuration dialog box 840. All configuration of the instance of the matching instance is stored in the configuration database 510 when Update button 84 7 is selected.

[0145] When a Matching Pro independent processing object instance is accessed by the network designer through the associated icon on canvas 821, the matching algorithms and weighting sequences are presented to the network designer for modification or selection of an appropriate algorithm or weighting sequence through configuration dialog box 840. Additionally, custom or third party matching algorithms or weighting sequences may be imported from external sources such as a file or database location and selected for application.

[0146] When an Analytics independent processing object instance is accessed by the network designer through the associated icon on canvas 821, the network designer is presented with access through configuration dialog box 840 to an analytical model configuration tool (not shown) within graphical user interface 800. Using the analytical model configuration tool, the network designer constructs custom analytical models from standardized math and logic components stored within the analytics independent processing object, such as those available from Apache Math Library. The network designer is also presented with the option to import algorithms published in compatible form (e.g. a Java.jar file) from third party analytic tools (e.g. SAS, TIBCO Spotfire, MatLab, Cognos, or other analysis products) from external sources such as a file or database location to the analytics independent processing object instance using configuration dialog box 840. If desired, analytical functions may be developed in standalone tools and similarly imported.

[0147] When a Rules independent processing object instance is accessed by the network designer through the associated icon on canvas 821, the network designer is presented with access through configuration dialog box 840 to a rules configuration tool, (not shown) within graphical user interface 800. Using the rules configuration tool, the network designer imports their own rules in a rules language (such as RulesML) compatible with the business logic execution engine of the Rules independent processing object. If desired, rules may be configured in a separate rules tool, and either imported during configuration through configuration dialog box 840 and stored to configuration database 501, or accessed by the Rules independent processing object instance from the separate rules tool at runtime. All of the rules, whether stored within the configuration database 501, or accessed from the separate rules tool at runtime, or provided in another manner, are presented to the execution engine by a rulelanguage specific interface included as part of the Rules independent processing object's information processing function.

[0148] When a Predictive independent processing object instance is accessed by the network designer through the associated icon on canvas 821, configuration dialog box 840 presents the network designer with the options to import Predictive Model Markup Language (PMML) standard files. The PMML standard predictive model files are configured in a third party modeling tool, and either imported during configuration through configuration dialog box 840 and stored to configuration database 501, or accessed by the predictive independent processing object instance from the separate modeling tool at runtime. All the models, whether stored within the configuration database 501, or accessed from the separate modeling tool at runtime, or provided in another manner, are presented to the runtime statistics engine by a PMML-specific interface included as part of the rules independent processing object's information processing function.

[0149] With reference to FIG. 8C, graphical interconnection of independent processing object icons 801-820 on the canvas 821 dictate origin, destination, and content of self-describing messages passed between underlying corresponding independent processing object instances. The network designer graphically interconnects underlying corresponding independent processing objects instances using the graphical user interface 800 by selecting the desired "From" independent processing object icon, e.g., "Match Passport" independent processing object icon 818, selecting the desired "To" independent processing object icon, e.g., "Compare Threshold" independent processing object icon 819, then selecting the type of connection between the two from a menu 849 presented to the network designer. The graphical

interconnection, shown by arrowed path 850 between these independent processing object icons 818, 819 (and similarly between any independent processing object icons 801-820) indicates that the independent processing object underlying the "From" icon 818 is the origin point of a self- describing message, and that the independent processing object underlying the "To" icon 819 is the destination point of that self-describing message. In another implementation, the interconnection process is operated by selecting the "From" independent processing object icon 818 via left-click, selecting the "To" independent processing object icon 819 by Ctrl-right-click, then selecting from the pop-up dialog (see FIG. 9C) as to the nature of the connection. Several connection types are configurable including normal 851 and error subroutine call 852; the latter is the path for messages to follow if an error condition is triggered during execution of the "From" independent processing object 818. Multiple message paths from a single "From" independent processing object to multiple "To" independent processing objects may be established, as from, e.g., "UK Account" independent processing object icon 812, shown by multiple parallel or branching paths 853, 854. Similarly, multiple message paths to a single "To" independent processing object from multiple "From" independent processing objects may be established, as to, e.g., "Match National ID" independent processing object icon 815, shown by multiple parallel or converging paths 855, 856. When these selections are completed, a path 850 is shown between the two independent processing object icons 818, 819. Corresponding message paths are established between the underlying corresponding independent processing object instances represented by the two icons 818, 819, and this connection information is stored in the configuration database 501. The path is effected by message service 306 passing self- describing messages from the "From" independent processing object to the "To" independent processing object.

[0150] FIGs. 9A-9B illustrate the addition of a new independent processing object instance to an independent processing object network 901 using graphical user interface 800. In FIG. 9A, in a first step, the canvas 821 is ready to build a new or extended network 901 with an independent processing object type selected from the palette 834 of available independent processing object types (e.g. a Query independent processing object 902 from the Data

Interaction category 837 subset).

[0151] In FIG. 9B, in a second step, a Query independent processing object 902 is selected from the palette 834 and dropped on the canvas 821. Dropping the Query independent processing object 902 to the canvas 834 places an icon 903 on the canvas 834 representing a new instance of the Query independent processing object type, and configuration database 501 is updated to include a corresponding new instance of the Query independent processing object. A

configuration dialog box 904 is presented, (similar to configuration dialog box 840 as discussed with reference to FIG. 8B) that allows naming and other configuration for specific values and behaviors of the newly added independent processing object instance represented by icon 903. Some configuration fields may have no default values, such as independent processing object name field 905; while others may be prepopulated based on context, such as the independent processing object project field 906, which is shown pre-populated with the name of the project associated with the tab 907 of canvas 821 to which icon 903 has been added. Values for each field may be required, or not, based on the independent processing object type. The entered configuration values of are immediately promulgated to the configuration database 501 when the network designer selects Update button 908. Selecting cancel button 909 does not promulgate the entered field values to the configuration database 501. In this instance of initial configuration of a newly added independent processing object, selecting cancel button 909 additionally deletes the independent processing object instance associated with icon 903 from configuration database 501, and removes icon 903 from canvas 821.

[0152] Placement and configuration operations here may be generalized as placing a first icon representing a first independent processing object instance within a graphical user interface; placing a second icon representing a second independent processing object instance within the graphical user interface; indicating a connection between the first and second icons within the graphical user interface; and modifying a variable (such as those of configuration dialog box 840) of the first independent processing object instance by access to the variable through the first icon.

[0153] Message Passing

[0154] Action within system 100 is event driven, and a message may act as a triggering event to launch an independent processing object. When an incoming message arrives at a server layer 102 hosting the message's target independent processing object it is enqueued by message service 306 in a message queue. When the message reaches the front of the queue, the execution manager 401 allocates a processing thread and launches that target independent processing object with its specifically configured instruction set. The incoming message also is provided to that instance so that the incoming message's data payload can serve as inputs to the independent processing object instance. When a given independent processing object completes its processing the processor thread is de-allocated by the independent processing object server and thus available for re-use.

[0155] Referring now to FIG. 10, a flowchart of the process 1000 of message passing between independent processing object instances in an independent processing object network is presented. The process is initiated, and available during runtime at START block 1001. The process is event driven, with the trigger event being the arrival of a message. In process block 1002, a message arrives at the local server layer (cortex) 102. At decision block 1003, it is determined whether the message is to be executed locally. If this determination is NO, at process block 1004, the message is sent to the remote server layer (cortex) 102 on which it is intended to execute, and the passing of the message is completed at END block 1005. If the determination made at decision block 1003 is YES, at process block 1006, the message is enqueued in a message queue behind other previously enqueued messages until the message reaches the front of the message queue.

[0156] At process block 1007, the type of independent processing object required to execute the message is determined. At decision block 1008, it is determined whether there is a thread available for an independent processing object of the type required to execute the message. If this determination is NO, then the system waits at process block 1009 until such a thread is available. If the determination at decision block 1008 is YES then at process block 1010, a thread is allocated to an independent processing object instance of the required type. At process block 1011 the independent processing object instance is configured with configuration data for the particular independent processing object instance retrieved from configuration database 501. Once the independent processing object instance is configured, at process block 1012 the message is passed from the message queue to the configured independent processing object instance.

[0157] At process block 1013, the independent processing object instance executes on the work payload of the message. At process block 1014, when the work is complete, the

independent processing object instance creates a completed work message including the results, if any, of that work. At process block 1015, the completed work message is sent to the local server layer (cortex) 102 for delivery to the next independent processing object in the network. The passing of the message is then completed at END block 1016.

[0158] Enforcing Sequential Dependencies

[0159] A segment of an independent processing object network can be required to complete all internal messaging before any message is passed to subsequent downstream independent processing objects, initiating their execution. This is accomplished by bracketing the desired network segment with a pair of start transaction and check transaction independent processing objects. For example, the golden copy generation network of FIG. 7 would be a reasonable candidate for such sequential dependency bracketing, as a network designer would want to ensure that the golden copy was complete before other operations were run against it. Thus, sequential dependencies can be designed into an independent processing object network.

[0160] Referring now to FIG. 11, a flowchart of the process 1100 of enforcing sequential dependencies between independent processing object network segments is presented. The process begins at START block 1101. At process block 1102, network designer establishes the independent processing object network segment which must complete before downstream independent processing object networks may commence processing by bracketing the beginning of that network segment with a start transaction independent processing object instance, and bracketing the end of that segment with a check transaction independent processing object instance. At process block 1103, a message N passed into the bracketed network segment through the start transaction independent processing object instance is assigned a common bracket ID. At process block 1104, the unique message identifier of the message N is registered as associated with the common bracket ID. At decision block 1105, the register of message identifiers is checked to determine if there is any unique message identifier associated with the common bracket ID. If this determination is NO, the process terminates at END block 1106. If the determination of decision block 1105 is YES, then at process block 1107, the message N is passed for execution, and executed at process block 1108.

[0161] At decision block 1109, it is determined whether the execution of the message N produced any outputs. If this determination is YES, then at block 111 0, new output messages N+ 1, N+2, ... ,N+x, are created for each output of the execution of message N, each of which are assigned the common bracket ID. At process block 1111, each output message is registered as associated with the common bracket ID, incrementing the 'in-flight' message IDs in the register. At process block 1112, message N, having been executed, is retired and its ID removed from the register, decrementing the 'in-flight' message IDs in the register. If the determination of decision block 1109 is NO, then blocks 111 0 and 1111 are skipped, and message N is simply retired and its ID removed from the register at process block 1112. The process reiterates from decision block 1105 until, after independent processing objects in the network segment have ceased generating new output messages, and all messages associated with the common bracket ID are removed from the register.

[0162] Reaching END block 1106 thus indicates completing the precursor tasks of the sequential dependency, and the check transaction independent processing object passes a message indicating that completion to the next downstream independent processing object instance(s), triggering its operation and allowing the system to begin subsequent sequentially dependent tasks.

[0163] Clustering

[0164] Server layers (cortexes) 102 can be organized into clusters for more complex processing needs, to distribute work across multiple compute resources available within a target processing environment, to implement high-availability execution, or otherwise as desired in a particular implementation. Clusters are configured in administrative control module 203, wherein multiple server layers (cortexes) 102 operating on one or more machines are configured to be opted-in to the cluster as worker nodes, various independent processing object networks are assigned as eligible to run on one or more of the opted-in server layers (cortexes) 102, and each combination of independent processing object network and server layers (cortexes) 102 is given a priority range.

[0165] A dispatch function, managed by the cortex within the Business Logic Service 403, handles the dispatching of messages across any server layers (cortexes) 102 configured to be opted-in to a given cluster, themselves the processing resources for execution of virtualized networks. This dispatch management service can provide run time filtering of target server layers (cortexes) 102 from all opted-in server layers (cortexes) 102, based on assignment of targeted independent processing object networks to specific opted-in server layers (cortexes) 102, and the priority ranges assigned to those combinations of independent processing object networks and hosts. As units of work arrive, eligible hosts are filtered according to network and priority range checking, followed by application of the chosen dispatch algorithm for this cluster's dispatcher.

[0166] Alternatively, a Dispatcher independent processing object can be assigned to one or more server layers (cortexes) 102 to assist in handling these messaging overhead processes for each cortex opted-in to the cluster of server layers (cortexes). A Complete Message independent processing object can be used to assist in the management of messages between independent processing objects and server layers (cortexes) 102 during processing of a workflow.

[0167] Realm Management

[0168] A realm manager manages scalable compute resources to be dynamically added to a defined cluster if the dispatcher queue in front of the cluster achieves a configured length. The realm manager is part of server layer (cortex) 102 and is configurable in administrative control module 203. When the queue returns to normal levels the dynamically added capacity is released out of the cluster. These interactions are with a cloud management system to allocate the dynamic capacity, e.g. Amazon Web Services.

[0169] FIG. 12 is a flow diagram depicting a process 1200 that can be used to work with one or more clusters as part of a realm. Processing begins at START block 1205 and continues to process block 1210. At process block 1210, one or more clusters are defined as part of, or otherwise associated with, a realm. Processing continues to process block 1215 where a set of operating parameters is defined for the realm. Examples of such operating parameters can include a number of virtual or physical machines the realm is permitted to span, processor, storage, and memory constraints, and network bandwidth constraints, among others. At process block 1220, operation of the one or more clusters is monitored for consistency with the operating parameters set at process block 1215.

[0170] Processing continues to decision block 1225 where a determination is made whether the one or more server layers (cortexes) 102 in the realm are operating within the defined parameters. If this determination is YES, processing returns to process block 1220. If the determination is NO, processing continues to decision block 1230.

[0171] At decision block 1230, a determination is made whether the availability of processing resources, such as virtual or physical machines, memory, storage, and network bandwidth, needs to be adjusted by increasing or decreasing allocations consistent with the constraints set. If this determination is YES, processing continues to process block 1235 where processing resources are allocated or deallocated, as appropriate. Processing continues at process block 1240 where one or more new server layers (cortexes) 102 are created and associated with the realm. Similarly, if the determination made at decision block 1230 is NO, processing returns to process block 1225.

[0172] From process block 1240, processing continues at decision block 1245 where a determination is made whether a maximum resource allocation limit for the realm has been reached. If this determination is NO, processing returns to process block 1220. If the

determination is YES, processing continues to process block 1250 where a resource limit notification is sent. Processing of the method 1200 concludes at END block 1255.

[0173] General Computer

[0174] FIG. 13 shows a block diagram of an exemplary computing environment 1300, which includes a general computer 1301. General computer 1301 includes a processing unit 1302, a system memory 1303, and a system bus 1304. The system bus 1304 can couple system components including, but not limited to, the system memory 1303 to the processing unit 1302. The processing unit 1302 can be any of various available processors. Dual microprocessors, multiple core microprocessors, and other multiprocessor architectures also can be employed as the processing unit 1303.

[0175] The system bus 1304 can be any of several types of bus structure(s) including the memory bus or memory controller, a peripheral bus or external bus, or a local bus using any variety of available bus architectures including, but not limited to, Industrial Standard

Architecture (ISA), Micro-Channel Architecture (MSA), Extended ISA (EISA), Intelligent Drive Electronics (IDE), VESA Local Bus (VLB), Peripheral Component Interconnect (PCI), Card Bus, Universal Serial Bus (USB), Advanced Graphics Port (AGP), Personal Computer Memory Card International Association bus (PCMCIA), Firewire (IEEE 1394), and Small Computer Systems Interface (SCSI).

[0176] The system memory 1303 includes volatile memory 1305 and nonvolatile memory 1306. The basic input/output system (BIOS), containing the basic routines to transfer information between elements within the general computer 1301, such as during start-up, is stored in nonvolatile memory 1306. For example, nonvolatile memory 1306 can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable ROM (EEPROM), or flash memory. Volatile memory 1305 can include random access memory (RAM), which can acts as external cache memory. For example, RAM is available in many formats such as synchronous RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR/SDRAM), enhanced SDRAM (ESDRAM) Synchlink DRAM (SLDRAM), and direct Rambus RAM (DRRAM).

[0177] General computer 1301 also includes removable/non-removable, volatile/non-volatile computer storage media, referred to generally as disk storage 1307. The disk storage 1307 includes, but is not limited to, devices like a magnetic disk drive, floppy disk drive, tape drive, Jaz drive, Zip drive, LS-I 00 drive, flash memory card, memory stick, or flash drive. In addition, disk storage 1307 can include storage media separately or in combination with other storage media including, but not limited to, an optical disk drive such as a compact disk ROM device (CDROM), CD recordable drive (CD-R Drive), CD rewritable drive (CD-RW Drive), a digital versatile disk ROM drive (DVD-ROM), a DVD recordable drive (DVD+R/-R), a DVD rewritable drive (DVD+RW/-RW), a Blu-ray ROM drive (BD-ROM), a Blu-ray recordable drive (BD+R/-R), a Blu-ray rewritable drive (BD+RW/-RW), or other optical storage media media. To facilitate connection of the disk storage devices 1307 to the system bus 1304, a removable or non-removable interface can be used such as interface 1308.

[0178] Software can act as an intermediary between users and the basic computer resources described in the computing environment 1300. Such software includes an operating system 1309. The operating system 1309, which can be stored on the disk storage 1307, acts to control and allocate resources of the general computer 1301. System applications 1310 take advantage of the management of resources by operating system 1309 through program modules 1311 and program data 1312 stored either in system memory 1303 or on disk storage 1307. The disclosed systems and methods can be implemented with various operating systems or combinations of operating systems.

[0179] As is well known in the field of computer science, a virtual machine (VM) is an abstraction-a "virtualization"-of an actual physical computer system, while maintaining to software running atop its platform the appearance of a hardware-based general computer 1301. Thus, one or more "guest" general computers 1301 may be implemented as virtual machine abstractions operating within a physical "host" general computer 1301.

[0180] A user enters commands or information into the general computer 1301 through input device( s) 1313. The input devices 1313 include, but are not limited to, a pointing device such as a mouse, trackball, stylus, touch pad, keyboard, microphone, joystick, game pad, satellite dish, scanner, TV tuner card, digital camera, digital video camera, web camera, and the like. These and other input devices 1313 connect to the processing unit 1302 through the system bus 1304 via interface port(s) 1314. Interface port(s) 1314 include, for example, a serial port, a parallel port, a game port, and a universal serial bus (USB). Output device(s) 1315 use some of the same type of ports as input device(s) 1313. Thus, for example, a USB port may be used to provide input to general computer 1301 and to output information from general computer 1301 to an output device 1315. Output adapter 1316 is provided to illustrate that there are some output devices 1315 like monitors, speakers, and printers, among other output devices 1315, which require special adapters. The output adapters 1316 include, by way of illustration and not limitation, video and sound cards that provide a means of connection between the output device 1315 and the system bus 1304. Further, other devices and/or systems of devices may provide both input and output capabilities, such as remote computer( s) 1317.

[0181] General computer 1301 can operate in a networked environment using logical connections to one or more remote computers, such as remote computer( s) 1317. The remote computer(s) 1317 can be a personal computer, a server, a router, a network PC, a workstation, a microprocessor based appliance, a peer device or other common network node and the like, and typically includes many or all of the elements described relative to general computer 1301. For purposes ofbrevity, only a memory storage device 1318 is illustrated with remote computer(s) 1317. Remote computer(s) 1317 is logically connected to general computer 1301 through a network interface 1319 and then physically connected via communication connection 1320. Network interface 1319 encompasses wire and/or wireless communication networks such as local-area networks (LAN) and wide-area networks (WAN). LAN technologies include Fiber Distributed Data Interface (FDDI), Copper Distributed Data Interface (CODI), Ethernet, Token Ring and the like. WAN technologies include, but are not limited to, point-to-point links such as High-Level Data Link Control (HDLC), circuit switching networks like Integrated Services Digital Networks (ISDN) and variations thereon, packet switching networks such as the Internet protocol (IP) and X.25, and Digital Subscriber Lines (DSL).

[0182] Communication connection(s) 1320 refers to the hardware/software employed to connect the network interface 1319 to the bus 1304. While communication connection 1320 is shown for illustrative clarity inside general computer 1301, it can also be external to computer 1301. The hardware/software necessary for connection to the network interface 1319 may include, for example, but is not limited to, internal and external technologies such as modems (including regular telephone grade modems, cable modems and DSL modems), ISDN adapters, and Ethernet cards.

[0183] It should be remembered that every software instruction or program can be reduced to a Boolean logic circuit, by implementing well-understood processes. Thus, dedicated hardware implementations, such as application specific integrated circuits, programmable logic arrays and other hardware devices, may be constructed to implement one or more of the methods described herein. One or more embodiments described herein may implement functions using two or more specific interconnected hardware modules or devices with related control and data signals that may be communicated between and through the modules, or as portions of an application- specific integrated circuit.

[0184] It is generally desirable, however, to avoid inherent circuit design and implementation costs by implementing the systems and methods through the adaptable, flexible general computer 1301, rather than building a specific, dedicated circuit for each operation. Thus, while this disclosure discusses operations in terms of software, it is to be understood that software controls the operation of hardware in a general computer 1301, and that the operation of circuitry in accordance with the invention is contemplated whether it is dedicated circuitry, or the circuitry of one or more general computers 1301 operating in accordance with the invention.

[0185] While various embodiments of the present invention have been described above, it should be understood that they have been presented by the way of example only, and not limitation. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined. Thus, the breadth and scope of the present invention should not be limited by any of the above-described exemplary embodiments.

[0186] Anti-Money Laundering Application Example

[0187] In a financial institution, a transaction monitoring system (TMS) can be operated in addition to a transaction processing system (TPS). The TMS includes a set of one or more transaction monitoring rules. The TMS applies this set of rules to transactions occurring within the TPS. Occasionally, application of the transaction monitoring rules to a transaction results in the TMS determining the transaction to be suspicious. The TMS then generates an alert regarding the transaction, and forwards the alert to a case management system (CMS). The CMS stores the alert in its database, pending further review. Alerts generated by the TMS typically include only enough data to identify the transaction itself. The financial institution generally additionally has access to a number of other internal and external data sources, including systems such as the Account Management System (AMS) and Know Your Customer (KYC) systems.

[0188] An overlay network of independent processing objects integrates these various resources, and enhances the delivery of suspicious activity data. The independent processing object overlay network can be configured to pre-process suspicious transaction alerts delivered by the TMS. The small amount of data provided by the TMS can be retrieved from the CMS, and through bootstrapping queries, by the independent processing objects in the overlay network, actionable data about the suspicious activity can be gathered from the many systems of the financial institution that are connected to an electronic communications network, and that permit access by the independent processing object overlay network. Objects in the independent processing object overlay network can perform their tasks in a somewhat autonomous manner and in parallel with other objects.

[0189] Data gathered internally may be determinative, or further due diligence can be derived from the operation of the independent processing object overlay network. The independent processing object overlay network can retrieve information from outside the financial institution, for instance, from news services or government restriction lists.

[0190] Proper configuration of the independent processing object overlay network further allows pre-emptive recommendation as to what the proper disposition of the suspicious transaction cases, allowing analysts to verify a conclusion, rather than prepare one. Further, analysis of human overrides of the independent processing object overlay network's

recommendations can be used to modify the transaction monitoring rules of the TMS, further reducing false positives.

[0191] While database queries and updates described in the operation of the independent processing object overlay network commonly refer to the CMS database, other databases may offer the required data, or serve to support the functions of the independent processing object overlay network, as would be readily apparent to the skilled artisan.

[0192] Anti-Money Laundering - Developing a Baseline

[0193] It is useful to develop a baseline of a customer's account activity when a transaction involving the customer's account is subject to an alert. Internal information about the account is retrieved and analyzed in order to describe the baseline behaviors of a customer in relation to its account. Referring now to FIG. 14, an independent processing object network 1400 for creating account statistics is shown. Account Analytics scheduling-type independent processing object 1401 is used to initiate processing in creating account statistics object network 1400. Account Analytics object 1401 sends an initiating message to Query Transaction Account Number query- type independent processing object 1403 at either a pre-scheduled time, a pre-determined interval, or upon manual activation by a user of the system.

[0194] Query Transaction Account Number object 1403 operates to retrieve the account numbers of transactions which have been listed in the CMS database as involved in suspicious transactions. The data retrieved by the object 1403, as well as any data received in the initiating message, are included in an outgoing message sent by the object 1403 to Query Account Statistics query-type independent processing object 1405.

[0195] Query Account Statistics object 1405 operates to retrieve data about the accounts involved in suspicious transactions from the financial institution's account management system database. The object 1405 retrieves summary statistics about each account listed as suspicious in the CMS, such as account identifier, account average balance, current account balance, account minimum balance, account maximum balance, account type, account open date, and associated customer ID number. The data retrieved by the object 1405, as well as any data received from Query Transaction Account Number object 1403, are included in an outgoing message sent by the object 1405 to Calculate Monthly Transaction Count variable-type independent processing object 1407.

[0196] Calculate Monthly Transaction Count object 1407 operates to determine, for each account listed in the CMS as involved in a suspicious transaction, an average number of transactions that occur in the account each month, based on a transaction count for the account divided by the number of days transactions could occur for the account, multiplied by thirty. These average numbers, along with any data received from Query Account Statistics object 1405, is included in an outgoing message sent by the object 1407 to Query Distribution Rows query -type independent processing object 1409.

[0197] Query Distribution Rows object 1409 operates to retrieve, for each account listed in the CMS as involved in a suspicious transaction, a low percentile row and a high percentile row from a table of percentile rows of transactions for the account in the account management system database. In this example, a fifteenth percentile row and an eighty-fifth percentile row are retrieved. These percentile rows of transactions for the account, along with any data received from Calculate Monthly Transaction Count object 1407, is included in an outgoing message sent by the object 1409 to Query Distribution 15 Amount query -type independent processing object 1411.

[0198] Query Distribution 15 Amount object 1411 operates to retrieve from the account management system database, for each account listed in the CMS as involved in a suspicious transaction, the 15th percentile transaction value amount. This transaction value amount, along with any data received from Query Distribution Rows object 1409, is included in an outgoing message sent by the object 1411 to Query Distribution 85 Amount query-type independent processing object 1413.

[0199] Query Distribution 85 Amount object 1413 operates to retrieve from the account management system database, for each account listed in the CMS as involved in a suspicious transaction, the 85th percentile transaction value amount. This transaction value amount, along with any data received from Query Distribution 15 Amount object 1411, is included in an outgoing message sent by the object 1413 to Write Account Analytics update-type independent processing object 1415.

[0200] Write Account Analytics object 1415 operates to record each field in the message received from Query Distribution 85 Amount object 1413 to the CMS database by an insert or update operation, as appropriate. The data stored in the CMS database can be accessed by other object networks, as well as by the CMS. The independent processing object network 1400 terminates with the object 1415, so the object 1415 does not pass a message to another independent processing object.

[0201] Anti-Money Laundering - Gathering Statistics About Alerts

[0202] Referring now to FIG. 15 A, an independent processing object network for creating alert statistics 1500 is shown. Alert Analytics scheduling-type independent processing object 1501 is used to initiate processing in creating alert statistics object network 1500. Alert

Analytics object 1501 sends an initiating message to Start Alert Analytics start transaction-type independent processing object 1503 at either a pre-scheduled time, a pre-determined interval, or upon manual activation by a user of the system.

[0203] Start Alert Analytics object 1503 operates to enforce a sequential dependency that requires completion of all processing in the object network segment comprising Drop Temporary Alert Statistics update-type independent processing object 1505, Query Alert Number query-type independent processing object 1507, Get Alert Transaction Numbers query -type independent processing object 1509, Get Alert Transaction Amounts query -type independent processing object 1511, and Write Temporary Alert Statistics update-type independent processing object 1513, before moving on to downstream objects. The completion of this network segment serves to collect and store in the CMS database relevant data for all outstanding alerts from the TMS. The object 1503 operates in conjunction with Finish Alert Transaction Data check transaction- type independent processing object 1515 to bracket that object network segment. The object 1503 composes an outgoing message including a bracket ID for the object 1503 and any data received in the initiating message. The outgoing message is sent by the object 1503 to Drop Temporary Alert Statistics object 1505.

[0204] Drop Temporary Alert Statistics object 1505 operates to clear any previously stored temporary alert statistics from the CMS database by a delete operation. The data received from Start Alert Analytics object 1503 is included in an outgoing message sent by the object 1505 to Query Alert Number object 1507.

[0205] Query Alert Number object 1507 operates to retrieve the list of alert numbers for all transactions listed in the CMS as being suspicious. This list, along with any data received from Drop Temporary Alert Statistics object 1505, is included in an outgoing message sent by the object 1507 to Get Alert Transaction Numbers object 1509.

[0206] Get Alert Transaction Numbers object 1509 operates to retrieve from the CMS database the lists of all transaction numbers associated with an alert included in the list of alerts retrieved by Query Alert Number object 1507. These lists, along with any data received from Query Alert Number object 1507, are included in an outgoing message sent by the object 1509 to Get Alert Transaction Amounts obj ect 1511.

[0207] Get Alert Transaction Amounts obj ect 1511 operates to retrieve from the CMS database the amount of each transaction included in the lists of transaction numbers retrieved by Get Alert Transaction Numbers object 1509. These transaction amounts, along with any data received from Get Alert Transaction Numbers object 1509, are included in an outgoing message sent by the object 1511 to Write Temporary Alert Statistics object 1513.

[0208] Write Temporary Alert Statistics object 1513 operates to record each field in the message received from Get Alert Transaction Amounts object 1511, except for the bracket ID, to the CMS database by an insert or update operation, as appropriate. The data stored in the CMS database can be accessed by other object networks, as well as by the CMS. The independent processing object network segment comprising independent processing objects 1505-1513 terminates with the object 1513, so the object 1513 does not pass a message to another independent processing object.

[0209] The outgoing message composed by Start Alert Analytics object 1503 is also sent by the object 1503 to Finish Alert Transaction Data object 1515. Finish Alert Transaction Data object 1515 monitors whether there are any messages including the bracket ID that have not completed processing. When all messages including the bracket ID have completed processing, the object 1515 includes the data received from Start Alert Analytics object 1503 in an outgoing message. The message is sent by the object 1515 to Drop Alert Statistics update-type

independent processing object 1517.

[0210] Drop Alert Statistics object 1517 operates to clear any previously stored alert statistics from the CMS database by a delete operation. The data received from Finish Alert Transaction Data object 1515 is included in an outgoing message sent by the object 1517 to Query Statistics Alert Number query -type independent processing object 1519.

[0211] Query Statistics Alert Number obj ect 1519 operates to retrieve from the CMS database a list of all the alert numbers collected and stored in the CMS database by Write Temporary Alert Statistics object 1513. This list of alert numbers, along with any data received from Drop Alert Statistics object 1517, is included in an outgoing message sent by the object 1519 to Query Alert Statistics query -type independent processing object 1521.

[0212] Query Alert Statistics object 1521 operates to retrieve from the CMS database, for each alert number included in the list generated by Query Statistics Alert Number object 1519, the list of all transaction numbers and respective transaction amounts stored in the CMS database by Write Temporary Alert Statistics object 1513 and associated with that alert number. These lists of transactions and amounts, along with any data received from Query Statistics Alert Number object 1519, are included in an outgoing message sent by the object 1521 to Query Alert Type and Customer Number query -type independent processing object 1523. [0213] Query Alert Type and Customer Number object 1523 operates to retrieve from the CMS database, for each alert number included in the list generated by Query Statistics Alert Number object 1519, the associated alert type and customer number for the alert. The associated alert types and customer numbers, along with any data received from Query Alert Statistics object 1521, are included in an outgoing message sent by the object 1523 to Query Account Balances query -type independent processing object 1525.

[0214] Query Account Balances object 1525 operates to retrieve from the CMS database, for each customer number associated with an alert and included by Query Alert Type and Customer Number object 1523, the total average balance of the accounts associated with that customer number. These total average balances, along with any data received from Query Alert Type and Customer Number object 1523, is included in an outgoing message sent by the object 1525 to Assign Value at Risk Ratio variable-type independent processing object 1527.

[0215] Assign Value at Risk Ratio object 1527 operates to determine a value at risk ratio for each alert. The value at risk ratio is the ratio of the total amount of the transactions associated with the alert to the total average balance of the accounts of the customer number associated with the alert by Query Account Balances object 1525. These value at risk ratios, along with any data received from Query Account Balances object 1525, is included in an outgoing message sent by the object 1527 to Write Alert Statistics update-type independent processing object 1529.

[0216] Write Alert Statistics object 1529 operates to record each field in the message received from Assign Value at Risk Ratio object 1527 to the CMS database by an insert or update operation, as appropriate. The data stored in the CMS database can be accessed by other object networks, as well as by the CMS. The independent processing object network 1500 terminates with the object 1529, so the object 1529 does not pass a message to another independent processing object.

[0217] Anti-Money Laundering - Gathering Information on a Counterparty

[0218] Occasionally, information regarding the counterparty in a transaction may be informative or dispositive as to whether a transaction is suspicious. Referring now to FIG. 15 B, an independent processing object network for creating counterparty alert statistics 1550 is shown. The object network 1550 operates to aggregate counterparties involved with transactions with a particular account, and gathers additional relevant information. Counterparty Analytics scheduling-type independent processing object 1551 is used to initiate processing in creating counterparty alert statistics object network 1550. Counterparty Analytics object 1551 sends an initiating message to Start Counterparty Analytics start transaction-type independent processing object 1553 at either a pre-scheduled time, a pre-determined interval, or upon manual activation by a user of the system.

[0219] Start Counterparty Analytics object 1553 operates to enforce a sequential dependency that requires completion of all processing in the object network segment comprising Drop Counterparty Transactions update-type independent processing object 1555, Query Alert Number query-type independent processing object 1557, Query Alert Transactions query-type independent processing object 1559, Check Beneficiary compare-type independent processing object 1561, Assign Originator analytic-type independent processing object 1563, Assign Beneficiary analytic-type independent processing object 1565, Insert Counterparty Transaction update-type independent processing object 1567, before moving on to downstream objects. The completion of this network segment serves to collect and store in the CMS database relevant data about the counterparty of the transaction for all outstanding alerts from the TMS. The Start Counterparty Analytics object 1553 operates in conjunction with Finish Counterparty Analytics check transaction -type independent processing object 1571 to bracket that object network segment. The object 1553 composes an outgoing message including a bracket ID for the object 1553 and any data received in the initiating message. The outgoing message is sent by the object 1553 to Drop Counterparty Transactions object 1555.

[0220] Drop Counterparty Transactions object 1555 operates to clear any previously stored counterparty transactions from the CMS database by a delete operation. The data received from Start Counterparty Analytics object 1553 is included in an outgoing message sent by the object 1555 to Query Alert Number object 1557.

[0221] Query Alert Number object 1557 operates to retrieve the list of alert numbers for all transactions listed in the CMS as being suspicious. This list, along with any data received from Drop Counterparty Transactions object 1555, is included in an outgoing message sent by the object 1557 to Query Alert Transactions object 1559.

[0222] Query Alert Transactions object 1559 operates to retrieve from the CMS database the lists of all transaction numbers associated with an alert included in the list of alerts retrieved by Query Alert Number object 1557. These lists, along with any data received from Query Alert Number object 1557, are included in an outgoing message sent by the object 1559 to Check Beneficiary object 1561.

[0223] Check Beneficiary object 1561 compares the customer's account number with the account number of the beneficiary in the transaction. If the account numbers match, then the transaction is an incoming transaction, and the originator of the transaction is the counterparty. Check Beneficiary object 1561 prepares and passes a message including data received from Query Alert Transactions object 1559 to Assign Originator analytics-type object 1563. If the account numbers do not match, then the transaction is an outgoing transaction, and the beneficiary of the transaction is the counterparty. Check Beneficiary object 1561 prepares and passes a message including data received from Query Alert Transactions object 1559 to Assign Beneficiary analytics-type object 1565.

[0224] Assign Originator object 1563 operates to assign the designation of counterparty to the originator of the transaction, and passes a message including that indication, as well as data received from Check Beneficiary object 1561, to Insert Counterparty Transaction update-type independent processing object 1567.

[0225] Assign Beneficiary object 1565 operates to assign the designation of counterparty to the beneficiary of the transaction, and passes a message including that indication, as well as data received from Check Beneficiary object 1561, to Insert Counterparty Transaction object 1567.

[0226] Insert Counterparty Transaction object 1567 operates to record each field in the message received from either Assign Originator object 1563 or Assign Beneficiary object 1565, except for the bracket ID, to the CMS database by an insert or update operation, as appropriate. The data stored in the CMS database can be accessed by other object networks, as well as by the CMS. The independent processing object network segment comprising independent processing objects 1555-1567 terminates with the object 1567, so the object 1567 does not pass a message to another independent processing object.

[0227] The outgoing message composed by Start Counterparty Analytics object 1553 is also sent by the object 1553 to Finish Counterparty Analytics check transaction -type independent processing object 1571. Finish Counterparty Analytics object 1571 monitors whether there are any messages including the bracket ID that have not completed processing. When all messages including the bracket ID have completed processing, Finish Counterparty Analytics object 1571 includes the data received from Start Counterparty Analytics object 1553 in an outgoing message. The message is sent by Finish Counterparty Analytics object 1571 to Drop

Counterparty Statistics update-type independent processing object 1573.

[0228] Drop Counterparty Statistics object 1573 operates to clear any previously stored counterparty transactions from the CMS database by a delete operation. The data received from Finish Counterparty Analytics object 1571 is included in an outgoing message sent by the object 1573 to Get Counterparty Transactions Alert Number query -type independent processing object 1575.

[0229] Get Counterparty Transactions Alert Number object 1575 retrieves the list of all distinct alert numbers for the counterparty, from the CMS database This list of counterparty alert numbers, as well as data received from Drop Counterparty Statistics object 1573, is included in an outgoing message sent by the object 1575 to Get Counterparty Transactions Customer Number query -type independent processing object 1577.

[0230] Get Counterparty Transactions Customer Number object 1577 retrieves all customer numbers of counterparties involved with an alert from the CMS database. This customer number, and the data received from Get Counterparty Transactions Alert Number object 1575, is included in an outgoing message sent by the object 1577 to Get Counterparty Number query -type independent processing object 1579.

[0231] Get Counterparty Number object 1579 retrieves the distinct customer numbers of counterparties from the CMS database. This distinct customer number, and the data received from Get Counterparty Transactions Customer Number object 1577, is included in an outgoing message sent by the object 1579 to Get Counterparty Transactions Biography query -type independent processing object 1581.

[0232] Get Counterparty Transactions Biography object 1581 retrieves biographical data about the counterparty from the CMS database, for example, business name, address, state, etc. This biographical information, and the data received from Get Counterparty Number object 1579 is included in an outgoing message sent by the object 1581 to Query Counterparty Account Number query -type independent processing object 1583.

[0233] Query Counterparty Account Number object 1583 retrieves the account numbers of the counterparties from the CMS database. These account numbers, and the data received from Get Counterparty Transactions Biography object 1581, are included in an outgoing message sent by the object 1583 to Query Counterparty Statistics query -type independent processing object 1585.

[0234] Query Counterparty Statistics object 1585 retrieves from the CMS database, for each counterparty, the counterparty statistics developed in the independent processing object network segment comprising independent processing objects 1555-1567. These statistics, and the data received from Query Counterparty Account Number object 1583, are included in an outgoing message sent by the object 1585 to Write Counterparty Statistics update-type independent processing object 1587.

[0235] Write Counterparty Statistics object 1587 operates to record each field in the message received from Query Counterparty Statistics object 1585 to the CMS database by an insert or update operation, as appropriate. The data stored in the CMS database can be accessed by other object networks, as well as by the CMS. The independent processing object network terminates with the object 1587, so the object 1587 does not pass a message to another independent processing object.

[0236] Anti-Money Laundering - Creating Case Risk Score and Recommendation

[0237] Consistent risk scoring of suspicious transaction cases allows verification of recommendation by analysts. Referring now to FIG. 16, an independent processing object network for creating a case risk score and making a recommendation 1600 as to regulatory suspicious activity reporting is shown.

[0238] Drop Case Statistics update-type independent processing object 1601 is activated either upon receipt of an incoming initiating message, or upon manual activation by a user of the system. The object 1601 operates to clear any previously stored alert statistics from the CMS database by a delete operation. The object 1601 composes an outgoing message which includes any data received in the initiating message, if an initiating message was received. The outgoing message is sent by the object 1601 to Get Case Number query -type independent processing object 1603.

[0239] Get Case Number object 1603 operates to retrieve from the CMS database the list of all case numbers and their associated customer numbers, alert months, and alert years. This list, along with any data received from Drop Case Statistics object 1601, is included in an outgoing message sent by the object 1603 to Get Customer State query -type independent processing object 1605.

[0240] Get Customer State object 1605 operates to retrieve from the account management system database the geographic state associated with each customer number associated with a case number in the list retrieved by Get Case Number object 1603. These states, along with any data received from Get Case Number object 1603, are included in an outgoing message sent by the object 1605 to Get Alert Count query -type independent processing object 1607.

[0241] Get Alert Count object 1607 operates to retrieve from the CMS database for each case number in the list retrieved by Get Case Number object 1603 a count of all alerts associated with the case number. These counts of alerts, along with any data received from Get Customer State object 1605, are included in an outgoing message sent by the object 1607 to Get Transaction Count query -type independent processing object 1609.

[0242] Get Transaction Count object 1609 operates to retrieve from the CMS database for each case number in the list retrieved by Get Case Number object 1603 a count of all

transactions associated with the case number. These counts of transactions, along with any data received from Get Alert Count object 1607, are included in an outgoing message sent by the object 1609 to Get Total Transaction Amount query-type independent processing object 1611.

[0243] Get Total Transaction Amount 1611 operates to retrieve from the CMS database for each customer number associated with a case number in the list retrieved by Get Case Number object 1603, and for each alert in the case, a total of all transactions made in the same month and year as that alert. These transaction totals, along with any data received from Get Transaction Count object 1609, are included in an outgoing message sent by the object 1611 to Get Average Alert Value at Risk query -type independent processing object 1613.

[0244] Get Average Alert Value at Risk object 1613 operates to retrieve from the CMS database, for each case number, the value at risk stored in the CMS database by Write Alert Statistics object 1529 for each alert associated with the case number, and to take the average of those values at risk. These averages, along with any data received from Get Total Transaction Amount 1611, are included in an outgoing message sent by the object 1613 to Score Value at Risk Ratio variable-type independent processing object 1615.

[0245] Score Value at Risk Ratio object 1615 operates to determine, for each case number, a raw score for the value at risk. The score can be determined by application of a formula to the average value at risk for the case number determined by Get Average Alert Value at Risk object 1613; or the score can be determined using a lookup table of raw scores selected for values of the average value at risk. This raw score, along with any data received from Get Average Alert Value at Risk object 1613, is included in an outgoing message sent by the object 1615 to Get Alert Types query -type independent processing object 1617.

[0246] Get Alert Types object 1617 operates to retrieve from the CMS database, for each case number, the list of distinct alert types associated with the case number. These lists of distinct alert types, along with any data received from Score Value at Risk Ratio object 1615, are included in an outgoing message sent by the object 1617 to Score Alert Types variable-type independent processing object 1619.

[0247] Score Alert Types object 1619 operates to determine, for each case number, a raw score for the alert types. In this example, the score is the lesser of the number of distinct alert types multiplied by 2.5, or 10. This score, along with any data received from Get Alert Types object 1617, is included in an outgoing message sent by the object 1619 to Get Total Transaction Amounts query -type independent processing object 1621.

[0248] Get Total Transaction Amounts object 1621 operates to retrieve from the CMS database, for each case, the total amount of all transactions of the customer associated with a case and occuring within the same year and month as an alert associated with the case. These totals, along with any data received from Score Alert Types object 1619, are included in an outgoing message sent by the object 1621 to Set Total Activity Ratio variable-type independent processing object 1623.

[0249] Set Total Activity Ratio object 1623 operates to set, for each case number, a total activity ratio. This ratio is the transaction amount associated with the case divided by the total transaction amount for the case established by Get Total Transaction Amounts object 1621. These ratios, along with any data received from Get Total Transaction Amounts object 1621, are included in an outgoing message sent by the object 1623 to Score Total Activity Ratio variable- type independent processing object 1625.

[0250] Score Total Activity Ratio object 1625 operates to determine , for each case number, a raw score for the total activity ratio. In this example, the score is given by the lesser of the total activity ratio multiplied by ten, and ten. These scores, along with any data received from Set Total Activity Ratio object 1623, are included in an outgoing message sent by the object 1625 to Get Prior Alerts query -type independent processing object 1627.

[0251] Get Prior Alerts object 1627 operates to retrieve from the CMS database, for each customer number associated with a case, a count of prior alerts for the customer. The counts of prior alerts, along with any data received from Score Total Activity Ratio object 1625, are included in an outgoing message sent by the object 1627 to Score Prior Alerts variable-type independent processing object 1629.

[0252] Score Prior Alerts object 1629 operates to determine, for each case number, a raw score for the case based on the count of prior alerts for the customer retrieved by Get Prior Alerts object 1627. In this example, the score is given by the lesser of one fourth of the count of prior alerts, and ten. This score, along with any data received from Get Prior Alerts object 1627, is included in an outgoing message sent by the object 1629 to Get Prior Cases query -type independent processing object 1631.

[0253] Get Prior Cases object 1631 operates to retrieve from the CMS database, for each case number, a count of prior cases for the customer. The counts of prior alerts, along with any data received from Score Prior Alerts object 1629, are included in an outgoing message sent by the object 1631 to Score Prior Cases variable-type independent processing object 1633.

[0254] Score Prior Cases object 1633 operates to determine, for each case number, a raw score for the case based on the count of prior cases for the customer retrieved by Get Prior Cases object 1631. In this example, the score is given by the lesser of five times the count of prior cases, and ten. These scores, along with any data received from Get Prior Cases object 1631, are included in an outgoing message sent by the object 1633 to Set Prior Suspicious Activity Reports Variable variable-type independent processing object 1635.

[0255] Set Prior Suspicious Activity Reports Variable object 1635 operates, for each case number, to set a variable indicating the number of prior suspicious activity reports filed for the associated customer. These numbers, along with any data received from Score Prior Cases object 1633, are included in an outgoing message sent by the object 1635 to Score Prior

Suspicious Activity Reports variable-type independent processing object 1637.

[0256] Score Prior Suspicious Activity Reports object 1637 operates to determine, for each case number, a raw score for the case based on the number of suspicious activity reports previously filed for a customer, as set by Set Prior Suspicious Activity Reports Variable object 1635. In this example, the score is given by the lesser of five times the count of prior cases, and ten. These scores, along with any data received from Set Prior Suspicious Activity Reports Variable object 1635, is included in an outgoing message sent by the object 1637 to Set First Negative News Variable variable-type independent processing object 1639.

[0257] Set First Negative News Variable object 1639 operates to create a first search string for each case for an external negative news inquiry related to the case, that may be based at least in part on the customer name and location information associated with the case. This search string, along with any data received from Score Prior Suspicious Activity Reports object 1637, is included in an outgoing message sent by the object 1639 to Score First Negative News query- type independent processing object 1641.

[0258] Score First Negative News object 1641 operates to execute the first search string set by Set First Negative News Variable object 1639 on an external first news source, such as Google, or Facebook. The object 1641 assigns a raw score based at least in part on the results of the search. The raw score may be a Boolean value indicating simply that there are, or are not, any search results. The raw score, along with any data received from Set First Negative News Variable object 1639, is included in an outgoing message sent by the object 1641 to Set Second Negative News Variable variable-type independent processing object 1643.

[0259] Set Second Negative News Variable object 1643 operates to create a second search string for an external negative news inquiry related to the case, that may be based at least in part on the customer name and location information associated with the case. This search string, along with any data received from Score First Negative News object 1641, is included in an outgoing message sent by the object 1643 to Score Second Negative News query -type independent processing object 1645.

[0260] Score Second Negative News object 1645 operates to execute the second search string set by Set Second Negative News Variable object 1643 on an external second news source, such as Lexis Nexis, C6 Intelligence, Bloomberg, or AP Newswire. The object 1645 assigns a raw score based at least in part on the results of the search. The raw score may be a Boolean value indicating simply that there are, or are not, any search results. This raw score along with any data received from Set Second Negative News Variable object 1643, is included in an outgoing message sent by the object 1645 to Set Politically Exposed Person Variable variable- type independent processing object 1647.

[0261] Set Politically Exposed Person Variable object 1647 operates to create a search string for a search of an external politically exposed person database for persons related to the case, that may be based at least in part on the customer name and location information associated with the case. This search string, along with any data received from Score Second Negative News object 1645, is included in an outgoing message sent by the object 1647 to Score Politically Exposed query -type independent processing object 1649.

[0262] Score Politically Exposed Person object 1649 operates to retrieve the results of executing the search string set by Set Politically Exposed Person Variable object 1647 on an external politically exposed person database. The presence or absence of a retrieved result is a Boolean raw score. The raw scores, along with any data received from Set Politically Exposed Person Variable object 1647, are included in an outgoing message sent by the object 1649 to Set Material News Variable variable-type independent processing object 1651.

[0263] Set Material News Variable object 1651 operates to create a search string for an external material news inquiry related to the case, that may be based at least in part on the customer name and location information associated with the case. This search string, along with any data received from Score Politically Exposed Person object 1649, is included in an outgoing message sent by the object 1651 to Score Material News query -type independent processing object 1653.

[0264] Score Material News object 1653 operates to retrieve the results of executing the search string set by Set Material News Variable object 1651 on an external news source, such as Lexis Nexis, C6 Intelligence, Bloomberg, or AP Newswire. The object 1653 assigns a raw score based at least in part on the results of the search. The raw score may be a Boolean value indicating simply that there are, or are not, any search results. These raw scores, along with any data received from Set Material News Variable object 1651, are included in an outgoing message sent by the object 1653 to Set Global News Variable variable-type independent processing object 1655.

[0265] Set Global News Variable object 1655 operates to create a search string for an external global news inquiry related to the case, that may be based at least in part on the customer name and location information associated with the case. This search string, along with any data received from Score Material News object 1653, is included in an outgoing message sent by the object 1655 to Score Global News query-type independent processing object 1657. [0266] Score Global News object 1657 operates to retrieve the results of executing the search string set by Set Global News Variable object 1655 on an external news source, such as Lexis Nexis, C6 Intelligence, Bloomberg, or AP Newswire. The object 1657 assigns a raw score based at least in part on the results of the search. The raw score may be a Boolean value indicating simply that there are, or are not, any search results. These raw scores, along with any data received from Set Global News Variable object 1655, are included in an outgoing message sent by the object 1657 to Set Business Reputation Variable variable-type independent processing object 1659.

[0267] Set Business Reputation Variable object 1659 operates to create a search string for an external business reputation inquiry related to the case, that may be based at least in part on the customer name and location information associated with the case. This search string, along with any data received from Score Global News object 1657, is included in an outgoing message sent by the object 1659 to Score Business Reputation query -type independent processing object 1661.

[0268] Score Business Reputation object 1661 operates to retrieve the results of executing the search string set by Set Business Reputation Variable object 1659 on an external business reputation data source, such as Dun & Bradstreet or World Check. The object 1661 assigns a raw score based at least in part on the results of the search. The raw score may be a Boolean value indicating simply that there are, or are not, any search results. These raw scores, along with any data received from Set Business Reputation Variable object 1659, are included in an outgoing message sent by the object 1661 to Get Risk Factor Weights query -type independent processing object 1663.

[0269] Additional queries to other external news or data sources may be executed by inserting similar pairs of variable type and query -type independent processing objects which define and then execute a search string at the news or data source.

[0270] Get Risk Factor Weights object 1663 operates to retrieve from the CMS database risk factor weights for: date and time; customer; alerts; geographic location; transactions; industry; counter-party; negative news; politically exposed person; and business conduct. The weights, along with any data received from Score Business Reputation object 1661, are included in an outgoing message sent by the object 1663 to Calculate Weighted Risks analytic-type independent processing object 1665.

[0271] Calculate Weighted Risks object 1665 operates to apply the risk factor weights retrieved by Get Risk Factor Weights object 1663, as applicable, to each case's raw scores. The weighted risks for each case, along with any data received from Get Risk Factor Weights object 1663, is included in an outgoing message sent by the object 1665 to Calculate Final Weighted Risks analytic-type independent processing object 1667.

[0272] Calculate Final Weighted Risks object 1667 operates to compile the weighted risk factors for each case calculated by Calculate Weighted Risks object 1665 into a single, aggregate weighted risk score for each case. The aggregated weighted risk scores, along with any data received from Calculate Weighted Risks object 1665, are included in an outgoing message sent by the object 1665 to Set Recommendation Thresholds query -type independent processing object 1669.

[0273] Set Recommendation Thresholds object 1669 operates to retrieve from the CMS database a set of score thresholds directed to making recommendation as to how the case should be subsequently handled. In this example, the set comprises a "High" risk threshold, and a "Low" risk threshold. The retrieved set of score thresholds, along with any data received from Calculate Final Weighted Risks object 1667, is included in an outgoing message sent by the object 1669 to Branch Score Thresholds case-type independent processing object 1671.

[0274] Branch Score Thresholds object 1671 operates to direct further processing to one of a set of downstream independent processing objects based on comparison of the aggregated final risk score of each case against the set of score thresholds retrieved by Set Recommendation Thresholds object 1669. In this example, the set of alternative downstream independent processing objects includes Set Potential Suspicious Activity Report Recommend variable-type independent processing object 1673; Set False Positive Recommend variable-type independent processing object 1675; and Set Review Recommend variable-type independent processing object 1677. [0275] For each case, the object 1671 prepares an outgoing message that includes any data applicable to that case received from Set Recommendation Thresholds object 1669. In this example, if the aggregated final risk score for a case exceeds a "High" threshold, the outgoing message is sent to Set Potential Suspicious Activity Report Recommend object 1673. Further, if the aggregated final risk score falls short of a "Low" threshold, the outgoing message is sent to Set False Positive Recommend object 1675. Finally, if the aggregated final risk score is in the middle range from the "Low" through "High" thresholds, inclusive, the outgoing message is sent to Set Review Recommend object 1677. In other examples, additional thresholds could be set by Set Recommendation Thresholds object 1669 and included in Branch Score Thresholds object 1671, for finer granularity. Such additional thresholds should be accompanied by commensurate expansion of the set of alternative immediately downstream independent processing objects.

[0276] Set Potential Suspicious Activity Report Recommend object 1673 operates to include in an outgoing message a variable indicating a recommendation that a SAR be filed for this case, along with any data received from Branch Score Thresholds object 1671. The message is sent by the object 1673 to Set Action Pending variable-type independent processing object 1679.

[0277] Set False Positive Recommend object 1675 operates to include in an outgoing message a variable indicating a recommendation that this case is a false positive, along with any data received from Branch Score Thresholds object 1671. The message is sent by the object 1675 to Set Action Pending object 1679.

[0278] Set Review Recommend object 1677 operates to include in an outgoing message a variable indicating a recommendation that the case risk score and recommendation object network does not recommend that the a SAR be filed for the case or that the case is a false positive, and that further review is required. The object 1677 also includes in the outgoing message any data received from Branch Score Thresholds object 1671. The message is sent by the object 1677 to Set Action Pending object 1679.

[0279] Set Action Pending object 1679 operates to include in an outgoing message a variable indicating a that a recommendation requiring subsequent action has been made in this case, along with any data received from either Set Potential Suspicious Activity Report Recommend object 1673; Set False Positive Recommend object 1675; or Set Review Recommend object 1677; as the case may be. The message is sent by the object 1679 to Set Status Open variable-type independent processing object 1681.

[0280] Set Status Open object 1681 operates to include in an outgoing message a variable indicating that this case is open, along with any data received from Set Action Pending object 1679. The message is sent by the object 1681 to Write Case Statistics upload-type independent processing object 1683.

[0281] Write Case Statistics object 1683 operates to record each field in the message received from Set Status Open object 1681 to the CMS database by an insert or update operation, as appropriate. The data stored in the CMS database can be accessed by other object networks, as well as by the CMS. The independent processing object network 1600 terminates with the object 1683, so the object 1683 does not pass a message to another independent processing object.

[0282] The section 1691 of independent processing object network 1600 between Drop Case Statistics object 1601 and Score Prior Suspicious Activity Reports object 1637, inclusive, can be characterized as an Internal Data Gathering Object Network. The section 1693 of independent processing object network 1600 between Set First Negative News Variable object 1639 and Score Business Reputation object 1661, inclusive, can be characterized as an External Data Gathering Object Network. The section 1695 of independent processing object network 1600 between Get Risk Factor Weights object 1663 and Write Case Statistics object 1683, inclusive, can be characterized as a Secondary Screening Object Network.

[0283] Anti-Money Laundering - Method for Reducing False Positives.

[0284] Referring now to FIG. 17A, a flowchart of the distributed processing method 1700 for reducing false positive identifications of suspicious financial transactions is presented. The process is initiated and commences at START block 1701, and proceeds to process block 1703. At process block 1703, a transaction monitoring system that includes a set of one or more transaction monitoring rules identifies a transaction occurring within a transaction processing system of a financial institution as suspicious. Processing continues at process block 1705. [0285] At process block 1705, a case is created within a case management system that includes the transaction. Processing continues at process block 1707. At process block 1707, internal data related to the transaction is acquired from one or more internal data sources of the financial institution acquiring. This acquisition is accomplished using an internal data gathering object network. This acquisition can include using a data access object that is part of the internal data gathering object network to do one or more of the following: access a customer information file; access a know your customer software application; access an account management system; access the transaction processing system; access an internal customer due diligence system; access an enhanced due diligence system; and access an internal blacklist.

[0286] Processing continues at process block 1709. At process block 1709, a preliminary score is assigned to the case. The preliminary score is assigned by a preliminary screening object network. This preliminary score is based on application of a set of one or more preliminary scoring rules to preselected factors of the acquired internal data.

[0287] Processing continues at decision block 1711. At decision block 1711, it is determined whether the case requires further processing. This determination is performed by the preliminary screening object network. The preliminary score is a factor in making the determination. If the case needs no further processing, processing terminates at END block 1713. If the case needs further processing, processing continues at process block 1715. At process block 1715, an external data gathering object network is used to acquire external data related to the case from one or more external data sources external to the financial institution. Processing continues at process block 1717. At Process block 1717, a secondary score to the case based at least in part on the preliminary score and the acquired external data is assigned using a secondary screening object network.

[0288] Processing continues at decision block 1719. At decision block 1719, it is determined, using the secondary screening object network, whether the secondary score of the case exceeds a threshold score that indicates that the case involves money laundering. If the secondary score of the case does not exceed the threshold score, processing terminates at END block 1713. If the secondary score does exceed the threshold score, processing continues at process block 1721. At process block 1721, a visual representation of the acquired internal and external data upon which the secondary score is based is presented. Processing continues at process block 1723. At process block 23, an overriding determination that the case does not involve money laundering is received. Upon receiving that overriding determination, processing continues at process block 1725. At process block 1725, one or more factors of the transaction that indicate that the identification by the transaction monitoring system is a false positive are identified. Processing continues at process block 1727. At process block 1727, the transaction monitoring rules of the transaction monitoring system are modified based at least in part on one or more of the identified factors.

[0289] Referring now to FIG. 17B, additional detail of process block 1715 is presented. At Process block 1715, the use of the external data gathering object network is used to acquire external data related to the case from one or more external data sources external to the financial institution includes process blocks 1731, 1733, and 1735. At process block 1731, information related to the case from a politically exposed person database at a first location is retrieved over an electronic communication network using a first data access object that is part of the external data gathering object network. Processing continues at process block 1733.

[0290] At process block 1733, information related to the case from one or more electronic news sources at a second location is retrieved over an electronic communication network using a second data access object that is part of the external data gathering object network. Processing continues at process block 1735. At process block 1735, information related to the case from a sanctions list at a third location is retrieved over an electronic communication network using a third data access object that is part of the external data gathering object network.

[0291] In a first example, the further set of transactions is selected based on a time period determined from the time the transaction occurred. In that case, the preliminary screening object network may evaluate the case against rules that are based on information selected from the group consisting of: a past alert within the time period; a past case within the time period; a past suspicious activity report filed within the time period; variation from average balance within the time period; and the type of alert generated by the transaction monitoring system.

[0292] In a second example, the further selected set of transactions is selected based on an entity involved in the transaction. In that case, the preliminary screening object network evaluates the case against rules that are based on information selected from the group consisting of: a past alert for the entity; a past case for the entity; a past suspicious activity report filed for the entity; variation from average balance for the entity; and the type of alert generated by the transaction monitoring system.

[0293] Anti-Money Laundering - Risk Score Adjustment Object Network

[0294] Referring now to FIG. 18, a risk score adjustment independent processing object network 1800 for making adjustments to a pre-existing risk score is presented.

[0295] Cast Case Number First Negative News data type -type independent processing object 1801 is activated upon receipt of an incoming initiating message. The object 1801 operates to receive an incoming XML field that contains a case number, and to cast the XML case number as a case number data type. Receipt of an XML Message at this object 1801 indicates that the first negative news for the arriving case number has been updated. The object 1801 composes an outgoing message that includes the cast case Number, and sends it to Get First Negative News Status query -type independent processing object 1803.

[0296] Get First Negative News Status object 1803 operates to retrieve from the CMS database a status of first negative news for the case number. The object 1803 includes the status, along with any data received from Cast Case Number First Negative News object 1801, in an outgoing message sent by the object 1803 to Log First Negative News Change update-type independent processing object 1805.

[0297] Log First Negative News Change object 1805 operates to record each field in the message received from Get First Negative News Status object 1803 to the CMS database by an insert or update operation, as appropriate. This records the change in status of the first negative news. The data stored in the CMS database can be accessed by other object networks, as well as by the CMS. The object 1805 composes an outgoing message that includes data received from Get First Negative News Status object 1803.

[0298] The processing object network segment composed of Cast Case Number PEP data type -type independent processing object 1807, Get PEP Status query -type independent processing object 1809, and Log PEP Change update-type independent processing object 1811, behaves in a similar manner to the processing object network segment composed of objects 1801, 1803, and 1805. This PEP network operates to receive an incoming case number (at 1807) and interpret that incoming case number to indicate an update to the politically exposed person information for the case, to retrieve the status change (at 1809), and to record the status change (at 1811).

[0299] Moreover, similar processing object network segments (not shown) are available to receive all external data source updates, such as for Material News, Global News, and Business Reputation.

[0300] Read Due Diligence Updates query -type independent processing object 1813 is activated upon receipt of an incoming initiating message or upon manual activation by a user of the system. The object 1813 operates to retrieve due diligence information updates from the CMS database. The object 1813 composes an outgoing message that includes the due diligence updates.

[0301] Each of Log First Negative News Change obj ect 1805, Log PEP Change obj ect 1811, the terminal 'Log . . . Change" objects of similar processing object network segments (not shown) , and Read Due Diligence Updates object 1813 send their composed outgoing message to Update First Negative News query -type independent processing object 1815. Update First Negative News object 1815 operates to retrieve a raw score for the first negative news for the case number from the CMS database. The retrieved raw score, along with any data received from Log First Negative News Change object 1805, Log PEP Change object 1811, or Read Due Diligence Updates object 1813, as the case may be, is included in an outgoing message sent by the object 1813 to Update PEP query -type independent processing object 1817.

[0302] Similarly, Update PEP object 1817 operates to retrieve a raw score for the politically exposed person information for the case number from the CMS database, and to include it an outgoing message. Such updates will occur for each of the additional external data sources (not shown), sequentially including an entire set of raw scores for each external data source in the outgoing messages from each update object. The order of the sequence of retrieving raw scores for each external data source for a case is not important. [0303] The message containing all the raw scores is passed to Refresh Risk Factor Weights query -type independent processing object 1819. The object 1819 operates to retrieve the risk factor weights stored in the CMS database. The risk factor weights, as well as any data received from Update PEP object 1817, are included in an outgoing message sent by the object 1819 to Get Preliminary Score query -type independent processing object 1821.

[0304] Get Preliminary Score object 1821 operates to retrieve the aggregate risk score for the case. The retrieved aggregate risk score, as well as any data received from Refresh Risk Factor Weights object 1819, is included in an outgoing message sent by the object 1821 to Recalculate Due Diligence Risks analytic-type independent processing object 1823.

[0305] Recalculate Due Diligence Risks object 1823 operates to recalculate the aggregate risk score. The new aggregate risk score, along with any data received from Get Preliminary Score object 1821, is included in an outgoing message sent by the object 1823 to Refresh Recommendation Thresholds query -type independent processing object 1825.

[0306] Refresh Recommendation Thresholds object 1825 operates to retrieve from the CMS database a set of score thresholds directed to making recommendation as to how the case should be subsequently handled. In this example, the set comprises a "High" risk threshold, and a "Low" risk threshold. The retrieved set of score thresholds, along with any data received from Recalculate Due Diligence Risks object 1823, is included in an outgoing message sent by the object 1825 to Branch Due Diligence Score Threshold case-type independent processing object 1827.

[0307] Branch Due Diligence Score Threshold object 1827 operates to direct further processing to one of a set of downstream independent processing objects based on comparison of the aggregated final risk score of each case against the set of score thresholds retrieved by Refresh Recommendation Thresholds object 1825. In this example, the set of alternative downstream independent processing objects includes Set Due Diligence Forward

Recommendation variable-type independent processing object 1829; Set Due Diligence Close Recommendation variable-type independent processing object 1831; and Set Due Diligence Review Recommendation variable-type independent processing object 1833. [0308] For each case, the object 1827 prepares an outgoing message that includes any data applicable to that case received from Refresh Recommendation Thresholds object 1825. In this example, if the aggregated final risk score for a case exceeds a "High" threshold, the outgoing message is sent to Set Due Diligence Forward Recommendation object 1829. This indicates that the case should be forwarded to creation of a SAR. Further, if the aggregated final risk score falls short of a "Low" threshold, the outgoing message is sent to Set Due Diligence Close Recommendation object 1831. This indicates that the case should be closed as non-suspicious. Finally, if the aggregated final risk score is in the middle range from the "Low" through "High" thresholds, inclusive, the outgoing message is sent to Set Due Diligence Review

Recommendation object 1833. This indicates that due diligence is inconclusive, and the case should be subject to further review. In other examples, additional thresholds could be set by Refresh Recommendation Threshold object 1825 and included in Branch Due Diligence Score Threshold object 1827, for finer granularity. Such additional thresholds should be accompanied by commensurate expansion of the set of alternative immediately downstream independent processing objects.

[0309] Set Due Diligence Forward Recommendation object 1829 operates to include in an outgoing message a variable indicating a recommendation that a SAR be filed for this case, along with any data received from Branch Due Diligence Score Threshold object 1827. The message is sent by the object 1829 to Check Open Status compare-type independent processing object 1835.

[0310] Set Due Diligence Close Recommendation object 1831 operates to include in an outgoing message a variable indicating a recommendation that this case should be closed, along with any data received from Branch Due Diligence Score Threshold object 1827. The message is sent by the object 1831 to Check Open Status object 1835.

[0311] Set Due Diligence Review Recommendation object 1833 operates to include in an outgoing message a variable indicating a recommendation that the case risk score and recommendation object network does not recommend that the a SAR be filed for the case or that the case should be closed, and that further due diligence review is required. The object 1833 also includes in the outgoing message any data received from Branch Due Diligence Score Threshold object 1827. The message is sent by the object 1833 to Check Open Status object 1835.

[0312] Check Open Status object 1835 operates to determine whether the case status is or is not open. If the case status is open, any data received from Set Due Diligence Forward

Recommendation object 1829, Set Due Diligence Close Recommendation object 1831, or Set Due Diligence Review Recommendation object 1833, as the case may be, is included in an outgoing message sent by the object 1835 to Set Due Diligence Action Pending variable-type independent processing object 1837. If the case is not open, the outgoing message is sent to Check Recommend Review compare-type independent processing object 1839.

[0313] Check Recommend Review object 1839 operates to determine whether the closed case was indicated by Set Due Diligence Review Recommendation object 1833 to be

recommended for due diligence review. If the closed case was recommended for further review, the object 1839 sends an outgoing message including any data received from Check Open Status object 1835 to Set Due Diligence Action Pending object 1837. If the closed case was not recommended for further review, the outgoing message is sent to Set Due Diligence Action variable-type independent processing object 1841.

[0314] Set Due Diligence Action Pending object 1837 operates to add a variable indicating that a due diligence action is pending to the outgoing message incorporating any information received from Check Open Status object 1835, or Check Recommend Review object 1839, as the case may be.

[0315] Set Due Diligence Action object 1841 operates to add a variable indicating that the recommendation (by one of objects 1829, 1831, or 1833) regarding the due diligence action to the to the outgoing message incorporating any information received from Check Open Status object 1835, or Check Recommend Review object 1839, as the case may be.

[0316] Both Set Due Diligence Action Pending object 1837 and Set Due Diligence Action object 1841 send their outgoing messages to Update Case update-type independent processing object 1843. Update Case object 1843 operates to store all contents of the incoming message to the CMS database. [0317] The independent processing object network comprising objects 1851 - 1859 operates to confirm that a recommended disposition for a case is complied with, or, if not, to notify a designated recipient of the mismatch. Cast Case Number Disposition data type -type independent processing object 1851 is activated upon receipt of an incoming initiating message. The object 1851 operates to receive an incoming XML field that contains a case number and associated disposition, and to cast the XML case number as a case number data type. The cast case number and disposition are passed by the object 1851 in a message to Get Current

Recommendation query -type independent processing object 1853.

[0318] Get Current Recommendation object 1853 retrieves the current recommendation for the disposition of the case from the CMS database. The object 1853 includes the

recommendation, as well as the data received from Cast Case Number Disposition object 1851, in an outgoing message passed to Update Case Status update-type independent processing object 1855. Update Case Status object 1855 writes all contents of the incoming message from Cast Case Number Disposition object 1851 to the CMS database. Update Case Status object 1855 includes the contents of the incoming message in an outgoing message sent to Check Override compare-type independent processing object 1857.

[0319] If the current recommendation for the disposition of the case and the current disposition of the case match, processing terminates at Check Override object 1857. If the current recommendation for the disposition of the case and the current disposition of the case do not match, a message, including the data received in the incoming message to Check Override object 1857 is passed to Notify on Override mail-type independent processing object 1859. Notify on Override object 1859 sends a message to a designated recipient indicating that the current recommendation for disposition of the case and the current disposition of the case do not match.

[0320] The independent processing object network comprising objects 1861 - 1863 operates to allow assignment of an analyst to a case. Cast Case Number Analyst data type -type independent processing object 1861 is activated upon receipt of an incoming initiating message. The object 1861 operates to receive an incoming XML field that contains a case number and an analyst identifier, and to cast the XML case number as a case number data type. The cast case number and analyst identifier are passed by the object 1861 in a message to Update Analyst update-type independent processing object 1863. Update Analyst object 1863 writes all contents of the incoming message from Cast Case Number Analyst object 1861, the case number and associated analyst identifier, to the CMS database.

[0321] Graphical User Interface for Presentation of Risk Recommendation

[0322] FIG. 19 shows a graphical user interface 1900 presenting a visual representation of internal and external data on which a suspicious transaction case recommendation is based. In a left hand column, the interface presents case details 1901, a visual breakdown of suspicious activity alert types 1902, and a distribution of transaction ranges 1903. A gauge of total risk versus risk thresholds 1904 is visible at the top of the central section. An arrow indicator on the gauge 1904 shows the total case risk against the threshold background shades of the gauge. Immediately below, two pairs of results and weighted risks are shown.

[0323] Pre-Scoring Results 1905, based on data sources internal to the financial institution, are shown opposite Pre-Score Weighted Risks 1907, visually indicating the level of risk demonstrated by the data. Similarly, Due Diligence results 1906 based on data sources external to the financial institution are shown opposite Due Diligence Weighted Risks 1908. In the top right, a summary 1909 of the Disposition Status of the suspicious transaction case is shown, which includes the current recommendation of how the case should be resolved. In the bottom right of the graphical user interface 1900, data about the operation of the risk analysis system is presented, showing the user Disposition Actions 1910 on other cases, as well as Analyst Re- Assignments 1911 to existing cases.

[0324] Across the top of the graphical user interface 1900, there are various tabs, 1912-1926, which allow the analyst to access source information or more detailed information behind the summaries presented on the graphical user interface 1900.

[0325] Non- Volatile Computer-Readable Media

[0326] FIG. 20 is a perspective view of various computer-readable media. Program information for a computer-executable program to perform the methods discussed above can be stored and retrieved using an optical disk 2010, a flash drive 2020, or a hard disk drive 2030. These devices can also be used to store content. The computer-readable media are non-volatile: the computer-readable media do not need constant electrical power in order to retain the program information or content.

Claims

The invention claimed is:

1. A computer implemented distributed processing method for reducing false positive identifications of suspicious financial transactions, the method comprising the steps of: identifying, with a transaction monitoring system that includes a set of one or more transaction monitoring rules, a transaction occuring within a transaction processing system of a financial institution as suspicious; creating a case within a case management system that includes the transaction; acquiring, using an internal data gathering object network, internal data related to the transaction from one or more internal data sources of the financial institution; assigning, using a preliminary screening object network, a preliminary score to the case based on application of a set of one or more preliminary scoring rules to preselected factors of the acquired internal data; determining, using the preliminary screening object network and based at least in part on the preliminary score, whether the case requires further processing; acquiring, using an external data gathering object network, external data related to the case from one or more external data sources external to the financial institution by retrieving, over an electronic communication network and using a first data access object that is part of the external data gathering object network, information related to the case from a politically exposed person database at a first location; retrieving, over an electronic communication network and using a second data access object that is part of the external data gathering object network, information related to the case from one or more electronic news sources at a second location; retrieving, over an electronic communication network and using a third data access object that is part of the external data gathering object network, information related to the case from a sanctions list at a third location; assigning, using a secondary screening object network, a secondary score to the case based at least in part on the preliminary score and the acquired external data; determining, using the secondary screening object network, whether the secondary score of the case exceeds a threshold score that indicates that the case involves money laundering; presenting a visual representation of the acquired internal and external data upon which the secondary score is based; upon receiving an overriding determination that the case does not involve money laundering, identifying one or more factors of the transaction that indicate that the identification by the transaction monitoring system is a false positive; and modifying the transaction monitoring rules of the transaction monitoring system based at least in part on one or more of the identified factors.

2. The method of claim 1, wherein the acquiring internal data related to the transaction includes one or more actions selected from the group consisting of: using a data access object that is part of the internal data gathering object network to access a customer information file; using a data access object that is part of the internal data gathering object network to access a know your customer software application; using a data access object that is part of the internal data gathering object network to access an account management system; using a data access object that is part of the internal data gathering object network to access the transaction processing system; using a data access object that is part of the internal data gathering object network to access a customer due diligence system; using a data access object that is part of the internal data gathering object network to access an enhanced due diligence system; and using a data access object that is part of the internal data gathering object network to access an internal blacklist.

3. The method of claim 1, wherein the created case includes a further selected set of transactions in addition to the transaction.

4. The method of claim 3, wherein the further selected set of transactions is selected based on a time period determined from the time the transaction occurred.

5. The method of claim 4, wherein the preliminary screening object network evaluates the case against rules that are based on information selected from the group consisting of: a past alert within the time period; a past case within the time period; a past suspicious activity report filed within the time period; variation from average balance within the time period; and the type of alert generated by the transaction monitoring system.

6. The method of claim 3, wherein the further selected set of transactions is selected based on an entity involved in the transaction.

7. The method of claim 6, wherein the preliminary screening object network evaluates the case against rules that are based on information selected from the group consisting of: a past alert for the entity; a past case for the entity; a past suspicious activity report filed for the entity; variation from average balance for the entity; and the type of alert generated by the transaction monitoring system.

8. The method of claim 1, wherein the visual representation of the acquired internal and external data is an interface that permits drill-down to the source of the acquired internal and external data.