Novaheim AI

For fintechs, exchanges, stablecoin payment firms and MSBs running AI on suspicious-activity work

Your AI drafts the SAR.Can you prove it’s right?

Independent monthly testing of the AI agent in your SAR workflow, on your own cases, with evidence your examiner can follow.

Book a 30-minute readiness reviewSee a sample finding
  • Runs read-only in your cloud
  • SAR data never leaves it
  • Your BSA Officer signs every report
Built for
BSA / AMLFinCEN SAROFAC sanctionsModel risk reviewSponsor-bank oversightGENIUS Act
Tests agents built on
Unit21HummingbirdVerafinFISFiservIn-house builds
The problem

The agent is fast. The proof is missing.

Detection got the budget. Then agents took over triage and drafting. Now examiners ask a new question: how do you know the agent is right? Your vendor can’t answer that for you.

500+institutions running AML agents in production on one vendor platform aloneNasdaq
30 daysto file, counted from initial detection. The clock doesn’t change because an agent wrote the draft.FinCEN
01Vendor validation tests their agent, not yours: your prompts, your typologies, your data.
02Agents fail quietly: a wrong amount, a missing “why,” an alert closed that should have been filed.
03The rulebook isn’t written yet. The April 2026 model-risk guidance leaves generative and agentic AI out of scope, so the burden of proof is yours.OCC Bulletin 2026-13
What you get

Your exam binder, built every month.

Sample finding · synthetic dataCASE-2026-0412
Subject · Harlow Trading LLC
3 alertsKYB · 20242 accounts0 prior SARs
Agent narrativeHover a flagged sentence to see the records behind it

On March 2, Harlow Trading received a wire of $48,500 A1 and within four hours sent $45,800 in USDC to an external wallet T4. Funds reached a high-risk exchange in two hops C2. missing · why it’s suspicious

Source records
03-02FIATWire in · ref 88120 · A1$48,500
03-02CHAINUSDC out · 0x7a3f…c91e · T4$48,200
03-04CHAIN2 hops → high-risk exchange · C2$47,900
Check result
Amount mismatchNarrative says $45,800. Record T4 says $48,200.Code
No reason for suspicionNo sentence says why the activity is suspicious.AI judge · quoted
Finding · High · Awaiting BSA Officer decision
How a test runs

Code checks. AI judges.Your officer signs.

Your environmentyour cloud · your model endpoint · your logsOutputMonthly QA report + write-once evidence log
01Agent outputDrafts and dispositionsYour vendor
02Snapshot + sampleRead-only, risk-weightedCode
03CheckEvery fact vs. source recordsCode
04Judge5 W’s, typology, policy fit, quotedAI
ReviewEvery flag adjudicatedNovaheim
06SignApproves findings and tuningYour BSA Officer
The agent your vendor shipped. Novaheim starts where its output lands.01 / 06
The usual wayonce a year · on the vendor’s model
  1. Vendor certificate
  2. Annual review
  3. Spot checks
  4. Exam question
  5. Scramble

Tested once, on someone else’s data. Agents change with every release.

1×
With Novaheim

12 times a year, on your cases.

12×
How we work

Start with a 30-day baseline.

01 · 4 weeks

Baseline sprint

We map your agent, deploy the engine read-only in your cloud, review 60–120 cases and deliver a baseline report and remediation plan.

Your agent’s error rate, measured on your own cases.

02 · Monthly

Assurance retainer

Monthly QA runs, a quarterly re-tune and re-test, and a live model and prompt register.

Evidence that keeps pace with every release.

03 · Annual or on trigger

Exam pack

The full evidence binder and a board summary. Triggered early by a model change, a new typology or an exam letter.

One binder an examiner can follow end to end.

Baseline delivered within 4 weeks of data access, or we keep working free and your first month is on us.

We take three new baselines a quarterBook a 30-minute readiness review
Bradley Behan
About

Meet the founder

I test the AI that handles what happens after the alert fires.

My background is statistics and applied analytics: seven years measuring model performance, false positive rates and where automated systems fail. That discipline is what AML programs need and rarely have. Monitoring stacks get tuned on intuition, and few teams can show an examiner why a threshold sits where it does.

Read more

I work across BSA/AML, OFAC, the FATF Travel Rule and the GENIUS Act stablecoin rules, and I read chains directly rather than relying on a vendor’s attribution. Most compliance stacks see the fiat leg and go blind at the chain boundary.

Novaheim is independent. We don’t resell AML platforms, and we never test a workflow we built.

Bradley BehanFounderLinkedIn
FAQ

Questions a BSA Officer asks first.

Their validation covers their platform. Your examiner looks at how you use it: your prompts, typologies, thresholds and data. We test that, every month.

No. Our access is read-only. We never draft, edit or file a SAR, and we never close an alert.

Everything runs in your cloud, on your model endpoint. Nothing is copied to Novaheim or used for training. Access is time-boxed, approved per session and limited to named roles.

Novaheim’s test engine, deployed read-only under your access controls. It’s the same engine every client runs, maintained and updated by us, so you get every new check without building or running it yourselves. Your data and results never leave your deployment. The engine runs for as long as your engagement does.

Every number comes from versioned SQL against your records. The AI only judges language quality and quotes its evidence, and a person reviews every flag. The judge’s own accuracy is measured and recorded in the register.

Any agent whose drafts and dispositions you can export or reach through an API, whether from a vendor or built in-house.

A few hours to grant access and kick off the baseline, then about 2–4 hours a month for your BSA Officer to review and sign.

No one can promise an exam outcome. We produce the evidence examiners ask for: what you tested, what you found and what you fixed. You own it.

No. It feeds into it, and we work with your auditor.

You do. Every report, finding and sign-off, and the write-once log, stay in your environment and stay yours. If the engagement ends, we remove the engine; the evidence stays where it is.

Ready to start?

An untested agent isn’t an efficiency gain.It’s a finding.

Agents change every release. Examiners ask every cycle. Start with a 30-day baseline.

Book a 30-minute readiness review