The Trace Is the Product: Files a Regulator Can Read

I spent years as an MLRO at a regional exchange, so I know the exact texture of this moment: the examiner on the other side of the table, the case file between you, and the question that decides the meeting — "why did you clear this?"

If your answer is "the system said the match was below threshold", the meeting is over and not in your favour. "The system said so" is not a reason; it is a confession that nobody in the room knows why the decision was made.

What an examiner actually wants

Examiners don't primarily want to find failures. They want to test whether the control can fail loudly and explainably. Three things make a file defensible:

1. Every factor that moved the decision is visible — which list matched, at what similarity, with what name variant, adjusted by what other data (DOB, nationality, jurisdiction).
2. Every step has a timestamp and an actor — machine or human. If a human overrode a recommendation, there is a named person and a reason.
3. The file and the filing cannot disagree — the STR narrative is drafted from the same evidence the trace used.

How we build the trace

When an analyst presses Run investigation, the agent walks the case the way a senior analyst would — and writes down every step in plain language, as it happens:

mizan.agent INVESTIGATION_STARTED · 14 reasoning steps · engine v1.0
mizan.agent SCREENING_COMPLETED · 3 of 12 lists hit
mizan.agent RISK_SCORED · composite 78 → HIGH
mizan.agent POLICY_OVERRIDE · none applied
mizan.agent DISPOSITION_RECOMMENDED · escalate to MLRO
[ANALYST] PENDING_HUMAN_REVIEW · agent does not file autonomously

The trace is not a log dump. Each step carries its evidence: the normalised names, the exact alias that matched, the factor deltas that produced the composite score. It reads like the working notes of a careful analyst — because it is the working notes of a careful analyst, generated at machine speed, with machine completeness.

Human in the loop, machine in the trace

The agent recommends; it never files. Dispositions — close, request information, escalate, file STR, freeze — are logged to a named analyst. The event log shows the handoff:

mizan.agent DISPOSITION_RECOMMENDED · escalate to MLRO
[ANALYST A. AL-RASHID] ESCALATED_TO_MLRO · reason: SDN alias match + structuring pattern
[MLRO M. KRISHNAN] APPROVED_STR_FILING · dual control satisfied
mizan.agent REPORT_EXPORTED · goAML XML · audit ref mz-case-2026-0417

Every actor, every timestamp, every reason. The chain is unbroken from the first transaction import to the XML that lands with the FIU.

The examiner's notebook

Back to that meeting. The cleared case: a medium-risk name hit that the analyst dismissed because the DOB mismatched by nine years and no distinctive token was shared. The examiner asked the question. We opened the case file and pointed at the trace — normalisation, similarity score, the −26 DOB discriminator, the analyst's disposition note. She looked at the trace, looked at the score, and wrote "OK" in her notebook.

That's the product. Not the dashboard, not the score — the ability to show your work. If the system can't explain a decision, you shouldn't be making the decision with it.