Hawk: AML monitoring, screening and controlled AI investigations

Hawk supplies financial-crime technology that combines transaction rules, behavioural analysis and case review. Its transaction-monitoring product supports customer-centred investigations, regional configurations within a multi-tenant platform, dual review and audit histories. The practical role for a financial institution is to connect detection with an accountable investigation process: who receives an alert, what evidence they review and how a decision is recorded. The published capabilities cover detection and workflow; an institution chooses the risk model and operating policies that govern their use.[1]

The Unified Case Manager brings queues, assignments, due dates, notifications and escalation into one workspace. Reviewers see customer and transaction context alongside the reason an alert was raised. Role permissions determine access; dual approval, alert sampling and quality-assurance functions add oversight after the initial investigation. This makes case management a separate operational layer from a detection score: closing an alert, escalating it and reviewing the quality of the decision are distinct actions.[6]

The AML Investigative Agent gathers information, assembles case summaries, suggests follow-up actions and prepares reporting narratives. Customers define which steps run automatically and where a person must intervene, as well as permitted data sources and the alerts on which the agent runs. Hawk describes synchronising actions and notes into the existing case system. The useful distinction is between automating evidence collection and delegating the final judgement; the workflow can assign different levels of autonomy to different tasks.[7]

The Customer Checks API returns a customer risk level, score and factors, together with customer and case identifiers. It can be used at onboarding or when customer information changes without running every AML or fraud check again. Retaining the customer identifier links later decisions to the same entity. The documentation also treats status values as extensible, so an integration should tolerate additional values instead of assuming that the currently illustrated list is permanent.[8]

The AML AI Overlay receives customer and transaction data, analyses activity beyond the alerts already produced by the incumbent system, and returns scores with explanations to that system’s case manager. Hawk lists its own cloud, a virtual private cloud and on-premises options for this product. Those choices belong to the overlay offering; they should not be applied automatically to every module in the catalogue.[9]

The core technology page describes a cloud-native SaaS service, a REST interface using JSON and support for batch integration. Its architecture uses containerised services and a streaming layer, with redundancy across components and availability zones. These are architectural descriptions rather than a customer-specific throughput or recovery commitment. Actual implementation still has to connect the institution’s records, identifiers and decision responses to the selected service.[11]

Hawk’s partner programme separates strategic advisory, implementation, technology/data and ecosystem relationships. Published examples include Capco, Deloitte, Dow Jones, Mitek, LexisNexis and AWS. A partner listing identifies an ecosystem relationship; the selected data licence, connector and delivery responsibility remain separate commercial and technical details. For example, using an external watchlist requires agreement on which source, update process and matching configuration the institution will operate.[10]

The public demonstration route introduces the API, data integration, modular design, tenant configuration and rule-building tools. It does not publish a numeric subscription tariff, usage allowance, minimum commitment or standard implementation charge. A commercial proposal therefore needs to state the modules, deployment and support included, alongside any separately supplied data. The public page is a way to scope a quotation, rather than a price schedule from which a complete operating cost can be calculated.[12]

Production Sandbox creates a separate tenant that mirrors the live configuration, including roles and rule sets. Users adjust rules, select a period and sample of historical transactions, run a simulation and compare outcomes before changing production settings. Hawk describes above- and below-threshold testing and an environment isolated from live detection. The sequence matters: simulating a rule change is a review stage, while applying the chosen settings to live monitoring is a subsequent decision.[13]

Analytics Studio addresses the model lifecycle rather than only individual rule thresholds. Its documented sequence covers selecting a financial-crime template and relevant data, training or retraining a model, reviewing performance and alert samples, comparing versions and exporting governance records. This lets reviewers trace a changed model to its inputs and performance evidence. The institution still needs acceptance criteria for its own customers and risks; the software’s ability to produce documentation does not determine whether a particular model is suitable.[14]

Hawk publishes ISO/IEC 27001:2022 and SOC 2 Type II statements, encryption in transit and at rest, role-based access, multifactor authentication and single sign-on capabilities. Its information-security page describes continuous availability and security monitoring. The detailed SOC report is supplied on request; the public overview provides the starting point for a supplier review rather than the full audit evidence.[15]

The subprocessor schedule gives a narrower view of data location than the general multi-cloud architecture. It names AWS for tenant transaction and customer-risk data in the EU and Switzerland, and separately identifies Brave Search for anonymised queries and public-data retrieval used by the Investigative Agent, with US, EU and Swiss processing. Data location therefore needs to be mapped to the specific function and data class, not inferred from the platform’s general deployment flexibility.[16]

The knowledge base organises material by API, monitoring, screening, intelligence and case-management workflows. Some detailed pages require authenticated access. The public routes below support product enquiries and documentation access; they do not specify a contractual response-time schedule or customer-support opening hours.[17]

The security team’s published 24-hour monitoring coverage concerns cloud-service availability and security. It should not be read as a promise that every commercial enquiry or application-support ticket receives the same round-the-clock service.[15]

Hawk’s DORA paper characterises the software as an ICT service supporting the AML work of regulated financial institutions. It describes decision support for compliance staff and contract provisions addressing data protection, incidents, audit access and exit arrangements. This is the relevant supplier relationship for the products covered here; it is not evidence of a brokerage, custody or client-money permission. The paper is Hawk’s account of its service and contracts, rather than a regulator’s approval of an institution’s implementation.[18]

The data-protection page says Hawk generally processes information on behalf of its customers. End customers are directed to their own financial institution for personal-data requests because Hawk cannot independently fulfil them without the customer organisation’s authority. The page also describes tokenisation, separated storage of personal identifiers and logged, case-specific access. That allocation of roles is relevant to onboarding data, investigation records and access to sensitive customer information.[19]

Hawk began in Munich in 2018 under the HAWK:AI name, founded by Tobias Schweiger and Wolfgang Berner. The company presents its development as a move from transaction analysis into a broader financial-crime platform. Its current leadership page identifies Schweiger as chief executive and Berner as chief product officer. Those origins explain the emphasis on machine-learning models alongside the operational tools used to configure, investigate and govern their outputs.[20]

The corporate imprint identifies Hawk AI GmbH, registered in Munich under HRB 243598, at Friedenstraße 22B/i3, 81671 Munich. This is the formal operator identified for the website and the company’s published corporate contact.[21]

Operator

Hawk AI GmbH

Service scope

AML monitoring, customer and payment screening, fraud detection, investigation workflows and reporting software for financial institutions.

Customer types

Banks; Payment providers; Fintechs; Digital-asset businesses

Delivery

SaaS; API; On premises; Hosted

Pricing publication

Quote only

Headquarters

Munich, Germany

Platforms

AML Transaction Monitoring; Customer Risk Rating; Customer Screening; Payment Screening; Transaction Fraud; AML AI Overlay; AML Investigative Agent; CDD Agent; Unified Case Manager; Production Sandbox; Analytics Studio; SAR / CTR Filing; Regulatory Reporting Agent

Integrations

REST JSON API; Batch integration; Customer checks API; Existing AML systems through the overlay; FinCEN filing; GoAML export

Pricing scope

Sales-led demonstration and quotation; no numeric tariff on the reviewed public commercial page.

Implementation

REST JSON and batch options; separate configuration of data, customer risk, rules and model governance. Overlay deployment choices are product-specific.

Support

Published knowledge base and enquiry routes; customer response times and support hours require contract confirmation.

Permissions and regulatory scope

Hawk describes its AML software as an ICT service supporting regulated customers. This profile covers technology supply and does not assert investment-dealing or client-money permissions.

Provider metadata checked 21 Oct 2026Source 7Source 8Source 6Source 24Source 20Source 12Source 17Source 18Source 5Source 21Source 23Source 1Source 9Source 4Source 2Source 13Source 22Source 3Source 14Source 11

The reporting workflow connects case evidence to SAR and CTR preparation, validates fields, routes dual approval and tracks submission status and continuing reviews. Hawk describes direct FinCEN filing and export for GoAML. Its reporting page explicitly leaves submission under human control: the Regulatory Reporting Agent drafts and populates the report but does not submit a SAR itself. A prepared narrative and a successfully filed report are therefore separate stages.[22]

The Regulatory Reporting Agent was announced on 15 October 2026. Its stated functions include using the institution’s narrative format, linking populated fields to case evidence and applying jurisdiction-specific mappings inside the Case Manager. This adds drafting assistance to the existing reporting process. The launch announcement describes a current product release; it does not publish a universal licence entitlement or a guaranteed reduction in rejected filings.[23]

The CDD Agent focuses on customer reviews: combining KYC records, screening results and transaction activity, highlighting changed risk and drafting the institution’s due-diligence forms. Its published configuration permits threshold settings, human intervention at different stages and SaaS or customer-cloud deployment. It is distinct from reviewing a single payment alert because the unit of work is the customer relationship and its changing evidence.[24]

For service exit, Hawk’s DORA document describes customer ownership of transaction logs, audit histories, case decisions and model configurations, together with portability, transition assistance and escrow arrangements. The signed agreement must define how those provisions apply to the actual deployment, including the form and timing of the handover.[18]