SAS: financial-risk analytics, AML and fraud operations

The principal users include fraud strategists, AML analysts, investigators, credit modellers, treasury and asset-liability teams, model validators and risk managers. Data engineers and platform administrators maintain the information and runtime environments on which those users depend. For a broker, the strongest fit is institutional risk, customer and payment controls, and analytical governance around the business.[11][5][10]

In AML, the published data model maps transactions to account, customer and household dimensions and includes nonmonetary events, geography, risk lists and third-party information. Monitoring can aggregate scenario results at entity level, prioritise alerts and route cases. The feature list also describes nightly batch preparation: the product’s broader real-time entity capabilities should not be read as a claim that every AML job runs continuously.[6]

SAS’s technical e-filing walkthrough describes a concrete FinCEN workflow: validate report data, generate ready-to-submit e-files, submit manually or through Secure Direct Transfer Mode, then process acknowledgement files to update case and report status. It documents scheduled jobs and permission checks. That establishes a configurable reporting process for the described implementation, rather than universal direct connections to all regulators.[34]

Data Hub also exposes connection health and usage and manages permissions at the connection layer. Its processing options include bulk loading, partitioning and database-side SQL. These features can reduce unnecessary movement, but they do not make every workload data-resident: where computation occurs depends on the selected engine, source and application.[14]

Model Risk Management adds a governance layer across analytical technologies. It records the owner, model version, validation history and usage and supports review workflows and business-glossary/lineage information. That is useful when financial decisions rely on both SAS models and models developed elsewhere; a central inventory does not itself validate the financial assumptions inside each model.[12]

The financial applications reviewed here invite customers to request pricing and a tailored demonstration. SAS sells Viya directly, through partners and through cloud marketplaces, so the commercial route and product bundle matter. No single public enterprise price establishes the cost of an AML, fraud or balance-sheet-risk deployment.[5][19]

SAS’s contracting overview says its newer contracts allow worldwide installation on physical or virtual hardware and public or private clouds. Most software licences include non-production test, development or failover installations without additional charge. Related-entity use can require increased licence quantity. Existing customers may still hold older master-licence arrangements, so these statements concern the newer contract framework.[20]

SAS Consulting offers architecture assessment, Quickstart deployment, modernisation, optimisation and model tuning. Financial-services work includes AML alert optimisation and fraud-risk assessment. Those services address different stages: selecting the operating design, deploying it, preparing the team and later revising models or workloads as the business changes.[28]

The AML administrator learning path makes the configuration work explicit: segmentation, watchlist monitoring, scenario properties, alert generation, customer risk ranking, report validation and e-filing. It links introductory materials and an administration course. These are operational capabilities that a customer team must learn and maintain, even when SAS manages the infrastructure.[29]

For self-managed Viya, current support policy requires an environment meeting the published Kubernetes and platform requirements. SAS supports Viya itself rather than administering Kubernetes under standard technical support. Alternative or noncompliant distributions can receive Limited Support and may require the customer to reproduce a problem on a supported stack.[22]

SAS publishes security bulletins and recommends current maintenance and security fixes. For SAS 9.4, its private Java runtime is updated separately from ordinary application hot fixes; the bulletin page distinguishes Java versions for different maintenance releases. Consequently, maintaining an older SAS estate includes component-level patching, not just upgrading a business application.[25]

Hosted Managed Services advertises 24/7 support and a 99% uptime guarantee. That statement applies to the managed-service offering; the contracting index separately lists its service-level warranty. It should not be extended to every self-managed licence, nor used to infer credit calculations or exclusions that were not accessible in the retrieved contract text.[18][21]

The support definitions distinguish supported software from work produced during a consulting or cloud engagement: such custom software/code does not automatically qualify for ordinary Technical Support. Purchased enhanced support can add a Technical Support Account Manager. This distinction matters when an implementation contains bespoke models, pipelines or application logic.[24]

Viya Copilot is a separately controllable cloud feature. Even when the main Viya environment is customer-managed or on premises, Copilot sends prompts and relevant context to a SAS-managed Azure service using Azure-hosted models. Depending on the request, that context can include code, metadata, pipeline information or personal data from a table. Customers can decide at enterprise level whether to use it.[17]

SAS states that Copilot processes prompts and contextual data transiently, deletes them after the request and does not use them to train models; it says the same applies to Microsoft. It has opted out of Microsoft human review, although automated abuse monitoring remains. Inputs remain customer-owned. These commitments concern the documented Copilot service, not every possible third-party model a customer connects.[17]

The Privacy Trust Center distinguishes SAS’s controller role for its own interactions from its processor role for customer-provided data. Customer processing follows agreed terms, supported by data-processing agreements, technical and organisational measures and service-specific subprocessor lists that include locations. That framework is the relevant starting point for processing scope and cross-border access.[26]

The compliance page explicitly says that some programmes and certifications are still under development and that applicability depends on scope. Accordingly, a framework logo on a SAS page should not be treated as evidence that every deployment is certified. The financial applications support an institution’s controls, reports and governance; they do not confer a banking, brokerage or investment-services authorisation.[27]

The 2025 annual report says SAS generated more than US$3 billion in annual sales, with Viya sales up 20% and cloud sales up 22%. SAS qualifies the report’s metrics as management-reporting figures that may differ from GAAP. They provide context for the supplier’s scale; they are not financial results attributable solely to its risk or financial-crime products.[2]

SAS acquired Kamakura Corporation in June 2022, adding risk software, research, quantitative expertise and subscription risk data. Kamakura Risk Manager remains an identified SAS product. In November 2024, SAS acquired Hazy’s principal software assets and intellectual property for synthetic-data capabilities. The latter was an asset/IP transaction, so it should not be described as proof that SAS acquired every Hazy corporate activity.[30][31]

Operator

SAS Institute Inc.

Service scope

Financial-crime monitoring and investigations; fraud decisioning; credit and model-risk management; asset-liability, liquidity and market-risk analytics; supporting data, AI and risk-data services.

Customer types

Banks; Financial institutions; Insurers; Asset managers; Financial intermediaries; Risk and treasury teams

Delivery

SaaS; Hosted; On premises; Hybrid; Managed service; API

Pricing publication

Quote only

Headquarters

Cary, North Carolina, United States

Platforms

SAS Viya; SAS Anti-Money Laundering; SAS Fraud Decisioning; SAS Real-Time Watchlist Screening; SAS Asset and Liability Management; Kamakura Risk Manager; SAS Risk Modeling; SAS Model Risk Management; SAS Data Hub; SAS Viya Copilot

Integrations

REST APIs; Python; R; SAS Viya MCP Server; Snowflake; Databricks; Google Cloud BigQuery; Amazon Redshift; Oracle; Teradata; MongoDB; Neterium

Pricing scope

Enterprise financial applications invite pricing requests; product packages, hosted services and marketplace offerings have distinct commercial scopes.

Implementation

Architecture and data preparation, application configuration, scenario/model validation, deployment and team training; SAS or partners can assist and managed-service options allocate infrastructure work differently.

Support

Regional technical support and critical telephone escalation; enhanced offerings and managed hosting have distinct terms. Customer portal, email, training and security bulletins support ongoing operation.

Permissions and regulatory scope

Analytics and financial-control software. Model governance, screening and regulatory reporting support institutions’ obligations without authorising financial services or validating every model assumption.

Provider metadata checked 21 Oct 2026Source 1Source 4Source 5Source 7Source 8Source 10Source 9Source 11Source 12Source 13Source 14Source 15Source 18Source 19Source 28Source 23Source 22Source 30Source 35Source 16

The former Kamakura website now presents SAS Risk Data and Analytics. It publishes default-probability analytics, bond-performance attribution and research on correlated interest-rate and foreign-exchange simulations. This provides a separate research and data dimension alongside the software products; a forecast or modelled default probability remains an analytical estimate rather than a realised market outcome.[35]

SAS Viya Copilot’s current application scope includes code assistance, model work, report creation and investigation support. In Asset and Liability Management, its documented role includes comparing economic value of equity and net interest income across runs, adjusting risk factors and examining warnings. The institution still determines scenarios, model suitability and how results inform actual financial decisions.[16][10]