Singapore Institute of Technology, 2026

KYC Screening

A Source of Wealth screening tool that helps bank compliance officers check new clients faster, without missing the red flags that matter.

See how it worksView on GitHub
Role
Software engineer
Team
5 SIT students
Period
Sep 2026 to now
Built with
Python, Flask, OpenAI, Claude, Docker, GitHub Actions

The report

What a compliance officer sees.

A screening report flagging a made-up client as Serious Risk, with the next step, review date and reasons
A made-up client flagged as Serious Risk. All client data in the project is synthetic.

The problem

Slow checks, high stakes.

Before a bank takes on a wealthy client, it has to check where their money came from. After the Monetary Authority of Singapore fined nine banks a combined S$27.45 million for missing Source of Wealth red flags, banks became far more careful, and opening an account could take six weeks or more.

We set out to make that screening faster and more consistent, while keeping the final call with a human officer.

How it works

One assessment, one verdict.

  1. Read the documents

    The AI reads payslips, tax notices, bank statements and company records, and fills in the client form. Anything the client didn't declare is flagged, not added.

  2. Research the risks

    It pulls known money laundering patterns for the client's industry from FATF and MAS reports, and turns them into possible stories: one honest, the rest criminal.

  3. Test every story

    A forecast checks whether the money adds up under each story, and a benchmark compares the client with peers in the same economy.

  4. Give one verdict

    Fixed rules combine every check into Passed, Manual Review, Risky or Serious Risk, with the reasons and the documents to request next.

The new client form, with a box at the top for uploading documents so the AI can fill in the form
Upload documents and the AI fills in the empty boxes.
The reasons section of a report, listing each failed check and where the checks agree
Every verdict lists the checks behind it.

Design decisions

Built for an industry that has to explain itself.

AI gathers, rules decideThe AI only collects evidence. Every verdict comes from fixed rules in a policy file, so the same case always gets the same answer and an auditor can trace why.
Privacy by designThe benchmark AI only sees an allowlist of career fields, such as job, industry and age. It never sees what the client says they own.
Two checks must agreeSerious Risk needs two independent features pointing the same way, which keeps one noisy AI answer from condemning an honest client.
Same result everywhereThe command line and the web app call the same assessment, and tests check both routes save the same client from the same documents.

The team

Five of us, one codebase.

I built this with Adrian, Dominic, Shannen and Shareen for SIT's Programming Foundations with DevOps module. My main role was coding the crime scan feature.

The crime scan checks whether the way a client describes their wealth matches a known money laundering pattern in their industry. The AI reads reports from trusted regulators such as FATF and MAS, and pulls out the crime patterns for that sector, quoting the exact sentence each one comes from. The code then confirms every quote really appears in the report and drops any pattern it can't verify, so the AI can't invent evidence.

Fixed rules then test five warning signs against the client's declaration, such as money in unusual countries or payments from people they don't name. A pattern only counts when all of its core warning signs fire.

Every change goes through a branch and a pull request, and GitHub Actions runs the tests and builds the Docker image on every push.

193 automated testsCovering the scoring rules, the AI response checks and the document routes, so a change to one part can't quietly break another.

Want the full story?

I'm happy to walk through how the screening works, or how we kept the AI auditable.

sohweiyu.work@gmail.com

Back to portfolioLinkedIn