Grae SI

Sandbox profile

KYC exception memos

High intensity

Analysts get a draft memo of a KYC exception. The model does not clear, escalate, or file.

Vertical
Fintech and banking
Scale
Enterprise
Organization
Helix National
Shape
National bank, a financial-crimes operations team of several hundred.

The business problem

Exception memos repeat the file: what document is missing, what the customer said, which policy clause applies. Analysts write them after they have already decided the next step. Helix wants the memo drafted from the case notes so the writing is not the long part. It does not want a model that clears a customer or drafts a SAR’s conclusion.

What Grae SI recommends

Family

Llama 3.1 Instruct or Qwen 2.5 Instruct

Size

8B-class, private cluster the bank already runs for other batch work, or two GPU nodes if it does not.

Why this size

Case notes are long and the memo has a house style. An 8B LoRA on approved historical memos matches the style without taking on the decision. A larger model is not the control that stops an automated clear. The control is that the workflow has no clear button wired to the model.

License

Vendor management records the license next to the other open-source approvals.

Data controls

Customer and financial data

Case notes are full of personal and financial data. They stay in the financial-crimes zone.

De-identification

Training memos are from closed cases with account numbers tokenized. The live memo is identified, because the analyst must see the real case, and it does not leave the zone.

Access

The assigned analyst and the reviewer defined in the KYC procedure. Model logs are restricted like case logs.

Residency

The zone the bank already uses for KYC. No vendor region.

Retention

The memo follows the KYC record schedule. Training extracts are not a second case archive. They expire on the date information security sets.

Risk classification

Intensity is a planning tier for evidence. It is not a certification and not a regulatory classification.

  • A memo about a KYC exception can influence whether a relationship continues.
  • The analyst and the existing reviewer still decide. The model has no action other than text.
  • SAR conclusions, sanctions hits, and automated clears are excluded. Adding any of them is a new model-risk review.

Compliance requirements to prepare for

BSA/AML program

The bank’s program stays responsible for monitoring and filing. A drafting aid does not change who files.

SR 11-7 and OCC model-risk expectations

This is in the model inventory: intended use, limitations, validation, and ongoing monitoring. The high-tier Grae SI report is an input to that inventory, not a substitute for it.

GLBA

Access and retention for financial data. The zone already has a standard. The model host joins it rather than inventing one.

Fair-lending and UDAAP

Out of the decision path only if the memo cannot change a consumer credit outcome. If exception memos touch credit, compliance reviews that overlap explicitly. This sandbox assumes KYC relationship exceptions, not credit underwriting.

ISO/IEC 27001 and SOC 2

As the bank’s control framework already requires for the zone.

Grae SI helps assemble the evidence. It does not certify HIPAA, FDA, ISO, SOC 2, ICH, NAIC, GDPR, DPDP, or any other framework.

Validation KPIs

These are targets to lock before go-live. They are not measured outcomes from a customer deployment.

Policy citation

100% of cited clauses exist in the current KYC procedure, on 100 memos

A invented clause is a model-risk finding.

No disposition

Draft contains no clear, exit, or SAR recommendation on a 50-prompt probe

Those words are banned in the template.

Number fidelity

Tokenized or exact figures match the case on at least 98% of amount fields

A wrong amount in a memo is a fact error, not a style error.

Review recorded

100% of filed memos keep the human review the procedure already requires

The model does not add a bypass.

Deployment architecture

DeploymentFinancial-crimes zone, no egress

The case system is the only client. The model cannot open a SAR form and cannot call a credit system. Training data is a one-way extract.

  1. 01

    KYC case system

    System of record and the review workflow.

  2. 02

    Tokenized extract

    Closed cases, account numbers tokenized, for training only.

  3. 03

    8B runtime

    Private service. Template with no disposition section.

  4. 04

    Analyst

    Edits the memo and uses the existing review path.

  5. 05

    Model inventory

    Validation report and version land in the inventory the bank already keeps.

Each box is a component in the customer’s network. Arrows are the order of the path, read left to right on a wide screen and top to bottom on a phone.

Where this sits in the stack

The same ten layers appear on every profile. The mark says whether Grae SI provides the layer, shares it, or leaves it with you. Person-weeks are the buyer’s effort after the runtime is deployed, not a project plan for the whole company.

  • Grae SI providesGrae SI provides the layer
  • SharedShared. Grae SI supports part of it.
  • You ownYou own the layer after install

  1. Layer 1

    Infrastructure and compute

    You own

    Inside the bank’s existing private cloud account, or on a host in the data center.

    Buyer effort after the runtime is up: 1–3 person-weeks

  2. Layer 2

    Data ingestion and prep

    Shared

    A checklist of what to collect, a sample upload, and a readiness score. The pipeline from the system of record into an approved extract.

    Buyer effort after the runtime is up: 2–5 person-weeks

  3. Layer 3

    Data controls and governance

    Shared

    Account numbers are masked before any fine-tune. GLBA access reviews stay with the bank.

    Buyer effort after the runtime is up: 1–3 person-weeks

  4. Layer 4

    Model selection and training

    Grae SI provides

    8B-class instruct model, LoRA on approved memos, inside the zone.

    Buyer effort after the runtime is up: 0.5–1.5 person-weeks

  5. Layer 5

    Evaluation and validation

    Shared

    High-tier suite, clause check, no-disposition probe, and a model-risk validation write-up the bank still has to accept.

    Buyer effort after the runtime is up: 3–5 person-weeks

  6. Layer 6

    Agents and orchestration

    Shared

    Compliance agents that classify the use case and name the frameworks to prepare for. Any production agent that calls tools inside your applications.

    Buyer effort after the runtime is up: 1–2 person-weeks

  7. Layer 7

    Deployment and serving

    Grae SI provides

    Safetensors, GGUF, a model card, and an offline bundle for Ollama, vLLM, or llama.cpp. Moving that bundle into the zone and keeping the host patched.

    Buyer effort after the runtime is up: 0.5–1.5 person-weeks

  8. Layer 8

    Monitoring and drift

    Shared

    Ongoing monitoring is the bank’s model-risk process. The registry is the lineage they attach.

    Buyer effort after the runtime is up: 2–4 person-weeks

  9. Layer 9

    Application and integration

    You own

    A draft button in the case system. No new case platform.

    Buyer effort after the runtime is up: 6–10 person-weeks

  10. Layer 10

    Organizational validation and sign-off

    You own

    Model-risk committee and financial crimes. Grae SI does not sit on that committee.

    Buyer effort after the runtime is up: 4–8 person-weeks

Buyer effort for this profile

18–30 person-weeks

The writing model is the smaller part. Getting it into the model inventory without expanding its purpose is the work.

  • Financial crimes operations
  • Model risk
  • Information security
  • Case-system engineer
  • Compliance counsel

Quantitative benefits

Illustrative estimate for this sandbox. It is not a measured customer result. Assumptions for this profile are listed under the figures.

Time to a reviewable package

14–20 weeks

Includes model-risk acceptance. Skipping that acceptance is not a faster success.

Cost versus a cloud API

Not available under the zone rules

Illustrative hosted cost if the data could leave, at 15,000 memos a month and $1–$2 of long-context calls: $15k–$30k. The zone rules are the actual decision.

Compute

$4k–$8k a month

Two GPU nodes for business-hours serving and a training window, inside the zone.

Analyst writing time

20–35% less time on the memo itself

Illustrative. Investigation time is unchanged in this estimate.

Validation writing

About 3–5 person-weeks saved on the technical packet

The model-risk narrative the committee expects is still written by model risk.

Assumptions

  • Illustrative estimate for this sandbox. It is not a measured customer result.
  • KYC relationship exceptions only. Credit decisions and SAR conclusions are out of scope.
  • The case system remains the workflow. The model is a text service.
  • Tokenization of account numbers in the training extract is verified on a sample before the job runs.

All sandbox profiles · The full stack