Unit21 is a fraud prevention and anti-money laundering (AML) company whose AI agents detect suspicious activity, investigate alerts and prepare regulatory filings for banks, credit unions, fintechs and crypto firms. It is aimed at financial crime teams that are buried in alerts and need to clear them faster without losing control of the decisions regulators care about.
The approach is to let software do the evidence gathering and paperwork while analysts keep the final say on what is reported.
At A Glance
| Vendor | Unit21 |
|---|---|
| Category | Fraud prevention, AML transaction monitoring, financial crime case management |
| Agentic AI | Detection, investigation, case and SAR agents with four autonomy levels |
| Customers | Brex, Chime, Crypto.com, FIS, Green Dot |
| Certifications | SOC 2 |
| Market classification | Fraud Prevention |
What Unit21 Does
Fraud and AML analysts spend much of their day gathering data for alerts that turn out to be harmless. Unit21 hands that work to AI agents that carry out detection and investigation themselves rather than summarising alerts for a person to read. One platform covers the path from the first risk signal to the regulatory report, so context gathered at detection is still there when a case is filed. Every AI decision is traceable and mapped to the customer’s own policies.
Products
AI Agents
Agents are available for specific financial crime workloads: transaction monitoring, sanctions screening, enhanced due diligence, check fraud, ACH fraud, account takeover and 314(a) requests. A Case Agent works through investigations and a SAR Agent pre-populates SAR, STR, CTR, 314(a) and goAML filings.
Real-Time Monitoring
Real-Time Monitoring is for payment and fintech teams that must stop fraud before money moves. It scores events in under a second and can block payments in that window.
Fraud Consortium
The Fraud Consortium lets institutions benefit from fraud that others have already seen. Members include over 100 fintechs, banks and crypto companies, and the network covers more than 80 million US adults. When a device, email or identity element is confirmed as linked to account takeover at one member, others are warned. It screens for account takeover, synthetic identity, first-party fraud, social engineering and mule accounts using pre-built rules, and members share signals rather than raw personal data.
Other Modules
- Device Intelligence for device risk scoring
- AML Transaction Monitoring and Case Management
- Payment Screening and Sanction Screening
- Customer Risk Rating and Regulatory Filings
How It Works
| Component | What it does |
|---|---|
| Data ingestion | A proprietary ingestion layer connects to any tool, provider or system, including direct links to Aurora MySQL, BigQuery, Databricks and Snowflake and direct core banking integrations that remove manual extraction and reconciliation. |
| Consortium flow | Users are screened against shared signals at onboarding or when a payment starts, alerts pass through the rules engine, and a member can confirm fraud with one click to update the network in real time. |
| Security | Data is protected with 256-bit AES encryption in storage and 256-bit SSL/TLS in transit, and penetration tests are carried out by Doyensec and Cobalt. |
Agentic AI Capabilities
Investigation Agents
Agents pull transaction histories and linked entity data, check watchlists, assemble evidence, draft narratives and recommend a disposition. To query data they write SQL or Python: “the model reasons, the code executes”. Every step is logged, and the Agentic Task Builder lets teams write their own investigation logic for agents to follow.
Human Oversight
- Agents never file SARs or CTRs themselves; a person approves before anything is filed or closed
- When a case is ambiguous or confidence is low, the agent escalates rather than guessing
- Analyst overrides take precedence and are logged
Autonomy Levels
Autonomy is set per queue, risk tier and jurisdiction. Level 1 runs on demand only, Level 2 reviews automatically while a human decides, Level 3 adds an AI recommendation, and Level 4 closes alerts automatically within guardrails. Most customers start at Level 2.
Integrations
| Area | Integrations |
|---|---|
| Core banking | Corelation Keystone, Fiserv DNA, Fiserv Finxact, Fiserv Premier, Jack Henry SilverLake, Jack Henry Symitar |
| Digital banking | Alacriti, Alkami, Bankjoy, Finastra, NCR/Candescent, Q2 Core Pro |
| KYC and KYB | AIPrise, Middesk, Persona, Socure, Trulioo, Veriff |
| Crypto | Chainalysis, Elliptic, Merkle Science, TRM Labs |
| Watchlists | LexisNexis Bridger, LexisNexis Risk Narrative |
| Device intelligence | Castle, Fingerprint |
| Other | Plaid, Salesforce, Zendesk, Treasury Prime, Unit, Jack Henry 4Sight and Synergy |
Company Background
| Founded | 2018 |
|---|---|
| Headquarters | San Francisco, United States |
| Leadership | Trisha Kothari, co-founder and CEO |
| Scale | A reported 4.5 billion events monitored each month and 5% of SARs filed in the US |
| Funding | A $45 million Series C in 2023, led by Tiger Global and South Park Commons |
| Recognition | Two 2026 Datos Impact Awards; included in the Chartis RiskTech100 |
Note: This overview is compiled from Unit21’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.