Fraud risk management, one connector
SanmigGRC's National FRM Connector is the middleware layer between a participating institution's core systems and the DPIP Smart Registry. Everything below runs against a local simulation of the published API contract, so a bank can see the whole workflow — screening, contribution, EDD, dispute and audit — before a single credential is issued.
Registry compositionedge node replica
Read the mix, not the count. A registry heavy with ALERT entries is a registry that has outrun its EDD capacity. Suspect should only ever be a minority of entries, and every one of them should trace to a closed case.
Decision policybank-configurable
- Block transactionscore ≥ 70
- Step-up authentication45 – 69
- Allow, monitor25 – 44
- Allow< 25
Thresholds belong to the bank. SanmigGRC ships defaults; the board's risk appetite sets the live numbers, and every change is versioned in the audit layer.
Run a screening →Moduleswhat SanmigGRC supplies
1 · Registry Gateway
Validation, salting, SHA-256, JWS signing, mTLS, retry and idempotency across all six APIs. Edge Node replica for sub-100ms screening.
Simulated in this build2 · Real-time Screening
Inline calls at onboarding, profile change, beneficiary addition, transaction initiation and inward credit. Fail-open or fail-closed is a bank policy setting.
Simulated in this build3 · Mule & Behavioural Engine
Fan-in/fan-out, velocity, dormancy-then-burst, structuring, device sharing, profile-change-then-transfer. Produces candidates, never verdicts.
Simulated in this build4 · Risk Scoring
Composite of registry status, identifier strength, corroborating institution count, source reliability, recency decay and bank-side behaviour.
Simulated in this build5 · EDD & Case Management
Alert → Suspect/Cleared lifecycle, feedback posting, revoke and dispute with SLA tracking and full audit trail.
Simulated in this build6 · External Intelligence Connectors
I4C/NCRP, NPCI, telecom regulatory bodies, LEA references, MuleHunter.ai outputs — each behind its own authorisation.
Requires separate authorisation7 · DPDP & Audit Layer
Lawful-basis register, retention clock, access logging, data-principal grievance route for wrongly listed customers, evidence pack for RBI IT examination.
Design completeLatest EDD caseslifecycle
| Case | Trigger | Status | SLA |
|---|---|---|---|
| CASE-2211 | Velocity — 14 new beneficiaries | ALERT | 3d left |
| CASE-2209 | Structuring below threshold | ALERT | 4d left |
| CASE-2204 | Inbound dispute from another PI | SUSPECT | OVERDUE |
| CASE-2198 | Customer grievance — wrongly listed | CLEARED | closed |
Session activitypi-id XYZB0001
Simulation mode. No live registry connection, no IDPIC empanelment, no production data. This console exists so a bank's build and UAT can proceed before credentials land.