An AML programme inside a single bank is hard enough. When the unit of analysis is a network, every familiar assumption shifts: the customer is a participant's client, the flow is netted across several institutions, and the audit trail spans entities that are also competitors. Building an AML programme for a payment hub means deciding what gets checked once, what gets checked locally, and how both stay visible.

One validation, once

SUPA's protocol places a single legitimacy validation in front of every operation: reliance confirmation, sanctions screening, agent mandate, client-profile fit, and network anomaly signals. Over-limit operations become a human approval request rather than an automatic rejection. This concentrates the control in one function instead of duplicating it at each participant.

What the order book changes

Netting alters what monitoring even sees. Approved operations enter a single order book; offsetting flows cancel internally; the remainder is routed onward. If bank A sends €10m and participants B and C receive €8.5m, only €1.5m leaves the hub. The programme must therefore monitor both the gross intent and the net settlement, and be able to explain the difference.

Auditability as a design choice

The ledger is double-entry, built on TigerBeetle, with attribution to principal, agent and policy version. Per-unit reporting keeps each unit's activity distinct. Because regulators get one point of observation, they can follow a chain across participants from a single vantage point.

The test of such a programme is whether a supervisor can follow a flow end to end without asking each participant for its own reconstruction. One validation, one order book and one ledger make that possible, while local monitoring keeps each participant accountable for its own clients.

None of this removes the obligation to monitor locally. It changes where the work sits, and where the record is held.

This article is general information, not legal, tax or financial advice.

In short

  • A network needs one validation function, not many copies.
  • Netting changes what is monitored: gross intent and net settlement both count.
  • Over-limit operations escalate to human approval, not rejection.
  • One point of observation gives supervisors an auditable view.

See the institutional design at /institutions/.