Overview

Merlon is self-hosted AML/CFT software for non-bank financial institutions in Japan. It scores customer risk (CDD), monitors transactions (TM), screens against sanctions and PEP lists, and manages the resulting alerts and cases — all running inside your own infrastructure, against your own PostgreSQL database.

These pages are organized by what you are trying to do. Pick the track that matches your role; each one is ordered so you can read it top to bottom.

Understand what Merlon does

Start here regardless of your role.

• Getting Started — run the whole stack with Docker Compose in about five minutes
• Merlon Demo Tour — walk a pre-loaded dataset through scoring, alerts, and case resolution
• Architecture — how the Go API, native engine, and React UI fit together, and why the CDD score is the central axis

Compliance and controls

For compliance officers and second-line reviewers: what Merlon does about your regulatory obligations, and what evidence it produces.

• Regulatory Scope — which obligations Merlon addresses, and which it deliberately does not
• FSA Guideline Mapping — Merlon's controls mapped to the FSA AML/CFT guidelines
• Data Retention Policy — retention periods and the statutes behind them
• Case Management Workflow — the alert-to-case lifecycle and the STR filing path
• Authorization and Segregation of Duties — roles, permissions, and the dual-control points

Configure and tune

For the people who decide how strictly Merlon detects. Every rule is a configuration file, not code.

• Configuration Reference — environment variables and config.yaml
• Rule Authoring Guide — writing CDD weights, country risk tables, and TM scenarios, and rolling changes out safely

Deploy and operate

For whoever runs Merlon in production.

• Deployment Runbook — production topology and rollout
• API and Worker Mode — splitting the API from background job processing
• Initial Data Migration — loading your existing customers and transaction history from files
• Upgrade Runbook — moving to a new release and verifying what you deployed
• Backup and Restore Runbook
• Partitioning and Capacity Operations Guide
• Dependency Lifecycle — supported runtime versions and EOL tracking
• Release Notes — what changed in each version

Integrate and extend

For developers connecting Merlon to a core banking system or another upstream.

• Adapter Guide — mapping your source system onto Merlon's data model
• REST API Reference — every endpoint, generated from the route definitions
• Rule Schemas — the JSON Schemas every rule configuration file is validated against

Contribute

For people changing Merlon itself.

• Development Environment Setup
• Testing Guide
• Documentation Guide — how these docs are written, translated, and checked
• Change Traceability
• Repository Governance
• Release Checklist