Overview

Merlon is self-hosted AML/CFT software, designed with Japan's AML/CFT requirements as its baseline. It scores customer risk (CDD), monitors transactions (TM), screens against sanctions and PEP lists, and manages the resulting alerts and cases — all running inside your own infrastructure, against your own PostgreSQL database.

These pages are organized by what you are trying to do. Pick the track that matches your role; each one is ordered so you can read it top to bottom.

Understand what Merlon does

Start here regardless of your role.

• Getting Started — run the whole stack with Docker Compose in about five minutes
• Merlon Demo Tour — walk a pre-loaded dataset through scoring, alerts, and case resolution
• Architecture — how the Go API, native engine, and React UI fit together, and why the CDD score is the central axis
• FAQ — what Merlon is, and the design decisions evaluators ask about most

Compliance and controls

For compliance officers and second-line reviewers: what Merlon does about your regulatory obligations, and what evidence it produces.

• Regulatory Scope — which obligations Merlon addresses, and which it deliberately does not
• FSA Guideline Mapping — Merlon's controls mapped to the FSA AML/CFT guidelines
• Data Retention Policy — retention periods and the statutes behind them
• Case Management Workflow — the alert-to-case lifecycle and the STR filing path
• Authorization and Segregation of Duties — roles, permissions, and the dual-control points

Configure and tune

For the people who decide how strictly Merlon detects. Every rule is a configuration file, not code.

• Configuration Reference — environment variables and config.yaml
• Rule Authoring Guide — writing CDD weights, country risk tables, and TM scenarios, and rolling changes out safely

Deploy and operate

For whoever runs Merlon in production.

• Deployment Runbook — production topology and rollout
• Container Images — what is published, what each tag promises, and why there is no latest
• API and Worker Mode — splitting the API from background job processing
• Initial Data Migration — loading your existing customers and transaction history from files
• Upgrade Runbook — moving to a new release and verifying what you deployed
• Backup and Restore Runbook
• Partitioning and Capacity Operations Guide
• Performance Evidence — reproducing localhost transaction-ingestion measurements for a release candidate
• Dependency Lifecycle — supported runtime versions and EOL tracking
• Release Notes — what changed in each version
• Troubleshooting — a symptom index keyed on the error messages you are actually seeing

Security and assurance

For security reviewers, vendor-risk assessors, and internal audit.

• Security and Assurance — the short answers, and where the long ones are
• Data Egress — every outbound connection Merlon can make, and what triggers it
• Supply Chain — pinning, scanning, release provenance, and the known gaps
• Accepted Risks — what Merlon deliberately does not do, and the compensating controls

Integrate and extend

For developers connecting Merlon to a core banking system or another upstream.

• Adapter Guide — mapping your source system onto Merlon's data model
• REST API Reference — every endpoint, generated from the route definitions
• Rule Schemas — the JSON Schemas every rule configuration file is validated against

Contribute

For people changing Merlon itself.

• Development Environment Setup
• Testing Guide
• Documentation Guide — how these docs are written, translated, and checked
• Change Traceability
• Repository Governance
• Release Checklist