watchman - AML/CTF/KYC/OFAC Search of global watchlist and sa

项目说明

![Moo Logo]()

<p align="center">
<a href=" Documentation</a>
·
<a href=" Watchman</a>
·
<a href=" Endpoints</a>
·
<a href="
·
<a href="
<br>
<br>
</p>

![GoDoc]()
![Build Status]()
![Go Report Card]()
![Apache 2 License]()
![Slack Channel]()
![Docker Pulls]()

moov-io/watchman

Moov's mission is to gi an easy way to create and integrate bank processing into their own software products. Our open source projects are each focused on solving a single responsibility in financial services and designed around performance, scalability, and ease of use.

What is Watchman?

Moo is an open-source sanctions screening engine. One Docker command downloads OFAC (and EU, UK, UN, and related lists), indexes them in memory, and scores each customer or counterparty with an inspectable multi-field matcher. You get a ranked hit and a score from 0 to 1 — Apache 2.0, in your network, with a scorer you can read.

HTTP API, Go client, browser UI, experimental MCP.

How to run it: Using Watchman. For BSA/AML and sanctions officers: For compliance and risk.

On 472,477 labeled people, companies, and (OpenSanctions Pairs), Jaro–Winkler at minMatch=0.80 had precision 0.99. Cross-script embeddings raised recall from 0.69 to 0.82, with precision 0.95. That is a production-shaped queue: almost every alert is real.

Key Features

Included Lists

Watchman integrates the following lists to help you maintain global compliance. Use the en INCLUDED_LISTS or config file to customize which lists are loaded.

| Source | List |
|-------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| OpenSanctions | Any Senzing formatted list from OpenSanctions |
| European Union | Consolidated Sanctions List |
| US Go | Consolidated Screening List (CSL), FinCEN 311 |
| US Treasury | Office of Foreign Assets Control (OFAC) and Non-SDN list |
| United Kingdom | UK sanctions list |
| United Nations | Consolidated Sanctions List |

When loading multiple OpenSanctions or custom Senzing-formatted lists, set the SENZING_CONCURRENT_DOWNLOADS en to control parallelism during downloads (defaults to 5 concurrent).

Project status

Moo is actively used in multiple production en. Please star the project if you are interested in its progress. If you ha abo to simplify tasks, perform business operations, or found bugs we would appreciate an issue or pull request. Thanks!

Try it

In another terminal, wait until OFAC is indexed (the first download can take a minute):

Screen a designated person at a production cutoff. This is OFAC SDN 48603. The Russian passport is an identity key, so the score is 1.0:

Browser UI: Always send type. minMatch=0.80 is the usual screening line (precision ~0.99 on a public labeled set).

The same name without an ID scores 0.767 and returns nothing at that cutoff. Add date of birth and it clears 0.80. Watchman is built so the fields CDD already collects change the score:

Add debug=true to see which fields produced the score. Full recipe: Using Watchman. Search API: Search.

Docker

Images: moo on Docker Hub, quay.io/moo for OpenShift. moo: ships frozen 2019 files for fast local tests (not the live SDN). The WASM UI is at / on :8084.

That docker run publishes only the business API (:8084). Do not expose Watchman on the public internet. See Network access. Each result in entities is the list record with a match field (0 to 1) on the same object.

Network access

Watchman is not designed to be ser on the internet. Run it on a private network or behind a reverse proxy / API gateway. Authentication, ACLs, and rate limiting belong at the edge of the deployment, not inside Watchman.

The HTTP API (BindAddress, :8084) is unauthenticated by design (search, ingest, export, refresh, web UI, MCP). The admin server (AdminAddress, :9094) is a separate port so you can firewall it, bind it to an internal interface, or block it entirely. Prometheus /metrics and / live on the admin port on purpose and are unauthenticated.

Download URLs (file:// locations, *_DOWNLOAD_TEMPLATE, *_DOWNLOAD_URL) are operator configuration, not API input. Watchman does not allowlist hosts or jail file:// paths.

See Network access, issue #875, and issue #876.

Data persistence

By design, Watchman does not persist search queries. Your application must retain screening logs (who was screened, when, against which list hashes, at which cutoff). Watchman can store ingested files (the indi records) in
a MySQL or PostgreSQL database for concurrent access. External lists that are downloaded on startup (and refreshed periodically) are only kept in memory. No encryption of data in-memory
is performed.

Download reliability

External sanctions lists are fetched over the network on startup and during periodic refreshes (default every 12h). Go endpoints can be flaky or una, causing startup failures
or refresh errors. For production use, see Caching Data Files for local pre-loaded files and the companion project
moov-io/watchman-cache, which provides a nginx reverse proxy + long-li designed to sit in front of Watchman.
It works with the existing *_DOWNLOAD_TEMPLATE / *_DOWNLOAD_URL en with no changes required to Watchman.

Configuration

Watchman recommends file-based configuration but supports en options.

FAQ

#### Reporting hits to OFAC

OFAC requires reporting of positive hits and has a self-disclosure portal. Work with your Financial Institution for complete details.

#### Useful resources

Getting help

channel | info
------- | -------
Project Documentation | Our project documentation a online.
Twitter | You can follow Moov.io's Twitter feed to get updates on our project(s). You can also tweet us questions or just share blogs or stories.
GitHub Issue | If you are able to reproduce a problem please open a GitHub Issue under the specific project that caused the error.
moov-io slack | Join our slack channel (#watchman) to have an interacti about the de of the project.

If you find a security issue please contact us at .

Supported and tested platforms

Contributing

Yes please! Checkout our issues for first time contributors for something to help out with.

Building Watchman's source code follows standard Go commands. You can use make build to compile the code and make check to run linters and tests.

Run make install to setup gopostal / libpostal for Watchman.

Run make setup-deepparse to start an optional deepparse HTTP sidecar (ghcr.io/graal-research/deepparse:0.11.0) as an alternati parser. It is disabled by default.

Related projects

As part of Moov's initiative to offer open source fintech infrastructure, we have a large collection of acti you may find useful:

License

Apache License 2.0 - See LICENSE for details.

项目信息

开发语言：Go

Star 数：512

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕AML/CTF/KYC/OFAC Search of global watchlist and sanctions展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。