Product Updates

New "Password" OAuth webhook

A new type of OAuth has been added to our webhooks called “Password” flow. This flow is compatible with Salesforce. Teams can use the username-password flow to authorize a client via a connected app that already has the user’s credentials.

Users can configure this in the webhooks modal in the Settings page

Required Fields:

  • Client ID
  • Client secret
  • Token URL
  • Username
  • Password

Optional Field:

  • Access token encoding
Password Webhook
Screenshot of Password Webhook

Manually add new cases

Transaction Monitoring clients can now manually create new cases in Case Management to track cases that are identified outside of the Alloy system (such as an email or phone call) to better consolidate all information and documentation relating to a suspicious activity investigation. Previously, cases were automatically generated based off of the workflow outcomes.

To create a case:

  • Click ‘Create Case’ on the Case Management home page

  • You will be prompted to enter an entity identifier (known as the entity token in the Alloy system or an external ID that is passed from your system to Alloy), associate a manual alert type, and enter any notes you may have on the case.



    • Please note that cases can only be created for known entities (i.e. it must be an existing entity in the Alloy system).

    • You can only have one open case per case type for a given entity.

  • Click ‘Create Case’ and you will be redirected to the new case page.

  • The new alerts will appear in the ‘Alerts Triggered’ section with “(manual)” identifier.

Note: Agents must be appropriately entitled (i.e. have case editing permissions) in order to create cases manually.

Entity sanction screening for transaction monitoring workflows

Transaction Monitoring clients can enroll users in recurring sanctions screening checks against the most up-to-date watchlists to stay on top of risky customers. Once enrolled, the entity will automatically be screened in real time every time a watchlist is updated in the future. Coverage can be tailored to include sanctions lists, PEP screens, and/or adverse media checks through our pre-built integrations with data partners specializing in watchlist screening.

If there is a match, a case will automatically be created for action in Case Management. Agents conducting due diligence can further drill down into the specific watchlist that triggered the alert and match confidence score to make informed decisions.

To get started with ongoing sanction screening, please refer to our support article or reach out to your CSM or [email protected].

Bulk assign applications

Users can now assign applications to either themselves or to other users - depending on their role & permissions.

Users can filter by Assignee so they can only view applications assigned to the filtered user. Filters will also now automatically be saved per user that’s signed in and will only be cleared if the user manually clears them.

Manually add alerts to cases

Transaction Monitoring clients can now manually add alerts to existing cases in Case Management to accommodate circumstances that may trigger an alert outside the Alloy system (such as an email or phone call). Previously, alerts were automatically triggered based off of workflow outcomes. Now, clients can consolidate the tracking and management of all types of alerts in a single place – irrespective of the originating source of the risk.

In order to start using this feature, the agent must have case editing permission and must be assigned the case they wish to add an alert to. On the Case details page, users will now be able to select “Add an Alert Manually” from the ‘Take Action’ menu on the top right. The user will then be prompted to select the alert they would like to associate to the case and add any notes they might have.


Once completed, the new alerts will appear in the ‘Alerts Triggered’ section with “(manual)” identifier.

Pass outcome reason tags between workflows in a Journey

Outcome Reason tags can now be passed from one workflow to another in a Journey. This enables Alloy to handle state management on the client’s behalf, even in a complex Journey. For example, if there are two instances where you might run document verification in a Journey, using an Outcome Reason tells Alloy whether document verification has already been called and prevents it from being triggered again, to ensure the customer is not asked to complete it twice.

When an Outcome Reason is passed into a downstream workflow, it is called an “imported” value in that workflow. This imported tag can be used in this subsequent workflow (of any type) in the same way as a normal tag. It can also be used in the new “Router”-type workflow, now available as part of this release, to determine what to do next in the Journey. The most common way of doing this in the new Router-type workflow would be to connect the imported value to different outcomes which represent the different paths your Journey could take from that point.

To pass an Outcome Reason tag from one workflow to another, clients using Journeys need to first make a tag into an Outcome Reason in the “Settings” section of the dashboard. In the workflow they wish to import into, they would then click “Import Outcome Reason” in the top right menu of the workflow builder, selecting the Outcome Reason they wish to import.

To learn more about Journeys, view our documentation. If you’d like to try Journeys or start passing Outcome Reasons in your Journey, reach out to your SA, CSM, or [email protected].

New SDK powers the future of custom step-up verification

Alloy clients can now use Alloy's future-proofed SDK to support step-up verification. Clients using the updated SDK will be able to leverage the services of new fraud vendors as quickly as their business requires. Clients only need to integrate the SDK once, and then can make changes to their plugins without having to touch the SDK initialization code. The new SDK also supports Document Verification for Multi-Entity Applications. Instructions for setting up the SDK and more on Multi-Entity Support can be found here.

View alert details in Case Management

Transaction Monitoring clients can now review the exact activity triggering alerts in Case Management to streamline the review and resolution of cases. Within the case details page, analysts can double click the Alerts tab to view detailed information about the rule and the specific event(s) (e.g. transactions or account level activity) setting off the alert in a pop up.

Depending on the rules, case alert details may include:

  • Date of event

  • Event/transaction description

  • Transaction type

  • Transaction amount

  • Email address, phone number

  • Account balance


Clients will be able to view alert details for the following types of rules:

  • Transaction History
    • Monetary

    • Non-monetary

    • Counterparty

  • Account History
    • PII snapshots

    • Balances.

Back