---
title: Sardine Product Updates: September 2026
source_page: https://www.sardine.ai/blog/product-updates-september-2026
canonical: https://www.sardine.ai/blog/product-updates-september-2026
format: text/markdown
date: 2026-10-01T17:00:00.000Z
author: Annie Liegel
description: September updates add cross-queue alert decisions, new fraud list and bot controls, pre-filled Swiss and U.K. reports, AI agent previews, and no-SQL analytics.
---

**Quick links:** [Human page](https://www.sardine.ai/blog/product-updates-september-2026) · [Home](https://www.sardine.ai) · [Customers](https://www.sardine.ai/customers) · [Blog](https://www.sardine.ai/blog) · [Demo](https://www.sardine.ai/demo)

---

# Sardine Product Updates: September 2026

**Author:** Annie Liegel · **Published:** 2026-10-01T17:00:00.000Z · **Categories:** Product

September updates add cross-queue alert decisions, new fraud list and bot controls, pre-filled Swiss and U.K. reports, AI agent previews, and no-SQL analytics.

A fraud analyst applies the same decision in five different queues. A compliance officer retypes case details into a regulatory report. A data analyst exports a spreadsheet to answer one question. None of that work takes judgment, and all of it competes with the work that does.
September's releases go after that repetition. Three new platform launches, Sardine Flow, Agent Hub, and Agent Routines, let teams automate workflows without code, work with AI agents from one place, and put those agents on a schedule. The rest of the month removes smaller pieces of busywork across investigations, fraud prevention, compliance, and analytics.
The highlights:
No-code workflows with Sardine Flow. Build fraud and compliance workflows in a visual builder that connects data, APIs, rules, AI agents, and human review.
Agent Hub. Run every AI agent from one workspace, with each agent opening on the customer, transaction, or alert you're already viewing.
Agent Routines. Schedule any AI agent to run hourly, daily, or monthly, and review its findings in a severity-sorted inbox.
Cross-queue alert decisions. Resolve alerts across multiple queues in one action while keeping each queue's decision controls.
Pinned investigation checklists. Keep checklist questions open while reviewing transactions, entities, and other supporting evidence.
Saved case views. Save filters, sort order, and column layouts on the case management table, and share them with your team.
Expanded fraud controls. Add Visitor Fingerprint identifiers to allowlists and blocklists, screen counterparty bank details, and detect Meta Muse traffic.
Redesigned customer due diligence (CDD) review queues. Prioritize overdue, high-risk, upcoming, and assigned reviews from one clearer workspace.
Hidden screening signals. Hide sanctions, politically exposed persons (PEP), and adverse media signals that don't apply to a queue, so analysts see only what they review.
Swiss goAML reporting workflows. Pre-fill report fields, indicator codes, and narratives from existing case data to speed up suspicious transaction report (STR) and suspicious activity report (SAR) preparation.
U.K. National Crime Agency SAR pre-fill. Pre-fill subject, merchant, and activity fields from case data in a SAR template built for U.K. National Crime Agency requirements.
AI queue agent previews. Test prompts against recent alert context and review agent responses before saving the configuration.
In-region large language model (LLM) processing. Keep LLM requests from Sardine AI features in the same region as your production environment across Australia, Canada, and the European Union.
Expanded self-serve analytics. Build charts, tables, and pivot tables across cases, filings, risk ratings, and transaction data without writing SQL.
Platform: Automate the work between your tools
Fraud and compliance teams stitch together data providers, rules, scripts, and manual reviews, then re-explain each case at every step. Three launches take over that stitching.
Build no-code risk workflows with Sardine Flow
Fraud and compliance decisions rarely come down to a single rule or API call. They run through data providers, rules, AI agents, case systems, and human reviewers, and teams usually connect those with custom code, scheduled jobs, and one-off integrations that are hard to monitor and maintain. Sardine Flow replaces that with a visual builder. Teams drag and connect steps that call Sardine and third-party data, apply rules and conditional logic, invoke AI agents, route cases to human reviewers, and trigger actions in downstream systems. One neobank, for example, uses Flow to automate its false-positive allowlisting. Every 15 minutes, the workflow pulls alerts that analysts have cleared, runs extra checks, and adds qualifying customers to an allowlist, with each run recorded.
A workflow can start from an API request, an event, or a schedule. It can handle fast decisions, and it can pause for a vendor response, a scheduled event, an AI investigation, or human review. Flow logs every step and its outcome, so a team can show how a decision was reached. Admins control which nodes each user can access and can see performance and execution stats for each flow. Flow is live in production, with support expanding across more use cases.
Run every AI agent from Agent Hub
When AI agents live in separate tools and start without context, analysts end up managing the agents instead of investigating the risk. Agent Hub brings Sardine's AI agents into one workspace in the dashboard, with the context of whatever the analyst is already viewing. The agents include Rule Assistant, Data Analyst, Doc KYC, OSINT Search, Graph Analyst, Business Due Diligence, and Compliance Screening. Each one can work from the customer, session, transaction, or alert on screen, so nobody has to copy IDs or re-explain the investigation.
Teams can also attach an agent to an alert queue so it runs on each new alert, and test new agents or updates against defined scenarios before changes go live. Agent Hub and its core agents are live now, with availability expanding across regions and environments. Capabilities may vary by region.
Put agents on a schedule with Agent Routines
Fraud and compliance risk doesn't follow a schedule. Card testing can start at 2 a.m., and a chargeback pattern can build for weeks before anyone notices, yet AI agents only run when an analyst remembers to start them. Agent Routines let teams attach a schedule to any Sardine AI agent, so recurring checks run on their own. A Routine can run hourly, daily, monthly, or on another cadence, and anyone can also trigger one on demand. Teams use them to catch a burst of small authorizations on one card before it becomes real fraud, flag a chargeback spike in one channel the day it begins, run enhanced due diligence on a cohort every month and produce a report per entity, and re-check a false-positive alert against new data. Findings go to a notification inbox sorted by severity, and anyone on the team can open a chat with the agent about a flagged item to ask follow-up questions.
Routines keep memory across runs, use governed tool access, and log activity for audit. Higher-risk findings can be routed for human review instead of being acted on automatically. Routines are live across Sardine's AI agents.
Investigations: Resolve alerts across queues without losing context
Fraud investigations rarely stay in one queue, on one page, or inside one piece of evidence. Analysts end up repeating decisions and switching views, and every switch costs some of the context they were building.
Resolve alerts across multiple queues in one action
Analysts can now select alerts from several queues and apply one decision to all of them. Some queues restrict which decision labels analysts can use, so a bulk action has to respect those rules. If the label isn't available in every queue, a per-queue view opens with the compatible queues pre-filled, and the analyst picks an approved label for each remaining queue. A confirmation screen shows the final decision for every queue before anything is applied.
Three guardrails apply to bulk decisions. The action skips alerts with incomplete mandatory checklists and reports them back, still escalates decisions configured to create cases so cross-queue work keeps feeding case management, and assigns unassigned alerts to the analyst applying the decision so ownership stays clear.
Keep investigation checklists open while reviewing evidence
Checklists guide an investigation, but the evidence for each question is on other pages, such as transactions, entities, and activity. Analysts can now pin the checklist and keep it open as they move between those pages, answering questions as they find evidence instead of returning to the original alert. The panel is draggable, so it doesn't cover the data they're checking.
The checklist also tracks the time an analyst spends on each question, starting from the first interaction. It adds up time across sessions, excludes idle gaps, and records the total with the answer, so teams get effort data without timers or timesheets.
Save views and configure columns on the case management table
Case triage repeats every review cycle, and rebuilding the same filters each time adds up. The case management table now supports saved views and column settings, as the Queues and Customer Profiles tables already do. A named view captures filters, sort order, page size, and column layout, and analysts can mark one as their default. Teams with organization view permissions can share a view so everyone works from the same case list.
The URL also stores sort order and page size, so a shared link reopens the case list as the sender left it.
Fraud prevention: Cover more identifiers and bot traffic
Allowlists, blocklists, and bot signals only work if they cover what a fraudster actually presents: a device, a bank account, a visit to a protected page.
Add Visitor Fingerprint to allowlists and blocklists
Teams can now add Visitor Fingerprint identifiers directly to allowlists and blocklists, from either the details page or the list page. Select Visitor Fingerprint as the attribute type, paste the identifier, and apply it to an allowlist or a blocklist, depending on your traffic enforcement strategy. Lists that historically relied on Device Fingerprint can now move to Visitor Fingerprint.
Screen counterparty bank details with blocklists and allowlists
Blocklist screening now covers the counterparty's bank account, International Bank Account Number (IBAN), and sort code, and allowlist screening covers the counterparty's bank account and IBAN. A counterparty match on a blocklist sets the transaction risk to very high, in addition to sender matches. A trusted counterparty on an allowlist for all rules sets it to low, which helps reduce false positives, and an allowlist entry for specific rules skips only those rules.
Rules see sender and recipient results separately, so they can tell the two apart, including self-transfers where both sides are flagged.
Detect Meta Muse traffic
Meta Muse traffic now has initial detection. Visits from Muse to your protected pages raise the session's bot risk level.
Compliance: Prioritize reviews and reduce filing work
Compliance teams carry two kinds of repetition: deciding which review to open next, and moving details from a finished investigation into a regulatory report. [
Prioritize CDD reviews around urgency and ownership
A due diligence queue only helps if analysts can see what's overdue and who owns it. The redesigned CDD page adds workload tiles for overdue reviews, reviews due within seven days, high-risk and very high-risk reviews, and reviews assigned to the current analyst. Selecting a tile opens the filtered view. An Assigned to me tab scopes the list to the analyst's own reviews without any filter setup.
When reviews are sorted by due date, which is the default, the page groups them into Overdue, Due This Week, Upcoming, and No Due Date, with a case count for each group. The page also remembers the analyst's last-used filters and tab between sessions, and a shared URL with parameters takes precedence over those saved filters.
Show analysts only the screening signals their queue handles
Analysts previously saw entity-resolution signals for sanctions, politically exposed persons (PEP), and adverse media even when those signals didn't apply to their queue, and an out-of-scope signal could hold up alert or case closure. Teams can now choose which signals to hide for each queue, up to two of the three. A team that handles only sanctions, for example, can hide PEP and adverse media, and hidden signals no longer appear on the alert and case review screens, so analysts don't see empty sections.
The setting is opt-in for each queue, so existing queues and workflows stay the same until a team configures it. Contact your Sardine Account Manager to enable it, and set signal visibility when you create a queue, because changing it after the queue has processed alerts can make earlier alerts display inconsistently. Customer profiles still show all signals, since one customer can belong to several queues with different settings.
Pre-fill Swiss goAML reports with the STR and SAR wizard
Filing a Swiss STR or SAR means re-entering case details, looking up indicator codes in the goAML standard operating procedure, and writing the narrative by hand. The new wizard takes over most of that work. It selects the indicator codes and pre-fills repeated information from the case, so teams can file up to 80% faster.
Analysts choose from nine pre-built flows, five for STRs and four for SARs, covering scenarios such as sanctions and terrorist financing, adverse media, aborted relationships, and crypto-specific transactions. Each flow shows only the forms and fields its scenario requires, and case data fills most of them, including about 90% of the narrative. Analysts can include multiple related transactions in one submission while keeping transaction-level detail.
Built-in guardrails help keep indicator code combinations consistent, such as mandatory versus discretionary reporting. After the wizard generates the report, the analyst reviews it, downloads the XML version, and uploads it to the portal of Switzerland's Money Laundering Reporting Office.
Pre-fill UK National Crime Agency SARs with case data
For U.K. teams, a new SAR template built for the reporting requirements of the U.K. National Crime Agency (NCA) pre-fills subject, merchant, and activity fields from information already in the case. Analysts write the narrative in their own words, review the completed template, make any edits, and download it as a PDF for submission to the NCA.
AI: Test agents before they go live and keep LLM requests in your region
AI-powered workflows need the same reviewability as any other operational process. 
Preview AI queue agent messages before saving
A prompt that reads well in the editor can still behave differently once it's filled with real alert data. The queue configuration form now shows a live preview of the agent's message template next to the editor. Teams can render the template against one of the queue's 25 most recent alerts, or against sample data for a new queue, and see the composed message along with each context field the agent receives, such as the alert ID and customer ID, with its resolved value.
Selecting Run in chat starts a preview conversation so teams can see how the agent responds. Follow-up messages in that conversation also run as a dry run, and none of them post comments or update the underlying alert.
Run Sardine AI features on LLMs hosted in your region
Sardine AI features now send large language model requests to endpoints hosted in the same region as the customer's production environment, across Australia, Canada, and the European Union. That gives organizations with regional data processing requirements a clearer answer to data residency questions during security, compliance, and vendor reviews. Model versions may change in each region from time to time.
Introducing Sardine AI Labs and its research fellowships
Sardine AI Labs is a new applied research group that builds fraud and financial crime models for production, with real-world latency, governance, and explainability requirements in mind. Its first foundation model learns from unlabeled cardholder transaction histories and feeds those learned features into Sardine's existing issuing fraud model. The first version of the pipeline was built on NVIDIA's open-source transaction foundation model blueprint before Sardine moved to its own implementation for multi-client data. In early testing on card issuers held out of training, fraud detection accuracy improved 68% for a consumer card issuer and 41% for a business card issuer.
Sardine AI Labs is also funding up to five research fellowships, with $375,000 in total, for researchers at U.S. and Canadian universities. Applications are open through Dec. 13, 2026.
Analytics: Answer operational questions without SQL or exports
Teams shouldn't have to export data or write a custom query every time they want to understand what's happening across investigations, filings, or transaction activity.
Analyze cases, filings, and customer risk ratings
Chart Creator now includes Cases, Activity Reports, and Customer Risk Ratings as data sources. Teams can break down cases by status, decision, type, and assignee, track activity reports by template type, filing date, and deadline, and analyze customer risk rating distribution and movement. Risk rating charts follow the dashboard's customer filter, so filtered views match across panels.
Teams build these views in the guided chart builder and add them to custom dashboards without writing SardineQL. Each data source requires the analytics permission plus the matching case, activity report, or risk rating permission.
Build tables, pivot tables, and area charts on dashboards
Teams can now add Table and Pivot Table charts to the dashboard home page and build them from transaction data. Table and Pivot Table are premium features, so contact your Sardine Account Manager to enable them.
A Table supports up to 20 columns with filtering, sorting, rearranging, and aggregations such as transaction count and amount, and shows up to 1,000 rows. A Pivot Table adds grouping across up to three columns. Group transactions by brand and fraud label, for example, to see which brand has the highest fraud rate, then expand any group to review the underlying transactions, 100 rows at a time.
Area charts are also available for custom dashboard widgets and embedded charts. Teams can stack an area chart by a category such as risk level to compare how composition changes over time, and export the data to CSV.
Want to see any of this in action? Get in touch for a demo. Current customers can find the full details, including this month’s SDK updates, in our release notes and changelog.