Category: bug, security
Problem
src/aml/aml.service.ts defines checkAndFlag(payment: Payment) (lines 25-44), which is the only entry point that creates AML flags for high-value or high-velocity payments. A repo-wide search shows it is never called from PaymentsService, StellarMonitorService, SettlementsService, or anywhere else outside the aml module itself.
Impact
For a crypto-to-fiat settlement platform, this means the AML high-value ($10k+) and high-velocity (>50/day) checks described in the code are never actually triggered by real payment activity — the aml_flags table will always be empty in production, and GET /aml/flags (via aml.controller.ts) will always return nothing to review, giving a false sense of compliance coverage.
Suggested fix
Call amlService.checkAndFlag(payment) from PaymentsService (or the Stellar confirmation path) at the point a payment transitions to CONFIRMED/SETTLED, and add an integration test asserting a high-value payment produces an AmlFlag row.
Category: bug, security
Problem
src/aml/aml.service.ts defines
checkAndFlag(payment: Payment)(lines 25-44), which is the only entry point that creates AML flags for high-value or high-velocity payments. A repo-wide search shows it is never called fromPaymentsService,StellarMonitorService,SettlementsService, or anywhere else outside the aml module itself.Impact
For a crypto-to-fiat settlement platform, this means the AML high-value ($10k+) and high-velocity (>50/day) checks described in the code are never actually triggered by real payment activity — the
aml_flagstable will always be empty in production, andGET /aml/flags(via aml.controller.ts) will always return nothing to review, giving a false sense of compliance coverage.Suggested fix
Call
amlService.checkAndFlag(payment)fromPaymentsService(or the Stellar confirmation path) at the point a payment transitions to CONFIRMED/SETTLED, and add an integration test asserting a high-value payment produces an AmlFlag row.