Product designer · research + end-to-end design
OKLink's compliance suite is two products: On-chain AML for alerts and address and entity profiles, and Chaintelligence, a separate site for mapping fund flows. One investigation crosses four of their surfaces, but nobody had designed the path between them, so analysts finished cases in XMind and spreadsheets and usage stayed low. New regulation in Hong Kong made the suite a priority.
Stage 1 · Triage
Alert page · KYT
"Is this alert worth a case?"
Handed over
Stage 2 · Assess
Address risk · KYA
"How risky is this address, and why?"
Shipped
Stage 3 · Identify
Entity profiles · KYE
"Who is behind the address?"
Shipped
Stage 4 · Trace and report
Fund-flow graph · Chaintelligence
"Where did the money go?"
Shipped
While the team debated what to build, I proposed watching first. I interviewed 3 compliance officers across APAC and the US and sat in on real cases, mapping each step, tool and breakdown.
AML investigators working the alert queue, and compliance officers at exchanges, OTC desks and institutions. Often on a small laptop, for a full shift.
A transfer crosses a risk rule, often around US$2,000. The analyst asks who else is involved, how much moved and whether it repeats.
Document the suspicious pattern, then close the case, escalate it, or export the fund-flow map as evidence for management or the regulator.
Low and medium alerts get about 15 minutes; high and severe ones 30 to 45. Anything an analyst has to hunt for comes out of that.
Decisions go to reviewers in other regions and, in the end, to regulators. A score nobody can explain doesn't survive that.
The real synthesis happened outside the product: colour groups and notes in XMind, comparisons in spreadsheets.
"It lacks features like A, B and C." Shown where they were: "Oh, I didn't know those features are there. They're what we need."
So each stage made existing features findable before adding new ones.Get the alert to the right person.
An alert fires (often around US$2,000); a team lead assigns a specialist; status becomes unreviewed.
Decide whether this alert is worth a case.
Ask the same four questions in order: risk share, amount, source, direction. Transfer and behaviour alerts share a similar structure.
Spot red flags in the user profile.
Check overview, past transactions, deposit and withdrawal behaviour; nationality, KYC level, VIP status, whether they trade actively.
Confirm whether the funds came from illicit activity.
Expand counterparties by risk amount, compare addresses, look for repeating patterns.
Document findings, then close or escalate.
Write up the findings, dismiss or escalate; the decision goes to reviewers in other regions and may reach a regulator.
Filter down to the addresses worth following.
Enter an address or hash, see everything connected to it, filter suspicious addresses by amount.
Pull everything into one picture of the chain.
Browse related addresses and transactions, group and annotate them, save, then keep updating.
Hand the evidence on.
Export the graph, rebuild it in XMind, share a link.
Three entry points (address graph, transaction map, transaction path) forced a technical choice before the analyst had any context.
Hundreds of nodes around a centre showed what was connected, not which way the money moved.
A label can name a person, and the bodies that receive a report don't share intelligence. Labels show to the analyst and stay off anything shared outward.
"Ten addresses, then their common counterparties one layer out, two layers, up to twenty. Right now I do it in a spreadsheet." This became multi-hop tracing in section 03.
Every analyst asked the same four questions in the same order, so I laid the page out by those questions instead of by data source:
AHeader: the alert ID onlyBThe graph behind a small iconThe answers sat in four places across two sections, out of order, so part of a 15–45 minute review went on jumping between them.
AActionsAWhy it firedAEvidenceBUser record · fund-flow graphCAssignment, status, findings, conclusionThe answers read top to bottom in the order analysts ask, with the case log beside the evidence.
The FATF-aligned score breaks down in layers: five risk dimensions built from 14+ configurable risk factors, then three evidence tables that go down to the original sanctions listing. I made every layer open to its source, because a score nobody can explain doesn't survive review. An analyst can answer "how do you know?" without leaving the page.
Detected risks: five dimensions on a radar, the categories that fired beside it, and three tabs into the evidence.
Each blocklist row names the category, the listing body and a link to the original, so the analyst can open the OFAC record itself.
Trace a target address outward layer by layer, up to 50 addresses, with first and last transaction times on hover. I designed and specified it from the same research; it was with engineering when I left.
Multi-hop analysis: the risk-path list, one asset's transaction map, and the detail panel for a related address.
An address tells you what moved, not who you're dealing with. KYE answers that for exchanges, mixers and services. I designed how analysts get to an entity: the landing page, search and the category list. Another designer did the entity page.
The design team disagreed in internal review about how to structure the entry. Rather than keep arguing, I asked 3 colleagues to try three layouts on the same tasks, such as "find the darknet-market entity in the United Kingdom".
Search, categories and the full entity table stacked on one scroll.
Search first, then explore by category; the entity list opens from a category, not stacked on the landing page.
No landing page; open straight on the entity table with search and a category filter.
All 3 found 1.2 the easiest to understand: search comes first, and categories don't blur into entities.
Their comments also shaped the final design: "KYE" alone wasn't clear to them, but the full name was, so the navigation says "Know Your Entity".Many open questions weren't about layout but about what the data could honestly support, and each was settled with product and the data team before the field shipped.
A count fits the table; a list is what a compliance officer needs. The answer changed the column in the entity list.
Exact, fuzzy or alias matching decides whether an analyst finds an entity under its local trading name or misses it.
The old graph was a star that hid which way money moved, and the write-up happened in XMind after an export. The redesign follows the analyst from opening a graph to writing it up. The biggest change was the layout: I chose a left-to-right flow because analysts read a case as money moving from source to destination. The other five steps are folded below.
The radial layout became a left-to-right flow that reads the way money moves.
The scattered tool rail became three groups: save and export, add and filter, edit. Edit actions appear only for what's selected.
The graph offers "Show mutual counterparts", the comparison analysts had been doing by hand in a spreadsheet.
After discussing it with the PM, I split the graph redesign into phases and implemented it feature by feature, so each feature could ship when it was ready instead of waiting for the whole redesign.
The cost was that some phases went out incomplete. When one couldn't supply risk-profile data yet, we dropped that column rather than ship it blank: a column that's always empty teaches people to skim past the table, and on a compliance screen every visible field has to be trustworthy.Analysts build a graph around a case, not a single address. Three entry types became one list of case graphs, and light mode became the default for analysis.
The entry moved from a bar at the top to the centre of the empty canvas, styled like the address node it creates, and it takes several addresses at once.
The old graph dropped one node onto an empty canvas. Now it expands one layer of senders and receivers automatically, so the analyst starts with the immediate picture.
Investigators gather suspicious addresses offline. They can now add them from a counterparty's related-addresses panel, from empty canvas, or from the transaction panel, not only from the top bar.
Analysts grouped evidence by colour and named the groups in XMind. Both moved into the tool, a colour palette for nodes and a summary label for a group, so the exported graph is already the report.
Screens from the design files. Red notes inside some screens are from the original reviews, in Chinese.
06 · SystemOne risk scale, an exchange-logo library, light and dark themes, and responsive layouts with permission variants, shared by all four stages.
Five levels built once, with light, dark, text and dot variants, used by alerts, addresses and entities.
Counterparties read as venues, not hashes, in alerts, the entity list and graph nodes.
Dark is tiring over a full shift but suits a projected review, so both ship, with light as the default.
Internal investigators and external clients see different fields, so each breakpoint has permission variants.
Global convention: a tooltip follows the direction of its arrow and always stays inside the content area. Each finding is boxed on the build, numbered and written up against the spec.
I specified a watermark for exported graphs; engineering moved it out of the release, and export shipped without it.
After launch, an analyst can go from an alert to a written-up graph inside the product, and every risk score opens to its source. The alert page and multi-hop tracing went to engineering as finished specs.
Time from opening an alert to a decision, against the 15–45 minute budget, watching high and severe alerts most closely.
How many cases still get exported and rebuilt in XMind. If in-graph synthesis works, this should fall.
Uses per case, as a measure of how much spreadsheet comparison it replaced.
I specified event tracking for the graph redesign, but it didn't ship before I left and no baseline was captured, so these are the measures I'd start with, not results.
The 15–45 minute budget, the detour into XMind and the copy-paste into a second tab all came from sitting in on real cases. Ordering four tools as one investigation mattered more than polishing any single screen.
The tracking was specified but didn't ship before I left, and there was no baseline, so I can describe what changed but not how much time it saved. Next time I'd agree a baseline with product during design and make tracking part of the first release.