EvoAML ships a dashboard, not a library, and its status labels disagree with its roadmap

One README gives two answers about whether the detectors exist

Core Architecture labels the graph-driven cross-industry tracker and the temporal evolution analyser as [In Progress]. A few lines below, the Roadmap marks Phase 3 Graph Tracking Module and Phase 4 Temporal Analysis Module as complete, and gives every other phase a completion marker too. Exactly one capability in that list is labelled [Implemented]: the AMLA 2020 Compliance Engine, described as translating detection results into standardized BSA-compliant SAR (Suspicious Activity Report) narratives.

So the two methods that carry both the project name and the repository description are the disputed ones, and the reporting step is the part presented as finished. That ordering matters to anyone deciding whether to spend an afternoon on this. A SAR narrative is the artefact a compliance officer has to defend to an examiner; a graph trace is the evidence they would use to defend it. The documentation treats the evidence as unfinished and the filing as done.

The Overview opens by promising coverage across cross-industry financial networks from three numbered methods, and two of the three carry an unfinished marker. Nothing in the repository reconciles the two lists.

Three required CSV columns, and both detectors depend on the optional pair

The Data Format section requires sender, receiver and amount. It then lists sector and timestamp as optional, and the sample file it shows carries all five columns. The README never says what the dashboard does when the optional pair is absent, and that pair is exactly what the two headline modules consume. Cross-industry tracking needs sector to know which industry a hop belongs to. Temporal evolution needs timestamp to have a time axis at all.

That makes a three-column file a quiet downgrade rather than an error. The upload is accepted, a sender-to-receiver graph exists, and the two passes the project is named for have no input. A reader who trims the sample down to the required columns, which the README invites by calling the rest optional, ends up with a smaller project and no warning that anything was lost.

The column list also stops at entity identifiers. There is no account number, no transaction id, no direction flag and no status field, so a reversed or duplicated transfer has nothing to distinguish it from a genuine one. Amount is described as a float in USD, which makes a file denominated in another currency valid input with no conversion step anywhere in the dependency list.

Two commands from the repository root are the entire documented install

Quick Start is three numbered lines, and only two of them are commands. Dependencies come from the requirements file, then the dashboard starts from app.py in the top level:

pip install -r requirements.txt
streamlit run app.py

Both have to run from a checkout of the repository. Nothing in the tree installs EvoAML itself: there is no setup.py and no pyproject.toml at the top level, so the code under src/ is never placed on the import path, and streamlit run app.py reaches it only because the working directory happens to be the repository root. The README gives no clone command and no import path, so a reader standing anywhere else has no documented way in.

The third Quick Start line sends you to examples/ for algorithmic workflows, which is a pointer rather than an action. Launching the dashboard is the whole documented first use, and the README does not describe what appears on screen, what a finished run looks like, or how a SAR narrative is retrieved from it.

Five lower bounds, no lock file, and no database anywhere in the list

requirements.txt is the entire dependency contract:

networkx>=3.1
pandas>=2.0.0
numpy>=1.24.0
streamlit>=1.28.0
scikit-learn>=1.3.0

Every entry is a lower bound with no upper pin, so two machines resolving the same commit can land on different pandas and numpy builds. scikit-learn sits in the same file as streamlit, which means the analytics stack and the interface upgrade together on every install.

The list also says where the analysis runs. There is no database driver and no service client, so the transaction graph, the time series and the web server all live inside one Python process. For a demonstration that is a light design. For a screening job it puts the dataset in the same process a browser session is talking to, and the README documents no row limit, no chunking step and no timeout for a large upload. Nothing in the list is a reporting or rule-engine library either, so whatever writes the SAR narrative lives in src/ with no published dependency that would identify it.

The Implemented label has no test, no rule set and no field list behind it

The top-level listing has no test directory and no test file. For a project whose Phase 1 is called Foundation & Compliance Architecture, the compliance engine is the one component marked [Implemented] and the one component with no automated check visible in the repository layout.

The claim itself is a single line. There is no field list for a SAR, no rule set, no reference filing to compare an output against, and no statement of which regulator's format is being targeted. The description names BSA and AMLA 2020 as the compliance targets, and the architecture section expands BSA into Suspicious Activity Report narratives, but nothing reconciles the two names or defines what a compliant narrative contains.

MIT is the only licence in the repository, and it covers the code. It says nothing about a filing produced by that code, and no document in the repository states who reviews a generated narrative before submission. A team reading the [Implemented] tag as a compliance sign-off would be reading a label rather than a control.

examples/ holds one file, and the documentation has two homes

Quick Start points at examples/ for algorithmic workflows, plural. The directory contains one file, workflow_demo.py, and the README gives no command to run it and no sample output to compare it against. A reader who wants to see detection logic outside a browser has a file name and no invocation.

The same one-to-many problem sits in the documentation. Two README files occupy the top level, README.md and README_zh.md, linked to each other as peers rather than generated from one another. There is no build step, no translation script, and no statement of which file leads. So the labels that disagree with the roadmap have to be corrected in a repository where two files make that claim, and fixing one leaves the other free to keep telling a reader who switches language something different.

A docs/ directory sits alongside examples/ and nothing in the README points into it. Its contents are not described, so a reader cannot tell whether the design notes live there or the directory holds something else.

Where putting the graph in a database takes a different route

The usual alternative to a framework like this is to keep the transaction graph in a graph database and query it there. Neo4j is the common example: entities and transfers become nodes and relationships, and the analysis is written as Cypher instead of Python that walks a networkx structure in memory. Three differences follow from that choice.

The data outlives the process. Here the graph is held by the same Python process that serves the dashboard, so re-analysing means uploading the file again. In a database the ingested graph persists and later queries run against it.

The work is inspectable. A Cypher query can be read, corrected and rerun by someone who does not write Python, then scheduled. A function inside src/ that the README never names as an import path cannot be handed over that way.

The cost moves as well. A database server is infrastructure to run, secure, back up and version. EvoAML needs five pip packages and no service, which is the easier thing to start and the harder thing to grow into. The two routes answer different questions about where that graph should live.

Editorial conclusion

EvoAML suits a compliance engineer who wants a transaction graph and a SAR-shaped narrative in a browser without standing up a database, and it suits nobody who needs a versioned release, a documented import path, or evidence that a filed narrative was checked by something other than its own author. Before adopting it, open src/ and settle which of the two README claims about the graph and temporal modules is true, because a label reading In Progress and a roadmap line marked complete cannot both be accurate.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. README
4. RongLiu-AML/EvoAML on GitHub