Inspiration
There’s a regular at the convenience store near my place. I’ll call him Dave. He’s partially visually impaired, and every time I saw him he’d tell me the same thing: he wanted to play OLG games online from home, because getting to the store all the time was a real hassle for him.
He tried. He couldn’t get through the online sign-up on his own. Photographing his ID, lining his face up in an oval, solving a CAPTCHA: every step assumed he could see the screen. In the end he needed someone else to do it for him.
That stuck with me for two reasons. First, Dave isn’t rare. Using Statistics Canada’s rate for seniors with a seeing disability, we estimate about 350,000 seniors in Ontario are in a similar position:
$$3.07\text{M Ontario seniors} \times 11.4\% \approx 350{,}000$$
Second, when someone else signs up for you, the operator no longer really knows who’s behind the account. That’s exactly the kind of account anti-money laundering rules worry about.
Then I talked to someone on OLG’s compliance team at the hackathon, and they described the other side of the same problem: it’s very hard to tell who is actually laundering money. Alert on a single signal like a VPN and you flag innocent people, waste analyst time, and lose good customers.
So ClearPass became one product with two sides: let people like Dave verify on their own, and help analysts focus on the patterns that actually matter.
What it does
For players: an accessible sign-up flow.
Fill the form by voice. The app asks each question out loud, listens, reads the answer back, and fills the field only after you confirm. Spoken camera guidance for ID photos (“Move the card left,” “There’s glare, tilt it”), with auto-capture so you never have to aim visually. Verify through your bank as a no-camera option. The bank you verify with becomes your verified bank, which the monitoring side uses as your baseline.
For OLG’s analysts: pattern-based AML monitoring.
11 red flags across funding source, cash-out route, play behaviour, timing and linked accounts. For example: verified with RBC but withdrawing to TD. Risk comes from how many red flags back each other up, not from any single one: $$ \text{Tier} = \begin{cases} \text{Clear} & 0 \text{ flags} \ \text{Low (watch quietly, no alert)} & 1 \text{ flag} \ \text{Medium (analyst review)} & 2 \text{ flags} \ \text{High (investigate)} & 3+ \text{ flags} \end{cases} $$ When flags line up with a known laundering method, the case is labeled with a pattern from the bank playbook (pass-through, structuring, third-party funding, mule networks, activity inconsistent with profile), along with the evidence and a recommended next step. A draft suspicious transaction report for any Medium or High case, a linked-account graph, and a money-in/money-out map. Accessibility signals are never scored. Using a screen reader, being slow, or retrying a photo is not suspicious. How we built it Front end: plain HTML, CSS and JavaScript, so there’s no build step and it runs anywhere. Atkinson Hyperlegible font (designed for low-vision readers), full keyboard support, and screen reader announcements through ARIA live regions. Voice and camera: the browser’s built-in speech synthesis and speech recognition. Camera frames are checked several times a second for brightness, glare, sharpness and where the card sits, and that becomes one spoken instruction at a time. AML engine: a standalone JavaScript module (engine.js) that also runs in Node, so we could test the logic without the UI. It generates 180 synthetic players and about 32,000 transactions, including planted launderers for each pattern and innocent “trap” players built to trip one or two red flags. Rules from real sources: FINTRAC’s casino guidance, including the 24-hour rule and the Casino Disbursement Report for payouts of $10,000 or more within 15 days, plus how banks group laundering methods into typologies. We used Claude as a coding and research assistant throughout. Challenges we ran into The rubric changed our direction. We started with accessible sign-up only. When OLG revealed their criteria (detection, contextual risk, prioritization, investigator experience), we realized sign-up alone wouldn’t score well, so we connected it to an AML engine through the verified bank. “Don’t flag anything under $10,000” turned out to be wrong. It sounds sensible, but splitting deposits under $10,000 is exactly how structuring works. Our final rule: a single transaction under $10,000 never alerts on its own, but several in 24 hours that add up past $10,000 do. Making validation honest. Our first run caught 100% of planted launderers with zero false alarms, which looked too good to be true. So we added innocent people with two red flags (like using a spouse’s card from another bank) to show that Medium means “a person checks,” not “guilty.” On the same data: Approach Alerts Innocent players flagged Precision One red flag = alert 33 13 61% ClearPass patterns 22 2 91% Camera guidance for someone who can’t see. Directions had to be mirrored for the front camera, glare had to be detected, and instructions had to be spaced out so the app didn’t talk over itself. Time zones. A UTC bug put “evening” sessions at 5 AM Toronto time, and that wrongly triggered our late-night player protection flags. What we learned One red flag is a question. Several are a pattern. That’s how bank investigators actually work, and it’s what the compliance team asked for. Reportable isn’t the same as suspicious. A $25,000 jackpot has to be reported to FINTRAC, but nothing about it is suspicious. Keeping those separate cuts noise. Accessibility is more than adding labels. The hard part was designing for the moment someone can’t see the screen at all, and making sure the fraud side never punishes people for using assistive tech. Talk to the actual users. Dave gave us the problem, and ten minutes with OLG’s compliance team gave us the design.
What’s next A pilot on anonymized OLG alerts, to replace our synthetic numbers with real ones Adding login and session data, so we read behaviour and not just money On-device speech recognition, so a player’s personal details never leave their phone Testing with blind and low-vision users through CNIB
Log in or sign up for Devpost to join the conversation.