# Where these names came from

Every list in this directory was written by hand for this environment. None
is derived from a customer file, a sanctions list, a leaked dataset, a public
records scrape or any other collection of real people or real businesses.

- **`first_names.json`, `surnames.json`** — 40 given names and 40 surnames,
  chosen to be common across many languages so that no generated customer
  reads as belonging to one region. A generated name such as "Priya Whitlock"
  or "Dmitri Okafor" is a random pairing; any resemblance to a real person is
  the ordinary consequence of common names being common. Analysts who "closed"
  prior alerts are drawn from the same two lists.
- **`words.json`** — business names are composed as `adjective + noun +
  suffix` ("Harbor Lane Bistro LLC" is the shape). Branch codes and street
  names are invented.
- **`jurisdictions.json`** — every counterparty jurisdiction is **fictional**.
  The "monitored" list is the synthetic institution's own high-risk corridor
  list; it names no real country and makes no claim about any real
  jurisdiction's risk rating. The customer's home country is the United States
  in the main seed slice and the fictional "Karnland" (currency KRN) in the
  held-out slice, where the reporting threshold is a fictional 20,000 KRN
  rather than the public 10,000 USD currency-transaction-report threshold.

Licence: these lists are part of the repository and carry its Apache-2.0
licence.

The scenario *templates* in `../alert_triage/generator.py` are written from
public typology descriptions — FinCEN's SAR narrative guidance and the FATF
typology reports — which are cited on the demo's evidence tab as references.
Nothing from those documents is shipped as data, and no template is a real
case.