AML compliance software and screening

An AML program is more than a tool. It is the set of policies, controls and people a firm uses to manage its money laundering and terrorist financing risk. Software supports most of the controls, but the program also needs governance, training and independent testing.

• Risk assessment: understanding which customers, products, channels and countries expose the business to money laundering risk.
• Customer due diligence: KYC for individuals and KYB for businesses, with enhanced measures where the risk is higher.
• Sanctions screening: checking customers, counterparties and payments against sanctions lists.
• Transaction monitoring: reviewing activity for patterns that may indicate money laundering.
• Reporting: filing suspicious activity or suspicious transaction reports with the financial intelligence unit.
• Record keeping: keeping customer and transaction records so that activity can be reconstructed later.

1. 1

   Onboarding

   Pre-onboarding fraud signals, identity checks and screening decide whether a customer is accepted and at what risk level.

2. 2

   Screening

   Customers and counterparties are screened against sanctions, PEP and other risk lists at onboarding and again whenever the lists change.

3. 3

   Monitoring

   Transactions and customer behavior are reviewed against rules and expected activity; unusual activity raises an alert.

4. 4

   Investigation and reporting

   Analysts review alerts and matches, document their decisions, and report suspicious activity where required.

The FATF Recommendations are the global standard. They call for a risk-based approach, customer due diligence (Recommendation 10), record keeping (Recommendation 11), and the reporting of suspicious transactions (Recommendation 20). Targeted financial sanctions apply in addition to these preventive measures.

Firms apply these standards through their national rules, such as the EU anti-money laundering framework, the US Bank Secrecy Act and FinCEN rules, and the UK Money Laundering Regulations 2017. Supervisors generally expect controls proportionate to the firm's risk and evidence that they work in practice.

• Risk fit: does it support a risk-based approach, with thresholds and rules you can tune to your own risk assessment?
• False positives: how many alerts does it raise for every real match, and how quickly can an analyst clear them?
• Explainability: is every alert and match explained, so decisions can be defended to an auditor or supervisor?
• Coverage: which lists and sources does screening cover, and is that coverage documented?
• Integration: real-time API for onboarding and payments, batch for re-screening the customer base.
• Deployment and data: where customer data is processed, and whether the deployment can be dedicated to your organization.