AML software for banks

• Breadth of products: current accounts, lending, trade finance, private banking and payments each bring different money laundering risks.
• Correspondent relationships: a bank processing payments for another bank depends on that bank's own controls.
• Scale: large customer bases and high payment volumes make manual screening impossible and false positives expensive.
• Cross-border payments: transfers reach many jurisdictions and several sanctions regimes at once.
• Evasion techniques: designated persons use spelling variants, transliterations, aliases and front companies to get past screening.
• Corporate customers: business accounts need ownership traced to the people who control them.

1. 1

   Assess and rate risk

   An enterprise-wide risk assessment and a customer risk rating that decides how much due diligence each relationship receives.

2. 2

   Onboard with due diligence

   Identity verification for individuals, KYB with beneficial ownership for companies, and enhanced due diligence for higher-risk customers such as PEPs.

3. 3

   Screen customers and payments

   Sanctions and PEP screening of customers at onboarding and of the parties to payments before they are executed.

4. 4

   Monitor

   Re-screening when lists change, and transaction monitoring for activity that does not fit the customer's profile.

5. 5

   Investigate and report

   Reviewing alerts, recording decisions and their reasons, and reporting suspicious activity to the financial intelligence unit.

The FATF Recommendations set the baseline for banks: customer due diligence (Recommendation 10), PEP measures (Recommendation 12), additional measures for correspondent banking (Recommendation 13), information that travels with wire transfers (Recommendation 16) and implementation of targeted financial sanctions (Recommendation 6).

In the UK, banks are subject to the Money Laundering Regulations 2017 and to the FCA's requirements for systems and controls against financial crime. In the EU, credit institutions are obliged entities under the EU anti-money laundering framework. In the US, banks are subject to the Bank Secrecy Act and FinCEN's rules, including customer identification and suspicious activity reporting, and US persons must comply with OFAC sanctions. Supervisors generally expect controls that match the bank's risk, tested regularly, with evidence that they work.

• Real-time and batch: an API that can sit inline in onboarding and payment flows, and batch screening for the whole book.
• Matching quality: fuzzy matching that handles transliterations, aliases and spelling variants without flooding analysts.
• Explainable matches: every alert shows the list, the record and the field that matched, so decisions can be defended to examiners.
• Ownership screening: company checks that reach the beneficial owners, with ownership-based sanctions rules applied.
• Ongoing monitoring: re-screening on list changes, with alerts only when something has changed.
• Deployment and data control: where customer data is processed, and whether anything outside the bank's control sits in the decision path.