Market Guide for Anti-Money Laundering

Market Definition

1. Placement: Introducing illegal money into the financial system (for example, depositing cash as smaller tranches into banks or purchasing assets).
2. Layering: Moving the money around to obscure its origins, often through complex transactions, transfers between accounts or international transfers.
3. Integration: The now “cleaned” money is reintroduced into the economy and made to look like it comes from a legitimate source (for example, investing in businesses or buying property).

• Unusually high or frequent movements of money (using transaction monitoring)
• Suspicious geographic origins or destinations (using location intelligence)
• High-risk payers and payees (using know your customer [KYC] and customer due diligence [CDD])

• Sanctioned individuals and countries
• Watchlists for suspicious individuals/companies (for example, those that have been prosecuted in criminal proceedings previously)
• Adverse media (such as reports of ongoing investigations)
• Politically exposed persons, aka “PEP” (for example, customers that may be more liable to blackmail)

Mandatory Features

1. Transaction monitoring (TM): This module is capable of ingesting data for financial events in the form of deposits and transfers (both internal and external). It must have links to the payments hub (or payment systems) at the bank and also its core banking system.
2. Decision engine (DE): This module is used to calculate risk scores and it must include a BRE and it is usually augmented by an ML model. The DE will process banking data accessed via the TM module. It will also need a set of API connectors for ingesting additional data from security systems such as device ID, location intel and behavioral biometrics. Some of these APIs will be standard off-the-shelf connectors for common systems and others will be custom-made for a specific deployment. The combination of BRE and ML is used to highlight suspected money laundering activity by calculating and then integrating the risk scores for:
   • The transaction — For example, is it an unusually large amount of money, or unusually frequent, or to/from a high-risk country that may be subject to sanctions?
   • The customer or account — For example, is this someone (or a business) that is on a watchlist, or liable to be blackmailed, or the subject of a criminal investigation/prosecution?
   • Note that the ML may be imported from the bank (if it has a preexisting model) or it may be supplied off-the-shelf by the vendor and then tuned for the specific bank it is deployed at.
3. Case investigation (CI): Transactions highlighted by the DE as high risk need to be assessed by human case investigators. Bank staff will use the CI module to make an informed judgment about whether a particular transaction is a TP or a FP. The CI module will give access to additional data sources such as KYC, adverse media and watchlists to help make the judgment. To increase productivity and accuracy, modern case investigation modules typically include such capabilities as step-by-step automated workflow, AI assistants, agentic AI, smart allocation, triage for urgency/importance and suggestions for data source prioritization. Advanced CI will handle the simplest, most common and most certain cases entirely by machine (straight-through processing [STP]) with minimal or zero inclusion of a human analyst.
4. Reporting: There is always a capability for generating a report (such as a suspicious activity report [SAR] for the regulator) that states the judgment with an audit trail for how that decision was determined. Modern systems will include some kind of automation or AI to prepopulate the report as much as possible.
5. Orchestration: This applies to both data and processes. There must be a means of importing the right data, from the right systems and sources, at the right time, and then processing them in the right order. This is the “glue” that integrates the preceding four modules. Most vendors will have built their own orchestration capability, or else they will have adapted a standard business process management (BPM) tool for this specific purpose.

Common Features

• AML is often used as an umbrella term that includes not just the mandatory features above (TM, DE, CI, reporting and orchestration), but also a host of other, often independent, systems that contribute to identifying and verifying the illicit activities associated with money laundering. These supplementary systems may already be present at the bank (in which case they must be connected) or they may be preintegrated and supplied by the main AML vendor. The AML vendor may have designed and built the supplementary system itself, or it may have acquired it, or it may have a preferred partner and “white label” this third-party solution. These supplementary systems can include:
  • Know your customer/business (KYC/KYB): A system for verifying at onboarding a customer’s identity and assessing the risks associated with their financial activities
  • Customer due diligence (CDD): An ongoing process for checking at regular and appropriate points that a customer’s financial behavior matches the profile that was captured at onboarding
  • Enhanced due diligence (EDD): A system used subsequent to CDD for a deeper assessment of high-risk customers
  • Entity resolution: A system used to match multiple records that may be linked to the same entity; especially important for unravelling complex corporate holding structures and shell companies that may be used to obscure the ultimate common source (or beneficiary) of a transaction
  • Sanction screening: A system used for checking customers, businesses and transactions to see if they are in contravention of international sanctions and watchlists (in which case the bank must not facilitate them)
  • Adverse media: A system that searches for negative information that could indicate that the customer/business may be involved in, or associated with, illicit or corrupt activities that could pose a risk to the bank
  • Politically exposed persons (PEP): A system for identifying those customers who hold high public office and, thereby, may be at greater risk of bribery, blackmail or corruption
• AI assistant for CI: Case investigators are often new to the job and can be greatly assisted (and made more productive, accurate and consistent) if there is an AI assistant alongside to help them through the CI process. An AI assistant can help with steps and tasks such as: what is the next step (task or decision); which is the best data source to use; prepopulating the bulk of the report which has to be submitted.
• Agentic AI: Whereas AI assistants usually augment and collaborate with human investigators and analysts, agentic AI is more often used to replace the human in a subset of CI instances. Typically, the agent is used to add rapid STP for the simplest, most common and most certain cases in the AML queue. These cases can be processed by the machine, leaving humans to focus on the more complex and more ambiguous cases. Agents can also be used to perform a triage on which cases should be prioritized (most urgent/most important) for humans, who is best equipped to deal with them (smart allocation) and calculating performance metrics.
• Fraud detection and anti-money-laundering (FRAML): Increasingly, AML systems are sold in conjunction with fraud detection systems as “FRAML.” This may be either (i) a bundle of two separate products or (ii) an actual single instance of code. In either case, if the end user only needs one half active, the other half can lie dormant and will not be charged for on-a-usage basis until it is activated. In most cases, users will be provided with different user interfaces and can have separate queues for fraud versus AML. Both AML and fraud detection may share the basics of the TM, DE and CI modules, but they will be configured and tuned differently and use customized models and algorithms for the two distinct purposes.
• Graph networks (visualization): In order to see the “big picture” for AML, graph network technology can be used to aggregate the data from many systems and then visualize the relationships and nodes between transactions and entities. This enables the user to see where patterns, spikes and clusters emerge for money laundering activities that otherwise are hard to see when a user is confined to the detail of a single system.
• Managed services: Smaller banks often lack internal resources, such as data scientists, to manage all aspects of an AML platform. Hence, many vendors will augment their software with a variety of managed services. The three most common services are: (i) hosting the platform in the cloud on behalf of the client; (ii) maintaining the ML model on behalf of the client; (iii) handling case investigations on behalf of the client.
• Third-party TM: Most vendors use their own, in-house created, TM module. So much so that the overall fraud system and the TM module often become synonymous with each other. But this is not necessarily always the case. Some banks will insist on retaining their own TM module, either built by the bank itself or acquired from a third party. In these cases, many AML systems are flexible enough to link to a third-party TM module.
• Access to communities and exchanges: However sophisticated and powerful a fraud detection platform is, it cannot do all the work itself. Increasingly, banks are collaborating to share and exchange information about new kinds of money laundering. Such networks and exchanges may be run by the vendor, or by a consortium of banks, or by a central party such as a regulator or a central bank. Modern AML systems may benefit from interacting with such communities and exchanges.