What are AML checks?

The AML check definition set out in FATF Recommendation 10 states that it is a set of preventive measures, procedures and controls that financial institutions and designated non-financial businesses and professions (DNFBPs) must implement to prevent, detect and report money laundering. 

It is divided into four duties, and a regulated firm owes all four on every in-scope relationship:

1. Identification of the customer and verification of that identity, all with the use of reliable, independent source data.
2. Identification of the beneficial owner and adoption of relatively reasonable measures to verify who ultimately owns or controls the entity.
3. Understanding and, where relevant, obtaining information on the purpose and intended nature of the business relationship.
4. Conducting thorough due diligence and scrutinising transactions throughout the life of the relationship.

The first two duties result in a verified subject. The third duty produces the expected behaviour against which activity is later measured. The last duty is the only one with no end date, and the one firms usually under-resource, because nothing in the onboarding flow forces it to happen.

How are AML checks carried out?

The following sequence is how an AML check is carried out:

1. Collect the identifying data 

This includes the name, date of birth, and address for individuals, and registered details and ownership information for entities. 

2. Verification of the Identity 

The data is to be matched to a government-issued document; this needs to come with a liveness or biometric check that binds that document to the person presenting it. 

3. Resolve Beneficial Ownership

For legal entity customers, work down the structure to the natural persons who ultimately own or control it. 

4. Screening of the Verified Subject 

Sanctions, PEP, and adverse media checks must be maintained and checked against the confirmed identity, not the self-declared name. 

5. Set the Risk-Rate

Set the risk rating, document the expected activity profile, and fix the monitoring cadence. 

6. Rescreening and Reviewing

Keep sanctions screening continuous and rerun earlier steps when risk or circumstances change. 

How are requirements different across regions like EU, UK and US

The four duties are constant. What moves is who owes them, when they bite, and how far verification has to go.

Across borders, the binding constraint is whichever regime sets the earliest trigger and the widest entity scope.

How AML Checks, KYC, and transaction monitoring differ from each other

These three terms are often used interchangeably. However, it is essential to understand that these are separate components of the one core obligation. 

• KYC covers the first two duties. It responds to the question of who the customer is and who sits behind the entity.
• Screening, on the other hand, tests verified subjects against sanctions, PEP, and adverse media data.
• Transaction monitoring discharges duty four by measuring the activity against the expected behaviour which was captured at onboarding.

Teams that scope AML checks as screening alone end up with a tidy alert log and no way to prove the name they screened belonged to the person who opened the account.

The screens that sit inside an AML check

When is an AML check triggered?

Onboarding remains the relatively prominent trigger, and it is one which most firms handle comparatively well. Under regulation 27 of the Money Laundering Regulations 2017 and the equivalent provisions of the EU AML Regulation, a check must be conducted when:

• There is a new business relationship established.
• There is a qualifying occasional transaction carried out which is above the applicable threshold.
• There is suspicion of money laundering or terrorist financing, regardless of any threshold or exemption.
• There is a doubt about the accuracy or the adequacy of documents or information previously obtained.
• The circumstances change materially for an existing customer.

The last two get missed most often. A customer verified four years ago who has since become a PEP, or moved a controlling stake, is an unscreened customer today.

Standard, simplified and enhanced due diligence

The AML Regulation requires you to set the extent of your checks against an individual risk assessment of the customer and the relationship.

Simplified does not mean skipped. Firms lose arguments with supervisors by treating a low-risk classification as a reason to stop screening rather than a reason to screen less often.

Where do AML checks break?

The failure is rarely the absence of a check. It is the seam between checks.

• Name-only matching: Screening a self-declared name with no verified identity behind it produces false negatives on transliterated names and false positives you cannot clear.
• Batch rescreening: Weekly or monthly sweeps leave a window in which a newly designated customer keeps transacting.
• Unresolved alerts: An alert queue with no disposition record is worse than no queue, because it evidences that you saw the risk and did nothing.
• Split ownership: Identity, screening, and monitoring held in three systems means no single audit trail, and supervisors ask for that trail.