The Context Gap in AML Risk Assessment

Challenge of AML Screening and Decisioning

Cost-effective AML compliance requires more than powerful screening capabilities. AML solutions must enable compliance teams to make accurate, context-rich risk decisions throughout the customer lifecycle. The bottleneck in modern AML operations is not screening but the decision that has to follow each match.

The gap emerges after screening. The customer’s identity, verified and documented at onboarding, may not flow to the screening system, and the screening result, once a customer’s risk has changed, may not flow to transaction monitoring. Transaction alerts that point to genuine risk never flow back to update the customer’s continuous risk profile either. Each system operates as an island, answering its own narrow question over incomplete data, so the information required to turn a screening result into a sound risk decision has to be reconstructed by hand, one alert at a time. Even the data behind AI-powered AML screening is often out of date and out of step with regulatory logic, which leaves the resulting risk assessment misleading.

This is why 32% of organisations name manual alert handling as their single largest operational challenge, and why, even as agentic AI improves screening, the decisioning that depends on customer context takes longer than ever. A model that inherits the same context gap inherits the same failure, because screening without context is never a decision in itself, only a task that still has to be passed to a person.

Voice of AML Compliance Professionals

Where the findings come from

This report is based on an analysis of anonymised market intelligence derived from Shufti’s customer and prospect base, comprising more than 600 organisations across the globe actively evaluating anti-financial crime solutions, including identity verification, fraud prevention, AML compliance, and transaction monitoring technologies.

All responses were anonymised prior to analysis and reviewed using thematic analysis to identify recurring patterns and emerging trends. Findings are presented in aggregate to provide a broader view of market priorities while ensuring that no individual organisation or respondent can be identified.

Regulators are now measuring the cost of compliance itself

In September 2025 the United States Financial Crimes Enforcement Network (FinCEN) opened a formal Survey of the Costs of AML/CFT Compliance. That a regulator has judged it necessary to measure the cost of compliance at all is itself a signal. The industry responses submitted to it already describe the pattern this report examines, naming personnel and technology as the largest components of compliance cost, and manual workflows and the difficulty of integrating multiple vendor systems among the principal operational burdens.

A Federal Reserve Bank of St. Louis study of 1,091 community banks found total regulatory compliance costs near 10% of non-interest expense at the smallest banks, roughly double the largest, with the Bank Secrecy Act the single most burdensome area at about a fifth of that total.

A 2026 PwC survey of more than five hundred financial institutions across Europe, the Middle East, and Africa found AML compliance costs rising structurally, customer due diligence now the largest operational bottleneck, confidence in transaction monitoring roughly halved since 2024, and data quality the leading barrier to AI adoption at up to 89%. Those figures measure the problem from the outside. The findings that carry this report, drawn from a proprietary dataset, explain it from the inside.

Why AML compliance becomes costly and inefficient

The customer’s identity is verified once, at onboarding, and the information captured there, date of birth, nationality, document details, is exactly what is needed to resolve a screening match. Yet when a screening alert arrives at the desk of a compliance officer, that information is not there. It was collected, verified, and paid for, but it sits behind a different vendor’s interface. This is not a staffing problem. It is an architectural problem. The cost lands in four connected places, all driven by the same root cause.

The bottleneck in AML Compliance is resolution of alerts not just screening

Practitioners describe officers spending time manually gathering context because the information required to resolve a screening match is not present when the alert arrives. That context, verified identity data from onboarding, transaction history, previous risk assessments, exists within the organisation’s systems but does not flow to the point where decisions must be made.

Why solving AML alerts becomes manual work

1. 01

   The data going into the match is weak

   A record built from a verified document carries the name as printed, a date of birth, a nationality, and machine-readable data, while one built from a sign-up form carries whatever the customer typed.

2. 02

   The matching logic is a blunt trade-off

   Matching narrowly misses the genuine hit whose name was spelled differently, while matching loosely returns a flood of alerts.

3. 03

   The alert arrives without the context to resolve it

   The system hands the officer a possible match, not an answer. When the identifiers needed to decide do not arrive with the alert, the officer searches for them manually, which is why AML screening became manual work.

4. 04

   The systems do not share what they know

   Most businesses verify identity with one supplier, screen with a second, monitor transactions with a third, and check company ownership with a fourth. None shares a record with the others.

5. 05

   The system only answers when asked

   A screening query is a one-off, and nothing watches the customer or the lists. When a customer becomes a PEP or adverse media appears, no alert follows.

How the five compound

That is not five separate problems but one architectural problem with five manifestations. The solution is not to hire more analysts. It is to preserve customer context across the AML lifecycle so that screening flows directly to decision.

AML Screening needs a decisioning layer

The question that decides whether a programme can meet the standard regulators have already set is not which lists it screens against, but whether the system that establishes who the customer is and the system that decides what that customer’s name signifies are the same system. Where they are, the customer’s context is preserved across the whole AML lifecycle, and that is what makes an assessment accurate, explainable, and aligned with the institution’s own risk appetite.

Ask one question of every vendor: is the verifying system and the deciding system the same system?

Use this in a live evaluation

Each question surfaces a specific operational weakness found common in deployed systems. The full report carries the complete checklist across these areas.