AML Analyst Operating Workflow
A practical workflow for onboarding, screening, periodic review, event-driven review and escalation.
The workflow is source-agnostic: it defines the control sequence and evidence standard, while the institution's policy defines approved providers, thresholds, folders, filenames and review cycles.
1. Workflow stages
| Stage | Analyst action | Evidence output |
|---|---|---|
| Intake | Receive pre-approval form, onboarding pack, periodic review trigger, payment document or investigation request. | Case reference, date, source document and request type. |
| Scope | Identify all subjects: customer, UBO, director, authorised person, counterparty, bank, employee, vendor, goods or service. | Subject list, role, identifiers and screening rationale. |
| Data collection | Collect legal name, aliases, DOB, nationality, registration number, SWIFT, addresses, website, goods codes and related parties. | Identifier set and data-quality notes. |
| Screening | Screen applicable subjects against sanctions, PEP, watchlist, adverse-information, registry, footprint and trade-control sources. | Queries, parameters, source class, timestamps, results and snapshots. |
| Match resolution | Separate no match, false positive, possible match, relevant match and confirmed match. | Identity comparison, match IDs, source assessment and disposition. |
| Risk assessment | Assess customer, product, geography, channel, transaction and relationship risks. | Risk factors, mitigating evidence and risk rating rationale. |
| Escalation / decision | Escalate red flags, possible matches, sanctions exposure, unusual activity or policy exceptions to the appropriate reviewer or MLRO. | Escalation note, decision, approver and conditions. |
| Evidence capture | Preserve both positive and negative outcomes in an audit-ready format. | Completed evidence pack and review status. |
| Monitoring | Set periodic, risk-based and event-driven re-screening or review triggers. | Next review date, trigger logic and monitoring scope. |
2. Subject scope
The analyst should not screen only the named customer. Depending on the relationship, the scope may include beneficial owners, directors, authorised persons, counterparties, sending or receiving banks, employees, suppliers, goods, services, websites, branches, phone indicators and addresses.
3. Matching logic
A source hit is not automatically an adverse finding. The analyst resolves identity, assesses source reliability, confirms relevance, records the reason for disposition and escalates unresolved or material concerns.
4. Source categories
Use applicable source classes: commercial screening databases, official sanctions authorities, consolidated sanctions datasets, corporate registries, adverse media and public search, domain or network intelligence, and official customs or trade-control sources. Named tools are implementation examples, not universal methodology.
5. Minimum output
The file should show who or what was checked, why it was in scope, which identifiers and sources were used, what the result was, how matches were resolved, who reviewed the case, whether escalation occurred and when the next review is due.