AML/KYC Map: From Customer to Evidence

AML/KYC/KYB work links customer facts to evidence, risk context and a review outcome. The map below shows how the pieces connect.

Boundary: this is a conceptual map, not a local onboarding procedure, reporting instruction or final decision tree.

1. The core idea #

AML/KYC work turns uncertainty into documented understanding.

Unknown customer
→ verified facts
→ risk context
→ evidence-backed conclusion
→ review or escalation when needed

The output is not “the customer is good” or “the customer is bad”. A better output is:

what we know
what source supports it
what remains unclear
what risk factors exist
what should be reviewed next under policy

2. The seven questions behind most AML/KYC work #

Question What it means Related AML Bible pages
1. Who is the subject? Identify the individual, company, trust, wallet, vessel or other party. CDD / KYC, Corporate Registry Data Sources
2. Is the subject real and verified? Check whether identity, registration and key facts are supported by reliable sources. Open AML Data Sources, LEI and GLEIF for KYB
3. Who owns or controls it? Understand UBOs, directors, controllers, nominees or legal arrangements. Beneficial Ownership, BO Data Standard
4. What does the subject want to do? Understand relationship purpose, expected activity, product and transaction logic. Core Concepts, Transaction Monitoring Source Map
5. What risk context exists? Look at geography, sector, PEP, sanctions, adverse media, debarment and typologies. Geographic Risk, PEP, Sanctions Data Sources
6. What evidence supports the view? Separate official records, aggregator leads, media, leak data and unsupported assumptions. Evidence Weight
7. What should happen next? Continue, request more information, review, escalate or apply a local control. Decision Matrices, SAR / STR Source Guidance

3. The difference between facts, risks and decisions #

Beginners often mix these together. They should be separated.

Type Example How to treat it
Fact Company registration number exists in a registry. Record source and date.
Risk factor Company has opaque ownership in a high-risk sector. Assess and document context.
Lead Name appears in an investigative database. Verify identity and original source if possible.
Possible match Similar name appears on a sanctions list. Compare identifiers and escalate if not cleared.
Decision Relationship proceeds or does not proceed. Must follow local law, internal policy and responsible review.

4. How data sources fit into the map #

Data sources help answer different questions:

Source category Helps answer Main limitation
Sanctions lists Is the subject listed or connected to a listed party? False positives, aliases and ownership/control complexity.
Corporate registries Does the company exist and who is recorded publicly? Some registries are incomplete, delayed or limited.
LEI / GLEIF Does a legal entity have a global identifier and reference data? Not every entity has an LEI.
BO standards How should ownership/control data be structured? A standard is not the same as a verified registry.
Debarment lists Has the subject been excluded by a development bank or procurement authority? Scope is limited to the issuing institution or regime.
Investigative data Are there useful leads or hidden relationship clues? Inclusion does not automatically prove wrongdoing.
FATF country materials What is the jurisdictional AML/CFT/CPF context? Country context is not a customer-specific conclusion.

5. A simple mental diagram #

Customer / counterparty
  ↓
Identity and verification
  ↓
Ownership and control
  ↓
Purpose and activity
  ↓
Risk signals
  ├─ sanctions / TFS / CPF
  ├─ PEP exposure
  ├─ adverse media
  ├─ geographic exposure
  ├─ sector and product risk
  ├─ transaction monitoring indicators
  └─ predicate-crime typologies
  ↓
Evidence quality review
  ↓
Local policy decision or escalation

6. What makes this map safe for beginners #

The map explains structure, not local instructions. It avoids:

  • filing deadlines;
  • domestic legal thresholds;
  • regulator portal instructions;
  • final “file / do not file” conclusions;
  • sanctions legal advice;
  • customer communication scripts for sensitive cases.

Those items belong in local policy, legal review or private implementation profiles.

7. How to use the map in AML Bible #

For analysts, this page explains the logic of AML/KYC review.

question → source-check workflow → evidence object → validation gate → review output

The map does not replace professional understanding of the process. It helps preserve source context, evidence weight and reviewer boundaries.