AML Process Atlas
The AML Process Atlas is the operational spine of this encyclopedia. It shows how individual topics connect into end-to-end AML/KYC/KYB work rather than remaining isolated definitions.
Use boundary: this atlas describes a jurisdiction-neutral control architecture. Local law, internal policy, risk appetite, reporting thresholds, approval levels and regulator-specific procedures must be added through a jurisdiction and institution-specific policy.
Universal process pattern#
Every AML process should be capable of being described through the same control sequence:
Purpose → Trigger → Inputs → Checks → Sources → Evidence → Decision
→ Escalation → Output → Owner → QA → Audit trail → Jurisdiction overlay
| Control field | Question the process must answer |
|---|---|
| Purpose | What risk or obligation is the process intended to address? |
| Trigger | What event starts the process? |
| Inputs | What customer, entity, transaction or case data is required? |
| Checks | What review actions must be performed? |
| Sources | Which approved internal and external sources are used? |
| Evidence | What dated and source-linked material must be retained? |
| Decision | What outcomes are available at the current control level? |
| Escalation | What conditions require senior, MLRO, legal or sanctions review? |
| Output | What case note, risk rating, memo or evidence pack is produced? |
| Owner | Which role performs and which role approves the work? |
| QA | How is consistency and control effectiveness tested? |
| Audit trail | Can another reviewer reconstruct who did what, when and why? |
| Jurisdiction overlay | Which local rules, time limits, forms or authorities apply? |
End-to-end customer lifecycle#
Relationship proposal
→ customer / entity classification
→ identity and legal-existence verification
→ ownership and control analysis
→ purpose and expected activity
→ sanctions / PEP / adverse-media screening
→ customer risk assessment
→ CDD or EDD route
→ approval or escalation
→ ongoing monitoring
→ event-driven or periodic review
→ restriction, remediation or exit
→ record retention and audit trail
Core process families#
| Process family | Typical trigger | Primary output | Main accountable gate |
|---|---|---|---|
| Customer onboarding | New relationship | CDD/KYB file and risk rating | Business approval / compliance gate |
| Beneficial ownership review | Legal person or arrangement | Ownership-control map and UBO rationale | Senior analyst / MLRO where unresolved |
| PEP review | PEP indicator or relationship | PEP assessment and EDD memo | Senior management where required |
| Sanctions hit review | Possible list or ownership/control match | Match-resolution memo and evidence | Sanctions/MLRO/legal gate |
| Adverse media review | Relevant media lead | Source-weighted adverse-media note | Analyst or MLRO depending on severity |
| Enhanced due diligence | High-risk or unresolved exposure | EDD evidence pack and recommendation | Senior/MLRO approval |
| Transaction monitoring | Rule, model or manual signal | Alert review note | Investigator / MLRO escalation gate |
| STR/SAR consideration | Reasoned suspicion or reporting trigger | Internal suspicion memo | MLRO or authorised reporting officer |
| Counterparty review | Supplier, buyer, bank or intermediary | Counterparty risk memo | Business/compliance approval |
| Periodic review | Review date or material event | Refreshed profile and re-rating | Reviewer / senior approval |
| VASP / crypto review | Crypto exposure | VASP/wallet risk note | Specialist / MLRO gate |
| TBML review | Trade and payment inconsistency | Trade-risk and value-trail memo | Senior/MLRO escalation |
| Restriction or exit | Risk outside appetite or unresolved control failure | Exit/restriction rationale | Senior, legal and MLRO governance |
Source-to-process discipline#
A source should never appear in a workflow merely because it is well known. The process must record:
- why the source is relevant to the specific check;
- whether it is primary, secondary, industry-practice, aggregator or investigative material;
- the source date and access date;
- what the source proves and what it does not prove;
- whether the material requires corroboration;
- how the finding affects the next action or decision gate.
See the AML Source Library & Register for the linked source inventory and page-level usage map.
Evidence and decision gates#
No process should move from a weak signal directly to a final conclusion. A controlled sequence separates:
signal → review item → evidence → discrepancy analysis
→ risk interpretation → reviewer decision → escalation where required
The case file should distinguish facts, customer statements, source findings, analyst inference, unresolved questions and final reviewer decisions.
Role ownership#
| Role | Typical responsibility |
|---|---|
| First-line analyst | Collect facts, perform checks, preserve evidence and draft the rationale. |
| Senior reviewer / checker | Test completeness, consistency and proportionate treatment. |
| MLRO / authorised officer | Decide escalations, suspicion reporting and higher-risk governance matters. |
| Legal / sanctions specialist | Interpret local legal restrictions, sanctions scope and blocking obligations. |
| Quality assurance | Test recurring decisions, evidence quality and methodology consistency. |
| Internal audit | Independently assess design and operating effectiveness. |
Jurisdiction overlays#
The universal process remains stable, while jurisdiction overlays add the local layer:
- obliged-entity scope;
- customer and beneficial-owner thresholds;
- reporting authority and filing channel;
- reporting and retention time limits;
- domestic sanctions programmes;
- senior approval requirements;
- data-protection and information-sharing restrictions;
- local supervisory expectations.
Published overlays: European Union, United States, United Kingdom.
Source basis#
- SRC-FATF-001: global AML/CFT/CPF control architecture.
- SRC-WOLF-003: proportionate, prioritised and effective risk-based programme design.
- SRC-BASEL-001: bank-level ML/TF governance and risk management.
- SRC-EGMONT-001: FIU role in receipt, analysis and dissemination of financial intelligence.
- SRC-WOLF-008: auditing for effectiveness.
Operational boundary#
The atlas does not make customer decisions, determine suspicion, provide filing instructions or replace accountable review. It defines the structure through which those decisions should become evidence-based, traceable and reviewable.