AML Review Examples

This page provides simplified examples of AML/KYC review reasoning. The examples are synthetic and illustrative. They are designed to show how facts, sources, evidence and escalation logic can fit together.

Boundary: Synthetic training examples only. Not legal advice, not filing guidance, and not a jurisdiction-specific procedure. A real case must follow local law, internal policy, source access and responsible reviewer judgment.

1. Individual onboarding with no obvious risk signal #

Facts: an individual applies for a standard account. Identity evidence is complete. Declared occupation and expected activity are ordinary for the product. No sanctions, PEP or adverse media concerns are identified.

Analyst reasoning: the case still needs documented identity, purpose and expected activity. “No hits” is not the whole review, but there is no unresolved signal requiring EDD in this simplified example.

Possible output: standard CDD completed, low or normal risk according to internal methodology, evidence saved, normal monitoring applied.

2. Small company KYB with transparent ownership #

Facts: a local company provides registry documents, director information and UBO details. Business activity is understandable. Ownership is direct and consistent with the registry.

Analyst reasoning: the analyst checks company existence, ownership/control, connected parties and screening results. The key question is whether the declared structure and business purpose are supported by independent evidence.

Possible output: KYB completed, UBO evidence recorded, risk rating supported by business activity, geography and screening results.

3. Possible sanctions false positive #

Facts: screening returns a name match, but date of birth, nationality and address do not match the listed person. The name is common.

Analyst reasoning: a name match alone is not enough. The analyst compares identifiers and records why the match is not the listed party. If identifiers are insufficient, the case should not be cleared too quickly.

Possible output: false positive cleared with identifier comparison, or more information requested if uncertainty remains.

4. PEP exposure with no criminal allegation #

Facts: a beneficial owner is identified as a PEP or close associate. No sanctions match or adverse media is identified.

Analyst reasoning: PEP status does not mean criminality. It means elevated corruption and influence risk requiring risk-sensitive review, senior approval or EDD where required by policy.

Possible output: PEP status recorded, EDD performed as required, source of wealth/source of funds considered, senior approval or escalation handled under policy.

5. Adverse media that needs context #

Facts: media articles mention a company in connection with a public investigation. The articles are credible but do not prove guilt. The customer provides an explanation and documents.

Analyst reasoning: adverse media is an input, not a final conclusion. The analyst assesses source credibility, dates, allegations, relevance to the customer and whether independent evidence resolves or strengthens concern.

Possible output: risk note, EDD, request for clarification, monitoring condition or escalation depending on the facts.

6. Complex ownership structure #

Facts: a company is owned through several legal entities in different jurisdictions. UBO information is incomplete.

Analyst reasoning: complexity is not automatically suspicious, but opacity matters. The analyst should identify ownership/control, missing documents, jurisdictional exposure and whether the structure has a clear business rationale.

Possible output: request ownership chart and supporting documents; pause decision or escalate if control cannot be understood.

7. Transaction monitoring alert #

Facts: a transaction-monitoring rule triggers because of higher-than-expected activity. The customer says the activity relates to a new contract.

Analyst reasoning: the analyst compares activity to expected profile, checks whether the new contract is plausible, reviews counterparties and geography, and records whether the explanation is supported.

Possible output: alert cleared with evidence, information requested, risk rating refreshed or escalation prepared if the explanation is weak.

8. Defensive Examples Boundary #

The examples on this page are deliberately synthetic and simplified. They are designed to teach review reasoning: facts, evidence, unresolved questions and escalation logic. They are not instructions for committing, hiding or testing financial crime behaviour.

Do not use these examples to infer operational misuse steps, evasion thresholds or product-specific bypass methods. A real case must follow local law, internal policy, source access, escalation rules and responsible reviewer judgment.

9. Source basis #