Agent Runbook Patterns

Purpose#

Agent runbook patterns are reusable workflow templates for controlled, analyst-supervised AML agent operation. They are not jurisdiction-specific SOPs and do not replace internal policies.

Runbook: First-pass customer onboarding#

1. Read customer input.
2. Classify customer type.
3. Extract identifiers.
4. Identify missing CDD fields.
5. Screen customer and connected parties.
6. Build UBO/control map if legal entity.
7. Identify PEP, sanctions, adverse media and geographic exposure risk triggers.
8. Assign preliminary route: CDD / EDD / MLRO escalation.
9. Produce CDD summary and evidence checklist.

Runbook: Sanctions possible match#

1. Do not clear the case automatically.
2. Capture screening output and source list.
3. Compare identifiers.
4. Check ownership/control links.
5. Classify match.
6. If possible/likely/true, escalate.
7. Avoid customer-facing explanations that reveal sanctions concern.
8. Produce sanctions hit memo.

Runbook: PEP match#

1. Confirm identity match.
2. Classify PEP type.
3. Identify role, geographic/organisational context and dates.
4. Determine relationship to customer.
5. Check source of wealth/source of funds need.
6. Check adverse media.
7. Determine senior approval requirement.
8. Produce PEP memo.

Runbook: Adverse media finding#

1. Verify subject identity.
2. Assess source quality.
3. Extract facts only.
4. Classify severity.
5. Link finding to AML risk.
6. Decide whether EDD or MLRO escalation is needed.
7. Produce adverse media memo.

Runbook: Suspicion escalation#

1. Stop treating the case as ordinary information gathering.
2. Preserve evidence.
3. Build timeline.
4. Write facts and red flags.
5. Identify tipping-off risk.
6. Escalate to MLRO.
7. Do not make final filing conclusion unless authorised by policy.

Runbook: Periodic review#

1. Retrieve prior CDD/EDD pack.
2. Refresh customer details.
3. Re-screen connected parties.
4. Compare actual activity to expected profile.
5. Review ownership/control changes.
6. Update geographic and sector risk.
7. Re-rate risk.
8. Produce periodic review summary.

Runbook: Counterparty screening#

1. Identify counterparty legal identity.
2. Collect registration details, operating context, address, website and directors.
3. Identify UBOs/controllers if available.
4. Screen names and related parties.
5. Check geographic and sector risk.
6. Check trade/product risk if relevant.
7. Produce counterparty risk memo.

Runbook: Digital Jurisdiction Exposure check#

1. Start with the customer's declared domain.
2. Collect public DNS and email records only.
3. Identify visible providers and jurisdictional references.
4. Compare against declared geography, business model and customer explanation.
5. Do not attempt to bypass CDN protection or access private infrastructure.
6. Mark the result as Digital Jurisdiction Exposure where relevant.
7. Add the result to the evidence pack.
8. Escalate only if the finding combines with other AML/KYB red flags.

Runbook: load verification and evidence controls#

Before running an operation workflow, the agent should load the shared verification and evidence control logic.

1. Identify operation workflow.
2. Identify subject type.
3. Create or load Case ID.
4. Build declared-data inventory.
5. Select source workflows from the implementation profile or public fallback plan.
6. Run source checks and create source check records.
7. Capture evidence and index it.
8. Log discrepancies, missing information and source limitations.
9. Map risk triggers and escalation rules.
10. Prepare analyst-reviewable output.

The agent should not skip evidence capture and should not merge unresolved discrepancies into a clean narrative. If source access is missing, mark the limitation clearly.

Related page: Verification & Evidence Control Layer