Evidence Pack Templates

Purpose#

Evidence packs make AML decisions auditable. Every pack should allow a reviewer to reconstruct what was checked, when, using which sources and why the decision was made.

Universal evidence index#

# Evidence Index

Case ID: [ID]
Customer/counterparty: [name]
Prepared by: Tom Custos / [analyst]
Date/time: [timestamp]
Policy overlay context: [context]

## Documents
1. [document name] — [source] — [date received] — [relevance]

## Screening
1. Sanctions — [source/list] — [date/time] — [result]
2. PEP — [source] — [date/time] — [result]
3. Adverse media — [queries] — [date/time] — [result]

## Registry/public sources
1. [source] — [URL] — [retrieval date] — [finding]

## Analyst notes
1. [note] — [rationale]

## Decision log
1. [date/time] — [decision-maker] — [decision] — [rationale]

CDD evidence pack#

Required sections:

Customer identity.
Customer verification.
Person acting on behalf of customer.
Beneficial ownership/control.
Purpose and expected activity.
Screening results.
Risk rating.
Missing information.
Decision recommendation.

EDD evidence pack#

Required sections:

EDD trigger.
Enhanced information requested.
Source of funds evidence.
Source of wealth evidence.
Adverse media review.
PEP review where relevant.
Sanctions ownership/control review where relevant.
Senior approval record where required.
Residual risk rating.

Sanctions evidence pack#

Required sections:

Screening source/list.
Matched entry.
Identifiers compared.
Ownership/control analysis.
Activity/transaction context.
Match classification.
Escalation record.
Freeze/no-dealing decision log where applicable.
Tipping-off controls.

PEP evidence pack#

Required sections:

PEP source.
Role and operating context.
Current/former status.
Relationship to customer.
Source of wealth/source of funds evidence.
Adverse media results.
Senior approval record.
Monitoring plan.

STR/SAR support pack#

Required sections:

Suspicion trigger.
Timeline.
Customer profile.
Transaction profile.
Red flags.
Customer explanations already received.
Tipping-off risk.
Evidence index.
MLRO decision log.

Tom Custos file naming convention#

[YYYY-MM-DD]_[case-id]_[customer-name]_[module]_[version].md

Examples:

2026-06-27_TC-0001_ACME-LTD_CDD_v1.md
2026-06-27_TC-0001_ACME-LTD_SANCTIONS-HIT_v1.md

Digital Jurisdiction Exposure evidence section#

## Digital Jurisdiction Exposure Evidence

Domain reviewed: [domain]
Date/time of review: [timestamp]
Records reviewed: [A/AAAA/MX/TXT/SPF/DMARC/DKIM/NS/CNAME/SOA/PTR]
Visible providers/domains: [list]
Jurisdictional references: [list]
Declared customer geography: [list]
Mismatch identified: [yes/no]
Analyst conclusion: [neutral/supporting-risk/higher-risk/combined-risk]
Recommended action: [record/request clarification/include in EDD/senior review/MLRO]
Evidence files: [screenshots/raw output]

Practical case file artifacts#

A practical Tom Custos operation should produce or update these artifacts:

Artifact	Why it matters
Case metadata	Shows what case was opened and why.
Declared-data inventory	Separates customer-provided information from verified facts.
Source plan	Shows which approved sources should be checked.
Source check record	Documents each material source check.
Evidence index	Maps evidence files to checks and findings.
Discrepancy register	Keeps mismatches and missing information visible.
Risk trigger summary	Maps findings to CDD, EDD or escalation logic.
Audit trail	Preserves reproducibility and reviewer accountability.

Tom Custos AML Knowledge BaseLearning & OperationsDownload source .md