AML Learning Path: From Beginner to MLRO

This page is for a reader who has no AML/KYC background. It explains the field in plain language and gives a safe learning order before the reader moves into detailed source pages, country-risk materials or operational controls.

1. The simplest explanation #

AML means anti-money laundering. It is the set of controls used to prevent a business or financial system from being used to move, hide, disguise or benefit from criminal money.

KYC means know your customer. It is the part of AML where a business identifies who the customer is, verifies key facts and understands the purpose of the relationship.

KYB means know your business. It applies the same idea to companies: what the company is, who owns or controls it, what it does and whether its structure or activity creates risk.

2. Why AML/KYC exists #

AML/KYC is not only paperwork. It answers a basic trust question:

Can this business reasonably understand who it is dealing with,
what risk exists,
and what evidence supports that understanding?

The purpose is to protect the financial system from misuse linked to money laundering, terrorist financing, proliferation financing, sanctions evasion, corruption, fraud and other predicate offences.

3. The whole AML world in five layers #

Think of AML/KYC as five connected layers:

If a beginner understands these five layers, most AML/KYC terms become easier to place.

4. The first 15 terms to learn #

This page does not redefine the core terminology. The single source of beginner definitions is the Beginner Glossary. Use this section only as a reading checklist.

Keeping definitions in one glossary reduces drift: other pages should explain how concepts are used, not silently create competing definitions.

5. The beginner reading order #

Use this order if you are starting from zero:

1. Beginner Glossary
2. AML/KYC Map: From Customer to Evidence
3. Core Concepts
4. CDD / KYC
5. Beneficial Ownership
6. Enhanced Due Diligence
7. PEP
8. Sanctions / TFS / CPF
9. Adverse Media
10. Open AML Data Sources
11. Open Source Limitations and Evidence Weight
12. FATF Mutual Evaluations and Country Risk
13. National Risk Assessment Source Map

After that, move to transaction monitoring, typologies, debarment sources, VASP/crypto AML, TBML and the Tom Custos framework pages.

6. What a beginner should understand first #

A beginner should not try to memorise every red flag. First understand this pattern:

identify the subject
→ understand ownership and control
→ understand purpose and activity
→ check risk context
→ use reliable sources
→ preserve evidence
→ separate facts from assumptions

This pattern is safer than jumping straight into suspicious activity conclusions.

7. How source pages should be used #

Data sources are not automatic answers. They are evidence inputs.

A sanctions list entry, company registry filing, LEI record, offshore leak record, debarment listing or adverse media article should be read with source context:

• Is the source official, aggregator-based or investigative?
• Is the identity match strong or weak?
• Are identifiers available, or only a name?
• Is the information current, historical or incomplete?
• Does the source prove a fact, or only create a lead for review?

For this reason, the wiki separates source-literacy pages from operational decision-making pages.

8. What AML/KYC is not #

AML/KYC is not:

• a simple checklist that makes every decision obvious;
• a blacklist-only exercise;
• a judgment based only on nationality or country of incorporation;
• a reason to treat all complex structures as suspicious;
• a substitute for local law, internal policy or responsible reviewer judgment.

AML/KYC is evidence-based risk understanding.

9. When the framework layer becomes useful #

The Tom Custos / TCAML framework logic becomes useful after the reader understands the basic AML/KYC map.

The analyst learning layer explains:

what the concept means
why the source matters
how evidence should be understood

The framework logic explains:

how a local AML agent routes sources,
structures evidence,
controls LLM drafts,
and hands reviewed outputs into local workflows

The two layers should be connected, but the beginner should start with AML/KYC understanding first.

10. Source basis #

• FATF Recommendations for the international AML/CFT/CPF control framework.
• FATF Glossary for core terminology.
• FATF Methodology for technical compliance and effectiveness concepts.
• FATF National Risk Assessment Guidance for national and sector risk assessment concepts.

11. Progression from Beginner to MLRO#

The foundation material above is Level 1. Continue through the following levels in order.

3. Level 2 — Junior AML Analyst#

Knowledge#

Understand how to gather, verify and record information without converting a signal into an unsupported allegation.

Core reading#

1. Enhanced Due Diligence
2. PEP
3. Sanctions / TFS / CPF
4. Adverse Media
5. Source of Wealth and Source of Funds
6. Open AML Data Sources
7. Case File and Evidence Lifecycle
8. Discrepancy, Risk and Escalation Controls

Practical outcome#

The learner can:

• collect approved customer and registry evidence;
• run screening using approved sources;
• identify missing or inconsistent information;
• distinguish verified fact, corroborated information, customer assertion and analyst inference;
• prepare a concise evidence-linked escalation note.

Authority boundary#

The learner does not resolve sanctions ownership/control questions, approve high-risk relationships, close material discrepancies or decide whether to file a SAR/STR.

4. Level 3 — AML/KYC Practitioner#

Knowledge#

Understand how risk factors combine across customer, product, sector, geography, delivery channel and activity.

Core reading#

1. Customer Risk Assessment & Risk Rating
2. Ongoing Monitoring & Periodic Review
3. Transaction Monitoring Source Map
4. Sector Risk Lens
5. Typologies & Red Flags
6. Trade-Based Money Laundering
7. Crypto / VASP AML
8. Decision Matrices

Practical outcome#

The learner can:

• perform a structured customer or event review;
• explain why a factor increases, reduces or does not resolve risk;
• identify plausible innocent explanations;
• apply approved risk-rating logic without treating the score as a decision;
• recommend proportionate controls or escalation.

Authority boundary#

Material overrides, exceptions, high-risk approvals and reporting decisions remain with the authorised reviewer or MLRO.

5. Level 4 — Senior Analyst / Reviewer#

Knowledge#

Understand evidence sufficiency, consistency across cases, control effectiveness and the difference between a defensible rationale and a convenient conclusion.

Core reading#

1. End-to-End AML Review Overview
2. Evidence Pack Templates
3. AML Review Examples
4. Name-Screening Calibration
5. AML Quality Assurance & Audit Readiness
6. Third-Party Reliance & Outsourcing
7. Data Protection & AML Recordkeeping
8. Role Tracks and Authority Boundaries

Practical outcome#

The learner can:

• challenge weak evidence and unsupported assumptions;
• approve, return or escalate a case within delegated authority;
• identify recurring quality failures;
• distinguish case risk from programme weakness;
• create clear reviewer rationale and remediation actions.

Authority boundary#

The reviewer does not exceed delegated approval, sanctions, reporting, legal or board authority. Escalation is a control, not a failure.

6. Level 5 — Compliance Officer / MLRO#

Knowledge#

Understand how the AML programme operates as a system: risk assessment, policy, controls, governance, management information, quality assurance, reporting, remediation and independent assurance.

Core reading#

1. AML Programme Design & Effectiveness
2. AML Governance & Three Lines of Defence
3. MLRO Review & Escalation Overview
4. STR / SAR & Tipping-Off
5. Rule-to-Action Map
6. FATF Mutual Evaluations and Country Risk
7. EU AML/CFT Framework, US AML/CFT Framework and UK AML/CFT Framework
8. Editorial & Source Policy

Practical outcome#

The learner can:

• understand and challenge enterprise and business-line risk assessments;
• connect material risks to policies, controls, ownership and evidence;
• evaluate whether controls are designed and operating effectively;
• make or route decisions under the applicable legal and governance framework;
• report material risk, control weakness and remediation status to senior management or the board;
• preserve independence, confidentiality and an audit trail.

Authority boundary#

MLRO responsibility is jurisdiction- and appointment-specific. It does not replace legal advice, sanctions counsel, the board, law enforcement or specialist functions.

7. Practice sequence#

Use the existing Wiki materials as exercises:

Training examples should be anonymised or synthetic and must not expose confidential customer or reporting information.

8. Role-based shortcuts#

The sequence remains the default, but experienced users can enter through:

• New analyst: Levels 1–2;
• KYC/KYB specialist: Levels 1–3;
• Transaction-monitoring analyst: Level 1, then monitoring and typologies in Level 3;
• Reviewer / QA: Levels 2–4;
• MLRO / Head of Compliance: Levels 3–5;
• Technology / local-agent team: Levels 1–3, then AI / LLM Index and the TCAML layer.

9. Completion standard#

A reader has not completed a level merely by opening the pages. Completion means they can:

1. explain the relevant concept;
2. identify the correct source;
3. produce the stated output;
4. state the limitations of the evidence;
5. identify who owns the next decision.

That standard keeps the path operational rather than decorative.