Tom Custos AML Knowledge Base — Local Bundle

Current Build: v0.5.29 · Updated July 2026 · AML/KYC/KYB Encyclopedia, Operational Textbook & Knowledge Base

Tom Custos AML Knowledge Base

Current Build: v0.5.29 · Updated July 2026 · AML/KYC/KYB Encyclopedia & Knowledge Base

Open-source AML/KYC/KYB learning and operations wiki for AML analysts, compliance teams, regulated businesses, local AML agents and RAG systems.

The wiki separates beginner entry points, AML fundamentals, AML programme controls, source/data literacy, operations reference, sector-risk perspective and controlled TCAML framework logic.

AML Fundamentals
→ AML Programme & Controls
→ Source & Data Literacy
→ AML Operations Reference
→ Defensive Typology & Sector Risk Lens
→ Encyclopedic Indexes & Source Layer
→ Controlled TCAML Framework / AI Agent Logic

Start Here#

• AML Learning Path: Beginner to MLRO
• Why AML Exists
• Beginner Glossary
• Customer-to-Evidence Map
• How to Use This Wiki
• Misconceptions & Control Errors

Aml Fundamentals#

• Core Concepts
• CDD / KYC
• Enhanced Due Diligence
• Source of Wealth & Source of Funds
• Beneficial Ownership
• PEP
• Sanctions / TFS / CPF
• Adverse Media
• STR / SAR & Tipping-Off
• Red Flags Library

Aml Programme & Controls#

• Programme Design & Effectiveness
• AML Governance & Three Lines
• Customer Risk Assessment & Risk Rating
• Ongoing Monitoring & Periodic Review
• Third-Party Reliance & Outsourcing
• Name-Screening Calibration
• AML Quality Assurance & Audit Readiness
• Data Protection & AML Recordkeeping

Source & Data Literacy#

• Open AML Data Sources
• Sanctions Data Sources
• Corporate Registry Sources
• LEI & GLEIF for KYB
• BO Data Standard
• Investigative & Leak Sources
• Debarment Sources
• Evidence Weight

Fatf Methodology & Typologies#

• FATF Mutual Evaluations
• National Risk Assessment
• SAR / STR Source Guidance
• Transaction Monitoring Sources
• Money Mules & Structuring
• Professional Enablers
• Sanctions Evasion Typologies
• Real Estate, Luxury Assets & Art
• Environmental Crime Typologies
• Human Trafficking / Smuggling

AML Operations Reference#

• AML Process Atlas
• Workflows
• Operation Workflow Patterns
• End-to-End AML Review Overview
• Transaction Monitoring & Alert Triage
• AML Review Examples
• Rule-to-Action Map
• Case File & Evidence Lifecycle
• Discrepancy, Risk & Escalation
• Decision Matrices
• Evidence Pack Templates
• MLRO Review & Escalation Overview

Special Topics#

• Sector Risk Lens
• Crypto / VASP AML
• Trade-Based Money Laundering / TBML
• Geographic Risk
• Digital Jurisdiction Exposure

Jurisdiction Overlays#

• EU AML/CFT Framework
• US AML/CFT Framework
• UK AML/CFT Framework

Controlled Tcaml Framework / Ai Agent Logic#

• Open AML Agent Framework
• Operation & Source Workflow Logic
• Verification & Evidence Control
• S010 Stagegate Runner
• LLM-to-S010 Bridge
• LLM Orchestration Interface
• Agent Runbook Patterns
• RAG Ingestion Guide

Project Reference#

• Source Register
• Role Tracks
• Agent Page Template
• About This Wiki
• Local AML Knowledge Base
• Editorial & Source Policy
• Practitioner & Academic References

Indexes & AI#

• AML Knowledge Ecosystem
• Topic Map
• AI / LLM Index
• A-Z Topic Index
• Category: AML Fundamentals
• Category: AML Programme & Controls
• Category: Source & Data Literacy
• Category: Typologies & Red Flags
• Category: AML Operations Reference
• Category: Special Topics
• Category: TCAML Framework / AI Agent Logic

Boundary#

This public wiki explains universal AML/KYC/KYB concepts, source literacy, defensive typology framing and controlled-framework knowledge. It does not replace local legal advice, internal policy, regulator-specific configuration, source subscriptions or responsible reviewer judgment.

Commercial AML databases and specialist intelligence tools require the adopter's own valid subscription or approved access.

AML Learning Path: From Beginner to MLRO

This page is for a reader who has no AML/KYC background. It explains the field in plain language and gives a safe learning order before the reader moves into detailed source pages, country-risk materials or operational controls.

1. The simplest explanation #

AML means anti-money laundering. It is the set of controls used to prevent a business or financial system from being used to move, hide, disguise or benefit from criminal money.

KYC means know your customer. It is the part of AML where a business identifies who the customer is, verifies key facts and understands the purpose of the relationship.

KYB means know your business. It applies the same idea to companies: what the company is, who owns or controls it, what it does and whether its structure or activity creates risk.

2. Why AML/KYC exists #

AML/KYC is not only paperwork. It answers a basic trust question:

Can this business reasonably understand who it is dealing with,
what risk exists,
and what evidence supports that understanding?

The purpose is to protect the financial system from misuse linked to money laundering, terrorist financing, proliferation financing, sanctions evasion, corruption, fraud and other predicate offences.

3. The whole AML world in five layers #

Think of AML/KYC as five connected layers:

If a beginner understands these five layers, most AML/KYC terms become easier to place.

4. The first 15 terms to learn #

This page does not redefine the core terminology. The single source of beginner definitions is the Beginner Glossary. Use this section only as a reading checklist.

Keeping definitions in one glossary reduces drift: other pages should explain how concepts are used, not silently create competing definitions.

5. The beginner reading order #

Use this order if you are starting from zero:

1. Beginner Glossary
2. AML/KYC Map: From Customer to Evidence
3. Core Concepts
4. CDD / KYC
5. Beneficial Ownership
6. Enhanced Due Diligence
7. PEP
8. Sanctions / TFS / CPF
9. Adverse Media
10. Open AML Data Sources
11. Open Source Limitations and Evidence Weight
12. FATF Mutual Evaluations and Country Risk
13. National Risk Assessment Source Map

After that, move to transaction monitoring, typologies, debarment sources, VASP/crypto AML, TBML and the Tom Custos framework pages.

6. What a beginner should understand first #

A beginner should not try to memorise every red flag. First understand this pattern:

identify the subject
→ understand ownership and control
→ understand purpose and activity
→ check risk context
→ use reliable sources
→ preserve evidence
→ separate facts from assumptions

This pattern is safer than jumping straight into suspicious activity conclusions.

7. How source pages should be used #

Data sources are not automatic answers. They are evidence inputs.

A sanctions list entry, company registry filing, LEI record, offshore leak record, debarment listing or adverse media article should be read with source context:

• Is the source official, aggregator-based or investigative?
• Is the identity match strong or weak?
• Are identifiers available, or only a name?
• Is the information current, historical or incomplete?
• Does the source prove a fact, or only create a lead for review?

For this reason, the wiki separates source-literacy pages from operational decision-making pages.

8. What AML/KYC is not #

AML/KYC is not:

• a simple checklist that makes every decision obvious;
• a blacklist-only exercise;
• a judgment based only on nationality or country of incorporation;
• a reason to treat all complex structures as suspicious;
• a substitute for local law, internal policy or responsible reviewer judgment.

AML/KYC is evidence-based risk understanding.

9. When the framework layer becomes useful #

The Tom Custos / TCAML framework logic becomes useful after the reader understands the basic AML/KYC map.

The analyst learning layer explains:

what the concept means
why the source matters
how evidence should be understood

The framework logic explains:

how a local AML agent routes sources,
structures evidence,
controls LLM drafts,
and hands reviewed outputs into local workflows

The two layers should be connected, but the beginner should start with AML/KYC understanding first.

10. Source basis #

• FATF Recommendations for the international AML/CFT/CPF control framework.
• FATF Glossary for core terminology.
• FATF Methodology for technical compliance and effectiveness concepts.
• FATF National Risk Assessment Guidance for national and sector risk assessment concepts.

11. Progression from Beginner to MLRO#

The foundation material above is Level 1. Continue through the following levels in order.

3. Level 2 — Junior AML Analyst#

Knowledge#

Understand how to gather, verify and record information without converting a signal into an unsupported allegation.

Core reading#

1. Enhanced Due Diligence
2. PEP
3. Sanctions / TFS / CPF
4. Adverse Media
5. Source of Wealth and Source of Funds
6. Open AML Data Sources
7. Case File and Evidence Lifecycle
8. Discrepancy, Risk and Escalation Controls

Practical outcome#

The learner can:

• collect approved customer and registry evidence;
• run screening using approved sources;
• identify missing or inconsistent information;
• distinguish verified fact, corroborated information, customer assertion and analyst inference;
• prepare a concise evidence-linked escalation note.

Authority boundary#

The learner does not resolve sanctions ownership/control questions, approve high-risk relationships, close material discrepancies or decide whether to file a SAR/STR.

4. Level 3 — AML/KYC Practitioner#

Knowledge#

Understand how risk factors combine across customer, product, sector, geography, delivery channel and activity.

Core reading#

1. Customer Risk Assessment & Risk Rating
2. Ongoing Monitoring & Periodic Review
3. Transaction Monitoring Source Map
4. Sector Risk Lens
5. Typologies & Red Flags
6. Trade-Based Money Laundering
7. Crypto / VASP AML
8. Decision Matrices

Practical outcome#

The learner can:

• perform a structured customer or event review;
• explain why a factor increases, reduces or does not resolve risk;
• identify plausible innocent explanations;
• apply approved risk-rating logic without treating the score as a decision;
• recommend proportionate controls or escalation.

Authority boundary#

Material overrides, exceptions, high-risk approvals and reporting decisions remain with the authorised reviewer or MLRO.

5. Level 4 — Senior Analyst / Reviewer#

Knowledge#

Understand evidence sufficiency, consistency across cases, control effectiveness and the difference between a defensible rationale and a convenient conclusion.

Core reading#

1. End-to-End AML Review Overview
2. Evidence Pack Templates
3. AML Review Examples
4. Name-Screening Calibration
5. AML Quality Assurance & Audit Readiness
6. Third-Party Reliance & Outsourcing
7. Data Protection & AML Recordkeeping
8. Role Tracks and Authority Boundaries

Practical outcome#

The learner can:

• challenge weak evidence and unsupported assumptions;
• approve, return or escalate a case within delegated authority;
• identify recurring quality failures;
• distinguish case risk from programme weakness;
• create clear reviewer rationale and remediation actions.

Authority boundary#

The reviewer does not exceed delegated approval, sanctions, reporting, legal or board authority. Escalation is a control, not a failure.

6. Level 5 — Compliance Officer / MLRO#

Knowledge#

Understand how the AML programme operates as a system: risk assessment, policy, controls, governance, management information, quality assurance, reporting, remediation and independent assurance.

Core reading#

1. AML Programme Design & Effectiveness
2. AML Governance & Three Lines of Defence
3. MLRO Review & Escalation Overview
4. STR / SAR & Tipping-Off
5. Rule-to-Action Map
6. FATF Mutual Evaluations and Country Risk
7. EU AML/CFT Framework, US AML/CFT Framework and UK AML/CFT Framework
8. Editorial & Source Policy

Practical outcome#

The learner can:

• understand and challenge enterprise and business-line risk assessments;
• connect material risks to policies, controls, ownership and evidence;
• evaluate whether controls are designed and operating effectively;
• make or route decisions under the applicable legal and governance framework;
• report material risk, control weakness and remediation status to senior management or the board;
• preserve independence, confidentiality and an audit trail.

Authority boundary#

MLRO responsibility is jurisdiction- and appointment-specific. It does not replace legal advice, sanctions counsel, the board, law enforcement or specialist functions.

7. Practice sequence#

Use the existing Wiki materials as exercises:

Training examples should be anonymised or synthetic and must not expose confidential customer or reporting information.

8. Role-based shortcuts#

The sequence remains the default, but experienced users can enter through:

• New analyst: Levels 1–2;
• KYC/KYB specialist: Levels 1–3;
• Transaction-monitoring analyst: Level 1, then monitoring and typologies in Level 3;
• Reviewer / QA: Levels 2–4;
• MLRO / Head of Compliance: Levels 3–5;
• Technology / local-agent team: Levels 1–3, then AI / LLM Index and the TCAML layer.

9. Completion standard#

A reader has not completed a level merely by opening the pages. Completion means they can:

1. explain the relevant concept;
2. identify the correct source;
3. produce the stated output;
4. state the limitations of the evidence;
5. identify who owns the next decision.

That standard keeps the path operational rather than decorative.

Why AML Exists: History, Economics and Evolution

AML makes more sense when it is understood as a response to an economic problem, not as a collection of forms.

Crime can generate money, assets or other value. Those proceeds are difficult to use safely if their origin remains visible. Laundering therefore seeks to distance value from the offence, disguise ownership or purpose, and make the proceeds appear usable. AML controls place verification, recordkeeping, monitoring and reporting obligations at points where value enters or moves through legitimate systems.

1. The underlying economic problem#

Predicate offences can include fraud, corruption, trafficking, tax crime, theft, environmental crime and many other offences defined by local law. The proceeds may be cash, bank balances, companies, securities, property, commodities or virtual assets.

The criminal problem is not only obtaining value. It is controlling, transferring, investing or spending it without exposing the offence or losing the value to seizure.

AML therefore targets several points:

• identity and beneficial ownership;
• entry into financial or commercial systems;
• conversion between forms of value;
• movement across persons, products and jurisdictions;
• use of professional and corporate structures;
• inconsistencies between the stated purpose and observed activity;
• evidence needed for investigation, restraint or reporting.

2. Why financial and professional systems became control points#

Banks and payment providers are important because they move and store value, but modern AML extends further. Company registries, lawyers, accountants, trust and company service providers, property professionals, casinos, dealers and VASPs may also sit at points where identity, ownership, assets and transactions become visible.

The policy logic is that legitimate systems can:

1. identify customers and beneficial owners;
2. understand purpose and expected activity;
3. preserve records;
4. detect material inconsistencies;
5. report concerns to competent authorities;
6. restrict or refuse activity where law or risk requires it.

This creates cost and friction. The justification is not that every obliged entity becomes a law-enforcement body. It is that certain businesses hold information and control access that would otherwise be unavailable.

3. Emergence of international cooperation#

Money and legal structures cross borders, while criminal law and supervision are largely national. International standards emerged to reduce gaps between jurisdictions and create a common baseline.

The Financial Action Task Force was established in 1989. Its first Forty Recommendations were issued in 1990 and later revised as risks, markets and policy priorities changed.

Over time, the framework expanded from a primary focus on money laundering to include:

• terrorist financing;
• targeted financial sanctions;
• proliferation financing;
• beneficial ownership transparency;
• risk-based supervision;
• newer technologies and virtual assets;
• assessment of whether systems work in practice.

4. The risk-based approach#

A universal maximum-control approach would waste resources and can exclude legitimate customers. A purely checklist approach can also miss serious risk.

The risk-based approach asks countries and institutions to:

identify risk
→ assess likelihood and impact
→ prioritise resources
→ apply proportionate controls
→ monitor outcomes
→ adjust when risk changes

Higher risk may require enhanced measures. Lower risk may justify simplified or less intensive measures where law permits. Risk-based does not mean evidence-free discretion: the rationale should be documented and reviewable.

5. From technical compliance to effectiveness#

An AML framework can look complete on paper while failing in operation. Policies may exist but ownership data may be unreliable, alerts may be poorly calibrated, reports may be low quality, or remediation may never close.

Modern evaluation therefore distinguishes:

• technical compliance: whether laws, powers and formal requirements exist;
• effectiveness: whether the system produces relevant outcomes.

The same distinction applies within a firm. A completed checklist is evidence that a task occurred, not proof that the customer was understood or the control was effective.

6. Expansion into CFT, CPF, sanctions and ownership transparency#

Terrorist financing may involve funds that are not criminal in origin, so the framework cannot rely only on detecting proceeds of crime. Proliferation-financing controls add risks connected to weapons-of-mass-destruction programmes and targeted financial sanctions.

Beneficial ownership became central because legal ownership may not reveal the natural person who ultimately owns, controls or benefits. Corporate and trust transparency therefore supports CDD, sanctions, tax, corruption and asset-recovery objectives.

These areas overlap, but they are not identical. A defensible programme keeps the legal tests and decision owners separate while sharing evidence where appropriate.

7. Technology and data#

Technology expanded both financial access and the range of data available to reviewers. Digital onboarding, automated screening, transaction monitoring, graph analysis and virtual assets changed the operating environment.

Technology can improve scale, consistency and evidence retrieval. It can also create:

• false positives and false confidence;
• opaque models;
• data-quality errors;
• automation bias;
• privacy and proportionality concerns;
• weak accountability when a tool's output is treated as a decision.

The control objective remains the same: reliable evidence, explainable reasoning and an authorised decision.

8. Costs, limits and unintended effects#

AML controls are not costless. Poorly designed systems can:

• exclude customers who lack standard documents;
• encourage indiscriminate de-risking;
• overload analysts with low-value alerts;
• duplicate requests across institutions;
• collect excessive data;
• create a false impression that compliance equals prevention.

AML cannot eliminate financial crime. It can make misuse harder, improve traceability, generate intelligence and support intervention. Its legitimacy depends on effectiveness, proportionality, data protection and accountable decisions.

9. Why evidence and boundaries matter#

The practical lesson from AML's evolution is simple:

risk indicator ≠ fact
data source ≠ conclusion
automation ≠ authority
completed process ≠ effective control

A strong AML review identifies the subject, uses appropriate sources, preserves evidence, distinguishes fact from inference and routes unresolved decisions to the correct role.

That logic connects the educational and operational parts of this Wiki.

Learning continuation#

After this chapter, follow the AML Learning Path: Beginner to MLRO. It turns the history and purpose of AML into a structured sequence of concepts, workflows and decision boundaries.

Source basis#

• FATF history, mandate, Recommendations and Methodology.
• FATF materials on risk-based supervision, effectiveness and evolving financial-crime risks.
• United Nations instruments and jurisdiction-specific law where relevant.

Beginner AML/KYC Glossary

This glossary explains common AML/KYC/KYB terms in plain language. It is designed for beginners, founders, junior analysts, developers building AML tools and non-specialists reading AML documentation for the first time.

AML#

Plain meaning: controls that stop criminal money from being hidden, moved or made to look legitimate.

Why it matters: AML is the umbrella concept. KYC, sanctions screening, transaction monitoring, red flags and suspicious reporting all sit inside or beside the AML control system.

Related pages: Core Concepts, CDD / KYC.

KYC#

Plain meaning: know who the customer is before doing business with them.

Why it matters: a business cannot assess risk if it does not know who it is dealing with.

Common evidence: identity document, proof of address, company documents, verification record, relationship purpose.

KYB#

Plain meaning: KYC for companies and other legal entities.

Why it matters: a company can hide its real owners, controllers, activity or links to other parties. KYB tries to understand the company as a real-world actor, not just a registration number.

Related pages: Corporate Registry Data Sources, Beneficial Ownership.

CDD#

Plain meaning: customer due diligence. The normal process of identifying, verifying and understanding a customer.

Why it matters: CDD is the foundation before risk rating, onboarding, monitoring or escalation.

EDD#

Plain meaning: enhanced due diligence. Deeper review when risk is higher.

Why it matters: not every customer needs the same level of review. Higher-risk situations need more evidence and more careful review.

Related page: Enhanced Due Diligence.

UBO#

Plain meaning: ultimate beneficial owner. The real natural person who ultimately owns or controls a company or legal arrangement.

Why it matters: a company may be registered in one name while another person benefits from or controls it.

Related pages: Beneficial Ownership, Beneficial Ownership Data Standard.

PEP#

Plain meaning: politically exposed person. A person with a prominent public function, plus relevant family members and close associates.

Why it matters: PEP status is not a crime. It means corruption, bribery or misuse-of-office risk may need closer review.

Related page: PEP.

Sanctions#

Plain meaning: legal restrictions against certain people, entities, vessels, goods, sectors, countries or activities.

Why it matters: sanctions are different from normal reputational risk. A possible sanctions match can require immediate specialist review under local law and policy.

Related pages: Sanctions / TFS / CPF, Sanctions Data Sources.

TFS#

Plain meaning: targeted financial sanctions. These usually focus on freezing assets and preventing funds from being made available to listed persons or entities.

Why it matters: TFS controls are central to terrorist financing and proliferation financing risk management.

CPF / PF#

Plain meaning: countering proliferation financing / proliferation financing. This relates to financing connected to weapons proliferation risks and sanctions evasion.

Why it matters: CPF is especially important where goods, technology, end users, shipping routes or counterparties could be connected to restricted programmes.

Adverse media#

Plain meaning: negative public information that may be relevant to financial crime risk.

Why it matters: adverse media can reveal risk that is not visible in documents. But it must be assessed carefully: source quality, identity match, relevance and recency matter.

Related page: Adverse Media.

Source of funds#

Plain meaning: where the money for a specific transaction comes from.

Example: salary savings used for a payment, proceeds from a property sale, business revenue, investment liquidation.

Source of wealth#

Plain meaning: how a person accumulated their overall wealth.

Example: business ownership, professional income, inheritance, investment returns, sale of assets.

Red flag#

Plain meaning: a warning sign that something may need closer review.

Important: a red flag is not proof of wrongdoing. It is a reason to check, document or escalate according to policy.

Related page: Red Flags Library.

STR / SAR#

Plain meaning: suspicious transaction report / suspicious activity report.

Why it matters: these are suspicious reporting concepts. Exact filing rules, deadlines, forms and FIU portals are local-law matters and should not be guessed from a general wiki.

Related page: SAR / STR Source Guidance.

Tipping-off#

Plain meaning: alerting a customer or other party that a suspicious report, investigation or certain internal review may be happening.

Why it matters: many jurisdictions restrict tipping-off. Local law and internal policy must control customer communication.

Risk-based approach#

Plain meaning: apply more attention where risk is higher and simpler controls where risk is lower, within legal and policy boundaries.

Why it matters: AML is not meant to be one-size-fits-all. The same customer facts may require different depth depending on product, geography, activity, ownership and other risk factors.

Country risk#

Plain meaning: risk connected to a jurisdiction or territory.

Important: country risk should not be based only on blacklists or nationality. It should consider FATF status, mutual evaluation findings, national risk context, sector exposure, transaction routes and the customer’s own facts.

Related pages: Geographic Risk, FATF Mutual Evaluations and Country Risk.

Predicate offence#

Plain meaning: the underlying crime that generated the money being laundered.

Examples: fraud, corruption, drug trafficking, tax crimes, human trafficking, environmental crime or other serious offences depending on the legal system.

FIU#

Plain meaning: financial intelligence unit. A national authority that receives and analyses suspicious reports and financial intelligence.

Why it matters: FIUs are central to suspicious reporting systems, but exact submission procedures are domestic and not universal.

Official source#

Plain meaning: data published by a competent public authority or official registry.

Why it matters: official sources usually carry stronger evidence weight than media, aggregators or leak databases, but still need identity matching and context.

Aggregator#

Plain meaning: a platform that combines data from multiple sources.

Why it matters: aggregators are useful for discovery and enrichment, but the original source and evidence trail should still be checked where possible.

Investigative source#

Plain meaning: a source created from journalism, leaks, document analysis or investigative research.

Why it matters: investigative sources can create valuable leads, but inclusion in a leak or investigation database should not be treated as automatic proof of wrongdoing.

Evidence weight#

Plain meaning: how much confidence a source should receive in a case file.

Why it matters: an official sanctions list, a company registry, an aggregator match and an anonymous forum post should not be treated as equal evidence.

Related page: Open Source Limitations and Evidence Weight.

Source basis#

• FATF Glossary
• FATF Recommendations
• ACAMS AML Glossary

AML/KYC Map: From Customer to Evidence

This page explains how the main AML/KYC/KYB pieces fit together. It is designed for a beginner who understands a few terms but does not yet see the whole system.

1. The core idea #

AML/KYC work turns uncertainty into documented understanding.

Unknown customer
→ verified facts
→ risk context
→ evidence-backed conclusion
→ review or escalation when needed

The output is not “the customer is good” or “the customer is bad”. A better output is:

what we know
what source supports it
what remains unclear
what risk factors exist
what should be reviewed next under policy

2. The seven questions behind most AML/KYC work #

3. The difference between facts, risks and decisions #

Beginners often mix these together. They should be separated.

4. How data sources fit into the map #

Data sources help answer different questions:

5. A simple mental diagram #

Customer / counterparty
  ↓
Identity and verification
  ↓
Ownership and control
  ↓
Purpose and activity
  ↓
Risk signals
  ├─ sanctions / TFS / CPF
  ├─ PEP exposure
  ├─ adverse media
  ├─ geographic exposure
  ├─ sector and product risk
  ├─ transaction monitoring indicators
  └─ predicate-crime typologies
  ↓
Evidence quality review
  ↓
Local policy decision or escalation

6. What makes this map safe for beginners #

The map explains structure, not local instructions. It avoids:

• filing deadlines;
• domestic legal thresholds;
• regulator portal instructions;
• final “file / do not file” conclusions;
• sanctions legal advice;
• customer communication scripts for sensitive cases.

Those items belong in local policy, legal review or private implementation profiles.

7. How this connects to Tom Custos / TCAML Framework #

For analysts, this page explains the logic of AML/KYC review.

For the TCAML framework, the same map becomes a routing structure:

question → source workflow → evidence object → validation gate → review output

The framework should not replace understanding. It should preserve source context, evidence weight and reviewer boundaries.

8. Recommended next pages #

• Beginner AML/KYC Glossary
• Open AML Data Sources
• Open Source Limitations and Evidence Weight
• FATF Mutual Evaluations and Country Risk
• National Risk Assessment Source Map

How to Use This Wiki

This wiki is designed as a plain-language AML/KYC learning layer first, and a TCAML framework reference second.

1. Start with AML Fundamentals #

If you are new to AML/KYC, start with the pages that explain the subject without technical architecture:

• AML/KYC From Zero
• Beginner Glossary
• Customer-to-Evidence Map
• Misconceptions & Control Errors

2. Read concepts before sources #

Do not start with sanctions lists, company registries or leak databases. First understand what AML/KYC is trying to answer: who the customer is, who owns or controls the customer, what risk context exists, and what evidence supports the conclusion.

3. Use source pages as evidence literacy #

Source pages explain what a source can and cannot prove. An official register, sanctions list, LEI record, media article, leak database or aggregator result does not have the same evidence weight.

4. Separate learning from local procedure #

The wiki can help a reader understand AML/KYC logic. It should not be treated as a local procedure for filing STR/SAR reports, setting thresholds, approving customers, rejecting customers or applying a specific jurisdiction's rule.

5. Read TCAML framework pages later #

The TCAML framework and AI agent pages become useful after the reader understands AML fundamentals, analyst controls and source/data literacy.

6. Suggested first reading order #

1. AML/KYC From Zero
2. Beginner Glossary
3. Customer-to-Evidence Map
4. Misconceptions & Control Errors
5. Core Concepts
6. CDD / KYC
7. Beneficial Ownership
8. PEP
9. Sanctions / TFS / CPF
10. Open AML Data Sources
11. Evidence Weight

7. Defensive Typology Boundary #

The wiki can explain typologies, sector risks, red flags, evidence questions and control objectives. It should not become a step-by-step manual for laundering, evasion, threshold avoidance, source-of-funds fabrication or bypassing screening and monitoring.

When a typology is discussed, the safe format is:

risk pattern → why it matters → defensive indicators → evidence questions → control response → escalation boundary

The unsafe format is:

operational sequence → exact method → bypass tactic → evasion threshold → product-specific exploit

8. Source basis #

• FATF Recommendations
• FATF Glossary
• FFIEC BSA/AML Examination Manual

9. Additional review-control pages #

For analyst and MLRO use, the wiki now includes additional control pages for customer risk assessment, transaction-monitoring triage, quality assurance and synthetic AML review examples. These pages are not a separate training section; they sit inside the existing AML programme and operations reference layers.

• Customer Risk Assessment & Risk Rating
• Transaction Monitoring & Alert Triage
• AML Quality Assurance & Audit Readiness
• AML Review Examples

AML/KYC Misconceptions & Control Errors

This page is not a list of “the only mistakes in AML since 1989”. It is a structured training checkpoint for recurring reasoning shortcuts that can weaken AML/KYC work. It is not a statistical ranking and it does not claim that every analyst makes these mistakes.

Training use: MLROs, compliance leads and onboarding managers can use this page to calibrate junior analysts, founders, operations teams and AI-assisted review workflows. The purpose is to reduce oversimplified conclusions, not to replace local AML policy, law, FIU guidance, internal escalation rules or responsible reviewer judgment.

How to read this page#

AML/KYC errors are rarely only “wrong facts”. Many weak decisions come from a correct fact being used too broadly. A sanctions no-match is a useful result, but it is not the same as full AML clearance. A PEP flag is a risk factor, but it is not an allegation of misconduct.

Identity and CDD control errors#

• KYC means collecting documents. Better frame: KYC/CDD is understanding and evidencing the customer, not only storing files.
• A verified passport or registry extract means low risk. Better frame: identity verification and risk assessment are different controls.
• CDD is only done at onboarding. Better frame: CDD is a lifecycle control.
• If the customer answers all questions, the case is complete. Better frame: statements should be compared with evidence and activity.
• Low-risk onboarding means no future monitoring is needed. Better frame: risk can change.

PEP and sanctions control errors#

• PEP means criminal. Better frame: PEP status is risk context, not a criminal finding.
• A domestic PEP is always irrelevant. Better frame: domestic PEP exposure depends on local law, policy and risk-based controls.
• No sanctions match means no AML risk. Better frame: sanctions screening is one control, not full clearance.
• A fuzzy sanctions hit means the customer is sanctioned. Better frame: a match is a review item until resolved with identifiers and source data.
• Only the customer name needs sanctions screening. Better frame: relevant parties may include UBOs, controllers, directors, counterparties and ownership/control links.
• If the name is spelled differently, there is no match. Better frame: aliases, transliteration and spelling variation matter.

Country and geographic risk control errors#

• Country risk equals nationality. Better frame: assess residence, incorporation, operations, routes, counterparties, sector and customer-specific facts.
• Only blacklists and greylists matter. Better frame: use list status with mutual evaluation findings, national risk context and actual relationship facts.
• A low-risk country means the customer is low risk. Better frame: country context does not replace customer-level risk assessment.
• A high-risk country means every customer is unacceptable. Better frame: higher-risk exposure should trigger proportionate controls, evidence and escalation.
• Digital exposure does not matter if legal incorporation is clean. Better frame: separate legal domicile from operational and digital exposure.

UBO and ownership-control errors#

• The shareholder register always identifies the real controller. Better frame: legal ownership and effective control may differ.
• UBO found once means UBO verified forever. Better frame: UBO evidence is point-in-time and may need refresh.
• Complex structure automatically means suspicious. Better frame: complexity should be understood and evidenced; unexplained inconsistency is the concern.
• Nominee or trust language can be ignored. Better frame: identify control, benefit and direction under applicable policy.
• Registry data is always complete and current. Better frame: record source date and limitations.

Adverse media and open-source control errors#

• Adverse media is a final conclusion. Better frame: it is a lead or risk context until source quality, date, relevance, identity and corroboration are assessed.
• No search result means no adverse information. Better frame: missing open-source results are scoped checks, not proof of no risk.
• A leak database mention proves wrongdoing. Better frame: use leak data carefully as investigative context and corroborate relevance.
• Old adverse media is always irrelevant. Better frame: assess age with severity, outcome and current relevance.
• Aggregators are official sources. Better frame: trace material hits back to primary sources where possible.

Transaction and behaviour control errors#

• Transaction monitoring is only about large amounts. Better frame: assess behaviour relative to expected customer profile.
• Small transactions cannot matter. Better frame: patterns can be relevant.
• A customer explanation is enough by itself. Better frame: compare explanations with documents, transaction facts and counterparties.
• Source of funds and source of wealth are the same thing. Better frame: they answer different questions.
• If a transaction is commercially possible, it is automatically reasonable. Better frame: assess economic rationale, route, timing and documentation.

Evidence and case-file control errors#

• More screenshots always mean better evidence. Better frame: evidence should be relevant, dated, source-linked, indexed and connected to the conclusion.
• Copying raw search results is an evidence pack. Better frame: record what was checked, when, where, why it matters and what remains unresolved.
• A single identifier resolves every match. Better frame: use the strongest available combination of identifiers.
• No discrepancy means no risk. Better frame: consistency is one outcome, not the entire risk assessment.
• The conclusion can be written before evidence review. Better frame: conclusion should follow facts, evidence weight and unresolved issues.

Escalation and MLRO control errors#

• Escalation means the analyst failed. Better frame: escalation is a control for uncertainty, higher risk and unresolved discrepancies.
• Every red flag must become a SAR/STR. Better frame: reporting is jurisdiction-specific and depends on legal thresholds, policy and reviewer judgment.
• Tipping-off only matters after a report is filed. Better frame: customer communication should follow local policy and escalation guidance.
• MLRO review is only for obvious cases. Better frame: unclear cases may need MLRO input because the answer is not obvious.
• Closing a case means the risk disappeared. Better frame: a closed decision is a documented point-in-time outcome.

TCAML and AI-assisted review errors#

• An AI output is evidence. Better frame: model output can summarize or route evidence, but it is not the underlying source.
• If the model sounds confident, the case is resolved. Better frame: language confidence is not evidence quality.
• RAG retrieval means the answer is complete. Better frame: retrieved context should be checked for coverage and source quality.
• Automation removes accountability. Better frame: automation should improve traceability and consistency, not replace accountable review.

Suspicion Is a Reasoned Analytical Conclusion#

Suspicion is not a keyword match, a single red flag or an automatically generated alert. It is a reasoned analytical conclusion formed after comparing activity, customer profile, source evidence, explanations, unresolved discrepancies and applicable escalation rules.

Safe wording should separate:

A strong case note explains why an issue was cleared, why more information is needed or why it was escalated. It should not rely on vague wording such as “looks fine” or “customer is known”.

Source basis#

• FATF Recommendations.
• FATF PEP guidance.
• FATF beneficial ownership guidance.
• FATF Methodology.
• OFAC Sanctions List Search Tool.
• OFAC Framework for Compliance Commitments.
• FinCEN SAR Narrative Guidance.
• Wolfsberg Group Risk-Based Approach resources.
• Open Source Limitations and Evidence Weight.

Core Concepts

Module map#

Core operating rules#

Risk-Based Approach#

The agent should allocate effort based on identified risk. Higher risk requires enhanced measures. Lower risk may allow simplified measures only where implementation policies and risk assessment permit it.

CDD/KYC#

The agent must understand who the customer is, who owns or controls the customer, why the relationship exists, and whether activity remains consistent with the customer risk profile.

Record keeping#

The agent should preserve enough evidence to reconstruct what was checked, which sources were used, what was found, what was missing, who reviewed it and why the decision was made.

PEP#

The agent must not treat all PEPs as automatically prohibited. It should identify PEP type, role, geographic/organisational context, risk relevance, source of wealth/source of funds needs, senior approval needs and monitoring intensity.

Sanctions / TFS / CPF#

The agent must treat sanctions hits as time-sensitive. Possible matches require controlled escalation. Likely or true matches require MLRO/legal process under applicable sanctions obligations.

Beneficial ownership#

The agent must identify natural persons behind ownership and control. If ownership is complex or opaque, the agent must document the chain and escalate unresolved control risk.

STR/SAR#

The agent should not decide final filing alone. It should assemble facts, chronology, red flags and evidence for MLRO review.

Internal controls#

The agent should support repeatability: every check should be explainable, logged and quality-reviewable.

Digital Jurisdiction Exposure#

Digital Jurisdiction Exposure is a Tom Custos practical KYB/EDD module. It reviews public domain, DNS and email infrastructure records for jurisdictional references that may not be visible from website IP geolocation alone.

It is not a traditional FATF-mandated standalone AML check. It is a supporting risk-based indicator used to enrich KYB/EDD analysis and evidence packs.

Related article: Digital Jurisdiction Exposure

Industry-practice risk-based layer#

SRC-WOLF-003 complements the FATF risk-based framework with practical financial-institution guidance on proportionality, prioritisation and effectiveness. It is a secondary industry-practice source and must remain subordinate to applicable law, FATF standards and institution-specific risk governance.

CDD / KYC

1. Agent definition #

CDD/KYC is the process by which Tom Custos identifies the customer, verifies identity, identifies beneficial owners, understands the purpose of the relationship and checks whether activity stays consistent with the customer risk profile.

2. Why this matters for AML agents #

Without CDD, the agent cannot know who it is screening, whether a sanctioned/PEP/criminal actor is hidden behind the customer, or whether transactions are unusual.

3. Trigger events #

• New customer onboarding.
• Occasional transaction above applicable threshold.
• Suspicion of ML/TF/PF.
• Doubt about previously obtained identity data.
• Material change in ownership, control, activity, address, sector or transaction pattern.
• Periodic review.

4. Source basis #

• SRC-FATF-001: FATF Recommendation 10 and Interpretive Note to Recommendation 10.
• Related: SRC-FATF-004 and SRC-FATF-005 for beneficial ownership depth.
• Local override: always apply applicable regulatory thresholds and prescribed CDD requirements where stricter or more specific.

5. Agent workflow #

1. Classify customer type: individual, legal person, legal arrangement, financial institution, DNFBP, VASP or other.
2. Collect identity data and proof of existence.
3. Verify identity from reliable independent source documents, data or information.
4. Identify person acting on behalf of the customer and verify authority.
5. Identify beneficial owners and controllers.
6. Understand nature of business, ownership/control structure and purpose of relationship.
7. Screen customer, UBOs, directors, controllers, signatories and relevant connected parties.
8. Determine initial risk rating.
9. Select SDD/CDD/EDD route.
10. Store evidence and decision rationale.
11. Escalate unresolved material gaps or suspicion to MLRO.

6. Data to collect: individual #

• Full legal name.
• Date and place of birth.
• Nationality and residence.
• Government ID/passport details.
• Residential address.
• Occupation and employer/business activity.
• Source of funds where relevant.
• Source of wealth where relevant.
• Expected activity and transaction size.
• PEP/sanctions/adverse media screening results.

7. Data to collect: legal person #

• Legal name.
• Legal form.
• Registration number.
• Place of incorporation/registration.
• Registered office and principal place of business.
• Constitutional documents where relevant.
• Directors/managers and authorised signatories.
• Ownership chart.
• Beneficial owners and controllers.
• Nature of business.
• Expected activity and transaction profile.
• Website/domain and operating footprint.

8. Data to collect: legal arrangement / trust-like structure #

• Settlor/founder.
• Trustee/administrator/council members.
• Protector/enforcer if any.
• Beneficiaries or class of beneficiaries.
• Any person exercising ultimate effective control.
• Purpose of the arrangement.
• Source of assets settled into the structure.

9. Evidence to collect #

• ID/passport copies or verified digital identity result.
• Corporate registry extract.
• Certificate of incorporation/good standing.
• Memorandum/articles or equivalent constitutional documents.
• UBO declaration and supporting documents.
• Ownership/control chart.
• Screening screenshots/logs.
• Public registry links and retrieval date.
• Adverse media search terms and results.
• Analyst notes and risk rationale.

10. Red flags #

Medium#

• Customer gives incomplete documents but cooperates.
• Non-resident customer without clear link to product/operating context.
• Expected activity is vague.
• Minor mismatch in address or transliteration.

High#

• Complex ownership without economic rationale.
• Nominees or bearer-like instruments without clear explanation.
• Third-party funding without clear connection.
• Customer refuses to identify UBO/controller.
• Documents appear inconsistent or unverifiable.

Critical#

• Possible sanctions match.
• Suspicion of forged identity documents.
• Customer attempts to avoid ownership disclosure.
• CDD request creates tipping-off risk in a suspicious context.

11. Decision matrix #

12. Tom Custos output #

# CDD Summary

Customer: [name]
Customer type: [individual/legal person/etc.]
Geographic/operating context: [country/territory/market if relevant]
Purpose of relationship: [summary]
UBO/control: [summary]
Screening results: [sanctions/PEP/adverse media]
Risk rating: [low/medium/high/critical]
Missing information: [list]
Recommendation: [proceed/request info/EDD/escalate]
Source basis: SRC-FATF-001
Evidence index: [links/files/screenshots]

13. Related pages #

• Enhanced Due Diligence
• Beneficial Ownership
• PEP
• Sanctions / TFS / CPF
• Adverse Media
• Evidence Pack Templates

Jurisdiction overlay check#

The universal CDD process should be followed by a jurisdiction check. For European Union implementation, use the EU AML/CFT Framework and verify the current AMLR, AMLD6 national implementation, AMLA standards and competent-authority guidance.

Enhanced Due Diligence

1. Agent definition #

EDD is a deeper review used when the customer, transaction, geography, product, delivery channel or screening result creates higher ML/TF/PF risk.

2. Why this matters for AML agents #

Normal CDD may be insufficient for higher-risk relationships. EDD helps the firm understand risk, justify acceptance or rejection, and create an audit trail for MLRO and regulator review.

3. Trigger events #

• Foreign PEP or high-risk domestic/international organisation PEP.
• High-risk geography or FATF call for EDD/countermeasures.
• Sanctions proximity or possible ownership/control risk.
• Serious adverse media.
• Complex or opaque beneficial ownership.
• Unusual transaction pattern.
• High-risk sector or product.
• Non-face-to-face onboarding without adequate controls.
• Third-party payments without clear rationale.
• VASP/crypto high-risk exposure.
• TBML indicators.

4. Source basis #

• SRC-FATF-001: RBA, CDD, PEP, high-risk countries, STR/SAR, internal controls.
• SRC-FATF-002: FATF geographic exposure risk triggers.
• SRC-FATF-006: TBML indicators.
• SRC-FATF-003: VASP/crypto risk.

5. Agent workflow #

1. Identify EDD trigger.
2. Explain why normal CDD is not enough.
3. Collect additional information about customer, UBOs, source of funds, source of wealth and transaction purpose.
4. Verify information using independent reliable sources where possible.
5. Increase screening depth: aliases, transliterations, related parties, corporate network, historic names.
6. Review adverse media and enforcement history.
7. Assess whether senior approval is required.
8. Recommend onboarding, decline, restrictions, enhanced monitoring or MLRO escalation.
9. Preserve EDD memo and evidence.

6. Additional information to collect #

• Source of funds evidence: bank statements, sale agreement, salary/dividend records, contract, invoice, audited accounts, exchange records.
• Source of wealth evidence: business ownership history, asset sale history, inheritance/gift evidence, audited financials, tax documents where available.
• Detailed transaction rationale.
• Expected counterparties and geographic exposure.
• Proof of business activity.
• UBO/control proof beyond declarations.
• Negative media explanation and independent corroboration.

7. EDD red flags #

High#

• Customer cannot explain wealth origin.
• Wealth appears inconsistent with known profile.
• High-value transaction lacks economic rationale.
• Customer changes story after questions.
• Corporate structure includes unnecessary offshore layers.

Critical#

• EDD reveals likely sanctioned ownership/control.
• Customer appears to be acting for undisclosed third party.
• Information suggests proceeds of crime, TF or PF.
• Further questions may tip off customer.

8. Decision matrix #

9. Tom Custos output #

# EDD Memo

Trigger: [why EDD was required]
Customer profile: [summary]
Risk factors: [list]
Additional evidence reviewed: [list]
Source of funds: [assessment]
Source of wealth: [assessment]
UBO/control: [assessment]
Adverse media/sanctions/PEP: [assessment]
Residual risk: [low/medium/high/critical]
Recommendation: [approve/approve with conditions/request info/decline/escalate]
Source basis: SRC-FATF-001; [additional source IDs]

10. Related pages #

• CDD / KYC
• Beneficial Ownership
• PEP
• Sanctions / TFS / CPF
• STR / SAR & Tipping-Off

Source of wealth and source of funds evidence#

SRC-WOLF-004 distinguishes Source of Wealth from Source of Funds and provides an industry-practice framework for proportionate evidence collection. SRC-WOLF-003 supports a risk-based approach to deciding the depth of EDD.

For the complete distinction, evidence hierarchy, plausibility assessment, contradiction handling and escalation output, use the canonical Source of Wealth and Source of Funds page.

The workflow should record:

• what question the evidence is intended to answer;
• why the requested evidence is proportionate to the risk;
• source reliability and coverage period;
• discrepancies between statements, documents and observed activity;
• residual uncertainty and approval/escalation status.

Source of Wealth and Source of Funds

Source of wealth (SoW) and source of funds (SoF) answer different questions. They should not be treated as interchangeable labels or as a request for a random financial document.

• Source of wealth explains how a person accumulated their overall wealth.
• Source of funds explains where the specific money or assets used in a relationship, transaction or investment came from.

A strong review defines the question first, collects proportionate evidence, tests whether the explanation is plausible and records what remains uncertain.

1. SoW and SoF are related but different#

A customer may have a credible source of wealth but still be unable to explain a particular source of funds. The reverse is also possible: a single payment may be traceable even though the wider wealth picture remains incomplete.

2. When the review may be triggered#

Triggers should be defined by local requirements and internal policy. Common risk-based triggers include:

• PEP or other higher-risk relationship;
• unusually large or complex transaction;
• wealth, income or activity inconsistent with the known profile;
• funding from an unexpected person, entity, account, wallet or jurisdiction;
• material change in ownership, control, occupation or expected activity;
• high-value property, investment, luxury-asset or private-wealth transaction;
• use of trusts, nominees, layered companies or unexplained intermediaries;
• adverse information relating to corruption, fraud, tax crime or other predicate offences;
• unresolved discrepancies during CDD, EDD or ongoing monitoring.

A trigger is not a conclusion of wrongdoing. It means that the existing explanation is insufficient for the level of risk.

3. Define the evidence question before requesting documents#

Poor requests ask for “proof of funds” without defining what must be proved. A better review records:

1. the amount or wealth component being assessed;
2. the claimed origin;
3. the relevant period;
4. the persons, entities, accounts or wallets involved;
5. the expected evidence chain;
6. the material risk or discrepancy that caused the request.

Example:

Question:
Explain and evidence the origin of USD 450,000 used for the property purchase.

Claimed source:
Proceeds from the sale of shares in a privately held company.

Expected evidence chain:
Ownership of shares → sale agreement → completion/payment record
→ receipt into an account controlled by the customer
→ transfer used for the purchase.

4. Evidence hierarchy#

Evidence strength depends on authenticity, independence, relevance, currency and continuity. No single document is automatically decisive.

A high account balance proves possession, not origin. A sale agreement may show a contractual explanation but not receipt of the proceeds. A tax return may support income but not necessarily the funding route for a specific transaction.

5. Evidence by common source type#

Employment and professional income#

Possible evidence:

• employment contract and role history;
• payroll records or bank credits;
• tax filings where lawfully available;
• bonus, partnership or carried-interest documentation.

Review whether the period, remuneration and accumulated savings reasonably support the claimed wealth or funds.

Business ownership and dividends#

Possible evidence:

• corporate registry and beneficial ownership records;
• audited or reliable financial statements;
• shareholding history;
• dividend resolutions and payment records;
• sale or exit documentation.

Distinguish company revenue from the customer's personal wealth. Control of a company does not by itself prove personal entitlement to its assets.

Investments#

Possible evidence:

• regulated broker or custodian statements;
• purchase and disposal history;
• dividend or interest records;
• redemption and bank receipt records.

Review whether the investment history predates the current transaction and whether the realised amount is consistent with the claimed proceeds.

Property sale#

Possible evidence:

• ownership record;
• sale and purchase agreement;
• completion statement;
• tax or registration record;
• receipt of proceeds and onward transfer.

A valuation is not evidence that a sale occurred or that funds were received.

Inheritance or gift#

Possible evidence:

• probate, will, estate or succession documentation;
• donor identity and relationship;
• donor SoW where proportionate;
• gift agreement and transfer record;
• tax or legal records where relevant.

A gift moves the SoF question upstream: the donor's ability to make the gift may need to be understood.

Loan#

Possible evidence:

• executed loan agreement;
• lender identity and authority;
• commercial purpose and repayment terms;
• disbursement record;
• lender SoF where risk requires it.

A document labelled “loan” should not end the review if the lender, economics or repayment logic is unclear.

Crypto-related wealth or funds#

Possible evidence may include:

• records from regulated exchanges or custodians;
• acquisition and disposal history;
• wallet addresses and transaction references;
• fiat funding and withdrawal records;
• tax or accounting records where available.

Blockchain visibility does not automatically identify the beneficial owner or establish a lawful origin. Attribution confidence and gaps should be recorded.

6. Plausibility assessment#

The analyst should test the whole explanation rather than merely confirm that documents exist.

The conclusion should be proportionate. “Plausible but partially evidenced” is different from “verified”, and both are different from “contradicted”.

7. Contradictions and warning signs#

Examples requiring clarification or escalation include:

• declared occupation or business history cannot support the claimed scale of wealth;
• transaction proceeds appear before the claimed sale or event;
• the customer did not own the asset said to have generated the funds;
• material gaps exist between receipt and onward payment;
• funds come from an unrelated third party without a credible explanation;
• documents use inconsistent names, dates, amounts or counterparties;
• the explanation changes after evidence is requested;
• complex structures or intermediaries have no clear role;
• evidence is repeatedly partial, altered or unverifiable;
• the source appears connected to sanctioned, criminal or materially adverse exposure.

These are review signals, not automatic findings of money laundering.

8. Decision matrix#

9. SoW/SoF review note#

Customer / subject:
Review trigger:
SoW question:
SoF question:
Customer explanation:
Amount and relevant period:
Evidence reviewed:
Verified facts:
Corroborated but limited facts:
Unsupported statements:
Contradictions:
Plausibility assessment:
Residual risk:
Recommended control or escalation:
Reviewer / decision owner:

The note should separate evidence from inference and should not claim that funds are “clean”. It records whether the explanation and evidence meet the applicable review standard.

10. Canonical use across this Wiki#

This is the canonical SoW/SoF methodology page. Other pages should use short context-specific references rather than repeat the full evidence framework.

• Enhanced Due Diligence explains when deeper review may be required.
• PEP explains the PEP risk context.
• Evidence Pack Templates provides file and output structures.
• Crypto / VASP AML covers virtual-asset evidence limitations.
• Real Estate, Luxury Assets & Art Risk applies the method to high-value assets.

Source basis#

• FATF Recommendations and risk-based guidance for CDD, EDD, beneficial ownership, recordkeeping and higher-risk relationships.
• Wolfsberg guidance and practitioner materials on SoW/SoF review.
• Applicable jurisdiction overlays and institution policy for mandatory triggers and approval authority.

Beneficial Ownership

1. Agent definition #

Beneficial ownership means identifying the natural person or persons who ultimately own, control or benefit from a legal person or legal arrangement.

2. Why this matters for AML agents #

Customers may use companies, trusts, foundations, nominees or layered ownership to hide sanctioned persons, PEPs, criminals or undisclosed controllers.

3. Trigger events #

• Legal entity onboarding.
• Trust, foundation or legal arrangement onboarding.
• Ownership chain includes nominees, offshore vehicles or unexplained layers.
• UBO cannot be identified from shareholder registers alone.
• Control appears different from ownership.
• Change in ownership/control.
• Counterparty due diligence.

4. Source basis #

• SRC-FATF-001: Recommendation 10, 24 and 25.
• SRC-FATF-004: legal persons BO guidance.
• SRC-FATF-005: legal arrangements BO guidance.

5. Agent workflow for legal persons #

1. Obtain legal entity documents.
2. Identify direct shareholders/members/partners.
3. Build ownership chain up to natural persons.
4. Identify controlling ownership interests under local threshold/policy.
5. If no natural person is identified through ownership, identify control through other means.
6. If no natural person is identified through ownership or control, identify senior managing official as fallback where permitted by implementation policies.
7. Screen UBOs, controllers and senior managing officials.
8. Verify BO information using reliable documents and registries where possible.
9. Document chain, evidence and unresolved gaps.

6. Agent workflow for trusts/legal arrangements #

1. Identify settlor/founder.
2. Identify trustee/administrator/council members.
3. Identify protector/enforcer if any.
4. Identify beneficiaries or class of beneficiaries.
5. Identify any person with ultimate effective control.
6. Understand purpose and source of assets.
7. Screen all relevant parties.
8. Document control map.

7. Evidence to collect #

• Corporate registry extract.
• Share register or ownership declaration.
• Constitutional documents.
• Trust deed/foundation charter where available.
• UBO declaration.
• Board/shareholder resolutions where relevant.
• Registry screenshots and retrieval dates.
• Ownership chart prepared by agent.
• Screening results for every material person/entity.

8. Red flags #

Medium#

• Multiple holding companies in low-risk context without clear reason.
• Recent change in shareholders.
• Inconsistent UBO information across documents.

High#

• Nominee shareholders/directors without credible explanation.
• Control by power of attorney, informal agreement or undisclosed financier.
• Layered offshore structure inconsistent with business size.
• Customer refuses to identify natural persons.
• Trust/foundation has vague beneficiary class and unclear protector/control rights.

Critical#

• UBO/controller appears sanctioned.
• UBO/controller is hidden PEP with unexplained wealth.
• Evidence suggests front company or straw owner.
• False or forged BO documentation.

9. Decision matrix #

10. Tom Custos output #

# Beneficial Ownership Memo

Customer: [name]
Legal form: [form]
Ownership chain: [summary]
Natural-person UBOs: [names/percent/control basis]
Control through other means: [yes/no/details]
Senior managing official fallback: [if used]
Legal arrangement parties: [if applicable]
Screening results: [summary]
Unresolved gaps: [list]
Risk rating: [low/medium/high/critical]
Recommendation: [proceed/request info/EDD/escalate]
Source basis: SRC-FATF-001; SRC-FATF-004; SRC-FATF-005

Nominee arrangements and corruption-proceeds risk#

StAR's Signatures for Sale (SRC-STAR-NOMINEES-001) is a specific reference for nominee arrangements, shell-company control and the gap between formal registration and effective control.

Use it to frame evidence questions, not to presume wrongdoing:

• Who gives instructions?
• Who receives economic benefit?
• Is the nominee relationship disclosed and commercially explained?
• Do registry records, contracts, bank information and actual conduct align?
• Is the structure linked to corruption, sanctions, tax crime or asset-concealment indicators?

The source strengthens review of control opacity but does not replace the applicable legal definition of beneficial ownership.

PEP

1. Definition #

A PEP is a person entrusted with a prominent public function, or a relevant family member or close associate, whose position may create corruption, bribery or influence-risk exposure.

2. Why It Matters #

PEP status is not automatically criminal and not automatically prohibited. It is a risk trigger requiring correct classification, EDD where needed and documented decision-making.

3. Common Triggers and Use Context #

• Screening identifies possible PEP.
• Customer declares PEP status.
• UBO, director, controller, signatory or close associate appears to be a PEP.
• Adverse media suggests political office or state-owned enterprise control.
• Customer has unexplained wealth linked to public office.

4. Source Basis #

• SRC-FATF-001: Recommendation 12.
• Implementation configuration may define domestic PEPs, declassification periods, family/associate scope and senior approval requirements differently.

5. PEP categories #

• Foreign PEP.
• Domestic PEP.
• International organisation PEP.
• Family member of PEP.
• Close associate of PEP.
• Former PEP, depending on implementation policy and residual risk.

6. How It Is Used in AML/KYC/KYB #

1. Confirm identity match and avoid namesake errors.
2. Identify PEP category.
3. Identify public role, geographic/organisational context, dates, authority and relevance.
4. Identify whether the PEP is customer, UBO, controller, signatory, family member or close associate.
5. Assess geographic exposure risk, sector risk and transaction risk.
6. Collect or assess source of wealth and source of funds where required.
7. Check adverse media and sanctions exposure.
8. Determine need for senior approval and enhanced ongoing monitoring.
9. Produce PEP memo.
10. Escalate to MLRO if high-risk or unexplained.

7. Evidence to collect #

• PEP screening result.
• Public official profile or official biography.
• Dates of office and current/former status.
• Relationship to customer/UBO/controller.
• Source of wealth/source of funds evidence.
• Adverse media search results.
• Senior approval record where required.

8. Red flags #

Medium#

• Former PEP with low-risk profile but limited information.
• Domestic PEP with low-value/simple product.
• PEP family member with plausible independent income.

High#

• Foreign PEP in high-corruption operating context.
• PEP has unexplained wealth or complex asset-holding structure.
• PEP uses nominee, relative or offshore entity.
• PEP has procurement, licensing, customs, defence, energy or state-enterprise influence.

Critical#

• PEP linked to sanctions, corruption, embezzlement, bribery or organised crime.
• Source of wealth contradicts public information.
• Customer hides PEP connection.
• Possible misuse of public funds.

9. Decision matrix #

10. Output Pattern #

# PEP Review Memo

Subject: [name]
Relationship to customer: [customer/UBO/director/signatory/family or close associate]
PEP category: [foreign/domestic/international organisation/family or close associate/former]
Role and geographic/organisational context: [details]
Dates/current status: [details]
Risk factors: [geography/sector/wealth/adverse media]
Source of wealth/funds: [assessment]
Senior approval required: [yes/no/local basis]
Recommendation: [false match/proceed/EDD/escalate/decline]
Source basis: SRC-FATF-001

Source of wealth, corruption and FIU case context#

Higher-risk PEP relationships may require a separate SoW/SoF assessment. Use Source of Wealth and Source of Funds for the evidence hierarchy, plausibility test and review note.

For higher-risk PEP relationships, use:

• SRC-WOLF-004 for Source of Wealth and Source of Funds evidence framing;
• SRC-EGMONT-BECA-001 for FIU case examples involving bribery, corruption and tax evasion;
• SRC-STAR-NOMINEES-001 for nominee and concealed-control questions.

These materials support questions and evidence design. They do not turn PEP status into an allegation or replace the applicable legal definition and approval rules.

Sanctions / TFS / CPF

1. Definition #

Sanctions screening checks whether a customer, counterparty, UBO, controller, asset, vessel, wallet, product, geography or transaction is connected to a designated person, prohibited activity or sanctions evasion risk.

2. Why It Matters #

Sanctions issues can require immediate freeze/no-dealing escalation and may create strict legal obligations. They must not be treated like ordinary adverse media.

3. Common Triggers and Use Context #

• Name or identifier match to UN baseline, internal policy list, or adopter-specific sanctions list.
• Ownership/control link to sanctioned person/entity.
• Transaction involves sanctioned sector, product, vessel, wallet, bank or restricted geography under the adopter policy overlay.
• PF-sensitive goods, end user or route.
• Attempted payment or onboarding linked to a designated person/entity.
• Customer asks how to avoid sanctions controls.

4. Source Basis #

• SRC-FATF-001: Recommendations 6, 7, 16, 19 and 20.
• SRC-UN-001: UN Security Council Consolidated List.
• Non-UN sanctions programmes should be configured in the adopter configuration layer if applicable.
• Adopter-specific sanctions guidance should be configured outside the open knowledge base.
• SRC-FATF-007: PF risk assessment and mitigation guidance.

5. Agent workflow: sanctions hit #

1. Pause normal approval path.
2. Capture screening result, source list, date/time and match score.
3. Classify match: false positive, possible match, likely match, true match.
4. Compare identifiers: name, aliases, date of birth, place of birth, nationality, address, ID, registration number, corporate identifiers, vessel/wallet/account details.
5. Check ownership/control and acting-on-behalf-of indicators.
6. Check whether the sanctions source is in scope under the adopter policy overlay.
7. Escalate possible/likely/true matches according to policy; likely/true must go to MLRO/legal process.
8. Avoid customer communication that could create tipping-off or sanctions circumvention risk.
9. Produce sanctions hit memo.

6. Agent workflow: CPF/PF risk #

1. Identify goods, technology, end user, end use, route, banks and intermediaries.
2. Check UN PF-related sanctions sources and any adopter-specific sources configured by the adopter.
3. Look for PF-sensitive exposure, including sanctioned programmes, restricted end users or evasion patterns configured by the adopter policy overlay.
4. Check dual-use or controlled goods indicators.
5. Check transshipment and end-user opacity.
6. Check unusual financing and document inconsistency.
7. Escalate high-risk PF indicators to MLRO.

7. Evidence to collect #

• Screening result and source list.
• Sanctions list entry details.
• Customer/counterparty identifiers.
• Ownership/control documents.
• Transaction documents.
• Goods/end-use/end-user documents where relevant.
• Communications log.
• Analyst match rationale.
• MLRO/legal decision log.

8. Match classification #

9. Red flags #

High#

• Ownership chain includes entity in restricted geography without clear reason.
• Goods route includes transshipment through high-risk geographies.
• Counterparty uses new intermediary after sanctions restrictions.
• Payment route differs from goods route.
• Customer refuses end-user/end-use information.

Critical#

• True sanctions list match.
• Ownership/control by sanctioned person/entity.
• Attempted transaction with designated person/entity.
• Evidence of sanctions evasion or PF-sensitive procurement.

10. Output Pattern #

# Sanctions Hit Memo

Subject: [customer/counterparty/person/entity/asset/wallet]
List/source: [UN/internal/adopter-specific]
Match type: [name/entity/vessel/wallet/ownership/control]
Classification: [false positive/possible/likely/true]
Identifiers compared: [list]
Ownership/control analysis: [summary]
Transaction/activity context: [summary]
Immediate risk: [low/medium/high/critical]
Recommended action: [clear/escalate/freeze/no-dealing/legal review]
Tipping-off controls: [instructions]
Source basis: [source IDs]
Evidence index: [links/files/screenshots]

11. Related pages #

• STR / SAR & Tipping-Off
• 15. TBML
• Geographic Risk
• Evidence Pack Templates

12. Proliferation-financing and sanctions-evasion lens#

PF and sanctions-evasion review may require more than a direct list match. Relevant questions include:

• whether goods or services have a sensitive or dual-use context;
• whether end user, end use, route and payment parties are consistent;
• whether ownership, control or acting-on-behalf relationships are obscured;
• whether counterparties, intermediaries or documentation changed after a designation or restriction;
• whether mandatory targeted-financial-sanctions controls apply.

Use Sanctions Evasion Typologies for the defensive evidence and escalation framework. Technical export classification and legal sanctions scope remain with authorised specialist functions.

Adverse Media

1. Agent definition #

Adverse media is negative public-source information that may indicate ML/TF/PF, sanctions, fraud, corruption, organised crime, regulatory enforcement or other financial crime risk.

2. Why this matters for AML agents #

Adverse media can reveal risk not visible in customer documents. But bad media must be assessed carefully: source quality, identity match, recency, relevance and severity all matter.

3. Trigger events #

• New onboarding.
• Periodic review.
• PEP review.
• Sanctions proximity review.
• Alert involving fraud/corruption/enforcement.
• Sudden change in customer activity.
• External news or regulator update.

4. Source basis #

• SRC-FATF-001: RBA, CDD, EDD, STR/SAR and record keeping.
• Local override: some regulators prescribe adverse media scope, sources and review frequency.

5. Agent workflow #

1. Build search strings: exact name, aliases, transliterations, prior names, directors, UBOs and company names.
2. Search reputable sources and selected open web sources.
3. Separate subject identity from namesakes.
4. Classify content type: allegation, investigation, prosecution, conviction, enforcement, regulatory action, sanctions, civil dispute, insolvency, reputational commentary.
5. Assess recency and relevance to proposed relationship.
6. Assess credibility: official source, court/regulator, major media, local media, blog/forum, anonymous content.
7. Link facts to AML risk factors.
8. Ask for explanation only if doing so does not create tipping-off risk.
9. Produce adverse media memo.

6. Evidence to collect #

• Search queries used.
• Search date/time.
• Source links.
• Screenshot or archived copy where policy permits.
• Summary of relevant facts.
• Identity match rationale.
• Customer explanation where obtained.
• Analyst relevance assessment.

7. Source quality scale #

8. Red flags #

Medium#

• Old allegation with no follow-up.
• Civil dispute unrelated to financial crime.
• Low-quality source with plausible but unverified claim.

High#

• Multiple independent reports of fraud/corruption/misappropriation.
• Ongoing investigation by regulator or law enforcement.
• Regulatory penalty for AML, sanctions or fraud controls.
• Customer/UBO/director named in major bribery or embezzlement case.

Critical#

• Conviction or enforcement for ML/TF/PF, sanctions evasion or organised crime.
• Official notice ties subject to sanctions, terrorist financing or proliferation financing.
• Customer explanation is false or contradicts official records.

9. Decision matrix #

10. Tom Custos output #

# Adverse Media Memo

Subject: [name/entity]
Search scope: [names/aliases/languages]
Sources reviewed: [list]
Relevant findings: [facts only]
Identity match: [confirmed/likely/uncertain/unrelated]
Source quality: [very high/high/medium/low]
AML relevance: [low/medium/high/critical]
Customer explanation: [if obtained]
Recommendation: [clear/EDD/escalate/decline]
Source basis: SRC-FATF-001
Evidence index: [links/screenshots]

Wolfsberg negative-news screening layer#

SRC-WOLF-005 provides industry-practice guidance for negative-news screening. It supports:

• risk-based search scope;
• source and allegation classification;
• identity resolution;
• materiality and relevance assessment;
• governance, quality control and recordkeeping.

It is industry best practice, not binding law. A media result remains a review input and should be traced to reliable underlying reporting or primary records where possible.

STR / SAR & Tipping-Off

1. Definition #

STR/SAR is the reporting pathway for suspicious activity or transactions. Tom Custos prepares internal evidence and narrative for MLRO review; the MLRO or authorised reporting function decides external filing under applicable legal overlay.

2. Why It Matters #

Poor escalation can lead to missed reporting obligations. Over-questioning a customer after suspicion arises can create tipping-off risk.

3. Common Triggers and Use Context #

• Funds suspected to be proceeds of crime.
• Activity suspected to be related to TF/PF.
• Attempted suspicious transaction.
• CDD/EDD cannot be completed and suspicion exists.
• Customer behaviour suggests evasion, concealment or fronting.
• Sanctions evasion indicators.
• Unusual activity becomes suspicious after review.

4. Suspicion Is a Reasoned Analytical Conclusion #

Suspicion is not a keyword match, a single red flag or an automatically generated alert. It is a reasoned analytical conclusion formed after comparing activity, customer profile, source evidence, explanations, unresolved discrepancies and applicable escalation rules.

Safe wording should separate:

A strong case note explains why an issue was cleared, why more information is needed or why it was escalated. It should not rely on vague wording such as “looks fine” or “customer is known”.

5. Source Basis #

• SRC-FATF-001: Recommendations 20 and 21.
• SRC-EGMONT-001: FIU institutional context.
• Adopter configuration layer: reporting thresholds, deadlines, forms, defences and consent/defence-against-money-laundering procedures are configured outside the open knowledge base.

6. Difference: unusual vs suspicious #

7. How It Is Used in AML/KYC/KYB #

1. Identify suspicious facts and red flags.
2. Build chronology.
3. Preserve evidence.
4. Avoid unnecessary customer contact if it could tip off.
5. Draft internal suspicion memo.
6. Escalate to MLRO through approved channel.
7. Await MLRO decision.
8. Record decision and follow-up controls.

8. Evidence to collect #

• Customer profile and expected activity.
• Transaction data and timeline.
• Related counterparties and geographic exposure.
• Screening results.
• Communications and document requests.
• Customer explanations already received.
• Analyst notes showing why facts are unusual/suspicious.
• Any attempted transactions.

9. Tipping-off control rules #

• Do not tell the customer that an STR/SAR has been or may be filed.
• Do not explain that a case is under MLRO/FIU review.
• Do not ask questions that reveal the suspected issue unless approved.
• Keep internal communications need-to-know.
• Mark case as confidential where policy allows.

10. STR/SAR internal memo template #

# Internal Suspicion Memo

Subject: [customer/counterparty/transaction]
Trigger: [what caused suspicion]
Timeline: [events]
Facts: [evidence-backed facts]
Unusual features: [list]
Why suspicion may exist: [reasoning]
Known explanations: [customer/internal]
Open questions: [material gaps]
Tipping-off risk: [low/medium/high]
Recommended MLRO action: [review/file/do not file/request controlled info]
Source basis: SRC-FATF-001; [local source]
Evidence index: [files/screenshots/logs]

11. Decision matrix #

FIU practice and national guidance#

Use Egmont sources for FIU role, international cooperation and case-analysis context. Use FinCEN advisories and narrative materials only as United States examples of typologies and reporting quality.

The final decision to file, the reporting channel, timing, confidentiality rule and tipping-off boundary remain jurisdiction-specific and must be decided by the authorised MLRO or reporting officer under applicable law and policy.

Red Flags Library

Purpose#

This library gives Tom Custos practical indicators that should increase risk, trigger EDD or support MLRO escalation. Red flags are not proof of wrongdoing. They are prompts for deeper review.

Severity scale#

Customer identity red flags#

• Customer avoids providing basic identity information.
• Documents are expired, inconsistent or unverifiable.
• Customer uses multiple names, transliterations or unexplained aliases.
• Registered address is a mass registration address without plausible business explanation.
• Customer refuses to explain purpose of relationship.

Beneficial ownership red flags#

• Ownership chain is unusually complex for a simple business.
• Nominee shareholders/directors are used without clear commercial reason.
• Control appears to sit outside formal ownership documents.
• UBO changes shortly before onboarding or transaction.
• Trust, foundation or holding structure lacks clear settlor/protector/beneficiary information.

PEP red flags#

• Customer or UBO is a foreign PEP with unexplained wealth.
• Customer is a close associate or family member of a high-risk PEP.
• Wealth source is inconsistent with public income or declared business activity.
• PEP status is hidden until adverse media or screening reveals it.
• Customer seeks urgent onboarding or transaction before EDD completion.

Sanctions / TFS / CPF red flags#

• Name, identifiers or ownership link match a sanctions target.
• Customer is owned or controlled by a sanctioned person or entity.
• Goods, route, vessel, bank or intermediary connects to restricted geographies or sectors.
• Transaction appears structured to avoid sanctions screening.
• Counterparty uses shell companies, transshipment or unclear end user in a PF-sensitive trade.

Adverse media red flags#

• Credible reports of fraud, corruption, organised crime, sanctions evasion or financial crime.
• Regulatory enforcement or criminal proceedings involving customer/UBO/director.
• Repeated allegations across credible and independent sources.
• Media is recent and directly connected to the proposed relationship.
• Customer explanation contradicts public record.

Transaction red flags#

• Activity is inconsistent with customer profile or declared purpose.
• High-value transaction with no clear economic rationale.
• Circular movement of funds with no obvious commercial purpose.
• Payments from or to unrelated third parties.
• Rapid pass-through of funds.
• Frequent changes to payment instructions.
• Split payments that appear linked.

Crypto/VASP red flags#

• Exposure to sanctioned wallet, darknet market, mixer, scam, ransomware or high-risk exchange cluster.
• VASP is unlicensed or claims licensing in a market that does not regulate the activity.
• Customer cannot explain source of crypto funds.
• Wallet movement appears designed to obscure trail.
• Funds originate from multiple newly created wallets and converge before fiat off-ramp.

TBML red flags#

• Price inconsistent with market value without commercial explanation.
• Goods description is vague or inconsistent across invoice, contract and shipping documents.
• Trade route is unnecessarily complex.
• Counterparty has no apparent experience in the traded goods.
• Payment route does not match goods route.
• Multiple intermediaries are added without economic rationale.
• Goods are dual-use, restricted, high-value, portable or easy to misdescribe.

Agent warning#

A single red flag may be explainable. Several red flags across different categories should increase risk and may justify EDD or MLRO escalation.

Digital infrastructure and DNS red flags#

• Public DNS records contradict the customer's declared operating geography.
• MX records point to a provider in a higher-risk or restricted geography without explanation.
• SPF/TXT records include unexplained email relays, SaaS vendors or legacy providers.
• NS, SOA or CNAME records reveal infrastructure dependencies inconsistent with the customer profile.
• PTR records reveal hosting provider names or geography inconsistent with the declared footprint.
• Digital infrastructure exposure appears together with adverse media, sanctions proximity, opaque UBOs or source-of-funds inconsistencies.

These indicators should be treated as supporting evidence for analyst review, not as automatic suspicion by themselves.

AML Programme Design & Effectiveness

Governance, risk rating, monitoring, outsourcing, QA and recordkeeping controls.

1. Programme architecture#

enterprise and business risk assessment
→ risk appetite, policy and control standards
→ customer, product and transaction controls
→ governance and accountable ownership
→ quality assurance, testing and management information
→ issue management and remediation
→ independent audit and supervisory challenge
→ revised risk assessment and control design

The cycle is continuous. New products, jurisdictions, customers, data, technology, typologies and regulatory changes may alter both risk and control effectiveness.

2. Component map#

3. Governance and accountability#

Effective governance identifies:

• who owns each material risk;
• who designs, operates, tests and approves each control;
• which decisions require senior management, MLRO, sanctions, legal or board authority;
• how conflicts, overrides and exceptions are recorded;
• how material weakness reaches the correct governing body.

The Three Lines model helps organise responsibility but does not transfer accountability. First-line ownership, second-line oversight and third-line assurance need clear interfaces and evidence.

4. Risk assessment must drive control design#

A risk assessment that does not change controls is mainly documentation.

For each material risk, the programme should be able to show:

risk statement
→ affected customers, products, sectors, channels and jurisdictions
→ inherent risk
→ control objective
→ control owner and frequency
→ evidence produced
→ residual risk
→ monitoring and remediation

Controls should be proportionate. Excessive controls applied indiscriminately can increase cost, reduce data quality and obscure higher-risk cases.

5. Design effectiveness and operating effectiveness#

Design effectiveness#

Ask:

• Would the control, if performed as designed, address the risk?
• Is the trigger, data, decision rule and escalation path appropriate?
• Is the control placed early enough to prevent or detect the issue?
• Does an authorised role own the outcome?

Operating effectiveness#

Ask:

• Was the control performed consistently and on time?
• Was the evidence complete and reliable?
• Were exceptions and alerts resolved appropriately?
• Did the reviewer challenge weak conclusions?
• Were issues corrected and recurrence reduced?

A policy can be well designed but poorly operated. A consistently operated control can still be badly designed.

6. Management information that matters#

Useful MI supports decisions. It may include:

• risk distribution and material change;
• overdue or incomplete CDD/EDD;
• alert, escalation and case ageing;
• quality-error type and recurrence;
• screening false-positive and false-negative indicators;
• high-risk approval and override patterns;
• SAR/STR process timeliness without exposing unnecessary confidential detail;
• data, system and vendor incidents;
• open findings, remediation age and closure validation;
• staffing, competence and capacity relative to workload.

Vanity metrics count activity without showing control quality, such as raw searches completed, documents collected or alerts closed.

7. Quality, audit and remediation cycle#

quality review or testing
→ finding
→ severity and risk impact
→ root cause
→ accountable owner
→ corrective action
→ target date
→ closure evidence
→ independent validation
→ trend and recurrence review

Closing a ticket is not the same as correcting the control. Remediation should address the cause, affected population and future prevention where proportionate.

8. Training and competence#

Training should be role-based:

• analysts need source, evidence and escalation competence;
• reviewers need judgment, challenge and consistency;
• MLROs need legal, governance, reporting and board-level competence;
• technology teams need data, model, change and human-approval controls;
• senior management and the board need sufficient understanding to challenge risk and resource decisions.

Completion records alone do not prove competence. Assessment and observed performance matter.

9. Common programme failures#

• enterprise risk assessment is generic or disconnected from products;
• policies contain obligations but no operational owner or evidence requirement;
• risk-rating models create numbers that no one can explain;
• screening and monitoring generate high volumes with poor feedback;
• investigators close cases without resolving material discrepancies;
• outsourced providers operate as a black box;
• first and second line rely on the same unchallenged data;
• metrics reward speed rather than quality;
• remediation closes administratively but weakness recurs;
• the board receives reassuring summaries without material limitations.

10. Programme review questions#

1. What are the most material current ML/TF/PF risks?
2. Which controls address each risk?
3. What evidence shows the controls work?
4. Where are limitations, overrides and backlogs?
5. Which failures are isolated and which are systemic?
6. Who owns remediation and who validates closure?
7. Which decisions require MLRO, legal, sanctions or board authority?
8. How does the programme learn from cases, QA, audit, regulatory findings and new typologies?

11. Programme review output#

Scope and period:
Applicable legal / policy framework:
Material risks:
Control architecture:
Design-effectiveness findings:
Operating-effectiveness findings:
Data and technology limitations:
Governance and MI findings:
Open issues and root causes:
Remediation owner / date:
Residual risk:
Required MLRO / senior management / board decision:

Source basis#

• FATF Recommendations and Methodology, including the risk-based approach, internal controls, supervision and effectiveness.
• Applicable law, regulator guidance and institution-specific risk appetite.
• Independent assurance and audit standards where relevant.

Pages in This Category#

See Also#

• A-Z Topic Index
• Topic Map
• Editorial & Source Policy

AML Governance & Three Lines of Defence

AML/KYC work is not only a set of checks on individual customers. It is a governance system inside a business. This page explains, in plain language, how the AML function usually fits together.

1. Why governance matters #

A good AML programme needs more than alert review. It needs clear ownership, policies, risk assessment, controls, training, independent testing, issue remediation and senior accountability. Without governance, even good analysts can produce inconsistent results.

2. The three lines idea #

The “three lines” model is a common way to separate operational ownership, compliance oversight and independent assurance.

3. MLRO and compliance function #

The MLRO or equivalent role is usually responsible for suspicious activity escalation governance and for ensuring that relevant AML issues are handled under applicable law and policy. The MLRO is not just a “last approver”; the role sits inside a wider control system.

Useful distinctions:

• Analyst: gathers facts, reviews sources, documents inconsistencies and prepares evidence.
• Compliance / AML manager: oversees methodology, quality and escalation standards.
• MLRO: handles regulated escalation/reporting responsibilities under the local framework.
• Senior management / board: owns risk appetite, resources, governance and accountability.

4. Training and culture #

Training is not only a formal annual course. It should help people understand risk-based thinking, evidence quality, escalation discipline and the limits of open-source information. Culture matters because AML failures often come from pressure to onboard, poor challenge, weak documentation or treating controls as box-ticking.

5. Management information and remediation #

Governance needs feedback loops. Useful management information may include volumes, alerts, escalations, overdue reviews, quality findings, unresolved issues, training completion and audit results. The goal is not only reporting numbers; it is finding where the system is weak.

6. Source basis #

• FATF Recommendations for internal controls, CDD, STR/SAR and risk-based programme concepts.
• Basel Committee ML/TF risk management guidance for banking governance and risk management framing.
• Wolfsberg Group resources for practitioner financial crime compliance and risk-based controls.

Customer Risk Assessment & Risk Rating

Customer risk assessment is the point where AML/KYC facts become a risk understanding. It brings together identity, ownership, geography, product use, delivery channel, source evidence, screening results and expected activity.

1. What risk assessment means #

AML risk assessment is not a label placed on a customer after one search. It is a reasoned view of whether the relationship, transaction or counterparty creates higher ML/TF, sanctions, proliferation financing or financial crime exposure.

A useful customer risk profile answers:

• who the customer or counterparty is;
• what they want to do;
• where the exposure sits;
• who owns or controls the structure;
• whether the activity makes sense;
• whether risk indicators are explained, unresolved or escalating.

2. Common risk-factor groups #

3. Risk rating is not arithmetic only #

Some firms use scorecards. Others use qualitative categories such as low, medium and high. Either way, a risk rating should be explainable. A high score without rationale is weak; a low score with unresolved adverse information is also weak.

Good risk-rating language is specific:

Medium risk due to cross-border activity and multi-jurisdictional ownership.
No sanctions or PEP match identified. UBO evidence is sufficient for initial review.
Ongoing monitoring should focus on transaction routes and changes in ownership.

Weak risk-rating language is generic:

Customer is medium risk. No issues found.

4. Initial risk vs ongoing risk #

Risk can change after onboarding. A customer that looked low risk at entry may become higher risk because of new ownership, new products, unexpected transaction behaviour, new geography, adverse media or sanctions-list changes.

Risk assessment should therefore support both:

• initial onboarding risk;
• ongoing monitoring and periodic review.

5. When risk should be refreshed #

Risk should be reviewed when material facts change. Examples include:

• new beneficial owner or director;
• new high-risk geography;
• new product, service or transaction type;
• material adverse media;
• new PEP exposure;
• sanctions proximity or close-match concern;
• unusual activity compared with expected profile;
• expired or inconsistent CDD evidence.

6. Analyst output #

A useful risk assessment output should include:

Customer / counterparty:
Relationship or transaction purpose:
Key risk factors:
Risk factors cleared or mitigated:
Unresolved issues:
Proposed risk rating:
Rationale:
Recommended controls / review frequency:
Evidence references:
Escalation status:

7. Value Trail vs Money Trail #

AML review should not focus only on visible bank payments. A money trail follows funds through accounts and payment rails. A value trail follows how economic value moves, changes form or becomes legitimised through goods, services, assets, invoices, ownership structures, wallets, loans or professional intermediaries.

This matters because some cases are not explained by a payment alone. The reviewer may need to understand:

• what value moved;
• who owned or controlled it;
• what document claims to explain it;
• whether the commercial story is plausible;
• whether goods, services, invoices, assets and payments align;
• whether the value trail creates unresolved risk even when the payment trail looks ordinary.

8. Source basis #

• FATF Recommendations for risk-based approach, CDD, ongoing due diligence and internal controls.
• FFIEC BSA/AML Examination Manual for customer risk and programme-risk concepts.
• Wolfsberg Group resources for practitioner risk-based financial crime control framing.

Jurisdiction indicators inside customer risk rating#

Country and jurisdiction indicators are supporting variables, not customer outcomes. FATF status, mutual-evaluation findings, NRAs and the Basel AML Index (SRC-BASEL-INDEX-001) should be combined with the customer's actual ownership, activity, products, routes, counterparties and evidence.

A model should not automatically assign a final customer rating from a country score. The case file must show which geographic exposure is relevant and why it changes, or does not change, the control response.

Ongoing Monitoring & Periodic Review

CDD/KYC does not end when a customer is onboarded. Ongoing monitoring is the control that checks whether the relationship continues to make sense as facts, ownership, activity and risk context change.

1. Why onboarding is not enough #

At onboarding, the firm forms an initial understanding of the customer. After onboarding, that understanding can become outdated. The customer may change ownership, start using new products, enter new markets, send unusual payments, appear in adverse media or become exposed to sanctions/PEP-related risk.

2. Ongoing monitoring in plain language #

3. Event-driven review triggers #

Event-driven review happens because something changes or new information appears. Common trigger categories include:

• change in ownership, directors or control;
• new sanctions, PEP or adverse media alert;
• material change in products, volume or transaction behaviour;
• new jurisdiction, route, counterparty or sector exposure;
• expired or inconsistent documents;
• internal quality finding, audit issue or unresolved discrepancy.

These are trigger categories, not universal legal thresholds.

4. Risk-based periodic review #

Periodic review is normally risk-based: higher-risk relationships are usually reviewed more closely or more frequently than lower-risk relationships. The exact timing is set by local law and internal policy.

A periodic review should not simply re-collect the same documents. It should check whether the customer profile, ownership, purpose, risk rating, source evidence and monitoring assumptions remain valid.

5. What to document #

• what changed or why the review was triggered;
• which sources were checked and when;
• which facts were confirmed, updated or contradicted;
• whether the risk rating remains appropriate;
• whether escalation, EDD or remediation is required under policy.

6. Source basis #

• FATF Recommendation 10 for CDD and ongoing due diligence concepts.
• Transaction Monitoring Sources for monitoring concepts and source boundaries.
• Evidence Weight for how to record source limits.

Third-Party Reliance & Outsourcing

Many AML/KYC processes involve other parties: introducers, agents, KYC utilities, screening vendors, corporate service providers, correspondent banks, consultants or outsourced operations teams. This page explains the control logic without giving local legal instructions.

1. Reliance vs outsourcing #

2. What can go wrong #

• the firm treats a third-party checklist as final clearance;
• underlying identity, UBO or source documents are not available when needed;
• screening vendors produce alerts but alert handling is not owned internally;
• outsourcing contracts do not define audit rights, data security or issue reporting;
• agents are commercially incentivised to onboard but not to challenge risk;
• correspondent or intermediary relationships create indirect exposure that is not reviewed.

3. Minimum control questions #

4. Correspondent and intermediary relationships #

Financial institution relationships can create indirect exposure to customers, counterparties, payment chains and jurisdictions that the firm does not directly onboard. Correspondent due diligence and intermediary risk should therefore be understood as relationship-risk controls, not just document collection.

5. Source basis #

• FATF Recommendation 17 for third-party reliance concepts.
• FATF Recommendation 18 for internal controls and group-wide programme concepts.
• Wolfsberg Correspondent Banking resources for FI-to-FI due diligence and questionnaire framing.

Name-Screening Calibration

Name screening is used to find possible matches against sanctions, PEP, adverse media or other risk datasets. It is not a magic yes/no engine. This page explains why screening creates false positives and false negatives, and how calibration thinking improves control quality.

1. What screening actually produces #

A screening system usually produces candidate matches. A candidate match is an alert that needs review. It is not automatically a confirmed match, and it is not automatically a false positive.

2. Why false positives happen #

• common names;
• partial name overlap;
• different transliteration systems;
• missing date of birth, address or nationality;
• poor customer data quality;
• alias-heavy list entries;
• conservative thresholds designed to avoid missed matches.

3. Why false negatives happen #

• overly strict exact matching;
• failure to screen aliases or transliterations;
• outdated lists or stale customer data;
• screening only the direct customer while ignoring relevant related parties;
• weak data ingestion or mapping from onboarding systems;
• poor handling of non-Latin scripts, abbreviations or name order.

4. Calibration is a governance activity #

Calibration means finding a defensible balance between too many irrelevant alerts and the risk of missing relevant matches. It should be governed, tested and documented. It is not a one-time technical setting.

5. Analyst review discipline #

A reviewer should look for identity evidence, not only name similarity. Useful match-resolution fields can include date of birth, place of birth, nationality, address, identifiers, entity registration number, ownership/control links and source list context.

6. Source basis #

• OFAC Sanctions List Search for approximate/fuzzy search concept.
• Wolfsberg Sanctions Screening Guidance for sanctions-screening control framing.
• Evidence Weight for match-resolution and source-limit recording.

AML Quality Assurance & Audit Readiness

AML quality assurance checks whether reviews are consistent, evidence-backed and aligned with policy. Audit readiness means a case file can be understood later by another reviewer, auditor, regulator or MLRO without relying on memory.

1. Why quality assurance matters #

AML work can fail even when individual analysts try to do the right thing. Common weaknesses include unclear rationale, missing evidence, inconsistent escalation, weak match-clearing notes and decisions that cannot be reconstructed later.

Quality assurance focuses on repeatability:

• similar cases should be reviewed using similar logic;
• material facts should be supported by evidence;
• alerts should not be closed with vague wording;
• escalations should be understandable and complete.

2. QC, QA and audit #

3. What a reviewer tests #

A reviewer may test whether:

• customer identity and identifiers are clear;
• ownership/control is documented;
• screening results are captured and explained;
• red flags are addressed, not ignored;
• risk rating rationale matches the facts;
• decision options are consistent with policy;
• escalation decisions are documented;
• evidence links or screenshots are recoverable.

4. Four-eyes principle #

The four-eyes principle means that certain decisions should be reviewed by a second competent person. It is useful for higher-risk onboarding, true or possible sanctions matches, PEP cases, complex structures, material adverse media, unusual transaction activity and MLRO escalations.

Four-eyes review should not be a rubber stamp. The second reviewer should be able to challenge assumptions, request evidence and record approval or disagreement.

5. Audit-ready case file #

An audit-ready case file should show:

what was reviewed
which sources were used
which identifiers were searched
what evidence was captured
what risks were found
what risks were cleared
what remains unresolved
who reviewed the case
what decision or recommendation was made
why that decision was reasonable at the time

6. Common quality findings #

Examples of quality findings include:

• “no match” without identifiers searched;
• adverse media noted but not assessed;
• PEP match cleared without date of birth or country comparison;
• customer risk rating changed without rationale;
• EDD requested but evidence not attached;
• escalation decision missing from the case file;
• outdated CDD accepted without refresh logic.

7. Metrics That Matter #

AML quality is not measured only by the number of alerts reviewed or reports filed. A mature programme also looks at whether reviews are explainable, consistent and useful for risk decisions.

Useful quality indicators include:

Weak metrics include raw alert volume, raw closure count or raw STR/SAR count without quality review. High volume does not automatically mean effective AML control.

8. Source basis #

• FATF Recommendations for internal controls, compliance function and training concepts.
• OFAC Framework for Compliance Commitments for sanctions compliance testing, internal controls and training context.
• FFIEC BSA/AML Examination Manual for examination, internal-control and independent-testing concepts.

Auditing for effectiveness#

SRC-WOLF-008 adds an industry-practice layer focused on whether financial-crime controls produce effective outcomes rather than merely existing on paper.

Audit and QA should test both:

• design: whether the control is capable of addressing the identified risk;
• operation: whether it is applied consistently, produces useful outputs and drives remediation.

The Wolfsberg source is not binding law. It should be mapped to FATF, local regulation, supervisory expectations and the institution's own control framework.

Data Protection & AML Recordkeeping

AML/KYC creates sensitive records: identity documents, ownership evidence, screening results, adverse media notes, transaction context and escalation materials. These records must be retained and protected under the applicable legal framework.

1. The AML/privacy tension #

AML rules often require firms to collect, review, retain and sometimes share information. Data protection rules emphasise purpose, minimisation, security, access control, retention limits and individual rights. A good AML system should be designed for both obligations rather than treating privacy as an afterthought.

2. What AML evidence can contain #

• identity and verification data;
• corporate registry extracts and UBO evidence;
• sanctions, PEP and adverse media screening results;
• source-of-funds or source-of-wealth materials where required;
• transaction context and monitoring alerts;
• internal notes, escalation reasoning and MLRO records.

These records can be sensitive even when they come from open sources, because the case file connects them to a person, company, risk assessment or internal decision.

3. Privacy-aware AML control principles #

4. Why local deployment matters #

For Tom Custos, local deployment is a privacy and control feature: sensitive AML evidence can stay inside the client’s infrastructure rather than being pushed into an uncontrolled external workflow. Locality does not solve all legal obligations, but it supports better control over access, audit logs, retention and data movement.

5. Open-source evidence is still personal or sensitive #

A common mistake is to treat public information as harmless. Public registry data, media articles or sanctions list entries can still become sensitive when stored in a case file, combined with other data, annotated by analysts or used in a risk decision.

6. Source basis #

• FATF Recommendations for recordkeeping, CDD and information-sharing concepts.
• FATF Private Sector Information Sharing guidance for AML/CFT information-sharing and safeguards context.
• EDPB statement on AML and data protection for the European data protection perspective.

Open AML Data Sources

Open AML data sources are public, official or clearly attributable sources that can support AML/KYC/KYB review. They do not replace regulated database subscriptions, local legal obligations or reviewer judgement. Their value is strongest when they are used as evidence anchors: source, date, identifier, limitation and relevance.

1. Purpose #

This page maps the open-source data layer of the Tom Custos AML Wiki. It focuses on sources that a person can inspect, cite, verify and explain.

The goal is to make the wiki more useful for AML learners, compliance teams, founders, legal teams and AI/RAG systems without turning the public site into private operational advice.

2. Source categories #

3. Evidence rule #

For every open source, record:

• source name;
• official URL;
• search term or identifier used;
• date and time checked;
• result summary;
• limitation of the source;
• whether the finding is a fact, a lead, a risk indicator or a decision input.

4. What open sources can do well #

Open AML sources can help confirm entity existence, legal names, officers, LEI records, sanctions designations, published debarments, FATF country status, known typology indicators and public investigative leads.

They are especially useful for learning, triage, transparency and building evidence packs that show how a conclusion was reached.

5. What open sources cannot do #

Open sources usually cannot provide full commercial PEP coverage, full adverse media coverage, complete UBO coverage, domestic regulator-specific obligations, local filing instructions, internal risk appetite, private subscription data or final compliance decisions.

6. Source priority #

Prefer primary and official sources when they exist. Use aggregators for discovery, enrichment and search convenience, then trace important findings back to the original source where possible.

7. Related TCAML Framework #

Operation workflows: customer onboarding, counterparty screening, enhanced due diligence, periodic review.

Source workflows: sanctions list check, corporate registry check, LEI check, beneficial ownership source review, debarment source review, investigative-source lead review.

Evidence outputs: source-check record, source limitation note, evidence index, reviewer memo.

8. Boundary #

This page is a data-source map, not a legal opinion, filing instruction or private investigation playbook. Local obligations and final decisions remain outside the public wiki.

9. Beginner rule: sources are not answers #

A source can provide a fact, a lead, a warning signal or a context layer. It does not automatically provide the final AML decision.

Use this mental model:

official source → stronger factual anchor
aggregator → discovery and enrichment
investigative/leak source → lead requiring context
media source → allegation or public-risk signal
missing result → not proof that no risk exists

For beginners, the most important habit is to write down what the source actually proves and what it does not prove.

Example:

Sanctions Data Sources

Sanctions data sources are dynamic lists, notices and tools used to identify designated persons, entities, vessels, aircraft and other restricted subjects. Sanctions screening must be treated separately from ordinary adverse media because a true match may trigger immediate legal and operational consequences.

1. Core official sources #

2. Matching logic #

A sanctions source hit should be classified carefully:

3. Data points to compare #

• full legal name;
• aliases and transliterations;
• date of birth or incorporation date;
• place of birth or registration jurisdiction;
• nationality or registration number;
• addresses;
• vessels, aircraft, IMO numbers or other identifiers;
• ownership/control links;
• source list and programme/regime.

4. Evidence value #

Official list entries have high evidence value for the fact of designation. However, the legal consequence depends on the jurisdiction, the institution's obligations, the customer relationship, ownership/control analysis and local policy.

Aggregators have strong discovery value but important matches should be traced to the original list before relying on them.

5. Source basis #

• SRC-UN-001: UN Security Council Consolidated List.
• SRC-OFAC-001: OFAC sanctions list search and list data.
• SRC-EU-001: EU Sanctions Map and consolidated EU financial sanctions data.
• SRC-UK-001: UK Sanctions List.
• SRC-OS-001: OpenSanctions.
• SRC-FATF-001: FATF Recommendations on TFS and sanctions-related controls.

6. Related TCAML Framework #

Operation workflows: onboarding, transaction review, sanctions alert review, MLRO/legal escalation.

Source workflows: sanctions list check, identifier comparison, ownership/control review, source-date capture.

Evidence outputs: sanctions source check record, match rationale, source limitation note.

7. Boundary #

This page does not define sanctions legal obligations. It maps source types and evidence handling principles only.

Corporate Registry Data Sources

Corporate registry data sources help verify that a legal entity exists and provide registry facts such as legal name, registration number, status, officers, filing history, addresses and sometimes persons with significant control. Registry facts are central to KYB but do not by themselves prove low risk.

1. Main source types #

2. What to capture #

• legal name exactly as registered;
• registration number;
• jurisdiction;
• status;
• incorporation date;
• registered address;
• directors/officers;
• PSC/UBO or controller information if available;
• filing dates;
• source URL and check date;
• source limitations.

3. Registry facts vs AML risk #

A registry can confirm facts. It usually cannot confirm commercial purpose, true source of funds, full control, nominee risk, adverse media risk, sanctions exposure or whether a structure is being misused.

Registry evidence should be combined with CDD, UBO, sanctions, PEP, adverse media, transaction and sector-risk checks.

4. Companies House example #

Companies House is useful because it is an official registry and its API provides live company information for UK companies. It is strong for UK entity facts, officers and public filings, but it is not a global AML risk database.

5. OpenCorporates example #

OpenCorporates is useful for cross-jurisdiction discovery and provenance because records link back to source data where available. It should be used as a discovery and enrichment layer, then important findings should be checked against the underlying source when possible.

6. Related TCAML Framework #

Operation workflows: KYB onboarding, counterparty screening, periodic review, beneficial ownership review.

Source workflows: corporate registry check, identifier extraction, officer/director extraction, discrepancy detection.

Evidence outputs: registry evidence note, corporate identity block, discrepancy list.

7. Boundary #

This page is about data sources. It does not provide jurisdiction-specific filing rules or private KYB policy thresholds.

LEI and GLEIF for KYB

A Legal Entity Identifier (LEI) is a standardised identifier for legal entities participating in financial transactions. GLEIF provides access to LEI reference data and related data that can support KYB identity matching.

1. Why LEI matters #

LEI data helps reduce entity ambiguity. It can support matching across systems where names, addresses, registration numbers or transliterations differ.

2. What GLEIF can support #

GLEIF API access can support:

• LEI lookup;
• legal entity name search;
• address matching;
• fuzzy name and address matching;
• ownership data where available;
• LEI issuer reference data;
• mapped identifiers such as BIC or ISIN where available.

3. Useful fields #

4. Limitations #

Not every entity has an LEI. An LEI record is an identity and reference-data source, not a complete AML risk assessment. LEI data should not replace sanctions, PEP, adverse media, UBO or source-of-funds checks.

5. Evidence use #

For KYB, record the LEI, legal name, status, source URL/API result date, matched fields and any mismatches with customer-provided documents.

6. Source basis #

• SRC-GLEIF-001: GLEIF API / LEI data.
• SRC-FATF-001: CDD and risk-based approach.

7. Related TCAML Framework #

Operation workflows: KYB onboarding, counterparty screening, periodic review.

Source workflows: LEI lookup, identity matching, address matching, parent-data review.

Evidence outputs: LEI match note, entity identity block, discrepancy note.

Beneficial Ownership Data Standard

Beneficial ownership data is difficult because ownership and control can be direct, indirect, layered, contractual, nominee-based or hidden through legal arrangements. A standard data model helps describe ownership information consistently.

1. What BODS is #

The Beneficial Ownership Data Standard (BODS), developed by Open Ownership with Open Data Services, is an open standard for collecting, sharing and using beneficial ownership data.

It is not a sanctions list and not a risk database. It is a structured way to represent ownership and control information.

2. Why it matters for the wiki #

The wiki can use BODS concepts to make UBO articles clearer:

• person statements;
• entity statements;
• ownership or control statements;
• interests;
• start and end dates;
• source and confidence metadata;
• missing or unknown information.

3. AML use #

4. Evidence cautions #

A clean ownership chart does not prove that there is no hidden control. BO data must be assessed against documents, registries, customer declarations, adverse media, nominee indicators and transaction behaviour.

5. Source basis #

• SRC-OO-001: Open Ownership Beneficial Ownership Data Standard.
• SRC-FATF-004: FATF beneficial ownership guidance for legal persons.
• SRC-FATF-005: FATF beneficial ownership guidance for legal arrangements.

6. Related TCAML Framework #

Operation workflows: UBO review, EDD, complex structure review.

Source workflows: ownership extraction, control relationship mapping, missing-information flagging.

Evidence outputs: UBO structure note, ownership/control statement table, discrepancy note.

Data-model and investigative layers#

The Open Ownership data standard structures beneficial-ownership data. StAR's nominee-arrangements research (SRC-STAR-NOMINEES-001) explains why structured fields alone may not reveal effective control.

A robust workflow therefore separates:

• data representation;
• source provenance;
• legal ownership;
• effective control;
• nominee or intermediary role;
• unresolved discrepancy and reviewer inference.

Investigative and Leak Data Sources

Investigative and leak datasets can reveal offshore links, historical relationships, intermediary networks and public-interest reporting leads. They must be handled carefully because inclusion in a leak or investigative database does not by itself prove wrongdoing.

1. Key open sources #

2. Safe interpretation rule #

Treat investigative datasets as lead sources unless the source itself is an official record, court record, regulator notice or directly verifiable registry record.

A finding should be described as:

• a public-source lead;
• an offshore data reference;
• a document link;
• a relationship requiring corroboration;
• not a conclusion of criminal conduct.

3. Evidence capture #

Record the dataset name, search term, subject identifiers, date checked, source document if available, relationship type and why the result may or may not be relevant.

4. Common AML relevance #

• offshore intermediary or service-provider links;
• complex ownership chains;
• repeated use of secrecy jurisdictions;
• historical director/shareholder connections;
• links to PEPs, sanctioned persons, fraud cases or procurement scandals;
• unexplained mismatch between customer declaration and public records.

5. Boundary language #

Use neutral wording. Do not state that a person or company committed wrongdoing merely because they appear in a dataset. Explain the limitation clearly.

6. Source basis #

• SRC-ICIJ-001: ICIJ Offshore Leaks Database.
• SRC-OCCRP-001: OCCRP Aleph.
• SRC-OC-001: OpenCorporates.

7. Related TCAML Framework #

Operation workflows: adverse media review, EDD, UBO review, PEP review.

Source workflows: investigative-source search, lead classification, corroboration flag.

Evidence outputs: investigative-source lead note, corroboration requirement, source limitation note.

Debarment and Procurement Integrity Sources

Debarment and procurement integrity sources list firms and individuals that are ineligible, suspended or sanctioned in relation to procurement or development-bank financed projects. These sources are useful for KYB, counterparty screening, corruption risk and adverse media context.

1. Key sources #

2. Why this matters #

A debarment source is not the same as a sanctions list, but it can be a strong adverse integrity signal. It can indicate fraud, corruption, collusion, coercion, obstruction or other prohibited practices depending on the source framework.

3. Evidence capture #

Record:

• exact listed name;
• source institution;
• ineligibility or debarment period;
• reason category if published;
• cross-debarment status if published;
• date checked;
• identifiers and addresses if provided;
• match rationale.

4. Interpretation #

Do not automatically treat a debarment result as a sanctions hit. Treat it as a procurement integrity or adverse-risk finding and apply local policy for EDD, senior review or decline.

5. Source basis #

• SRC-WB-001: World Bank Listing of Ineligible Firms and Individuals.
• SRC-ADB-001: ADB Debarment and Suspension Register.
• SRC-EBRD-001: EBRD Ineligible Entities.

6. Related TCAML Framework #

Operation workflows: counterparty screening, vendor onboarding, EDD, adverse media review.

Source workflows: debarment source check, identity comparison, adverse integrity classification.

Evidence outputs: debarment match note, procurement integrity risk note, source limitation note.

Open Source Limitations and Evidence Weight

Open AML sources are powerful when used honestly. Their value depends on source authority, freshness, coverage, identifier quality, relevance and corroboration.

1. Evidence weight scale #

2. Freshness rule #

Dynamic sources must be checked close to the review date. Sanctions lists, FATF lists, company registry status, debarment lists and enforcement pages can change.

3. Coverage rule #

No public source covers everything. A missing result does not prove that there is no risk. It only proves that no result was found in that source at that time using those search terms.

4. Identity rule #

Name matches are weak unless supported by identifiers. Stronger evidence uses registration numbers, dates of birth, addresses, LEI, passport/national IDs where lawfully available, vessel identifiers, corporate numbers or other stable attributes.

5. Corroboration rule #

For important findings, use at least two source types where possible: official registry plus LEI, sanctions list plus aggregator, adverse media plus court/regulator source, investigative lead plus official record.

6. Neutral wording rule #

Write precisely:

• “listed by source X as of date Y”;
• “possible match requiring review”;
• “public-source lead requiring corroboration”;
• “no result found in source X using search term Y on date Z”.

Avoid unsupported conclusions such as “criminal”, “sanctioned”, “laundered money” or “fraudster” unless an official source directly supports that statement.

7. Related TCAML Framework #

Operation workflows: all source-check workflows.

Source workflows: evidence weighting, source limitation note, identity matching, corroboration flag.

Evidence outputs: source limitation note, evidence confidence label, reviewer rationale.

FATF Mutual Evaluations and Country Risk

FATF mutual evaluations are peer reviews of countries' AML/CFT/CPF systems. They help explain country-level risk beyond simple black-list/grey-list labels.

1. Two evaluation dimensions #

2. Why effectiveness matters #

A country may have formal laws but weak supervision, investigation, beneficial ownership transparency, confiscation, STR use or prosecution outcomes. For risk assessment, effectiveness can be as important as technical compliance.

3. Useful FATF concepts #

• Recommendations;
• Immediate Outcomes;
• mutual evaluation reports;
• follow-up reports;
• high-risk jurisdictions subject to a call for action;
• jurisdictions under increased monitoring;
• sectoral and national risk assessment.

4. How to use in the wiki #

Country-risk articles should avoid saying that a whole country is “bad”. Instead, they should separate:

• FATF list status;
• mutual evaluation findings;
• relevant deficiencies;
• sector exposure;
• customer-specific facts;
• transaction or goods-route exposure;
• adopter policy overlay.

5. Evidence capture #

Record report title, country, assessment round, publication date, relevant findings and date accessed.

6. Source basis #

• SRC-FATF-009: FATF Methodology and mutual evaluation materials.
• SRC-FATF-002: FATF high-risk and increased monitoring lists.
• SRC-FATF-010: FATF National Risk Assessment guidance.

7. Related TCAML Framework #

Operation workflows: geographic risk review, EDD, counterparty screening.

Source workflows: FATF list status check, mutual evaluation reference, geographic exposure note.

Evidence outputs: country-risk source note, FATF status record, policy overlay placeholder.

Independent comparative indicators#

FATF mutual evaluations assess technical compliance and effectiveness. The Basel AML Index (SRC-BASEL-INDEX-001) is a separate composite indicator that can support comparison and benchmarking.

The two sources must not be merged:

• FATF findings are the standard-setting and peer-evaluation layer;
• Basel AML Index is an independent comparative index;
• neither source replaces customer-specific CDD, transaction facts or internal risk appetite.

Record the precise report or index edition used and explain the limitation of each source.

National Risk Assessment Source Map

A National Risk Assessment (NRA) is a country's structured assessment of money laundering and terrorist financing risks. It helps explain sectoral risks, threat patterns, vulnerabilities and control priorities.

1. Why NRAs matter #

NRAs are useful because they show how a country understands its own risk landscape. They can inform sector risk, geographic risk, product risk and customer-risk context.

2. What to look for #

3. Evidence use #

Use NRA findings as context, not as a final customer decision. A customer still needs individual CDD, KYB, UBO, sanctions, PEP and adverse media assessment.

4. Limitations #

NRAs vary in quality, age, public detail and methodology. Some are not public. They may also be politically sensitive or too high-level for a specific customer decision.

5. Source basis #

• SRC-FATF-010: FATF Money Laundering National Risk Assessment Guidance.
• SRC-FATF-001: FATF Recommendations and risk-based approach.

6. Related TCAML Framework #

Operation workflows: geographic risk review, sector risk review, EDD.

Source workflows: NRA source capture, sector-risk context extraction, local-policy overlay placeholder.

Evidence outputs: NRA context note, sector risk summary, source limitation note.

Egmont and comparative context#

Egmont's report on the role of FIUs in the National Risk Assessment process (SRC-EGMONT-NRA-001) adds operational context on FIU data, coordination, stakeholder participation and implementation of NRA findings.

The Basel AML Index (SRC-BASEL-INDEX-001) may be used as an external comparative indicator, but it is not an NRA and must not replace the country's own risk assessment or FATF findings.

A strong source note separates:

1. national assessment;
2. FATF evaluation and list status;
3. FIU operational context;
4. independent comparative indices;
5. institution-specific exposure.

SAR / STR Source Guidance

Suspicious activity reports and suspicious transaction reports are jurisdiction-specific. A public wiki should not provide local filing instructions unless they are verified for a specific jurisdiction and kept current. This page maps reliable source categories and universal evidence concepts only.

1. Why caution is required #

Filing deadlines, forms, thresholds, confidentiality rules, tipping-off rules and portal procedures differ by jurisdiction. Incorrect public instructions can create compliance risk.

2. Reliable source types #

3. Universal evidence concepts #

A suspicion report usually needs clear facts, not speculation. Evidence should distinguish subject identity, activity observed, dates, amounts, counterparties, source documents, reason for suspicion and internal decision trail.

4. What this wiki should not publish yet #

Until jurisdiction-specific pages are verified, do not publish:

• local filing deadlines;
• portal instructions;
• thresholds;
• domestic legal definitions;
• regulator-specific forms;
• final “file/do not file” decision trees.

5. Source basis #

• SRC-FINCEN-001: FinCEN SAR Narrative Guidance Package.
• SRC-FFIEC-001: FFIEC BSA/AML Examination Manual.
• SRC-EGMONT-001: Egmont FIU materials.
• SRC-FATF-001: FATF Recommendations.

6. Related TCAML Framework #

Operation workflows: MLRO escalation, suspicion escalation, case evidence preparation.

Source workflows: FIU/regulator source reference, evidence chronology, narrative-quality check.

Evidence outputs: escalation memo, evidence index, local-rule placeholder.

Egmont and FinCEN source layers#

Egmont and FinCEN serve different purposes in this wiki:

• SRC-EGMONT-BECA-001 provides cross-border FIU case and financial-analysis examples.
• SRC-EGMONT-001 explains the institutional role of FIUs.
• SRC-FINCEN-001 supports SAR narrative quality.
• SRC-FINCEN-ADVISORIES-001 provides United States typology and red-flag examples.

FinCEN materials are jurisdiction-specific. They may strengthen typology awareness and drafting quality, but they are not universal filing instructions, legal thresholds or reporting deadlines. Egmont case materials are illustrative FIU practice and do not create a universal suspicion standard.

Transaction Monitoring Source Map

Transaction monitoring detects unusual or potentially suspicious activity by comparing transactions against expected behaviour, risk factors, rules, scenarios and typology indicators. This page maps source materials only; it does not define institution-specific monitoring rules.

1. Source categories #

2. Why public rules are risky #

Static public thresholds can be misleading. They depend on product type, customer profile, jurisdiction, transaction corridor, institution size, risk appetite and local legal obligations.

3. Safe wiki approach #

The public wiki should explain concepts:

• expected vs unexpected activity;
• customer profile and purpose;
• transaction corridor;
• source and destination of funds;
• unusual frequency, size or pattern;
• link to typologies;
• evidence and escalation boundaries.

It should avoid publishing private institution thresholds or evasion-sensitive detection logic.

4. Evidence to describe #

• alert reason;
• customer profile;
• transaction chronology;
• counterparties;
• source documents;
• typology link;
• explanation and reviewer assessment;
• escalation or closure rationale.

5. Source basis #

• SRC-FFIEC-001: FFIEC BSA/AML Examination Manual.
• SRC-FATF-001: FATF Recommendations.
• SRC-WOLF-001: Wolfsberg resources.

6. Related TCAML Framework #

Operation workflows: ongoing monitoring, alert triage, MLRO escalation.

Source workflows: transaction chronology, typology mapping, evidence index.

Evidence outputs: alert review note, chronology table, source limitation note.

Effectiveness and typology source layers#

The Wolfsberg monitoring statements distinguish effective monitoring for suspicious activity from a narrow reliance on static transaction rules:

• SRC-WOLF-006: Part I, moving beyond automated transaction monitoring.
• SRC-WOLF-007: Part II, transition, validation, model-risk balance and explainability.
• SRC-FINCEN-ADVISORIES-001: United States typology and red-flag examples.

FinCEN advisories are jurisdiction-specific and should not be converted into universal thresholds. Monitoring design must remain linked to the institution's risk assessment, customer profile, products, data and applicable law.

Money Mules and Structuring Red Flags

Money mule and structuring indicators are common AML red-flag categories. This page presents defensive indicators and evidence concepts only. It should not be used to teach avoidance of controls.

1. Defensive definitions #

A money mule is a person or account used to receive, move or transfer funds on behalf of others, often hiding the real beneficiary or origin of funds.

Structuring means splitting activity into smaller parts to avoid attention, reporting thresholds or internal controls. Local legal definitions vary.

2. Defensive indicators #

3. Evidence concepts #

Evidence should focus on chronology, profile mismatch, source of funds, counterparties, communication records, account purpose and customer explanation where appropriate.

4. Caution #

A single indicator rarely proves suspicious activity. Assess combined behaviour, customer context, product, geography, timing and source evidence.

5. Source basis #

• SRC-FATF-001: FATF Recommendations and suspicious reporting framework.
• SRC-FFIEC-001: FFIEC monitoring and suspicious activity concepts.
• SRC-FINCEN-001: SAR narrative quality concepts.

6. Related TCAML Framework #

Operation workflows: alert triage, ongoing monitoring, MLRO escalation.

Source workflows: pattern summary, customer profile comparison, evidence chronology.

Evidence outputs: red-flag note, chronology, escalation rationale.

Professional Enablers and Professional Money Laundering

Professional money laundering involves persons, organisations or networks that specialise in facilitating the movement, concealment or apparent legitimisation of criminal proceeds. Professional enablers may misuse skills, access or otherwise legitimate services to support financial crime.

A profession, complex structure or use of an adviser is not suspicious by itself. The review focuses on conduct, transparency, economic purpose, control of value and evidence.

1. Why this risk is distinct#

Ordinary customer risk usually starts with the customer's own activity. Professional-enabler risk can connect multiple customers, entities, transactions or jurisdictions through a common intermediary.

Relevant services may include:

• company, partnership or trust formation;
• nominee, director, secretary or registered-office services;
• legal, accounting, tax or fiduciary services;
• escrow, client-account or payment administration;
• property, investment or high-value-asset transactions;
• trade, logistics or corporate restructuring;
• introductions to banks, payment providers, VASPs or other gatekeepers.

The concern is not the service label. It is whether the service is used to obscure the real client, ownership, control, purpose or value trail.

2. Observable risk patterns#

Examples of defensively framed indicators include:

• the intermediary appears to control decisions while the stated customer cannot explain the arrangement;
• the same adviser, address, nominee or service provider recurs across otherwise unrelated high-risk entities;
• legal or corporate complexity has no clear operational, tax, succession or commercial rationale;
• instructions, payments and documents come from different persons without a transparent authority chain;
• client or escrow accounts are used without a clear link to the underlying service;
• companies are formed, transferred or dissolved rapidly with little visible activity;
• the intermediary discourages direct contact with the beneficial owner or source of funds;
• documents appear standardised but do not match the actual transaction;
• fees, loans or consultancy payments lack a proportionate scope of work;
• the professional's role changes when questions are asked.

No single pattern establishes misconduct. Repetition, inconsistency and lack of transparency increase concern.

3. Innocent explanations to test#

Legitimate explanations may include:

• confidentiality arrangements that remain lawful and properly documented;
• centralised family-office or group administration;
• cross-border tax, succession or investment planning;
• outsourced company-secretarial or bookkeeping functions;
• regulated client-account use connected to a genuine transaction;
• language, disability or accessibility support;
• temporary restructuring following an acquisition or inheritance.

The analyst should test the explanation against documents, authority, ownership, timing and economic purpose rather than accept or reject it based on appearance.

4. Evidence questions#

Regulatory status is relevant but not conclusive. A licence does not verify the customer's facts or the lawfulness of a particular transaction.

5. Defensive control sequence#

identify the real client and beneficiary
→ verify authority and professional role
→ map ownership, control and payment paths
→ understand the commercial or personal purpose
→ assess SoW/SoF and third-party involvement
→ compare documents with observed conduct
→ record recurring intermediaries or network indicators
→ escalate material opacity or contradiction

Controls may include direct customer confirmation, enhanced verification, restriction of third-party funding, senior approval, independent registry checks, case-link analysis and ongoing monitoring.

6. Escalation matrix#

7. Analyst output#

Professional / intermediary:
Stated role:
Underlying client or beneficiary:
Authority evidence:
Entities / assets involved:
Ownership and control findings:
Payment or client-account role:
SoW/SoF findings:
Recurring network indicators:
Innocent explanation considered:
Unresolved contradictions:
Recommended control or escalation:
Decision owner:

8. Relationship to sector risk#

This typology intersects with the Sector Risk Lens, especially legal, accounting, TCSP, real-estate and private-wealth services. The sector page explains normal business models; this page addresses conduct that may indicate professional facilitation.

Source basis#

• FATF, Professional Money Laundering.
• FATF materials on vulnerabilities involving legal professionals and other DNFBPs.
• FATF Recommendations for CDD, beneficial ownership, reliance, internal controls and suspicious transaction reporting.

Sanctions Evasion Typologies

Sanctions evasion risk arises when ownership, control, parties, goods, services, geography or value flows may be concealed or misrepresented to avoid applicable restrictive measures.

Sanctions regimes differ. The analyst should never infer legal scope from a generic typology page. The applicable jurisdiction, list, ownership/control test, prohibition, licence, exemption and effective date must be verified.

1. Start with the legal and factual perimeter#

A sanctions review should define:

• which jurisdiction or contractual sanctions policy applies;
• which persons, entities, vessels, goods, services or activities may be restricted;
• whether ownership, control or acting-on-behalf rules apply;
• the date on which the relevant measure took effect;
• whether a licence, authorisation or exemption may be relevant;
• which facts are confirmed and which remain assumptions.

A name-screening result alone is not a legal conclusion. Evasion risk often appears through relationships and behaviour rather than a direct exact-name match.

2. Core review dimensions#

3. Observable indicator groups#

Ownership and identity opacity#

• recent transfers of shares, voting rights or management without a clear commercial explanation;
• fragmented holdings or control rights that appear designed to avoid transparency;
• nominee, trust or intermediary layers that obscure the ultimate decision-maker;
• identifiers, addresses or contact details linked to a restricted party despite a different legal name;
• customer reluctance to explain recent ownership or control changes.

Trade and service inconsistency#

• goods, quantities, values, end users or destinations do not align across documents;
• intermediaries have no clear function in the supply chain;
• routing is unusually complex for the goods or service;
• the customer cannot explain the final user, use or delivery location;
• commodity, vessel, logistics or insurance information is incomplete or changes late in the process.

Payment and relationship anomalies#

• an unrelated third party pays or receives funds;
• payment instructions change after screening or compliance questions;
• transaction narrative is generic or inconsistent with the contract;
• value is split across multiple intermediaries without a clear business need;
• new financial institutions, VASPs or jurisdictions appear shortly after a designation or restriction.

Behavioural and timing changes#

• established counterparties are replaced without credible reason;
• transactions accelerate, pause or reroute around a legal event;
• the customer seeks unusual confidentiality or insists that certain parties not be named;
• supporting records are recreated after questions are raised;
• the customer provides technically true fragments that omit the overall relationship.

These indicators require context. International trade, group treasury, restructuring and urgent supply needs can create complexity without evasion.

4. Innocent explanations to test#

Potential legitimate explanations include:

• ordinary corporate restructuring or lender requirements;
• supply-chain disruption, port closure or carrier availability;
• lawful use of distributors, freight forwarders or group payment centres;
• data-quality differences between registries;
• authorised activity under a licence or exemption;
• payment rejection unrelated to sanctions;
• commercial confidentiality supported by full disclosure to the regulated firm.

The test is whether the explanation is documented, coherent and compatible with the applicable legal framework.

5. Evidence map#

A defensible review may use:

• official sanctions lists and legal instruments;
• corporate registries and ownership records;
• director, shareholder and control documentation;
• contracts, invoices, purchase orders and end-user statements;
• transport, customs, vessel, logistics and insurance records;
• bank and payment records;
• communications relevant to authority and purpose;
• reliable adverse information and official enforcement notices;
• internal case links showing recurring parties, addresses or intermediaries.

Source limitations and retrieval time should be recorded. Aggregators assist matching but do not replace official legal sources.

6. Proliferation-financing connection#

PF-related sanctions evasion may involve procurement networks, dual-use goods, intermediaries, opaque end users and cross-border payment arrangements. A reviewer should consider:

• whether the goods or services have a sensitive or dual-use context;
• whether the stated end user and end use are credible;
• whether procurement, shipping and payment parties are consistent;
• whether the transaction involves jurisdictions, entities or networks linked to PF concern;
• whether mandatory targeted-financial-sanctions controls apply.

The analyst should not determine technical export classification without the necessary expertise. Refer goods-control questions to the authorised trade-control or legal function.

7. Decision and escalation matrix#

8. Sanctions-evasion review note#

Applicable jurisdiction / policy:
Legal instrument or list checked:
Subject and identifiers:
Ownership / control findings:
Acting-on-behalf findings:
Goods / services:
Route and geography:
Payment and value path:
Material changes and timing:
Documents reviewed:
Innocent explanation considered:
Unresolved indicators:
Licence / exemption status:
Required legal, sanctions or MLRO decision:

9. Relationship to other pages#

• Sanctions / TFS / CPF explains the core legal-control concepts.
• Sanctions Data Sources explains source selection.
• Beneficial Ownership supports ownership/control review.
• TBML supports trade-document consistency review.
• Crypto / VASP AML covers virtual-asset evidence limits.

Source basis#

• FATF Recommendations relating to targeted financial sanctions and proliferation financing.
• FATF, Complex Proliferation Financing and Sanctions Evasion Schemes (2025).
• Applicable official sanctions authorities and jurisdiction overlays.

Real Estate, Luxury Assets and Art Risk

Real estate, luxury assets, art, antiquities and collectibles can store or transfer substantial value. Risk may increase where ownership is opaque, valuation is subjective, intermediaries dominate the relationship, payment comes from third parties or the asset moves across jurisdictions.

The asset or sector is not suspicious by itself. Review should focus on the customer, beneficial owner, funding, valuation, transaction purpose, intermediaries and evidence.

1. Shared risk logic#

These asset classes differ, but they share several AML/KYC questions:

• Who is the real buyer, seller, owner and beneficiary?
• Why is the asset being bought, sold, transferred or held?
• How was the purchase funded?
• Is the valuation credible and independently supported?
• Which agents, dealers, lawyers, brokers, galleries, auction houses or other intermediaries are involved?
• Does the payment path match the contract and ownership path?
• Is the asset or transaction linked to a higher-risk jurisdiction, PEP, sanctions or adverse-information concern?
• Does the customer's wider wealth make the transaction plausible?

2. Real-estate review lens#

Key evidence may include:

• official title or land records;
• sale and purchase agreement;
• beneficial ownership of purchasing or selling entities;
• mortgage or lender information;
• completion statement and payment records;
• valuation and property history;
• identity and authority of agents, lawyers and representatives;
• explanation for third-party funding or ownership.

Risk indicators may include rapid resale without a clear commercial reason, unexplained price divergence, opaque purchasing vehicles, unrelated third-party payments, unexplained use of nominees, or a mismatch between stated use and observed control.

Legitimate explanations can include development activity, distressed sale, family ownership, lawful tax or succession planning, lender-driven structuring and market volatility. They still require evidence.

3. Luxury goods and high-value moveable assets#

This group may include jewellery, precious stones and metals, watches, vehicles, yachts and other high-value moveables.

Review questions include:

• Is the dealer or intermediary identifiable and, where applicable, regulated?
• Is the asset described precisely enough to support ownership and valuation?
• Are payment method, buyer, delivery recipient and registered owner consistent?
• Is the purchase proportionate to the customer's known SoW?
• Does rapid resale, cross-border movement or repeated dealer activity have a credible purpose?
• Are cash, crypto or third-party payments permitted and properly controlled?

An invoice proves a claimed sale only to the extent that the issuer, asset, price, payment and delivery can be corroborated.

4. Art, antiquities and collectibles#

Art-market risk can involve private sales, agents, trusts, freeports, auction houses, galleries, subjective valuation and confidentiality expectations.

A defensive review should distinguish:

• artist, object and provenance;
• seller, consignor, buyer, payer and ultimate owner;
• valuation source and sales history;
• location, custody and cross-border movement;
• authenticity, export or cultural-property restrictions where relevant;
• use of intermediaries and purpose of confidentiality;
• funding and settlement path.

The analyst is not expected to authenticate an artwork. Where authenticity, cultural-property rules or valuation are material, obtain qualified specialist input.

5. SoW/SoF and plausibility#

The Source of Wealth and Source of Funds method applies directly.

claimed wealth
→ ability to acquire the asset
→ specific source of purchase funds
→ payment to the correct counterparty
→ ownership / custody after completion
→ explanation for later sale or transfer

Material gaps should not be hidden behind the value of the asset or the reputation of an intermediary.

6. Evidence map#

7. Control and escalation matrix#

8. Analyst output#

Asset and transaction:
Buyer / seller / ultimate owner:
Intermediaries and authority:
Stated purpose:
Valuation evidence:
SoW and SoF:
Payment path:
Ownership / delivery / custody:
PEP, sanctions, adverse-media and geography results:
Innocent explanations considered:
Unresolved issues:
Control or escalation:
Decision owner:

Source basis#

• FATF Recommendations and risk-based guidance for the real-estate sector and relevant DNFBPs.
• FATF materials on money laundering and terrorist-financing risks in the art and antiquities market.
• Applicable property, dealer, customs, cultural-property and sanctions rules in the relevant jurisdiction.

Environmental Crime Typologies

Environmental crime can generate significant illicit proceeds and can overlap with corruption, organised crime, trade fraud, tax crime and cross-border smuggling. This page provides defensive AML typology context only.

1. Scope #

FATF materials discuss laundering linked to environmental crimes such as illegal logging, illegal land clearance, illegal mining and waste trafficking. Wildlife trafficking is also a related environmental-crime area.

2. AML relevance #

Environmental crime matters for AML because proceeds may enter the financial system through trade, commodities, logistics, cash-intensive businesses, shell companies, corrupt licensing and false documentation.

3. Risk signals #

4. Evidence sources #

• trade documents;
• permits and licences;
• corporate registry records;
• adverse media;
• sanctions/debarment checks;
• environmental regulator or enforcement records where available;
• FATF typology materials.

5. Source basis #

• SRC-FATF-012: FATF Money Laundering from Environmental Crime.
• SRC-FATF-001: FATF Recommendations and RBA.
• SRC-FATF-006: FATF/Egmont TBML indicators.

6. Related TCAML Framework #

Operation workflows: TBML review, counterparty screening, EDD, adverse media review.

Source workflows: typology mapping, goods-route review, document inconsistency check.

Evidence outputs: environmental-crime typology note, trade evidence index, escalation rationale.

Human Trafficking and Migrant Smuggling Typologies

Human trafficking and migrant smuggling are serious predicate-crime areas for AML/CFT. This page provides defensive typology context and source mapping only.

1. Scope #

FATF materials cover financial flows from human trafficking, including sexual exploitation, forced labour and organ trafficking indicators. FATF also covers ML/TF risks linked to migrant smuggling.

2. AML relevance #

Financial indicators may appear through account behaviour, payments, business fronts, transport or travel-related activity, recruitment patterns, cash activity and repeated transfers. Interpretation requires care because vulnerable people and legitimate migration activity must not be unfairly treated as suspicious.

3. Defensive risk signals #

4. Evidence cautions #

Do not assume guilt from nationality, migration status, poverty, occupation or travel corridor alone. Use source-linked facts, combined indicators and reviewer judgement.

5. Source basis #

• SRC-FATF-013: FATF/APG Financial Flows from Human Trafficking.
• SRC-FATF-014: FATF migrant smuggling ML/TF risks.
• SRC-FATF-001: FATF Recommendations and RBA.

6. Related TCAML Framework #

Operation workflows: alert triage, adverse media review, EDD, MLRO escalation.

Source workflows: typology mapping, evidence chronology, source-quality classification.

Evidence outputs: typology context note, evidence index, reviewer escalation note.

AML Process Atlas

A process-first map connecting AML purpose, triggers, evidence, decisions and accountable review.

The AML Process Atlas is the operational spine of this encyclopedia. It shows how individual topics connect into end-to-end AML/KYC/KYB work rather than remaining isolated definitions.

Universal process pattern#

Every AML process should be capable of being described through the same control sequence:

Purpose → Trigger → Inputs → Checks → Sources → Evidence → Decision
→ Escalation → Output → Owner → QA → Audit trail → Jurisdiction overlay

End-to-end customer lifecycle#

Relationship proposal
→ customer / entity classification
→ identity and legal-existence verification
→ ownership and control analysis
→ purpose and expected activity
→ sanctions / PEP / adverse-media screening
→ customer risk assessment
→ CDD or EDD route
→ approval or escalation
→ ongoing monitoring
→ event-driven or periodic review
→ restriction, remediation or exit
→ record retention and audit trail

Core process families#

Source-to-process discipline#

A source should never appear in a workflow merely because it is well known. The process must record:

1. why the source is relevant to the specific check;
2. whether it is primary, secondary, industry-practice, aggregator or investigative material;
3. the source date and access date;
4. what the source proves and what it does not prove;
5. whether the material requires corroboration;
6. how the finding affects the next action or decision gate.

See the AML Source Library & Register for the linked source inventory and page-level usage map.

Evidence and decision gates#

No process should move from a weak signal directly to a final conclusion. A controlled sequence separates:

signal → review item → evidence → discrepancy analysis
→ risk interpretation → reviewer decision → escalation where required

The case file should distinguish facts, customer statements, source findings, analyst inference, unresolved questions and final reviewer decisions.

Role ownership#

Jurisdiction overlays#

The universal process remains stable, while jurisdiction overlays add the local layer:

• obliged-entity scope;
• customer and beneficial-owner thresholds;
• reporting authority and filing channel;
• reporting and retention time limits;
• domestic sanctions programmes;
• senior approval requirements;
• data-protection and information-sharing restrictions;
• local supervisory expectations.

Published overlays: European Union, United States, United Kingdom.

Source basis#

• SRC-FATF-001: global AML/CFT/CPF control architecture.
• SRC-WOLF-003: proportionate, prioritised and effective risk-based programme design.
• SRC-BASEL-001: bank-level ML/TF governance and risk management.
• SRC-EGMONT-001: FIU role in receipt, analysis and dissemination of financial intelligence.
• SRC-WOLF-008: auditing for effectiveness.

Operational boundary#

The atlas does not make customer decisions, determine suspicion, provide filing instructions or replace accountable review. It defines the structure through which those decisions should become evidence-based, traceable and reviewable.

Workflows

Purpose#

Workflows convert AML knowledge into repeatable agent actions. Each workflow must end with a specific Tom Custos output.

Tom Custos workflow taxonomy#

Tom Custos separates the work the agent performs from the sources it uses.

Operation workflow = what Tom does for the compliance team.
Source workflow    = where Tom checks while performing that operation.

This distinction prevents two common mistakes:

• treating Tom Custos as a bundled AML database subscription;
• mixing source names with the actual AML operation the local node performs.

Related page: Operation & Source Workflow Logic

Website-aligned workflow groups#

Current Tom Custos hero positioning uses the following operational language:

• CDD / EDD workflows;
• KYB & UBO checks;
• audit-ready evidence;
• reports & MLRO escalation;
• local deployment.

Current source workflow groups are:

• Official sanctions databases;
• Commercial AML databases;
• PEP, media and public search;
• KYB, UBO and regulator registers;
• Domain, DNS and IP intelligence;
• Trade, export control;
• Blockchain intelligence.

Universal workflow pattern#

Input → operation workflow → source workflows → checks → evidence → classification → outputs → MLRO escalation

Customer onboarding workflow#

Trigger#

A new individual or legal entity is being onboarded.

Agent workflow#

1. Identify customer type: individual, legal person, trust/legal arrangement, financial institution, DNFBP, VASP, other.
2. Collect identification data.
3. Verify identity using reliable independent source documents, data or information.
4. Identify beneficial owner and control structure.
5. Understand purpose and intended nature of the relationship.
6. Screen customer, UBOs, controllers, authorised signatories and relevant connected parties.
7. Assess risk factors: customer, country, product/service, delivery channel, transaction pattern.
8. Decide CDD / SDD / EDD route.
9. Build evidence pack.
10. Escalate to MLRO if critical trigger exists.

Output#

• CDD summary.
• Risk factor table.
• Evidence pack.
• Missing information list.
• Escalation memo where required.

Counterparty screening workflow#

Trigger#

A client wants to deal with a supplier, buyer, intermediary, bank, exchange, payment processor or other counterparty.

Agent workflow#

1. Identify counterparty and geographic or operating context.
2. Collect corporate identifiers, website, registered address, directors, UBOs and related parties.
3. Screen names against sanctions, PEP and adverse media sources.
4. Check geographic and sector risk.
5. Check trade/product risk if goods or cross-border trade are involved.
6. Check ownership/control red flags.
7. Produce counterparty risk memo.

Output#

• Counterparty risk rating.
• Evidence pack.
• Deal blockers.
• Open questions.
• MLRO escalation if sanctions, serious adverse media or unexplained ownership red flags are present.

PEP review workflow#

1. Confirm whether the match is a possible, likely or true PEP match.
2. Identify PEP type: foreign, domestic, international organisation, family member or close associate.
3. Identify role, role context, dates and current status.
4. Assess relevance to customer/UBO/controller/signatory.
5. Request or review source of wealth and source of funds evidence where required.
6. Apply EDD and enhanced ongoing monitoring for high-risk relationship.
7. Obtain senior approval where required by implementation policies or policy.
8. Produce PEP memo.

Sanctions hit review workflow#

1. Freeze the workflow state: do not quietly approve or ignore a potential sanctions hit.
2. Classify match: false positive, possible match, likely match, true match.
3. Compare identifiers: full name, aliases, date of birth, nationality, address, registration number, passport/ID, corporate identifiers.
4. Check ownership/control links.
5. Check whether the list is the UN baseline, an internal policy list, or an adopter-specific list configured by the adopter.
6. Escalate likely/true matches to MLRO immediately.
7. Do not alert the customer where tipping-off or sanctions confidentiality risks exist.
8. Produce sanctions hit memo.

Adverse media review workflow#

1. Search exact names and transliterations.
2. Separate allegations, confirmed enforcement, litigation, sanctions, fraud, corruption, insolvency and reputational content.
3. Assess source quality and recency.
4. Identify whether the media relates to the customer, UBO, controller, director, associate or unrelated namesake.
5. Extract facts, not opinions.
6. Link media to risk factors.
7. Produce adverse media memo.

STR/SAR escalation workflow#

1. Identify facts giving rise to suspicion or reasonable grounds to suspect.
2. Separate unusual from suspicious.
3. Avoid further customer questioning if it risks tipping-off.
4. Preserve evidence and chronology.
5. Draft internal suspicion memo.
6. Escalate to MLRO.
7. MLRO decides whether to file STR/SAR with FIU or local reporting portal.

Periodic review workflow#

1. Confirm review cycle: low, medium, high or event-driven.
2. Refresh customer information and screening.
3. Compare expected activity against actual activity.
4. Re-check UBO/control structure.
5. Update geographic exposure, sector and sanctions exposure.
6. Re-rate risk.
7. Produce periodic review summary.

VASP / crypto review workflow#

1. Identify whether the party is a VASP or crypto-exposed customer.
2. Check licensing/registration status where required by adopter policy.
3. Identify wallet addresses, counterparties and flow type where available.
4. Assess blockchain exposure using approved tools where available.
5. Check Travel Rule context for transfers.
6. Escalate darknet, mixer, sanctioned address or high-risk exchange exposure.
7. Produce crypto AML memo.

Trade-based money laundering review workflow#

1. Identify parties, goods, geographies, trade route and payment route.
2. Check whether goods are dual-use, high-value, cash-like, sanctioned, restricted or inconsistent with the customer profile.
3. Compare invoice, contract, shipping and payment data.
4. Check unusual routing, pricing, volumes and intermediaries.
5. Check sanctions and PF indicators.
6. Produce TBML risk memo.

Digital Jurisdiction Exposure Review Workflow#

Purpose: identify public DNS and email infrastructure links that may create jurisdictional exposure indicators for KYB/EDD.

1. Identify the customer domain and relevant operational subdomains.
2. Review public A/AAAA, MX, TXT/SPF, DMARC, DKIM where available, NS, CNAME, SOA and PTR records.
3. Identify visible email, DNS, hosting, CDN, SaaS and relay providers.
4. Compare those references with the customer's declared geography and business model.
5. Mark mismatches as Digital Jurisdiction Exposure, not as automatic sanctions hits.
6. Add evidence to the case file and request clarification where appropriate.
7. Escalate only if combined with other AML/KYB risk factors.

Related article: Digital Jurisdiction Exposure

Practical operation workflow layer#

Tom Custos operation workflows should use a common evidence-first control layer.

The same review discipline applies to client onboarding, counterparty screening, supplier review, employee screening, periodic review and MLRO escalation support:

1. create the case context;
2. classify the subject;
3. list declared facts;
4. choose approved source workflows;
5. record each material source check;
6. capture evidence;
7. log discrepancies and missing information;
8. map risk triggers;
9. prepare a analyst-reviewable output;
10. preserve the audit trail.

The scope, source list and evidence handling must still change by workflow. Employee screening is narrower and privacy-sensitive. Periodic review focuses on change detection. EDD and MLRO support focus on unresolved risk and escalation evidence.

Related page: Operation Workflow Patterns

Operation Workflow Patterns

This page explains common AML/KYC/KYB operation workflow patterns and how they can connect to the open AML agent framework.

An operation workflow is a repeatable review pattern performed for a compliance team: client onboarding review, counterparty screening, supplier review, periodic review, EDD escalation or case-file preparation. The workflow should produce a review-ready case file, not only a narrative answer.

Operation workflow model#

request / trigger
→ case setup
→ subject classification
→ source plan
→ source checks
→ evidence capture
→ discrepancy handling
→ risk trigger mapping
→ S010 gate confirmation
→ case folder
→ analyst review / escalation

Operation workflows covered#

The public framework can be applied to:

Source workflow routing#

Each operation chooses source categories according to the subject and risk context. Examples include:

• sanctions and targeted financial sanctions sources;
• PEP sources;
• adverse media sources;
• official company and beneficial ownership registers;
• commercial AML databases where the adopter has valid access;
• domain, website, wallet or transaction intelligence sources where relevant;
• internal documents, forms and prior case history.

The public framework describes source categories and evidence logic. It does not grant database access or credentials.

S010 control overlay#

S010 can be used as a shared control overlay when the operation requires verification, evidence control, discrepancy handling or review-ready output.

S010 does not replace the operation workflow. It governs it:

operation workflow = business task
S010 control       = evidence and stagegate discipline
runner             = deterministic execution path
analyst reviewer     = decision and accountable judgment

LLM-drafted workflow content#

A model can draft structured content for a workflow, but it must not control workflow progression. The LLM-to-S010 bridge should validate the draft and block control fields before the runner is used.

Allowed model-drafted content may include:

• declared data;
• source check summaries;
• evidence references;
• discrepancy notes;
• risk triggers;
• open questions;
• draft case summary.

Blocked model-drafted control fields include gate logs, auto-confirm plans and final decisions.

Review-ready output#

An operation workflow should be review-ready when another analyst can understand:

• what was checked;
• why those sources were used;
• what identifiers were used;
• what evidence supports each material fact;
• where uncertainty remains;
• what discrepancies exist;
• which risk triggers are active;
• whether the case should be escalated.

End-to-End AML Review Overview

This page describes an end-to-end AML/KYC review as a conceptual sequence. It is designed for AML analysts, compliance teams and local AML agents that need a review-ready structure without treating the page as a local legal manual.

1. Start the case #

Collect the basic case context:

• customer or counterparty name;
• individual / legal entity / legal arrangement / wallet / vessel / other;
• requested product, service, transaction or relationship;
• countries/geographies involved;
• expected volume, value, frequency and purpose;
• who requested the review;
• deadline and business context.

2. Identify the subject #

Individual#

Collect and verify:

• full legal name;
• date of birth;
• nationality or residence indicators where available;
• ID document or reliable identity evidence;
• address or contact information where required by policy;
• occupation, employer, business activity or source of income where relevant.

Legal entity#

Collect and verify:

• legal name;
• registration number;
• legal form;
• registered address;
• business activity;
• directors / managers / authorised signatories;
• ownership structure;
• beneficial owners;
• group structure where relevant.

3. Understand purpose and expected activity #

Ask:

• Why does the customer need this relationship or transaction?
• What is the expected activity?
• Does the activity fit the customer profile?
• Is there a clear economic or lawful purpose?
• Does the activity involve higher-risk sectors, countries, products or delivery channels?

4. Run core screening #

At minimum, screen:

• customer / counterparty;
• beneficial owners;
• directors / managers / signatories;
• known connected parties;
• payers and beneficiaries;
• vessels, wallets, banks or other relevant objects where applicable.

Screening categories:

• sanctions / TFS;
• PEP;
• adverse media;
• geographic exposure;
• sector or activity risk;
• ownership/control complexity.

5. Review results #

For each hit or red flag, classify:

No match → document why cleared.
Possible match → collect more identifiers and review.
True match → escalate immediately.
Risk indicator → consider EDD or monitoring.
Suspicion indicator → escalate to MLRO / compliance owner.

6. Assign initial risk #

Use risk factors:

• customer type;
• beneficial ownership transparency;
• geography;
• product/service;
• transaction pattern;
• delivery channel;
• PEP exposure;
• sanctions exposure;
• adverse media;
• source of funds / source of wealth;
• business activity and sector.

7. Decide CDD or EDD #

Apply standard CDD when the customer is understandable, risk is normal and no unresolved red flags exist.

Apply EDD when there is higher risk, such as:

• PEP exposure;
• high-risk geography;
• complex or opaque ownership;
• unusual transaction activity;
• adverse media;
• sanctions proximity;
• unexplained wealth or funds;
• high-risk sector;
• crypto/VASP exposure;
• trade-based money laundering indicators.

8. Collect additional evidence where needed #

EDD evidence may include:

• source of funds documents;
• source of wealth explanation and supporting evidence;
• ownership chart;
• corporate registry documents;
• transaction documents;
• invoices, contracts, shipment documents or proof of service;
• independent media or database evidence;
• blockchain tracing evidence for crypto cases;
• management approval record where required by policy.

9. Make a documented recommendation #

Recommendation options:

Proceed — no material unresolved risk.
Proceed with monitoring — risk exists but is understood and controlled.
Request more information — evidence is insufficient.
EDD required — higher-risk case needs deeper review.
Escalate to MLRO — suspicion, serious red flag or unresolved high-risk issue.
Reject / exit — risk is outside appetite or cannot be mitigated.

10. Build the evidence pack #

Evidence pack should contain:

• case summary;
• subject identifiers;
• documents reviewed;
• screening screenshots or logs;
• source links;
• red flags found;
• red flags cleared;
• risk rating rationale;
• decision matrix used;
• recommendation;
• escalation memo if applicable.

11. Final output format #

AML Review Result

Subject:
Purpose:
Risk rating:
Checks completed:
Key findings:
Red flags:
Cleared alerts:
Outstanding issues:
Evidence collected:
Decision:
Recommended next action:
Source basis:
Prepared by:
Date:

12. Golden rule #

The analyst does not need to prove crime. The analyst needs to identify whether the facts create risk, unresolved concern or suspicion requiring escalation under the AML process.

13. Optional KYB/EDD step: digital infrastructure exposure #

For corporate customers and counterparties with meaningful online presence, the analyst may add a Digital Jurisdiction Exposure check.

The check reviews public DNS and email infrastructure records to identify visible providers, email relays, DNS dependencies and jurisdictional references. The result should support the KYB/EDD narrative, not replace standard sanctions, PEP, UBO, adverse media or source-of-funds checks.

Related article: Digital Jurisdiction Exposure

14. Practical verification controls #

A complete AML review should not rely only on documents or declarations supplied by the subject. The analyst or agent should:

1. list declared facts in a declared-data inventory;

2. decide which facts require independent source verification;

3. record exact source checks and search inputs;

4. capture evidence during the review;

5. log mismatches and missing information separately;

6. map findings to risk factors and escalation triggers;

7. prepare a review-ready case file rather than an unsupported narrative.

Related page: Verification & Evidence Control Layer

Transaction Monitoring & Alert Triage

Transaction monitoring is the review of activity against a customer profile, rules, scenarios and risk indicators. Alert triage is the first disciplined review of whether an alert can be cleared, needs more information or should be escalated.

1. Alert does not mean suspicion #

An alert is a signal generated by a rule, model, list, scenario or manual observation. It is not automatically suspicious activity. The analyst must understand why the alert triggered and whether the activity is consistent with the customer profile and available evidence.

2. Basic triage flow #

Alert triggered
→ understand the rule or scenario
→ identify the customer and expected activity
→ review transaction context
→ compare with prior behaviour and risk profile
→ check supporting evidence
→ clear, request information or escalate

3. What the analyst should compare #

4. Common triage outcomes #

5. Strong vs weak closure rationale #

Weak closure:

No issue. Customer is known.

Stronger closure:

Alert triggered due to transaction size. Activity is consistent with the customer’s stated business model and historical monthly volume. Counterparty is an existing supplier; invoice and contract reviewed. No new sanctions, PEP or adverse media concerns identified. Alert cleared with evidence references.

6. When to escalate #

Escalation should be considered when:

• the activity has no clear economic or lawful purpose;
• customer explanation conflicts with documents or behaviour;
• sanctions, PEP or adverse media concerns remain unresolved;
• transaction routes, counterparties or goods create higher-risk exposure;
• the customer avoids information requests or provides inconsistent evidence;
• the alert forms part of a repeated pattern.

7. Suspicion Is a Reasoned Analytical Conclusion #

Suspicion is not a keyword match, a single red flag or an automatically generated alert. It is a reasoned analytical conclusion formed after comparing activity, customer profile, source evidence, explanations, unresolved discrepancies and applicable escalation rules.

Safe wording should separate:

A strong case note explains why an issue was cleared, why more information is needed or why it was escalated. It should not rely on vague wording such as “looks fine” or “customer is known”.

8. Source basis #

• FATF Recommendations for ongoing due diligence, STR/SAR and internal-control concepts.
• FFIEC BSA/AML Examination Manual for transaction monitoring and suspicious activity review concepts.
• FinCEN SAR Narrative Guidance for narrative quality and evidence-focused escalation writing.

Monitoring effectiveness and modernisation#

Wolfsberg's monitoring statements (SRC-WOLF-006 and SRC-WOLF-007) support a broader view of suspicious-activity monitoring that combines transactions, customer behaviour, attributes, typologies and feedback.

When rules or models change, the control file should document:

• intended risk coverage and expected outcomes;
• data and product scope;
• validation approach;
• precision, recall and quality considerations where applicable;
• explainability for investigators and reviewers;
• transition risks and governance approval;
• downstream impact on case investigation and SAR/STR quality.

Innovation does not remove the need for reviewable evidence and accountable escalation.

AML Review Examples

This page provides simplified examples of AML/KYC review reasoning. The examples are synthetic and illustrative. They are designed to show how facts, sources, evidence and escalation logic can fit together.

1. Individual onboarding with no obvious risk signal #

Facts: an individual applies for a standard account. Identity evidence is complete. Declared occupation and expected activity are ordinary for the product. No sanctions, PEP or adverse media concerns are identified.

Analyst reasoning: the case still needs documented identity, purpose and expected activity. “No hits” is not the whole review, but there is no unresolved signal requiring EDD in this simplified example.

Possible output: standard CDD completed, low or normal risk according to internal methodology, evidence saved, normal monitoring applied.

2. Small company KYB with transparent ownership #

Facts: a local company provides registry documents, director information and UBO details. Business activity is understandable. Ownership is direct and consistent with the registry.

Analyst reasoning: the analyst checks company existence, ownership/control, connected parties and screening results. The key question is whether the declared structure and business purpose are supported by independent evidence.

Possible output: KYB completed, UBO evidence recorded, risk rating supported by business activity, geography and screening results.

3. Possible sanctions false positive #

Facts: screening returns a name match, but date of birth, nationality and address do not match the listed person. The name is common.

Analyst reasoning: a name match alone is not enough. The analyst compares identifiers and records why the match is not the listed party. If identifiers are insufficient, the case should not be cleared too quickly.

Possible output: false positive cleared with identifier comparison, or more information requested if uncertainty remains.

4. PEP exposure with no criminal allegation #

Facts: a beneficial owner is identified as a PEP or close associate. No sanctions match or adverse media is identified.

Analyst reasoning: PEP status does not mean criminality. It means elevated corruption and influence risk requiring risk-sensitive review, senior approval or EDD where required by policy.

Possible output: PEP status recorded, EDD performed as required, source of wealth/source of funds considered, senior approval or escalation handled under policy.

5. Adverse media that needs context #

Facts: media articles mention a company in connection with a public investigation. The articles are credible but do not prove guilt. The customer provides an explanation and documents.

Analyst reasoning: adverse media is an input, not a final conclusion. The analyst assesses source credibility, dates, allegations, relevance to the customer and whether independent evidence resolves or strengthens concern.

Possible output: risk note, EDD, request for clarification, monitoring condition or escalation depending on the facts.

6. Complex ownership structure #

Facts: a company is owned through several legal entities in different jurisdictions. UBO information is incomplete.

Analyst reasoning: complexity is not automatically suspicious, but opacity matters. The analyst should identify ownership/control, missing documents, jurisdictional exposure and whether the structure has a clear business rationale.

Possible output: request ownership chart and supporting documents; pause decision or escalate if control cannot be understood.

7. Transaction monitoring alert #

Facts: a transaction-monitoring rule triggers because of higher-than-expected activity. The customer says the activity relates to a new contract.

Analyst reasoning: the analyst compares activity to expected profile, checks whether the new contract is plausible, reviews counterparties and geography, and records whether the explanation is supported.

Possible output: alert cleared with evidence, information requested, risk rating refreshed or escalation prepared if the explanation is weak.

8. Defensive Examples Boundary #

The examples on this page are deliberately synthetic and simplified. They are designed to teach review reasoning: facts, evidence, unresolved questions and escalation logic. They are not instructions for committing, hiding or testing financial crime behaviour.

Do not use these examples to infer operational misuse steps, evasion thresholds or product-specific bypass methods. A real case must follow local law, internal policy, source access, escalation rules and responsible reviewer judgment.

9. Source basis #

• FATF Recommendations for risk-based CDD, EDD, ongoing due diligence and internal controls.
• Wolfsberg Group resources for practitioner risk-based review framing.
• FinCEN SAR Narrative Guidance for clear evidence-based narrative discipline.

Rule-to-Action Map

This page translates source rules into practical AML agent actions. It is the bridge between regulatory-style standards and the actual checklist an analyst follows.

1. Risk-Based Approach #

Source basis: SRC-FATF-001 / Recommendation 1.

Plain-language rule: not every customer needs the same level of review. Higher risk means deeper checks; lower risk may allow simpler checks if no suspicion exists.

Agent action:

1. Identify risk factors.
2. Assign preliminary risk.
3. Decide SDD / CDD / EDD according to policy.
4. Document why the level of review is proportionate.

2. Customer Due Diligence #

Source basis: SRC-FATF-001 / Recommendation 10.

Plain-language rule: know who the customer is, who owns or controls them, why they need the relationship and whether their activity makes sense over time.

Agent action:

1. Identify the customer.
2. Verify identity using reliable information.
3. Identify beneficial owner or controlling person.
4. Understand purpose and intended nature.
5. Set ongoing monitoring expectations.
6. Stop or escalate if required information cannot be obtained.

3. Record Keeping #

Source basis: SRC-FATF-001 / Recommendation 11.

Plain-language rule: AML decisions must be reconstructable later.

Agent action:

1. Save identity evidence.
2. Save screening results.
3. Save case notes.
4. Save documents and source links.
5. Save rationale for risk rating and decision.

4. PEP Review #

Source basis: SRC-FATF-001 / Recommendation 12.

Plain-language rule: politically exposed persons can create higher corruption, bribery or abuse-of-office risk. The risk often extends to family members and close associates.

Agent action:

1. Screen the customer, UBOs and controllers for PEP exposure.
2. Classify the role, country/geography, date and closeness of exposure.
3. Request source of wealth and source of funds evidence where required.
4. Escalate high-risk PEP cases for senior/compliance approval.
5. Apply enhanced ongoing monitoring where needed.

5. Sanctions / Targeted Financial Sanctions #

Source basis: SRC-FATF-001 / Recommendations 6 and 7; SRC-UN-001.

Plain-language rule: listed persons and entities must not be provided with funds or economic resources where applicable. Possible matches must be reviewed carefully and true matches must be escalated immediately.

Agent action:

1. Screen all relevant parties and connected objects.
2. Compare identifiers: name, date of birth, address, nationality, registration number, ownership/control, aliases.
3. Clear false positives with evidence.
4. Escalate possible unresolved matches.
5. Escalate true matches immediately and follow the adopter configuration.

6. Higher-Risk Countries / Geographic Exposure #

Source basis: SRC-FATF-001 / Recommendation 19; SRC-FATF-002.

Plain-language rule: geography is a risk factor, not an automatic decision. Exposure to higher-risk jurisdictions may require EDD or additional controls.

Agent action:

1. Identify geographic connections: residence, incorporation, operations, counterparties, banks, shipment routes, wallets, IP or payment flow.
2. Check whether FATF or other configured sources flag the geography.
3. Decide whether EDD is required.
4. Document how the geographic risk affects the overall risk rating.

7. Suspicious Activity / STR-SAR Logic #

Source basis: SRC-FATF-001 / Recommendations 20 and 21; SRC-EGMONT-001.

Plain-language rule: when there is suspicion or reasonable grounds to suspect ML/TF, the case should be escalated to the proper reporting function. The customer must not be tipped off.

Agent action:

1. Identify suspicion indicators.
2. Avoid customer communication that could reveal suspicion.
3. Prepare internal escalation memo.
4. Send to MLRO/compliance owner.
5. Preserve evidence and confidentiality.

8. Internal Controls #

Source basis: SRC-FATF-001 / Recommendation 18; SRC-BASEL-001.

Plain-language rule: AML is not just individual checks. A firm needs policies, controls, training, compliance management and independent testing.

Agent action:

1. Follow approved procedures.
2. Record deviations and exceptions.
3. Use standard templates.
4. Escalate control gaps.
5. Support auditability through clean evidence packs.

9. Crypto / VASP AML #

Source basis: SRC-FATF-001 / Recommendation 15; SRC-FATF-003.

Plain-language rule: virtual asset activity can carry ML/TF/PF risk and requires risk assessment, screening, wallet/entity review and transaction context.

Agent action:

1. Identify wallet, VASP, blockchain and transaction context.
2. Screen parties and wallet exposure where tools are available.
3. Look for mixers, darknet, scams, ransomware, sanctioned exposure or high-risk services.
4. Assess source and destination of funds.
5. Escalate unresolved or serious exposure.

10. Trade-Based Money Laundering #

Source basis: SRC-FATF-006.

Plain-language rule: trade can be abused to move value using false pricing, fake documents, unusual routing or mismatched goods and payments.

Agent action:

1. Review buyer, seller, goods, route, value and documents.
2. Look for invoice mismatch, over/under pricing, unusual shipping route, vague goods, dual-use goods or inconsistent counterparties.
3. Request supporting documents.
4. Escalate suspicious or unexplained trade patterns.

11. Tom Custos practical control: Digital Jurisdiction Exposure #

Boundary: this is not a separate FATF-mandated check. It is a practical control that helps analysts document digital infrastructure inconsistencies under a broader risk-based approach.

Case File & Evidence Lifecycle

The case file is the durable output of an AML/KYC/KYB operation. It should allow a reviewer to reconstruct what was checked, what evidence was collected, what remained uncertain and why the case was routed for review or escalation.

Lifecycle overview#

intake
→ declared-data inventory
→ source plan
→ source checks
→ evidence capture
→ discrepancy register
→ risk trigger summary
→ review reports
→ gate event log
→ handover note

Local runner case folder#

A local S010 runner can produce a folder structure such as:

00_case_metadata/
01_declared_data/
02_verification_plan/
03_source_checks/
04_evidence/
05_discrepancies_and_risk/
06_reports/
07_audit_trail/
08_handover/

This folder structure is a neutral example. A real implementation can map it into an internal case management system, document repository or evidence vault.

Evidence capture principles#

Evidence should be captured when a material source check is performed, not after the summary is written.

Each evidence item should include:

• evidence reference;
• source name or category;
• date and time captured;
• query or identifier used;
• file path, URL or internal reference;
• capture method;
• confidence or quality label;
• limitation note.

Source check records#

A source check record should explain:

• what source was checked;
• why the source was relevant;
• what exact query or identifier was used;
• what result status was observed;
• which evidence item supports the result;
• what limitation affects interpretation;
• what next action is required.

Discrepancies#

A discrepancy is not automatically a risk conclusion. It is a fact conflict or uncertainty that must be classified and handled.

Examples:

• declared name differs from registry name;
• address differs across sources;
• ownership percentages do not reconcile;
• source unavailable or not checked;
• possible sanctions / PEP / adverse-media match requires manual review;
• website or domain exposure conflicts with declared business activity.

Reports#

A review-ready case file may include:

• operation review summary;
• stagegate status;
• gate event log;
• source checks report;
• evidence index;
• discrepancy register;
• risk trigger summary;
• handover note.

Reports should support review. They should not create a final approval or rejection unless that decision is made by an authorized analyst reviewer outside the agent-generated output.

Retention and audit#

Retention periods, evidence vault rules, access controls and domestic recordkeeping obligations are implementation-specific. The public framework defines the structure and discipline; each adopter defines its own retention and legal requirements.

Value Trail vs Money Trail#

AML review should not focus only on visible bank payments. A money trail follows funds through accounts and payment rails. A value trail follows how economic value moves, changes form or becomes legitimised through goods, services, assets, invoices, ownership structures, wallets, loans or professional intermediaries.

This matters because some cases are not explained by a payment alone. The reviewer may need to understand:

• what value moved;
• who owned or controlled it;
• what document claims to explain it;
• whether the commercial story is plausible;
• whether goods, services, invoices, assets and payments align;
• whether the value trail creates unresolved risk even when the payment trail looks ordinary.

Asset tracing and recovery handoff#

Where a case may support freezing, confiscation or asset recovery, preserve an additional handoff layer:

• asset identifiers and ownership/control links;
• chronology of transfers and changes in title;
• source provenance and access dates;
• jurisdiction and custodian information;
• legal restrictions on disclosure or preservation;
• unresolved gaps requiring FIU, legal or law-enforcement action.

SRC-UNODC-UNCAC-AR-001 and SRC-STAR-ASSET-001 provide the institutional asset-recovery context. They do not authorise the analyst to freeze, seize or disclose assets without the applicable legal process.

Discrepancy, Risk & Escalation Controls

This page explains how discrepancies, risk triggers and escalation controls should be handled in an AML agent workflow.

An agent should not collapse every mismatch into a risk conclusion. A mismatch should first be documented, classified and linked to evidence. Only then should the case be mapped to risk triggers and escalation logic.

Discrepancy handling sequence#

identify mismatch
→ record source and evidence
→ classify discrepancy type
→ assess materiality
→ request clarification or additional source checks
→ map to risk trigger if relevant
→ route for analyst review when required

Discrepancy types#

Common discrepancy categories include:

Risk trigger mapping#

A risk trigger is a rule or pattern that requires attention. It may come from internal policy, source findings, red flags, regulatory expectations or reviewer judgment.

Examples:

• possible sanctions or targeted financial sanctions match;
• PEP or close associate exposure;
• adverse media suggesting financial crime risk;
• unexplained complex ownership;
• high-risk jurisdiction exposure;
• nominee or opaque control pattern;
• mismatch between declared and observed activity;
• source unavailable for a material verification step.

Escalation override#

A controlled framework should prevent a case from being released as routine when active escalation conditions are present.

If escalation is required, the workflow should route to the responsible reviewer, MLRO or compliance team instead of producing a routine release.

LLM safety boundary#

An LLM-generated draft must not treat active risk triggers as resolved unless a analyst reviewer has done so outside the agent. The model may describe the trigger, cite evidence and propose open questions, but it must not approve, reject or suppress escalation.

Hard stop conditions for LLM-generated content include attempts to:

• set a final approval or rejection decision;
• inject gate status;
• create gate event logs;
• provide auto-confirm instructions;
• bypass escalation routing.

Handover output#

An escalation handover should include:

• case identifier;
• subject and connected parties;
• summary of issue;
• relevant source checks;
• evidence references;
• discrepancy register;
• active risk triggers;
• unresolved questions;
• recommended analyst review path.

The handover prepares the reviewer. It does not replace the reviewer.

Decision Matrices

Purpose#

Decision matrices give Tom Custos consistent decision support. They do not replace MLRO or legal decisions.

Master escalation matrix#

CDD route matrix#

Screening result matrix#

Residual risk matrix#

Confidence matrix#

Digital Jurisdiction Exposure decision matrix#

Evidence Pack Templates

Purpose#

Evidence packs make AML decisions auditable. Every pack should allow a reviewer to reconstruct what was checked, when, using which sources and why the decision was made.

Universal evidence index#

# Evidence Index

Case ID: [ID]
Customer/counterparty: [name]
Prepared by: Tom Custos / [analyst]
Date/time: [timestamp]
Policy overlay context: [context]

## Documents
1. [document name] — [source] — [date received] — [relevance]

## Screening
1. Sanctions — [source/list] — [date/time] — [result]
2. PEP — [source] — [date/time] — [result]
3. Adverse media — [queries] — [date/time] — [result]

## Registry/public sources
1. [source] — [URL] — [retrieval date] — [finding]

## Analyst notes
1. [note] — [rationale]

## Decision log
1. [date/time] — [decision-maker] — [decision] — [rationale]

CDD evidence pack#

Required sections:

• Customer identity.
• Customer verification.
• Person acting on behalf of customer.
• Beneficial ownership/control.
• Purpose and expected activity.
• Screening results.
• Risk rating.
• Missing information.
• Decision recommendation.

EDD evidence pack#

Required sections:

• EDD trigger.
• Enhanced information requested.
• Source of funds evidence.
• Source of wealth evidence.
• Adverse media review.
• PEP review where relevant.
• Sanctions ownership/control review where relevant.
• Senior approval record where required.
• Residual risk rating.

Sanctions evidence pack#

Required sections:

• Screening source/list.
• Matched entry.
• Identifiers compared.
• Ownership/control analysis.
• Activity/transaction context.
• Match classification.
• Escalation record.
• Freeze/no-dealing decision log where applicable.
• Tipping-off controls.

PEP evidence pack#

Required sections:

• PEP source.
• Role and operating context.
• Current/former status.
• Relationship to customer.
• Source of wealth/source of funds evidence.
• Adverse media results.
• Senior approval record.
• Monitoring plan.

STR/SAR support pack#

Required sections:

• Suspicion trigger.
• Timeline.
• Customer profile.
• Transaction profile.
• Red flags.
• Customer explanations already received.
• Tipping-off risk.
• Evidence index.
• MLRO decision log.

Tom Custos file naming convention#

[YYYY-MM-DD]_[case-id]_[customer-name]_[module]_[version].md

Examples:

2026-06-27_TC-0001_ACME-LTD_CDD_v1.md
2026-06-27_TC-0001_ACME-LTD_SANCTIONS-HIT_v1.md

Digital Jurisdiction Exposure evidence section#

## Digital Jurisdiction Exposure Evidence

Domain reviewed: [domain]
Date/time of review: [timestamp]
Records reviewed: [A/AAAA/MX/TXT/SPF/DMARC/DKIM/NS/CNAME/SOA/PTR]
Visible providers/domains: [list]
Jurisdictional references: [list]
Declared customer geography: [list]
Mismatch identified: [yes/no]
Analyst conclusion: [neutral/supporting-risk/higher-risk/combined-risk]
Recommended action: [record/request clarification/include in EDD/senior review/MLRO]
Evidence files: [screenshots/raw output]

Practical case file artifacts#

A practical Tom Custos operation should produce or update these artifacts:

Related pages:

• Case File & Evidence Lifecycle
• Discrepancy, Risk & Escalation Controls

MLRO Review & Escalation Overview

Purpose#

The MLRO review and escalation overview explains how Tom Custos can prepare decision-quality escalation materials. The MLRO or authorised reviewer remains accountable where implementation policies require it.

MLRO escalation triggers#

Tom Custos should escalate to MLRO when any of the following appear:

• Likely or true sanctions match.
• Possible ownership/control by a sanctioned person or entity.
• Suspicion or reasonable grounds to suspect ML/TF/PF.
• PEP with serious unexplained source of wealth/source of funds risk.
• Serious adverse media tied to fraud, corruption, organised crime, sanctions evasion, TF or PF.
• Customer refuses to provide material CDD/EDD information.
• Activity inconsistent with profile and cannot be plausibly explained.
• High-risk country exposure combined with opaque ownership or unusual transaction pattern.
• Potential tipping-off risk.

MLRO escalation memo structure#

# MLRO Escalation Memo

## 1. Case summary
Customer / counterparty / transaction / relationship.

## 2. Trigger
What triggered escalation.

## 3. Facts established
Only evidence-backed facts.

## 4. Open questions
Material gaps and unresolved inconsistencies.

## 5. Source basis
Source IDs and implementation policies or policy references.

## 6. Risk factors
Customer, country, product, delivery channel, transaction, sanctions, PEP, adverse media.

## 7. Evidence index
Documents, screenshots, search results, registry extracts, screening outputs.

## 8. Agent assessment
Preliminary risk view, not final legal conclusion.

## 9. Recommended MLRO options
- Request information.
- Continue with EDD and senior approval.
- Reject onboarding / exit relationship.
- Freeze/no-dealing escalation under sanctions process.
- File STR/SAR or equivalent report.
- No report, record rationale.

## 10. Tipping-off controls
What the front office/customer-facing team must not disclose.

MLRO decision log#

Every MLRO decision should preserve:

• Date and time.
• Decision-maker.
• Facts considered.
• Sources consulted.
• Decision.
• Rationale.
• Follow-up actions.
• Review date.

STR/SAR support note#

Tom Custos may draft internal suspicion narratives. It should not submit external reports unless explicitly integrated with the regulated firm’s approved reporting workflow.

FIU and asset-recovery escalation context#

Egmont materials distinguish the FIU's receipt, analysis and dissemination role from the institution's internal review. SRC-EGMONT-ASSET-001 adds context where financial intelligence may support asset tracing or securing.

The MLRO escalation pack should clearly separate:

• internal suspicion and evidence;
• proposed reporting action;
• assets or transactions requiring preservation attention;
• legal or sanctions questions;
• actions that only an FIU, court, regulator or law-enforcement authority can take.

Sector Risk Lens for AML/KYC/KYB

A sector risk lens helps analysts ask better questions about how a customer, counterparty, product or transaction can be exposed to ML/TF/PF and broader financial-crime risk. The same customer profile can carry different risk depending on the sector, product, delivery channel, geography and evidence available.

1. Why sector risk matters #

AML/KYC/KYB review is not only about who the customer is. It also depends on where value can enter, move, change form or exit. Sector context changes:

• which documents are meaningful;
• which counterparties matter;
• what normal activity looks like;
• which sources are relevant;
• which red flags need senior review;
• which controls are proportionate.

2. Sector risk map #

3. Detailed sector profiles#

3. Banking and payments profile#

Business model and typical flows#

Banks, payment institutions, e-money firms and similar providers may hold accounts, execute transfers, issue payment instruments or connect customers to wider financial networks.

Primary vulnerabilities#

• high transaction volume can hide unusual activity;
• nested, correspondent or intermediary relationships reduce visibility;
• rapid movement can separate value from its source;
• third-party and merchant flows may not match the stated customer;
• digital onboarding can introduce identity and device uncertainty.

Evidence and monitoring#

Review expected account use, counterparties, countries, payment types, source of funds, merchant or business model, linked accounts, device/IP context where lawful, and changes from expected activity.

Escalation questions#

• Is the customer acting for another person?
• Does the payment route have a credible purpose?
• Are intermediary institutions and beneficiaries understood?
• Is unusual activity a one-off event or a repeated network?
• Do monitoring and CDD tell a consistent story?

4. Crypto and VASP profile#

Business model and typical flows#

VASPs may provide exchange, transfer, custody or other services involving virtual assets. Customers may interact with hosted and unhosted wallets, other VASPs, protocols and fiat payment channels.

Primary vulnerabilities#

• identity and wallet ownership may be uncertain;
• cross-border service location and regulatory status may be unclear;
• value can move rapidly between assets and services;
• high-risk services, obfuscation and sanctions exposure may reduce traceability;
• Travel Rule data can be incomplete or inconsistent.

Evidence and monitoring#

Review VASP status, customer and wallet relationship, transaction references, fiat funding/withdrawals, counterparty information, attribution confidence, transaction purpose, sanctions results and geographic/service exposure.

Escalation questions#

• What does the blockchain record show and what does it not prove?
• Who controls the wallet?
• Is the counterparty a regulated or higher-risk service?
• Can SoF be followed across fiat and virtual-asset legs?
• Which gaps require specialist blockchain, sanctions or MLRO review?

See Crypto / VASP AML.

5. Real estate and property intermediaries profile#

Business model and typical flows#

Property transactions may involve buyers, sellers, developers, lenders, brokers, lawyers, agents, special-purpose companies and trusts.

Primary vulnerabilities#

• opaque beneficial ownership;
• high-value transactions and subjective valuation;
• unrelated third-party funding;
• rapid resale or unexplained ownership transfer;
• multiple intermediaries and cross-border funds.

Evidence and monitoring#

Review title, buyer/seller/UBO, purchase agreement, valuation, mortgage, completion, payment records, SoW/SoF and intermediary authority.

Escalation questions#

• Who ultimately owns and benefits from the property?
• Does the customer have the wealth and specific funds to transact?
• Why is the price or structure unusual?
• Are payer, buyer, owner and occupant consistent?
• Does a professional intermediary clarify or obscure the relationship?

See Real Estate, Luxury Assets & Art Risk.

6. Legal, accounting and TCSP profile#

Business model and typical flows#

Professionals may form and administer entities, provide legal or tax advice, maintain records, act as trustee/director, manage client accounts or support transactions.

Primary vulnerabilities#

• the real client or beneficiary may be obscured;
• legal privilege or confidentiality may be misunderstood;
• nominees and layered entities may reduce transparency;
• client accounts or invoices may create an appearance of legitimacy;
• third-party reliance can weaken direct understanding.

Evidence and monitoring#

Review engagement and authority, underlying client, beneficial owner, service purpose, structure rationale, payment role, regulatory status, SoW/SoF and recurring networks.

Escalation questions#

• Who instructs and who benefits?
• Why is the structure or professional account needed?
• Is the adviser independent, regulated and acting within the stated role?
• Are documents supported by the underlying facts?
• Does the intermediary facilitate transparency or prevent it?

See Professional Enablers.

7. Trade, logistics and import/export profile#

Business model and typical flows#

Trade connects buyers, sellers, manufacturers, brokers, freight forwarders, carriers, insurers, banks, customs and end users. Payments and goods may follow different routes.

Primary vulnerabilities#

• documents can be inconsistent or incomplete;
• price, quantity or quality can be difficult to assess;
• intermediaries and transshipment reduce visibility;
• goods may have sanctions, export-control or dual-use relevance;
• payment may come from or go to unrelated parties.

Evidence and monitoring#

Review contract, invoice, purchase order, goods description, quantity, price, shipping, customs, origin/destination, end user, insurance, payment route and counterparties.

Escalation questions#

• Do goods, documents and payments describe one transaction?
• Is the route commercially reasonable?
• Are all intermediaries necessary and understood?
• Does the end user and use make sense?
• Are TBML, sanctions or PF specialist checks required?

See TBML and Sanctions Evasion Typologies.

4. Defensive typology questions#

A safe typology lens asks review questions rather than teaching misuse mechanics:

• What value is moving?
• Who controls it?
• What source explains it?
• What documents support it?
• Does the commercial story make sense?
• Which facts are verified, unsupported or inconsistent?
• Which risk indicators remain unresolved?
• Which reviewer should decide next?

5. What not to do#

This wiki should not convert sector typologies into operational misuse instructions. Avoid:

• step-by-step laundering sequences;
• threshold-avoidance guidance;
• instructions for bypassing screening, monitoring or verification;
• procedural recipes for hiding ownership, source of funds or transaction purpose;
• tactical guidance on exploiting a specific product, bank, VASP or jurisdiction.

6. Analyst output#

A sector-risk note should be short and evidence-linked:

Sector / activity:
Relevant product or service:
Normal activity expected:
Observed activity:
Key sector risk indicators:
Evidence reviewed:
Unresolved questions:
Control or escalation recommendation:

7. Source basis#

• FATF Recommendations for risk-based approach, CDD, ongoing due diligence, record-keeping and internal controls.
• FATF typology and methods reports for safe red-flag and risk-indicator framing.
• AUSTRAC and FinCEN public typology/advisory materials for defensive indicators and monitoring context.
• Practitioner and academic references in the Source Register for professional framing and historical perspective.

Crypto / VASP AML

1. Definition #

Crypto AML is the process of assessing ML/TF/PF risk from virtual assets, wallet flows, exchanges, VASPs, token transfers, on-chain exposure and fiat on/off ramps.

2. Why It Matters #

Virtual assets can move quickly across geographies and may involve pseudonymous wallets, unregulated VASPs, high-risk services or sanctioned addresses.

3. Common Triggers and Use Context #

• Customer is a VASP or crypto business.
• Customer source of funds includes crypto.
• Transaction involves wallet address, exchange, broker or OTC desk.
• Customer receives/sends virtual assets.
• Blockchain tool identifies high-risk exposure.
• Transfer requires Travel Rule analysis under implementation policy.

4. Source Basis #

• SRC-FATF-001: Recommendation 15 and related preventive measures.
• SRC-FATF-003: FATF virtual assets/VASP guidance.
• Adopter configuration layer: VASP licensing, Travel Rule scope and transaction thresholds are configured outside the open knowledge base.

5. Agent workflow: VASP customer #

1. Identify VASP activity type: exchange, transfer, custody, brokerage, issuance, payment, other.
2. Verify licensing/registration status where required by the adopter policy overlay.
3. Identify ownership, management and controllers.
4. Review AML/CFT policy, sanctions controls and Travel Rule controls if available.
5. Screen VASP, UBOs, directors and key wallets if available.
6. Check adverse media, enforcement and regulatory warnings.
7. Assess geography, customer base and product risk.
8. Produce VASP due diligence memo.

6. Agent workflow: crypto source of funds #

1. Identify wallet addresses and transaction hashes where available.
2. Identify asset, network and transfer path.
3. Check exposure using approved blockchain analytics tool if available.
4. Identify exchange/on-ramp/off-ramp.
5. Ask for evidence of acquisition where appropriate.
6. Assess whether crypto source is consistent with customer profile.
7. Escalate high-risk exposure.

7. High-risk crypto exposure examples #

• Sanctioned address or sanctioned exchange exposure.
• Mixer/tumbler exposure.
• Darknet market exposure.
• Ransomware, scam, fraud or stolen funds cluster exposure.
• Unlicensed exchange used as main source of funds.
• Wallet layering with no economic rationale.
• Rapid movement through multiple wallets before conversion to fiat.

8. Evidence to collect #

• Wallet addresses.
• Transaction hashes.
• Network/chain name.
• Exchange/VASP account statements if available.
• Blockchain analytics report or screenshot.
• Source of crypto acquisition evidence.
• VASP licensing evidence.
• Travel Rule data where applicable.

9. Decision matrix #

10. Output Pattern #

# Crypto AML Memo

Subject: [customer/VASP/wallet/transaction]
Activity type: [VASP/customer SOF/transfer]
Licensing status: [verified/unverified/not applicable]
Wallets/transactions reviewed: [list]
Blockchain exposure: [summary]
Sanctions exposure: [summary]
Travel Rule context: [if applicable]
Source of funds: [assessment]
Risk rating: [low/medium/high/critical]
Recommendation: [proceed/EDD/escalate/decline]
Source basis: SRC-FATF-001; SRC-FATF-003

11. Obfuscation, higher-risk services and attribution limits#

A crypto review should distinguish what the evidence shows from what it only suggests.

Relevant review dimensions include:

• whether the customer controls the wallet;
• whether counterparties are hosted, unhosted, regulated, offshore or otherwise higher risk;
• rapid movement across assets, chains or services;
• use of services designed or commonly used to reduce traceability;
• sanctions, fraud, theft or other adverse exposure;
• gaps between blockchain activity, exchange records and the claimed SoF;
• reliability and date of any wallet-attribution data.

Do not treat analytics labels as verified identity. Record attribution confidence, source limitations and the point at which specialist or MLRO review is required. Use Source of Wealth and Source of Funds for the canonical plausibility method.

Trade-Based Money Laundering / TBML

1. Definition #

TBML is the misuse of trade transactions, goods, invoices, shipping routes, prices or documentation to move, disguise or legitimise value.

2. Why It Matters #

Trade can hide value transfer behind apparently commercial documents. Goods, payments and documents may each tell a different story.

3. Common Triggers and Use Context #

• Cross-border trade transaction.
• Goods involve high-risk geographies, sectors or routes.
• Trade documents inconsistent with each other.
• Pricing appears unusual.
• Payment route differs from goods route.
• Intermediaries inserted without commercial purpose.
• Dual-use, restricted, high-value or easily misdescribed goods.
• Counterparty lacks experience in goods traded.

4. Value Trail vs Money Trail #

AML review should not focus only on visible bank payments. A money trail follows funds through accounts and payment rails. A value trail follows how economic value moves, changes form or becomes legitimised through goods, services, assets, invoices, ownership structures, wallets, loans or professional intermediaries.

This matters because some cases are not explained by a payment alone. The reviewer may need to understand:

• what value moved;
• who owned or controlled it;
• what document claims to explain it;
• whether the commercial story is plausible;
• whether goods, services, invoices, assets and payments align;
• whether the value trail creates unresolved risk even when the payment trail looks ordinary.

5. Source Basis #

• SRC-FATF-006: TBML risk indicators.
• SRC-FATF-001: CDD, RBA, record keeping and STR/SAR.
• SRC-FATF-007: PF/TFS evasion risk where goods/end-user are sensitive.

6. Agent workflow #

1. Identify buyer, seller, intermediary, shipper, consignee, bank and end user.
2. Identify goods, HS code/description where available, quantity, price and route.
3. Compare contract, invoice, packing list, bill of lading/air waybill and payment documents.
4. Check geographic exposure risk and sanctions/PF exposure.
5. Compare price and quantity to plausible market range where data is available.
6. Assess whether customer has legitimate business capability for the goods.
7. Identify red flags and unresolved inconsistencies.
8. Produce TBML memo.
9. Escalate suspicious or PF/sanctions-sensitive cases to MLRO.

7. Evidence to collect #

• Contract/purchase order.
• Commercial invoice.
• Packing list.
• Bill of lading/air waybill.
• Certificates of origin/quality where relevant.
• Payment instructions and SWIFT/payment data where available.
• Buyer/seller corporate profiles.
• End-user/end-use statement where relevant.
• Public price/commodity references where available.
• Sanctions and geographic exposure risk screening.

8. TBML red flags #

Documentation#

• Vague goods description.
• Invoice does not match shipping documents.
• Multiple invoices for same goods.
• Inconsistent weights, quantities or values.
• Missing end-user information for sensitive goods.

Transaction structure#

• Payment by unrelated third party.
• Payment to unrelated offshore account.
• Goods route and payment route do not align.
• Unusual advance payment or overpayment.
• Back-to-back trades with no value added.

Goods and route#

• Goods are dual-use, high-value, portable or easy to over/under value.
• Route includes unnecessary transshipment.
• Counterparty located in geography unrelated to goods flow.
• Customer has no track record in the traded commodity.

Behaviour#

• Customer resists providing trade documents.
• Customer insists on speed despite missing evidence.
• Customer changes counterparties or route after compliance questions.

9. Decision matrix #

10. Tom Custos output #

# TBML Risk Memo

Transaction: [summary]
Goods: [description/HS if known]
Parties: [buyer/seller/intermediaries/end user]
Countries/routes: [summary]
Payment route: [summary]
Document consistency: [assessment]
Price/quantity plausibility: [assessment]
Sanctions/PF exposure: [assessment]
Red flags: [list]
Risk rating: [low/medium/high/critical]
Recommendation: [proceed/request info/EDD/escalate]
Source basis: SRC-FATF-006; SRC-FATF-001; SRC-FATF-007

Corruption proceeds and asset-recovery context#

TBML reviews may intersect with corruption proceeds, nominee entities, hidden control and later asset tracing. In those cases:

• SRC-STAR-NOMINEES-001 supports review of nominee arrangements and control opacity;
• SRC-STAR-ASSET-001 supports the asset-tracing and recovery lifecycle;
• SRC-UNODC-UNCAC-AR-001 provides the UNCAC asset-recovery framework.

These sources do not create standalone TBML indicators. They support the wider analysis when trade structures appear connected to corruption proceeds, concealed ownership or recoverable assets.