Operation Workflow Patterns

Topic TypeOperations ReferencePrimary UseReview workflow design, triage, evidence lifecycle and escalationScopeJurisdiction-neutral public referenceLast Reviewed2026

This page explains common AML/KYC/KYB operation workflow patterns and how they can connect to the open AML agent framework.

An operation workflow is a repeatable review pattern performed for a compliance team: client onboarding review, counterparty screening, supplier review, periodic review, EDD escalation or case-file preparation. The workflow should produce a review-ready case file, not only a narrative answer.

Operation workflow model#

request / trigger
→ case setup
→ subject classification
→ source plan
→ source checks
→ evidence capture
→ discrepancy handling
→ risk trigger mapping
→ S010 gate confirmation
→ case folder
→ analyst review / escalation

Operation workflows covered#

The public framework can be applied to:

Workflow	Main purpose	Typical output
Client onboarding review	Understand and verify a new customer before onboarding.	CDD/KYC workpaper, evidence index, risk triggers and open questions.
Counterparty screening	Review a company, person or connected party before engagement.	Screening summary, source checks and discrepancy register.
Supplier review	Check vendor or supplier exposure.	KYB summary, sanctions/PEP/adverse-media references, risk notes.
Bank counterparty screening	Review financial-institution relationships.	FI due diligence checklist and escalation memo if needed.
Employee screening	Support controlled staff screening or rescreening workflows.	Screening record and manual review triggers.
Periodic review / rescreening	Refresh old CDD/KYC/KYB information.	Change log, refreshed source checks, updated risk factor mapping.
EDD / MLRO escalation support	Prepare complex or higher-risk cases for senior review.	Escalation pack, evidence summary and unresolved questions.

Source workflow routing#

Each operation chooses source categories according to the subject and risk context. Examples include:

sanctions and targeted financial sanctions sources;
PEP sources;
adverse media sources;
official company and beneficial ownership registers;
commercial AML databases where the adopter has valid access;
domain, website, wallet or transaction intelligence sources where relevant;
internal documents, forms and prior case history.

The public framework describes source categories and evidence logic. It does not grant database access or credentials.

S010 control overlay#

S010 can be used as a shared control overlay when the operation requires verification, evidence control, discrepancy handling or review-ready output.

S010 does not replace the operation workflow. It governs it:

operation workflow = business task
S010 control       = evidence and stagegate discipline
runner             = deterministic execution path
analyst reviewer     = decision and accountable judgment

LLM-drafted workflow content#

A model can draft structured content for a workflow, but it must not control workflow progression. The LLM-to-S010 bridge should validate the draft and block control fields before the runner is used.

Allowed model-drafted content may include:

declared data;
source check summaries;
evidence references;
discrepancy notes;
risk triggers;
open questions;
draft case summary.

Blocked model-drafted control fields include gate logs, auto-confirm plans and final decisions.

Review-ready output#

An operation workflow should be review-ready when another analyst can understand:

what was checked;
why those sources were used;
what identifiers were used;
what evidence supports each material fact;
where uncertainty remains;
what discrepancies exist;
which risk triggers are active;
whether the case should be escalated.

References#

Source Register and official guidance for CDD, EDD, monitoring, escalation and evidence concepts.
Practitioner & Academic References for professional framing and historical context.
Editorial & Source Policy for non-jurisdiction-specific boundaries.