Operational separation of competence, permitted actions, mandatory escalation, outputs and decision authority.
This page defines what each AML role is expected to understand, what work it may perform, what must be escalated and who remains accountable for the final decision. It is not a training syllabus, certification path or automated delegation of legal responsibility.
Authority rule: capability does not equal authority. An analyst or local AML agent may collect evidence, test consistency and draft a recommendation, but final acceptance, reporting, sanctions and exit decisions remain with the role authorised by law and internal governance.
AML/CFT/CPF vocabulary; CDD/KYC inputs; identity and verification basics; PEP, sanctions and adverse-media screening; red flags; evidence provenance.
May perform
Collect and organise data; run approved searches; capture dated evidence; identify missing information; prepare factual screening notes.
Must escalate
Potential sanctions match; PEP or close-associate indicator; material adverse media; inconsistent identity or ownership; unexplained activity; any suspicion indicator.
CDD, SDD and EDD; beneficial ownership and control; source of funds/wealth; geographic and sector risk; false-positive handling; case narrative and evidence weighting.
AML programme governance; risk appetite; customer acceptance; policies and controls; management information; training governance; audit and inspection readiness.
May perform
Interpret policy; oversee QA; approve delegated exceptions; manage remediation; coordinate audits; act for MLRO only within documented delegation.
Must escalate
Material control failure; systemic QA issue; regulatory breach; significant policy exception; board-level risk; matter outside delegated authority.
A local AML agent inherits the permissions of the user and workflow, not the apparent seniority of its output. It may prepare evidence, draft rationales and route cases, but it must not silently promote a recommendation into an approval.
Every action records the acting role and reviewer.
Decision gates are explicit and non-bypassable.
Jurisdiction overlays can narrow permissions.
Legal, sanctions and MLRO gates remain separate.
Reviewer override is recorded with rationale and timestamp.