Workflows

Purpose#

Workflows convert AML knowledge into repeatable agent actions. Each workflow must end with a specific Tom Custos output.

Tom Custos workflow taxonomy#

Tom Custos separates the work the agent performs from the sources it uses.

Operation workflow = what Tom does for the compliance team.
Source workflow    = where Tom checks while performing that operation.

This distinction prevents two common mistakes:

• treating Tom Custos as a bundled AML database subscription;
• mixing source names with the actual AML operation the local node performs.

Related page: Operation & Source Workflow Logic

Website-aligned workflow groups#

Current Tom Custos hero positioning uses the following operational language:

• CDD / EDD workflows;
• KYB & UBO checks;
• audit-ready evidence;
• reports & MLRO escalation;
• local deployment.

Current source workflow groups are:

• Official sanctions databases;
• Commercial AML databases;
• PEP, media and public search;
• KYB, UBO and regulator registers;
• Domain, DNS and IP intelligence;
• Trade, export control;
• Blockchain intelligence.

Universal workflow pattern#

Input → operation workflow → source workflows → checks → evidence → classification → outputs → MLRO escalation

Customer onboarding workflow#

Trigger#

A new individual or legal entity is being onboarded.

Agent workflow#

1. Identify customer type: individual, legal person, trust/legal arrangement, financial institution, DNFBP, VASP, other.
2. Collect identification data.
3. Verify identity using reliable independent source documents, data or information.
4. Identify beneficial owner and control structure.
5. Understand purpose and intended nature of the relationship.
6. Screen customer, UBOs, controllers, authorised signatories and relevant connected parties.
7. Assess risk factors: customer, country, product/service, delivery channel, transaction pattern.
8. Decide CDD / SDD / EDD route.
9. Build evidence pack.
10. Escalate to MLRO if critical trigger exists.

Output#

• CDD summary.
• Risk factor table.
• Evidence pack.
• Missing information list.
• Escalation memo where required.

Counterparty screening workflow#

Trigger#

A client wants to deal with a supplier, buyer, intermediary, bank, exchange, payment processor or other counterparty.

Agent workflow#

1. Identify counterparty and geographic or operating context.
2. Collect corporate identifiers, website, registered address, directors, UBOs and related parties.
3. Screen names against sanctions, PEP and adverse media sources.
4. Check geographic and sector risk.
5. Check trade/product risk if goods or cross-border trade are involved.
6. Check ownership/control red flags.
7. Produce counterparty risk memo.

Output#

• Counterparty risk rating.
• Evidence pack.
• Deal blockers.
• Open questions.
• MLRO escalation if sanctions, serious adverse media or unexplained ownership red flags are present.

PEP review workflow#

1. Confirm whether the match is a possible, likely or true PEP match.
2. Identify PEP type: foreign, domestic, international organisation, family member or close associate.
3. Identify role, role context, dates and current status.
4. Assess relevance to customer/UBO/controller/signatory.
5. Request or review source of wealth and source of funds evidence where required.
6. Apply EDD and enhanced ongoing monitoring for high-risk relationship.
7. Obtain senior approval where required by implementation policies or policy.
8. Produce PEP memo.

Sanctions hit review workflow#

1. Freeze the workflow state: do not quietly approve or ignore a potential sanctions hit.
2. Classify match: false positive, possible match, likely match, true match.
3. Compare identifiers: full name, aliases, date of birth, nationality, address, registration number, passport/ID, corporate identifiers.
4. Check ownership/control links.
5. Check whether the list is the UN baseline, an internal policy list, or an adopter-specific list configured by the adopter.
6. Escalate likely/true matches to MLRO immediately.
7. Do not alert the customer where tipping-off or sanctions confidentiality risks exist.
8. Produce sanctions hit memo.

Adverse media review workflow#

1. Search exact names and transliterations.
2. Separate allegations, confirmed enforcement, litigation, sanctions, fraud, corruption, insolvency and reputational content.
3. Assess source quality and recency.
4. Identify whether the media relates to the customer, UBO, controller, director, associate or unrelated namesake.
5. Extract facts, not opinions.
6. Link media to risk factors.
7. Produce adverse media memo.

STR/SAR escalation workflow#

1. Identify facts giving rise to suspicion or reasonable grounds to suspect.
2. Separate unusual from suspicious.
3. Avoid further customer questioning if it risks tipping-off.
4. Preserve evidence and chronology.
5. Draft internal suspicion memo.
6. Escalate to MLRO.
7. MLRO decides whether to file STR/SAR with FIU or local reporting portal.

Periodic review workflow#

1. Confirm review cycle: low, medium, high or event-driven.
2. Refresh customer information and screening.
3. Compare expected activity against actual activity.
4. Re-check UBO/control structure.
5. Update geographic exposure, sector and sanctions exposure.
6. Re-rate risk.
7. Produce periodic review summary.

VASP / crypto review workflow#

1. Identify whether the party is a VASP or crypto-exposed customer.
2. Check licensing/registration status where required by adopter policy.
3. Identify wallet addresses, counterparties and flow type where available.
4. Assess blockchain exposure using approved tools where available.
5. Check Travel Rule context for transfers.
6. Escalate darknet, mixer, sanctioned address or high-risk exchange exposure.
7. Produce crypto AML memo.

Trade-based money laundering review workflow#

1. Identify parties, goods, geographies, trade route and payment route.
2. Check whether goods are dual-use, high-value, cash-like, sanctioned, restricted or inconsistent with the customer profile.
3. Compare invoice, contract, shipping and payment data.
4. Check unusual routing, pricing, volumes and intermediaries.
5. Check sanctions and PF indicators.
6. Produce TBML risk memo.

Digital Jurisdiction Exposure Review Workflow#

Purpose: identify public DNS and email infrastructure links that may create jurisdictional exposure indicators for KYB/EDD.

1. Identify the customer domain and relevant operational subdomains.
2. Review public A/AAAA, MX, TXT/SPF, DMARC, DKIM where available, NS, CNAME, SOA and PTR records.
3. Identify visible email, DNS, hosting, CDN, SaaS and relay providers.
4. Compare those references with the customer's declared geography and business model.
5. Mark mismatches as Digital Jurisdiction Exposure, not as automatic sanctions hits.
6. Add evidence to the case file and request clarification where appropriate.
7. Escalate only if combined with other AML/KYB risk factors.

Related article: Digital Jurisdiction Exposure

Practical operation workflow layer#

Tom Custos operation workflows should use a common evidence-first control layer.

The same review discipline applies to client onboarding, counterparty screening, supplier review, employee screening, periodic review and MLRO escalation support:

1. create the case context;
2. classify the subject;
3. list declared facts;
4. choose approved source workflows;
5. record each material source check;
6. capture evidence;
7. log discrepancies and missing information;
8. map risk triggers;
9. prepare a analyst-reviewable output;
10. preserve the audit trail.

The scope, source list and evidence handling must still change by workflow. Employee screening is narrower and privacy-sensitive. Periodic review focuses on change detection. EDD and MLRO support focus on unresolved risk and escalation evidence.

Related page: Operation Workflow Patterns