AML Monitoring

Introduction

gu1’s AML monitoring helps you comply with anti-money laundering regulations by automatically detecting suspicious patterns, generating alerts, and facilitating regulatory reporting.

Regulations Covered

FATF Recommendations

Financial Action Task Force international standards

BSA/AML (USA)

Bank Secrecy Act and Anti-Money Laundering regulations

6AMLD (Europe)

Sixth Anti-Money Laundering Directive

UIF (LATAM)

Financial Intelligence Units across Latin America

Detectable Patterns

1. Structuring (Smurfing)

Multiple transactions just below reporting thresholds to avoid detection. Indicators:

Multiple transactions near $10,000 threshold
Consistent amounts across multiple days
Same origin/destination entities
Round amounts

2. Rapid Movement (Layering)

Funds moving quickly through multiple accounts to obscure origin. Indicators:

Multiple transfers in short time
Funds passing through multiple intermediaries
Immediate withdrawals after deposits
Complex transaction chains

3. High-Risk Countries

Transactions involving FATF grey list or sanctioned countries. Indicators:

Countries under increased monitoring
Sanctioned jurisdictions
Non-cooperative territories

4. Politically Exposed Persons (PEPs)

Transactions involving individuals with prominent public functions. Indicators:

PEP database matches
Family members of PEPs
Close associates
High-value transactions

5. Round Dollar Amounts

Unusually round amounts that may indicate structuring or cash placement. Indicators:

Frequent exact round amounts ( $1000,$ 5000, $10000)
Patterns of similar round amounts
Inconsistent with normal behavior

6. Cash-Intensive Businesses

Higher scrutiny for businesses with high cash volumes. Indicators:

MCC codes for cash-intensive industries
High cash deposit frequency
Inconsistent transaction patterns
Unusual cash-to-revenue ratios

Production-Ready AML Rules

1. Structuring Detection - $10K Threshold

{
  "name": "Structuring Detection - $10K Threshold",
  "category": "aml",
  "priority": 900,
  "enabled": true,
  "evaluationMode": "async",
  "targetEntityTypes": ["transaction"],
  "conditions": {
    "operator": "AND",
    "conditions": [
      {
        "field": "amountBaseCurrency",
        "operator": "GREATER_THAN",
        "value": 9000
      },
      {
        "field": "amountBaseCurrency",
        "operator": "LESS_THAN",
        "value": 10000
      },
      {
        "field": "metadata.transactionsSameOriginLast7d",
        "operator": "GREATER_THAN_OR_EQUAL",
        "value": 3
      }
    ]
  },
  "actions": [
    {
      "type": "generate_alert",
      "config": {
        "severity": "high",
        "type": "possible_structuring",
        "message": "Entity {{originEntityId}} has {{metadata.transactionsSameOriginLast7d}} transactions near $10K threshold in last 7 days"
      }
    },
    {
      "type": "create_investigation",
      "config": {
        "priority": "high",
        "assignToTeam": "aml_compliance",
        "requiresSAR": true
      }
    }
  ]
}

2. Rapid Movement - Layering Detection

{
  "name": "Rapid Movement - Layering Pattern",
  "category": "aml",
  "priority": 850,
  "enabled": true,
  "evaluationMode": "async",
  "targetEntityTypes": ["transaction"],
  "conditions": {
    "operator": "AND",
    "conditions": [
      {
        "field": "type",
        "operator": "EQUALS",
        "value": "TRANSFER"
      },
      {
        "field": "metadata.entityTransferChainLength",
        "operator": "GREATER_THAN",
        "value": 3
      },
      {
        "field": "metadata.chainTotalTime",
        "operator": "LESS_THAN",
        "value": 3600
      },
      {
        "field": "amount",
        "operator": "GREATER_THAN",
        "value": 5000
      }
    ]
  },
  "actions": [
    {
      "type": "generate_alert",
      "config": {
        "severity": "high",
        "type": "rapid_movement",
        "message": "Funds moved through {{metadata.entityTransferChainLength}} entities in {{metadata.chainTotalTime}} seconds - Amount: ${{amount}}"
      }
    },
    {
      "type": "create_investigation",
      "config": {
        "priority": "high",
        "assignToTeam": "aml_compliance"
      }
    }
  ]
}

3. High-Risk Country Monitoring

{
  "name": "High-Risk Country Transaction",
  "category": "aml",
  "priority": 900,
  "enabled": true,
  "evaluationMode": "async",
  "targetEntityTypes": ["transaction"],
  "conditions": {
    "operator": "AND",
    "conditions": [
      {
        "field": "metadata.involvedCountries",
        "operator": "INTERSECTS",
        "value": ["AF", "KP", "IR", "SY", "MM", "YE"]
      },
      {
        "field": "amountBaseCurrency",
        "operator": "GREATER_THAN",
        "value": 1000
      }
    ]
  },
  "actions": [
    {
      "type": "generate_alert",
      "config": {
        "severity": "critical",
        "type": "high_risk_country",
        "message": "Transaction involving high-risk countries: {{metadata.involvedCountries}} - Amount: ${{amountBaseCurrency}}"
      }
    },
    {
      "type": "create_investigation",
      "config": {
        "priority": "critical",
        "assignToTeam": "aml_compliance",
        "requiresImmediateAction": true
      }
    }
  ]
}

4. PEP Transaction Monitoring

{
  "name": "PEP Transaction Alert",
  "category": "aml",
  "priority": 950,
  "enabled": true,
  "evaluationMode": "async",
  "targetEntityTypes": ["transaction"],
  "conditions": {
    "operator": "AND",
    "conditions": [
      {
        "field": "metadata.originEntityIsPEP",
        "operator": "EQUALS",
        "value": true
      },
      {
        "field": "amountBaseCurrency",
        "operator": "GREATER_THAN",
        "value": 10000
      }
    ]
  },
  "actions": [
    {
      "type": "generate_alert",
      "config": {
        "severity": "high",
        "type": "pep_transaction",
        "message": "PEP {{originEntityId}} ({{metadata.pepPosition}}) - Transaction: ${{amountBaseCurrency}}"
      }
    },
    {
      "type": "create_investigation",
      "config": {
        "priority": "high",
        "assignToTeam": "aml_compliance",
        "enhancedDueDiligence": true
      }
    }
  ]
}

5. Round Dollar Amount Pattern

{
  "name": "Round Amount Structuring Pattern",
  "category": "aml",
  "priority": 800,
  "enabled": true,
  "evaluationMode": "async",
  "targetEntityTypes": ["transaction"],
  "conditions": {
    "operator": "AND",
    "conditions": [
      {
        "field": "amount",
        "operator": "MODULO_EQUALS",
        "value": 0,
        "divisor": 1000
      },
      {
        "field": "metadata.roundAmountTransactions30d",
        "operator": "GREATER_THAN",
        "value": 5
      },
      {
        "field": "amount",
        "operator": "GREATER_THAN",
        "value": 5000
      }
    ]
  },
  "actions": [
    {
      "type": "generate_alert",
      "config": {
        "severity": "medium",
        "type": "round_amount_pattern",
        "message": "Entity {{originEntityId}} has {{metadata.roundAmountTransactions30d}} round amount transactions in 30 days"
      }
    }
  ]
}

6. Cash-Intensive Business Monitoring

{
  "name": "Cash-Intensive Business - Enhanced Monitoring",
  "category": "aml",
  "priority": 850,
  "enabled": true,
  "evaluationMode": "async",
  "targetEntityTypes": ["transaction"],
  "conditions": {
    "operator": "AND",
    "conditions": [
      {
        "field": "mccCode",
        "operator": "IN",
        "value": ["5813", "7995", "7999", "9399"]
      },
      {
        "field": "type",
        "operator": "EQUALS",
        "value": "DEPOSIT"
      },
      {
        "field": "origin.paymentMethod",
        "operator": "EQUALS",
        "value": "CASH"
      },
      {
        "field": "amount",
        "operator": "GREATER_THAN",
        "value": 5000
      }
    ]
  },
  "actions": [
    {
      "type": "generate_alert",
      "config": {
        "severity": "medium",
        "type": "cash_intensive_business",
        "message": "Cash-intensive business (MCC: {{mccCode}}) - Cash deposit of ${{amount}}"
      }
    }
  ]
}

Reporting Thresholds

United States (FinCEN)

Report Type	Threshold	Timeframe
CTR (Cash Transaction Report)	$10,000	Single day
SAR (Suspicious Activity Report)	$5,000 (known)	Suspicious activity
SAR	$25,000 (unknown)	Suspicious activity
FBAR (Foreign Bank Account)	$10,000	Aggregate balance

European Union (6AMLD)

Report Type	Threshold	Timeframe
STR (Suspicious Transaction Report)	No threshold	Suspicious activity
High-Value Transaction	€10,000	Single transaction
Cross-Border Declaration	€10,000	Cash movement

Latin America

Country	Report Type	Threshold
Brazil	COAF	R$ 10,000
Mexico	UIF	$7,500 USD
Argentina	UIF	$10,000 USD
Colombia	UIAF	$10,000 USD
Chile	UAF	$10,000 USD

Compliance Workflow

SAR/STR Export Format

{
  "reportType": "SAR",
  "reportDate": "2024-10-28T00:00:00Z",
  "filingInstitution": {
    "name": "Your Institution",
    "ein": "12-3456789",
    "address": "123 Main St, City, State, ZIP"
  },
  "subject": {
    "entityId": "customer_001",
    "name": "John Doe",
    "dateOfBirth": "1980-01-01",
    "ssn": "XXX-XX-1234",
    "address": "456 Oak Ave, City, State, ZIP"
  },
  "suspiciousActivity": {
    "type": "structuring",
    "dateBegin": "2024-10-01",
    "dateEnd": "2024-10-28",
    "totalAmount": 45000.00,
    "description": "Subject conducted 5 transactions between $9,000-$9,999 over 14 days, pattern consistent with structuring to avoid CTR reporting threshold."
  },
  "transactions": [
    {
      "date": "2024-10-01",
      "amount": 9500.00,
      "type": "DEPOSIT",
      "method": "CASH"
    },
    {
      "date": "2024-10-05",
      "amount": 9800.00,
      "type": "DEPOSIT",
      "method": "CASH"
    }
  ],
  "narrative": "Over a 14-day period, the subject made 5 cash deposits, each between $9,000 and $9,999, totaling $45,000. The pattern, timing, and amounts suggest deliberate structuring to avoid the $10,000 CTR threshold. Subject has no business activity justifying these cash volumes. Previous transaction history shows average deposits of $500-$1,000. Enhanced due diligence revealed no legitimate source for these funds.",
  "filedBy": {
    "name": "Jane Smith",
    "title": "AML Compliance Officer",
    "phone": "555-0123",
    "email": "[email protected]"
  }
}

Best Practices

✅ DO

Risk-Based Approach
- Focus resources on highest risk
- Adjust thresholds by customer risk profile
- Enhanced due diligence for high-risk
Document Everything
- Record all decisions
- Maintain audit trail
- Document reasoning
Regular Training
- Train all relevant staff
- Update on new regulations
- Test knowledge periodically
Monitor Effectiveness
- Track detection rates
- Measure false positives
- Review filed reports
Timely Reporting
- File SARs within required timeframes
- Don’t delay investigations
- Maintain required records

❌ DON’T

Don’t Tip Off Subjects
- Never inform subjects of SAR filing
- Maintain confidentiality
- Train staff on tipping off rules
Don’t Use Static Thresholds
- Adjust for inflation
- Consider currency differences
- Use risk-based approach
Don’t Ignore Patterns
- Look beyond individual transactions
- Analyze relationships
- Consider temporal patterns
Don’t Rush Investigations
- Thorough analysis required
- Gather all evidence
- Document properly

KPIs and Metrics

AML Program Effectiveness

{
  "amlMetrics": {
    "alertsGenerated": 450,
    "alertsReviewed": 445,
    "investigationsOpened": 89,
    "sarsFiledTimely": 23,
    "sarsFiledLate": 0,
    "averageInvestigationTime": "18 hours",
    "falsePositiveRate": 0.78,
    "detectionRate": 0.93,
    "regulatoryFindings": 0
  }
}

Monthly AML Report

-- Monthly SAR filing summary
SELECT
  DATE_TRUNC('month', filed_date) as month,
  COUNT(*) as sars_filed,
  SUM(total_amount) as total_suspicious_amount,
  AVG(investigation_time_hours) as avg_investigation_time,
  COUNT(DISTINCT subject_id) as unique_subjects
FROM sar_filings
WHERE filed_date > NOW() - INTERVAL '12 months'
GROUP BY month
ORDER BY month DESC;

Pattern Detection Effectiveness

-- Most effective AML rules
SELECT
  pattern_type,
  COUNT(*) as alerts_generated,
  SUM(CASE WHEN resulted_in_sar THEN 1 ELSE 0 END) as sars_generated,
  ROUND(100.0 * SUM(CASE WHEN resulted_in_sar THEN 1 ELSE 0 END) / COUNT(*), 2) as conversion_rate,
  SUM(suspicious_amount) as total_amount_flagged
FROM aml_alerts
WHERE created_at > NOW() - INTERVAL '90 days'
GROUP BY pattern_type
ORDER BY conversion_rate DESC;

Integration with Intelligence

All AML alerts automatically:

Consolidate into investigations
Track across related entities
Maintain complete timeline
Enable team collaboration
Generate audit trail
Export SAR-ready reports

Next Steps

Fraud Detection

Real-time fraud prevention

Merchant Monitoring

Monitor merchants and acquirers

Rules Configuration

Create custom rules

Overview

Back to overview

Getting Started

API Reference

Data Ingestion

Entities

Documents

Know Your Business (KYB)

Know Your Customer (KYC)

Transaction Monitoring

Interactive Tutorials

​Introduction

​Regulations Covered

FATF Recommendations

BSA/AML (USA)

6AMLD (Europe)

UIF (LATAM)

​Detectable Patterns

​1. Structuring (Smurfing)

​2. Rapid Movement (Layering)

​3. High-Risk Countries

​4. Politically Exposed Persons (PEPs)

​5. Round Dollar Amounts

​6. Cash-Intensive Businesses

​Production-Ready AML Rules

​1. Structuring Detection - $10K Threshold

​2. Rapid Movement - Layering Detection

​3. High-Risk Country Monitoring

​4. PEP Transaction Monitoring

​5. Round Dollar Amount Pattern

​6. Cash-Intensive Business Monitoring

​Reporting Thresholds

​United States (FinCEN)

​European Union (6AMLD)

​Latin America

​Compliance Workflow

​SAR/STR Export Format

​Best Practices

​✅ DO

​❌ DON’T

​KPIs and Metrics

​AML Program Effectiveness

​Monthly AML Report

​Pattern Detection Effectiveness

​Integration with Intelligence

​Next Steps