AML Monitoring

Introduction

gu1’s AML monitoring helps you comply with anti-money laundering regulations by automatically detecting suspicious patterns, generating alerts, and facilitating regulatory reporting.

Regulations Covered

FATF Recommendations

Financial Action Task Force international standards

BSA/AML (USA)

Bank Secrecy Act and Anti-Money Laundering regulations

6AMLD (Europe)

Sixth Anti-Money Laundering Directive

UIF (LATAM)

Financial Intelligence Units across Latin America

Detectable Patterns

1. Structuring (Smurfing)

Multiple transactions just below reporting thresholds to avoid detection. Indicators:

Multiple transactions near $10,000 threshold
Consistent amounts across multiple days
Same origin/destination entities
Round amounts

2. Rapid Movement (Layering)

Funds moving quickly through multiple accounts to obscure origin. Indicators:

Multiple transfers in short time
Funds passing through multiple intermediaries
Immediate withdrawals after deposits
Complex transaction chains

3. High-Risk Countries

Transactions involving FATF grey list or sanctioned countries. Indicators:

Countries under increased monitoring
Sanctioned jurisdictions
Non-cooperative territories

4. Politically Exposed Persons (PEPs)

Transactions involving individuals with prominent public functions. Indicators:

PEP database matches
Family members of PEPs
Close associates
High-value transactions

5. Round Dollar Amounts

Unusually round amounts that may indicate structuring or cash placement. Indicators:

Frequent exact round amounts ( $1000,$ 5000, $10000)
Patterns of similar round amounts
Inconsistent with normal behavior

6. Cash-Intensive Businesses

Higher scrutiny for businesses with high cash volumes. Indicators:

MCC codes for cash-intensive industries
High cash deposit frequency
Inconsistent transaction patterns
Unusual cash-to-revenue ratios

Production-Ready AML Rules

1. Structuring Detection - $10K Threshold

{
  "name": "Structuring Detection - $10K Threshold",
  "category": "aml",
  "priority": 900,
  "enabled": true,
  "evaluationMode": "async",
  "targetEntityTypes": ["transaction"],
  "conditions": {
    "operator": "AND",
    "conditions": [
      {
        "field": "amountInUsd",
        "operator": "GREATER_THAN",
        "value": 9000
      },
      {
        "field": "amountInUsd",
        "operator": "LESS_THAN",
        "value": 10000
      },
      {
        "field": "metadata.transactionsSameOriginLast7d",
        "operator": "GREATER_THAN_OR_EQUAL",
        "value": 3
      }
    ]
  },
  "actions": [
    {
      "type": "generate_alert",
      "config": {
        "severity": "high",
        "type": "possible_structuring",
        "message": "Entity {{originEntityId}} has {{metadata.transactionsSameOriginLast7d}} transactions near $10K threshold in last 7 days"
      }
    },
    {
      "type": "create_investigation",
      "config": {
        "priority": "high",
        "assignToTeam": "aml_compliance",
        "requiresSAR": true
      }
    }
  ]
}

2. Rapid Movement - Layering Detection

{
  "name": "Rapid Movement - Layering Pattern",
  "category": "aml",
  "priority": 850,
  "enabled": true,
  "evaluationMode": "async",
  "targetEntityTypes": ["transaction"],
  "conditions": {
    "operator": "AND",
    "conditions": [
      {
        "field": "type",
        "operator": "EQUALS",
        "value": "TRANSFER"
      },
      {
        "field": "metadata.entityTransferChainLength",
        "operator": "GREATER_THAN",
        "value": 3
      },
      {
        "field": "metadata.chainTotalTime",
        "operator": "LESS_THAN",
        "value": 3600
      },
      {
        "field": "amount",
        "operator": "GREATER_THAN",
        "value": 5000
      }
    ]
  },
  "actions": [
    {
      "type": "generate_alert",
      "config": {
        "severity": "high",
        "type": "rapid_movement",
        "message": "Funds moved through {{metadata.entityTransferChainLength}} entities in {{metadata.chainTotalTime}} seconds - Amount: ${{amount}}"
      }
    },
    {
      "type": "create_investigation",
      "config": {
        "priority": "high",
        "assignToTeam": "aml_compliance"
      }
    }
  ]
}

3. High-Risk Country Monitoring

{
  "name": "High-Risk Country Transaction",
  "category": "aml",
  "priority": 900,
  "enabled": true,
  "evaluationMode": "async",
  "targetEntityTypes": ["transaction"],
  "conditions": {
    "operator": "AND",
    "conditions": [
      {
        "field": "metadata.involvedCountries",
        "operator": "INTERSECTS",
        "value": ["AF", "KP", "IR", "SY", "MM", "YE"]
      },
      {
        "field": "amountInUsd",
        "operator": "GREATER_THAN",
        "value": 1000
      }
    ]
  },
  "actions": [
    {
      "type": "generate_alert",
      "config": {
        "severity": "critical",
        "type": "high_risk_country",
        "message": "Transaction involving high-risk countries: {{metadata.involvedCountries}} - Amount: ${{amountInUsd}}"
      }
    },
    {
      "type": "create_investigation",
      "config": {
        "priority": "critical",
        "assignToTeam": "aml_compliance",
        "requiresImmediateAction": true
      }
    }
  ]
}

4. PEP Transaction Monitoring

{
  "name": "PEP Transaction Alert",
  "category": "aml",
  "priority": 950,
  "enabled": true,
  "evaluationMode": "async",
  "targetEntityTypes": ["transaction"],
  "conditions": {
    "operator": "AND",
    "conditions": [
      {
        "field": "metadata.originEntityIsPEP",
        "operator": "EQUALS",
        "value": true
      },
      {
        "field": "amountInUsd",
        "operator": "GREATER_THAN",
        "value": 10000
      }
    ]
  },
  "actions": [
    {
      "type": "generate_alert",
      "config": {
        "severity": "high",
        "type": "pep_transaction",
        "message": "PEP {{originEntityId}} ({{metadata.pepPosition}}) - Transaction: ${{amountInUsd}}"
      }
    },
    {
      "type": "create_investigation",
      "config": {
        "priority": "high",
        "assignToTeam": "aml_compliance",
        "enhancedDueDiligence": true
      }
    }
  ]
}

5. Round Dollar Amount Pattern

{
  "name": "Round Amount Structuring Pattern",
  "category": "aml",
  "priority": 800,
  "enabled": true,
  "evaluationMode": "async",
  "targetEntityTypes": ["transaction"],
  "conditions": {
    "operator": "AND",
    "conditions": [
      {
        "field": "amount",
        "operator": "MODULO_EQUALS",
        "value": 0,
        "divisor": 1000
      },
      {
        "field": "metadata.roundAmountTransactions30d",
        "operator": "GREATER_THAN",
        "value": 5
      },
      {
        "field": "amount",
        "operator": "GREATER_THAN",
        "value": 5000
      }
    ]
  },
  "actions": [
    {
      "type": "generate_alert",
      "config": {
        "severity": "medium",
        "type": "round_amount_pattern",
        "message": "Entity {{originEntityId}} has {{metadata.roundAmountTransactions30d}} round amount transactions in 30 days"
      }
    }
  ]
}

6. Cash-Intensive Business Monitoring

{
  "name": "Cash-Intensive Business - Enhanced Monitoring",
  "category": "aml",
  "priority": 850,
  "enabled": true,
  "evaluationMode": "async",
  "targetEntityTypes": ["transaction"],
  "conditions": {
    "operator": "AND",
    "conditions": [
      {
        "field": "mccCode",
        "operator": "IN",
        "value": ["5813", "7995", "7999", "9399"]
      },
      {
        "field": "type",
        "operator": "EQUALS",
        "value": "DEPOSIT"
      },
      {
        "field": "origin.paymentMethod",
        "operator": "EQUALS",
        "value": "CASH"
      },
      {
        "field": "amount",
        "operator": "GREATER_THAN",
        "value": 5000
      }
    ]
  },
  "actions": [
    {
      "type": "generate_alert",
      "config": {
        "severity": "medium",
        "type": "cash_intensive_business",
        "message": "Cash-intensive business (MCC: {{mccCode}}) - Cash deposit of ${{amount}}"
      }
    }
  ]
}

Reporting Thresholds

United States (FinCEN)

Report Type	Threshold	Timeframe
CTR (Cash Transaction Report)	$10,000	Single day
SAR (Suspicious Activity Report)	$5,000 (known)	Suspicious activity
SAR	$25,000 (unknown)	Suspicious activity
FBAR (Foreign Bank Account)	$10,000	Aggregate balance

European Union (6AMLD)

Report Type	Threshold	Timeframe
STR (Suspicious Transaction Report)	No threshold	Suspicious activity
High-Value Transaction	€10,000	Single transaction
Cross-Border Declaration	€10,000	Cash movement

Latin America

Country	Report Type	Threshold
Brazil	COAF	R$ 10,000
Mexico	UIF	$7,500 USD
Argentina	UIF	$10,000 USD
Colombia	UIAF	$10,000 USD
Chile	UAF	$10,000 USD

Compliance Workflow

SAR/STR Export Format

{
  "reportType": "SAR",
  "reportDate": "2024-10-28T00:00:00Z",
  "filingInstitution": {
    "name": "Your Institution",
    "ein": "12-3456789",
    "address": "123 Main St, City, State, ZIP"
  },
  "subject": {
    "entityId": "customer_001",
    "name": "John Doe",
    "dateOfBirth": "1980-01-01",
    "ssn": "XXX-XX-1234",
    "address": "456 Oak Ave, City, State, ZIP"
  },
  "suspiciousActivity": {
    "type": "structuring",
    "dateBegin": "2024-10-01",
    "dateEnd": "2024-10-28",
    "totalAmount": 45000.00,
    "description": "Subject conducted 5 transactions between $9,000-$9,999 over 14 days, pattern consistent with structuring to avoid CTR reporting threshold."
  },
  "transactions": [
    {
      "date": "2024-10-01",
      "amount": 9500.00,
      "type": "DEPOSIT",
      "method": "CASH"
    },
    {
      "date": "2024-10-05",
      "amount": 9800.00,
      "type": "DEPOSIT",
      "method": "CASH"
    }
  ],
  "narrative": "Over a 14-day period, the subject made 5 cash deposits, each between $9,000 and $9,999, totaling $45,000. The pattern, timing, and amounts suggest deliberate structuring to avoid the $10,000 CTR threshold. Subject has no business activity justifying these cash volumes. Previous transaction history shows average deposits of $500-$1,000. Enhanced due diligence revealed no legitimate source for these funds.",
  "filedBy": {
    "name": "Jane Smith",
    "title": "AML Compliance Officer",
    "phone": "555-0123",
    "email": "jane.smith@institution.com"
  }
}

Best Practices

✅ DO

Risk-Based Approach
- Focus resources on highest risk
- Adjust thresholds by customer risk profile
- Enhanced due diligence for high-risk
Document Everything
- Record all decisions
- Maintain audit trail
- Document reasoning
Regular Training
- Train all relevant staff
- Update on new regulations
- Test knowledge periodically
Monitor Effectiveness
- Track detection rates
- Measure false positives
- Review filed reports
Timely Reporting
- File SARs within required timeframes
- Don’t delay investigations
- Maintain required records

❌ DON’T

Don’t Tip Off Subjects
- Never inform subjects of SAR filing
- Maintain confidentiality
- Train staff on tipping off rules
Don’t Use Static Thresholds
- Adjust for inflation
- Consider currency differences
- Use risk-based approach
Don’t Ignore Patterns
- Look beyond individual transactions
- Analyze relationships
- Consider temporal patterns
Don’t Rush Investigations
- Thorough analysis required
- Gather all evidence
- Document properly

KPIs and Metrics

AML Program Effectiveness

{
  "amlMetrics": {
    "alertsGenerated": 450,
    "alertsReviewed": 445,
    "investigationsOpened": 89,
    "sarsFiledTimely": 23,
    "sarsFiledLate": 0,
    "averageInvestigationTime": "18 hours",
    "falsePositiveRate": 0.78,
    "detectionRate": 0.93,
    "regulatoryFindings": 0
  }
}

Monthly AML Report

-- Monthly SAR filing summary
SELECT
  DATE_TRUNC('month', filed_date) as month,
  COUNT(*) as sars_filed,
  SUM(total_amount) as total_suspicious_amount,
  AVG(investigation_time_hours) as avg_investigation_time,
  COUNT(DISTINCT subject_id) as unique_subjects
FROM sar_filings
WHERE filed_date > NOW() - INTERVAL '12 months'
GROUP BY month
ORDER BY month DESC;

Pattern Detection Effectiveness

-- Most effective AML rules
SELECT
  pattern_type,
  COUNT(*) as alerts_generated,
  SUM(CASE WHEN resulted_in_sar THEN 1 ELSE 0 END) as sars_generated,
  ROUND(100.0 * SUM(CASE WHEN resulted_in_sar THEN 1 ELSE 0 END) / COUNT(*), 2) as conversion_rate,
  SUM(suspicious_amount) as total_amount_flagged
FROM aml_alerts
WHERE created_at > NOW() - INTERVAL '90 days'
GROUP BY pattern_type
ORDER BY conversion_rate DESC;

Integration with Intelligence

All AML alerts automatically:

Consolidate into investigations
Track across related entities
Maintain complete timeline
Enable team collaboration
Generate audit trail
Export SAR-ready reports

Next Steps

Fraud Detection

Real-time fraud prevention

Merchant Monitoring

Monitor merchants and acquirers

Rules Configuration

Create custom rules

Overview

Back to overview

​Introduction

​Regulations Covered

FATF Recommendations

BSA/AML (USA)

6AMLD (Europe)

UIF (LATAM)

​Detectable Patterns

​1. Structuring (Smurfing)

​2. Rapid Movement (Layering)

​3. High-Risk Countries

​4. Politically Exposed Persons (PEPs)

​5. Round Dollar Amounts

​6. Cash-Intensive Businesses

​Production-Ready AML Rules

​1. Structuring Detection - $10K Threshold

​2. Rapid Movement - Layering Detection

​3. High-Risk Country Monitoring

​4. PEP Transaction Monitoring

​5. Round Dollar Amount Pattern

​6. Cash-Intensive Business Monitoring

​Reporting Thresholds

​United States (FinCEN)

​European Union (6AMLD)

​Latin America

​Compliance Workflow

​SAR/STR Export Format

​Best Practices

​✅ DO

​❌ DON’T

​KPIs and Metrics

​AML Program Effectiveness

​Monthly AML Report

​Pattern Detection Effectiveness

​Integration with Intelligence

​Next Steps