> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gu1.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# AML Monitoring
> Anti-money laundering compliance and suspicious activity detection — in the gu1 transaction monitoring product for fraud and AML, with examples for aml.
## Introduction
gu1's AML monitoring helps you comply with anti-money laundering regulations by automatically detecting suspicious patterns, generating alerts, and facilitating regulatory reporting.
## Regulations Covered
Financial Action Task Force international standards
Bank Secrecy Act and Anti-Money Laundering regulations
Sixth Anti-Money Laundering Directive
Financial Intelligence Units across Latin America
## Detectable Patterns
### 1. Structuring (Smurfing)
Multiple transactions just below reporting thresholds to avoid detection.
**Indicators:**
* Multiple transactions near \$10,000 threshold
* Consistent amounts across multiple days
* Same origin/destination entities
* Round amounts
### 2. Rapid Movement (Layering)
Funds moving quickly through multiple accounts to obscure origin.
**Indicators:**
* Multiple transfers in short time
* Funds passing through multiple intermediaries
* Immediate withdrawals after deposits
* Complex transaction chains
### 3. High-Risk Countries
Transactions involving FATF grey list or sanctioned countries.
**Indicators:**
* Countries under increased monitoring
* Sanctioned jurisdictions
* Non-cooperative territories
### 4. Politically Exposed Persons (PEPs)
Transactions involving individuals with prominent public functions.
**Indicators:**
* PEP database matches
* Family members of PEPs
* Close associates
* High-value transactions
### 5. Round Dollar Amounts
Unusually round amounts that may indicate structuring or cash placement.
**Indicators:**
* Frequent exact round amounts ($1000, $5000, \$10000)
* Patterns of similar round amounts
* Inconsistent with normal behavior
### 6. Cash-Intensive Businesses
Higher scrutiny for businesses with high cash volumes.
**Indicators:**
* MCC codes for cash-intensive industries
* High cash deposit frequency
* Inconsistent transaction patterns
* Unusual cash-to-revenue ratios
## Production-Ready AML Rules
### 1. Structuring Detection - \$10K Threshold
```json theme={null}
{
"name": "Structuring Detection - $10K Threshold",
"category": "aml",
"priority": 900,
"enabled": true,
"evaluationMode": "async",
"targetEntityTypes": ["transaction"],
"conditions": {
"operator": "AND",
"conditions": [
{
"field": "amountInUsd",
"operator": "GREATER_THAN",
"value": 9000
},
{
"field": "amountInUsd",
"operator": "LESS_THAN",
"value": 10000
},
{
"field": "metadata.transactionsSameOriginLast7d",
"operator": "GREATER_THAN_OR_EQUAL",
"value": 3
}
]
},
"actions": [
{
"type": "generate_alert",
"config": {
"severity": "high",
"type": "possible_structuring",
"message": "Entity {{originEntityId}} has {{metadata.transactionsSameOriginLast7d}} transactions near $10K threshold in last 7 days"
}
},
{
"type": "create_investigation",
"config": {
"priority": "high",
"assignToTeam": "aml_compliance",
"requiresSAR": true
}
}
]
}
```
### 2. Rapid Movement - Layering Detection
```json theme={null}
{
"name": "Rapid Movement - Layering Pattern",
"category": "aml",
"priority": 850,
"enabled": true,
"evaluationMode": "async",
"targetEntityTypes": ["transaction"],
"conditions": {
"operator": "AND",
"conditions": [
{
"field": "type",
"operator": "EQUALS",
"value": "TRANSFER"
},
{
"field": "metadata.entityTransferChainLength",
"operator": "GREATER_THAN",
"value": 3
},
{
"field": "metadata.chainTotalTime",
"operator": "LESS_THAN",
"value": 3600
},
{
"field": "amount",
"operator": "GREATER_THAN",
"value": 5000
}
]
},
"actions": [
{
"type": "generate_alert",
"config": {
"severity": "high",
"type": "rapid_movement",
"message": "Funds moved through {{metadata.entityTransferChainLength}} entities in {{metadata.chainTotalTime}} seconds - Amount: ${{amount}}"
}
},
{
"type": "create_investigation",
"config": {
"priority": "high",
"assignToTeam": "aml_compliance"
}
}
]
}
```
### 3. High-Risk Country Monitoring
```json theme={null}
{
"name": "High-Risk Country Transaction",
"category": "aml",
"priority": 900,
"enabled": true,
"evaluationMode": "async",
"targetEntityTypes": ["transaction"],
"conditions": {
"operator": "AND",
"conditions": [
{
"field": "metadata.involvedCountries",
"operator": "INTERSECTS",
"value": ["AF", "KP", "IR", "SY", "MM", "YE"]
},
{
"field": "amountInUsd",
"operator": "GREATER_THAN",
"value": 1000
}
]
},
"actions": [
{
"type": "generate_alert",
"config": {
"severity": "critical",
"type": "high_risk_country",
"message": "Transaction involving high-risk countries: {{metadata.involvedCountries}} - Amount: ${{amountInUsd}}"
}
},
{
"type": "create_investigation",
"config": {
"priority": "critical",
"assignToTeam": "aml_compliance",
"requiresImmediateAction": true
}
}
]
}
```
### 4. PEP Transaction Monitoring
```json theme={null}
{
"name": "PEP Transaction Alert",
"category": "aml",
"priority": 950,
"enabled": true,
"evaluationMode": "async",
"targetEntityTypes": ["transaction"],
"conditions": {
"operator": "AND",
"conditions": [
{
"field": "metadata.originEntityIsPEP",
"operator": "EQUALS",
"value": true
},
{
"field": "amountInUsd",
"operator": "GREATER_THAN",
"value": 10000
}
]
},
"actions": [
{
"type": "generate_alert",
"config": {
"severity": "high",
"type": "pep_transaction",
"message": "PEP {{originEntityId}} ({{metadata.pepPosition}}) - Transaction: ${{amountInUsd}}"
}
},
{
"type": "create_investigation",
"config": {
"priority": "high",
"assignToTeam": "aml_compliance",
"enhancedDueDiligence": true
}
}
]
}
```
### 5. Round Dollar Amount Pattern
```json theme={null}
{
"name": "Round Amount Structuring Pattern",
"category": "aml",
"priority": 800,
"enabled": true,
"evaluationMode": "async",
"targetEntityTypes": ["transaction"],
"conditions": {
"operator": "AND",
"conditions": [
{
"field": "amount",
"operator": "MODULO_EQUALS",
"value": 0,
"divisor": 1000
},
{
"field": "metadata.roundAmountTransactions30d",
"operator": "GREATER_THAN",
"value": 5
},
{
"field": "amount",
"operator": "GREATER_THAN",
"value": 5000
}
]
},
"actions": [
{
"type": "generate_alert",
"config": {
"severity": "medium",
"type": "round_amount_pattern",
"message": "Entity {{originEntityId}} has {{metadata.roundAmountTransactions30d}} round amount transactions in 30 days"
}
}
]
}
```
### 6. Cash-Intensive Business Monitoring
```json theme={null}
{
"name": "Cash-Intensive Business - Enhanced Monitoring",
"category": "aml",
"priority": 850,
"enabled": true,
"evaluationMode": "async",
"targetEntityTypes": ["transaction"],
"conditions": {
"operator": "AND",
"conditions": [
{
"field": "mccCode",
"operator": "IN",
"value": ["5813", "7995", "7999", "9399"]
},
{
"field": "type",
"operator": "EQUALS",
"value": "DEPOSIT"
},
{
"field": "origin.paymentMethod",
"operator": "EQUALS",
"value": "CASH"
},
{
"field": "amount",
"operator": "GREATER_THAN",
"value": 5000
}
]
},
"actions": [
{
"type": "generate_alert",
"config": {
"severity": "medium",
"type": "cash_intensive_business",
"message": "Cash-intensive business (MCC: {{mccCode}}) - Cash deposit of ${{amount}}"
}
}
]
}
```
## Reporting Thresholds
### United States (FinCEN)
| Report Type | Threshold | Timeframe |
| -------------------------------- | ------------------ | ------------------- |
| CTR (Cash Transaction Report) | \$10,000 | Single day |
| SAR (Suspicious Activity Report) | \$5,000 (known) | Suspicious activity |
| SAR | \$25,000 (unknown) | Suspicious activity |
| FBAR (Foreign Bank Account) | \$10,000 | Aggregate balance |
### European Union (6AMLD)
| Report Type | Threshold | Timeframe |
| ----------------------------------- | ------------ | ------------------- |
| STR (Suspicious Transaction Report) | No threshold | Suspicious activity |
| High-Value Transaction | €10,000 | Single transaction |
| Cross-Border Declaration | €10,000 | Cash movement |
### Latin America
| Country | Report Type | Threshold |
| --------- | ----------- | ------------ |
| Brazil | COAF | R\$ 10,000 |
| Mexico | UIF | \$7,500 USD |
| Argentina | UIF | \$10,000 USD |
| Colombia | UIAF | \$10,000 USD |
| Chile | UAF | \$10,000 USD |
## Compliance Workflow
```mermaid theme={null}
graph TD
A[Transaction Processed] --> B{AML Rules}
B -->|Pattern Detected| C[Generate Alert]
B -->|No Pattern| D[Normal Processing]
C --> E[Alert Consolidation]
E --> F{Severity Assessment}
F -->|Low| G[Queue for Review]
F -->|Medium| H[Assign to Analyst]
F -->|High| I[Priority Investigation]
F -->|Critical| J[Immediate Action]
G --> K[Analyst Review]
H --> K
I --> K
J --> L[Senior Compliance Officer]
K --> M{Decision}
M -->|False Positive| N[Close & Adjust Rules]
M -->|Suspicious| O[Enhanced Due Diligence]
M -->|Reportable| P[Prepare SAR/STR]
O --> Q{Outcome}
Q -->|Legitimate| R[Document & Monitor]
Q -->|Suspicious| P
P --> S[Submit to Regulator]
S --> T[Block Account if Required]
T --> U[Maintain Records]
L --> V[Executive Review]
V --> P
```
## SAR/STR Export Format
```json theme={null}
{
"reportType": "SAR",
"reportDate": "2024-10-28T00:00:00Z",
"filingInstitution": {
"name": "Your Institution",
"ein": "12-3456789",
"address": "123 Main St, City, State, ZIP"
},
"subject": {
"entityId": "customer_001",
"name": "John Doe",
"dateOfBirth": "1980-01-01",
"ssn": "XXX-XX-1234",
"address": "456 Oak Ave, City, State, ZIP"
},
"suspiciousActivity": {
"type": "structuring",
"dateBegin": "2024-10-01",
"dateEnd": "2024-10-28",
"totalAmount": 45000.00,
"description": "Subject conducted 5 transactions between $9,000-$9,999 over 14 days, pattern consistent with structuring to avoid CTR reporting threshold."
},
"transactions": [
{
"date": "2024-10-01",
"amount": 9500.00,
"type": "DEPOSIT",
"method": "CASH"
},
{
"date": "2024-10-05",
"amount": 9800.00,
"type": "DEPOSIT",
"method": "CASH"
}
],
"narrative": "Over a 14-day period, the subject made 5 cash deposits, each between $9,000 and $9,999, totaling $45,000. The pattern, timing, and amounts suggest deliberate structuring to avoid the $10,000 CTR threshold. Subject has no business activity justifying these cash volumes. Previous transaction history shows average deposits of $500-$1,000. Enhanced due diligence revealed no legitimate source for these funds.",
"filedBy": {
"name": "Jane Smith",
"title": "AML Compliance Officer",
"phone": "555-0123",
"email": "jane.smith@institution.com"
}
}
```
## Best Practices
### ✅ DO
1. **Risk-Based Approach**
* Focus resources on highest risk
* Adjust thresholds by customer risk profile
* Enhanced due diligence for high-risk
2. **Document Everything**
* Record all decisions
* Maintain audit trail
* Document reasoning
3. **Regular Training**
* Train all relevant staff
* Update on new regulations
* Test knowledge periodically
4. **Monitor Effectiveness**
* Track detection rates
* Measure false positives
* Review filed reports
5. **Timely Reporting**
* File SARs within required timeframes
* Don't delay investigations
* Maintain required records
### ❌ DON'T
1. **Don't Tip Off Subjects**
* Never inform subjects of SAR filing
* Maintain confidentiality
* Train staff on tipping off rules
2. **Don't Use Static Thresholds**
* Adjust for inflation
* Consider currency differences
* Use risk-based approach
3. **Don't Ignore Patterns**
* Look beyond individual transactions
* Analyze relationships
* Consider temporal patterns
4. **Don't Rush Investigations**
* Thorough analysis required
* Gather all evidence
* Document properly
## KPIs and Metrics
### AML Program Effectiveness
```javascript theme={null}
{
"amlMetrics": {
"alertsGenerated": 450,
"alertsReviewed": 445,
"investigationsOpened": 89,
"sarsFiledTimely": 23,
"sarsFiledLate": 0,
"averageInvestigationTime": "18 hours",
"falsePositiveRate": 0.78,
"detectionRate": 0.93,
"regulatoryFindings": 0
}
}
```
### Monthly AML Report
```sql theme={null}
-- Monthly SAR filing summary
SELECT
DATE_TRUNC('month', filed_date) as month,
COUNT(*) as sars_filed,
SUM(total_amount) as total_suspicious_amount,
AVG(investigation_time_hours) as avg_investigation_time,
COUNT(DISTINCT subject_id) as unique_subjects
FROM sar_filings
WHERE filed_date > NOW() - INTERVAL '12 months'
GROUP BY month
ORDER BY month DESC;
```
### Pattern Detection Effectiveness
```sql theme={null}
-- Most effective AML rules
SELECT
pattern_type,
COUNT(*) as alerts_generated,
SUM(CASE WHEN resulted_in_sar THEN 1 ELSE 0 END) as sars_generated,
ROUND(100.0 * SUM(CASE WHEN resulted_in_sar THEN 1 ELSE 0 END) / COUNT(*), 2) as conversion_rate,
SUM(suspicious_amount) as total_amount_flagged
FROM aml_alerts
WHERE created_at > NOW() - INTERVAL '90 days'
GROUP BY pattern_type
ORDER BY conversion_rate DESC;
```
## Integration with Intelligence
All AML alerts automatically:
* Consolidate into investigations
* Track across related entities
* Maintain complete timeline
* Enable team collaboration
* Generate audit trail
* Export SAR-ready reports
## Next Steps
Real-time fraud prevention
Monitor merchants and acquirers
Create custom rules
Back to overview