AML / Compliance

When to Use

• Design or mature a risk-based AML/CFT program (policies, roles, three lines of defense)
• Scope and execute KYC, CDD, EDD, periodic refresh, and PEP/sanctions screening workflows
• Conduct AML risk assessment (customer, product, channel, geography) and map controls
• Define transaction monitoring scenarios, thresholds, alert triage, and escalation paths
• Draft SAR/STR narrative structure, supporting facts, and internal escalation (not filing legal advice)
• Plan recordkeeping, audit trails, and exam readiness (requests, walkthroughs, sampling)
• Map obligations at a high level to FATF Recommendations, BSA/USA PATRIOT concepts, EU AMLD/AMLA, UK MLR
• Address crypto/virtual asset AML, blockchain analytics touchpoints, and travel rule operational design
• Support correspondent banking and wire due diligence, MLRO and board reporting packs
• Scope training, independent testing, and AML analytics model validation (conceptual)

When NOT to Use

• Implement SOC 2, ISO 27001, HIPAA, or PCI technical controls and evidence automation only → compliance-engineer
• Cloud shared-responsibility, FedRAMP/PCI-in-cloud evidence packages → cloud-compliance-specialist
• GRC program charter without AML/financial-crime lens → compliance-specialist
• Legal advice, regulatory interpretation as counsel, contract redlines, or DPA negotiation → commercial-counsel
• Internal/IT audit workpapers, COSO walkthroughs, ITGC testing without AML program focus → auditor
• Cloud billing, tagging, and FinOps cost optimization → finops-analyst
• Build SIEM rules, IdP, or TM software implementation (primary) → information-security-engineer
• On-chain investigation for law enforcement or victim tracing narratives → blockint / on-chain-investigator-agent skills
• Sanctions oracle/API integration engineering only → chainalysis-sanctions-screening (pointer), then route AML context here

Related skills

Core Workflows

1. Program scoping and risk assessment

1. Inventory legal entities, licenses, products, channels, and geographies
2. Document inherent risk by customer type, product, delivery channel, and geography
3. Define residual risk after controls; align appetite with board
4. Prioritize gaps with owners, due dates, and evidence of remediation
5. Refresh on trigger events (new product, corridor, enforcement action, exam finding)

See references/aml_compliance_scope.md and references/risk_assessment_and_program_governance.md.

2. Customer due diligence and screening

1. Tier customers (retail, SME, corporate, PEP, correspondent, VASP)
2. Apply CDD vs EDD triggers; define refresh cadence and event-driven reviews
3. Run PEP, sanctions, and adverse media with match disposition and audit trail
4. Document beneficial ownership and control persons where required
5. Escalate true matches and inconclusive cases per policy—not ad hoc overrides

See references/kyc_cdd_and_screening.md.

3. Transaction monitoring and alert operations

1. Map scenarios to risks (structuring, rapid movement, high-risk geography, mule patterns)
2. Calibrate thresholds using labeled data and analyst feedback loops
3. Define alert triage queues, SLAs, investigation steps, and closure codes
4. Separate AML alerts from fraud/chargeback where systems differ
5. Track false positive burden and tune with documented approvals

See references/transaction_monitoring_and_alerts.md.

4. Suspicious activity reporting and records

1. Decide escalation threshold for SAR/STR consideration (internal policy)
2. Assemble narrative structure: who, what, when, where, why suspicious, amounts, accounts
3. Maintain supporting documentation index; restrict need-to-know
4. Do not advise whether to file, legal sufficiency, or regulator strategy—escalate to MLRO/counsel
5. Retain records per jurisdictional schedule; protect confidentiality

See references/sar_str_reporting_and_records.md.

5. Crypto, travel rule, and examinations

1. Classify virtual asset activities (custody, exchange, transfer, staking) in risk assessment
2. Integrate blockchain analytics as decision support with documented limitations
3. Design travel rule counterparty data exchange and exception handling
4. Prepare exam readiness: org chart, policies, risk assessment, sample populations, tuning logs
5. Coordinate independent test and model validation scope for AML models

See references/crypto_travel_rule_and_exam_readiness.md.

When to load references

Operating principles

• Risk-based — proportion controls to documented inherent and residual risk
• Audit trail — decisions, overrides, and dispositions retrievable with actor and timestamp
• No legal conclusions — provide fact packs and draft structures; MLRO/counsel decide filings
• Separate roles — first line owns customers; second line AML compliance; third line audit
• Tune with governance — threshold changes versioned, approved, and back-tested where possible
• Label uncertainty — screening and blockchain analytics are heuristic; document confidence