AML/CFT, Sanctions and Financial Crime Compliance

Introduction and context

Banks occupy a central position in the prevention of money laundering, terrorist financing and proliferation financing. They provide payment, deposit, lending, securities, trade-finance and correspondent-banking services through which legitimate economic activity occurs—and through which criminal proceeds can be concealed, transferred or transformed. Effective compliance is therefore not merely an operational obligation. It is a component of prudential governance, market integrity, national security and institutional reputation.

Anti-money laundering and countering the financing of terrorism (AML/CFT) frameworks are generally built around international standards issued by the Financial Action Task Force (FATF), domestic legislation, regulatory rules and supervisory guidance. Sanctions regimes may be imposed by the United Nations, regional organisations or individual states. Requirements differ by jurisdiction; consequently, a bank must identify the law applicable to its entity, branches, customers, transactions, products and correspondent relationships rather than rely on a universal checklist.

A mature programme combines governance, customer due diligence (CDD), beneficial-ownership analysis, transaction monitoring, sanctions screening, suspicious activity reporting (SAR), fraud controls, record keeping, training, independent testing and continuous improvement. Its central principle is proportionality: resources should be directed toward the highest risks, while lower risk must still be understood and documented.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Explain the purposes and distinctions among AML, CFT, sanctions compliance and fraud prevention.
2. Apply a risk-based approach to customer and beneficial-owner due diligence.
3. Design a logically coherent transaction-monitoring and alert-management process.
4. Evaluate sanctions-screening and correspondent-banking controls.
5. Determine when escalation and suspicious activity reporting are appropriate.
6. Critically assess governance, technology, privacy, effectiveness and ethical risks.

1. The financial-crime risk landscape

Money laundering

Money laundering is the process of disguising the criminal origin of property or proceeds. A conventional analytical model describes three overlapping stages:

• Placement: introducing illicit proceeds into the financial system, for example through deposits, purchases or cash-intensive businesses.
• Layering: creating distance from the underlying offence through transfers, securities transactions, trade transactions, loans or multiple entities.
• Integration: making the proceeds appear to be legitimate wealth or business revenue.

The stages are not mandatory or sequential. Digital payments, virtual assets and sophisticated trade structures may combine them or bypass placement entirely.

Terrorist financing and proliferation financing

Terrorist financing concerns the collection or movement of funds for terrorist acts, organisations or individuals. Unlike money laundering, the funds may originate from lawful activities and may be small. Proliferation financing concerns funds or financial services connected with the development, acquisition or transfer of weapons of mass destruction and related delivery systems. These distinctions matter because a programme designed only to detect unusually large or profitable transactions may miss serious threats.

Sanctions

Sanctions restrict dealings with designated persons, entities, countries, sectors, goods, services or activities. They may be asset freezes, trade restrictions, financial prohibitions, travel restrictions or sectoral measures. Sanctions compliance is related to AML/CFT but is not identical to it: a transaction can breach sanctions without appearing suspicious under an AML model, and a suspicious transaction may involve no sanctioned party.

Fraud and predicate offences

Fraud is generally the intentional use of deception for unlawful gain or to cause unlawful loss. It is often the source of laundering risk, but fraud prevention also protects customers and the bank from direct losses. Common forms include payment impersonation, account takeover, synthetic identity fraud, insider abuse, loan fraud, cyber-enabled theft and manipulation of digital channels. AML, sanctions and fraud teams should exchange intelligence while preserving clear legal responsibilities and investigative controls.

2. The risk-based approach

A rules-only system treats every customer and transaction alike. A risk-based approach identifies threats, vulnerabilities and consequences, then applies controls proportionate to the assessed risk. FATF-style supervision expects institutions to understand their risks rather than simply accumulate documents.

A bank-wide risk assessment normally considers:

• customer types, ownership structures and occupations;
• countries and geographic corridors;
• products, services and delivery channels;
• transaction volumes, values and velocities;
• cash, correspondent, private-banking and trade-finance exposure;
• use of intermediaries, agents and fintech partners; and
• quality of available data and control effectiveness.

A useful conceptual model is:

Here, inherent risk is the exposure before controls, control effectiveness is expressed as a proportion from 0 to 1, and residual risk is the exposure remaining after controls. This is a management heuristic, not a universally prescribed regulatory formula. It assumes that the input scales are defined consistently and that control effects are represented meaningfully; risks that are correlated or non-linear should not be reduced mechanically to one number.

Risk ratings should be supported by evidence, not by unexplained scores. A high-risk rating does not automatically mean rejection, and a low-risk rating does not eliminate monitoring. The appropriate response may include enhanced due diligence (EDD), senior approval, tighter limits, more frequent review, additional source-of-wealth evidence or exit.

Customer risk assessment

A customer risk assessment should examine the purpose and expected nature of the relationship, occupation or business, source of funds, source of wealth where relevant, geography, ownership and control, products requested and delivery method. Risk indicators are contextual. A politically exposed person (PEP) is not necessarily a criminal, but public position may create corruption and bribery exposure requiring additional controls.

Risk assessments should be refreshed when there is a material change, such as a new beneficial owner, unexplained change in activity, adverse media, a new high-risk geography or a significant product expansion. Periodic review alone is insufficient where events provide earlier warning.

3. Customer due diligence and beneficial ownership

CDD is a continuing process, not a one-time identification exercise. Its core elements are:

1. identifying and verifying the customer;
2. identifying and taking reasonable measures to verify beneficial owners;
3. understanding the purpose and intended nature of the relationship;
4. understanding expected activity and risk; and
5. conducting continuing due diligence and updating information.

Beneficial ownership

The beneficial owner is the natural person who ultimately owns or controls a customer, or on whose behalf a transaction is conducted. Legal ownership may obscure control through companies, trusts, nominees, layered entities or shareholder agreements. A sound inquiry proceeds through ownership and control rather than stopping at the first corporate shareholder.

A practical sequence is:

• identify natural persons with a controlling ownership interest under applicable law;
• identify persons exercising control through other means, such as voting rights, appointment powers or contractual influence; and
• where no natural person can be identified after reasonable efforts, apply the jurisdiction’s permitted senior-managing-official fallback and document the analysis.

The fallback is not a shortcut. A bank should retain ownership charts, registers, constitutive documents, identification evidence, explanations of control and the rationale for its conclusion. Trusts require attention to the settlor, trustee, protector, beneficiaries or class of beneficiaries and any person exercising ultimate control, subject to local law.

Simplified and enhanced due diligence

Simplified due diligence may be appropriate only where a documented assessment establishes lower risk and applicable law permits it. It must not be used where there is suspicion, sanctions exposure or a legal prohibition. EDD may include independent verification, detailed source-of-wealth analysis, senior management approval, corroboration of business activity, more intensive monitoring and shorter review cycles.

CDD can fail in two opposite ways. Weak CDD permits anonymous or opaque relationships; excessive, indiscriminate CDD produces customer exclusion, poor data quality and alert fatigue. Proportionality and explainability are therefore both compliance and fairness requirements.

4. Transaction monitoring and suspicious activity reporting

Transaction monitoring seeks to identify activity inconsistent with a customer’s known profile or indicative of criminal methods. It may use rules, scenarios, statistical methods, network analysis and investigator judgment. Examples of risk patterns include:

• rapid movement of funds through newly opened accounts;
• transactions inconsistent with stated occupation or business;
• structuring to avoid reporting thresholds;
• unusual use of cash, money-service businesses or high-risk corridors;
• circular payments with no clear economic purpose;
• third-party payments and unexplained pass-through activity;
• trade transactions with implausible prices, quantities or routes; and
• transactions involving adverse media, high-risk persons or sanctioned connections.

A monitoring scenario should have a defined typology, population, threshold or logic, rationale, owner, tuning process and validation evidence. Thresholds should not be treated as proof of illegality. A transaction below a threshold may still be suspicious, while a legitimate transaction above it may be explainable.

The operational sequence is usually:

data capture → screening or scenario detection → alert generation → triage → investigation → escalation or closure → SAR decision → filing and follow-up

Investigators should reconstruct the relationship, not assess an isolated payment. They should examine customer information, counterparties, beneficial ownership, prior alerts, account flows, device or channel information where lawful, explanations and documentary evidence. Closure decisions should state the facts, analysis, rationale and any remedial action.

A SAR is generally based on reasonable suspicion under the applicable legal standard, not proof beyond reasonable doubt. Filing a report does not replace account controls, and a report should not be disclosed to the subject where tipping-off prohibitions apply. Confidentiality, secure access and careful communication are essential.

Alert-quality metrics

Useful measures include alert volumes, true-positive rates, aged cases, repeat alerts, investigative turnaround time, filing timeliness, model stability and quality-assurance findings. A high closure rate does not necessarily mean a good system; it may indicate excessive false positives or weak investigation. Metrics must be interpreted with sampling, thematic reviews and independent challenge.

5. Sanctions screening and controls

Sanctions controls should operate across customers, beneficial owners, counterparties, payment messages, trade documents, vessels, goods and other relevant data. Screening design requires:

• authoritative and timely list ingestion;
• name transliteration and alias handling;
• date of birth, nationality, address and entity identifiers;
• ownership and control analysis, including indirect ownership where required;
• fuzzy-matching calibration;
• documented alert disposition; and
• escalation, blocking, rejection or reporting in accordance with the relevant regime.

A name match is not automatically a true match. Analysts must compare identifiers and assess whether the listed party is involved. Conversely, a screening engine cannot substitute for legal analysis: some regimes prohibit dealings based on ownership, control, sector or activity even where a name is absent from a list.

Screening should occur at onboarding, periodically, at payment initiation and when lists or customer data change. Controls must include resilience, time-zone coverage, list-change testing and procedures for system outages. A bank should not assume that screening one side of a payment is enough when other parties, goods or jurisdictions create exposure.

6. Correspondent banking and higher-risk services

Correspondent banking enables one institution to provide payment or settlement services to another institution. It can amplify exposure because the correspondent may not know every underlying customer using the respondent’s accounts. Before establishing a relationship, the bank should understand the respondent’s ownership, management, reputation, licensing, AML/CFT programme, customer base, jurisdictions, products, nested relationships and regulatory history.

Controls commonly include senior approval, a written risk assessment, clear contractual responsibilities, prohibition of anonymous or shell-bank relationships where applicable, information-sharing arrangements, transaction monitoring and periodic review. Payable-through accounts require particular attention because the respondent’s customers may obtain direct access to the correspondent’s system.

De-risking—terminating entire categories of customers or countries without a proportionate assessment—can push activity into less transparent channels and reduce access to finance. A more defensible approach is calibrated risk mitigation, while recognising that some relationships must be refused or exited where legal, operational or reputational risks cannot be controlled.

7. Fraud prevention, data and artificial intelligence

Fraud controls operate before, during and after a transaction. Preventive controls include strong authentication, device and behavioural analysis, transaction limits, payee verification, segregation of duties and customer warnings. Detective controls include anomaly detection, mule-account analysis, employee monitoring subject to law, and rapid post-transaction review. Corrective controls include freezing or recalling funds where lawful, customer remediation, root-cause analysis and law-enforcement cooperation.

Technology can improve screening and monitoring through graph analytics, entity resolution, natural-language processing and machine-learning models. However, automation introduces risks: biased data, opaque decisions, concept drift, adversarial behaviour, privacy breaches and excessive reliance on vendor claims. Model governance should include documented purpose, data lineage, validation, performance testing, explainability proportionate to use, human review, access controls, change management and independent assurance.

Data minimisation must be balanced against record-keeping and investigative requirements. Cross-border transfers, confidentiality, data protection, proportionality and lawful information sharing require explicit governance. A technologically sophisticated system with unreliable customer identifiers may perform worse than a simpler, well-controlled system.

8. Governance and the three-lines model

The board is responsible for setting risk appetite and ensuring adequate resources. Senior management converts that appetite into policies, systems and accountability. A compliance function should have sufficient authority, independence, expertise and access to information. Business units own the risks created by their activities; compliance provides oversight and challenge; internal audit provides independent assurance. These roles must not be confused.

A strong programme includes:

• an enterprise-wide risk assessment;
• written policies linked to legal obligations;
• accountable owners and escalation routes;
• employee screening and role-based training;
• quality assurance and independent testing;
• regulatory reporting and record retention;
• issue management with deadlines and accountable executives; and
• a process for learning from enforcement actions, incidents and typologies.

The board should receive meaningful information: material risks, overdue remediation, control failures, suspicious-activity trends, sanctions incidents, staffing constraints and emerging threats—not merely the number of training completions.

9. Illustrative case: Northbridge Bank and an import-export customer

Background. Northbridge Bank onboards Meridian Trade Solutions Ltd, incorporated locally and owned through two companies in different jurisdictions. Meridian states that it imports consumer electronics. It requests a current account, trade finance and international payments.

Problem. The stated business is plausible, but the ownership chain ends in a trust with a professional trustee. Expected monthly turnover is modest. Within three months, the account receives numerous payments from unrelated companies, rapidly sends funds to a high-risk corridor, and presents invoices with inconsistent product descriptions. One counterparty resembles a name on a sanctions list. A director is also identified as a PEP.

Analysis. The combination of layered ownership, PEP exposure, rapid pass-through activity, inconsistent trade information and a potential sanctions match creates elevated risk. None of the indicators alone proves criminal conduct. The bank must distinguish a false sanctions match from a true match, identify the trust’s relevant parties and establish the source and purpose of funds.

Approach. Northbridge pauses the relevant payment in accordance with law and internal procedures, escalates the sanctions alert, and obtains reliable identifiers. It requests the ownership and control documents, trust information, contracts, shipping records, customs evidence, source-of-wealth information and an explanation of counterparties. Compliance reviews linked accounts and transaction networks, while trade-finance specialists test whether goods, prices and routes are commercially credible. Senior management considers whether the relationship can be controlled. If reasonable suspicion remains, the bank files a SAR without tipping off Meridian and applies legally appropriate account restrictions. It separately reports or blocks any confirmed sanctions exposure.

Outcome. The sanctions match is resolved as a false positive, but documents cannot explain the payment network and shipping records conflict with invoices. Northbridge exits the relationship under a controlled process, preserves records, considers recovery and law-enforcement engagement, and conducts a post-incident review. The review identifies that the onboarding form did not capture trust-control information and that a trade-monitoring scenario was not calibrated for rapid pass-through activity.

Learning points. Effective compliance is cumulative and investigative. The bank neither rejects the customer merely because it is complex nor accepts explanations without corroboration. AML suspicion, sanctions determination and commercial fraud analysis are related but separate judgments requiring documented evidence.

10. Challenges, limitations and contemporary developments

Financial crime controls face encrypted communications, instant payments, virtual assets, artificial intelligence, deepfakes, mule networks, trade-based laundering, professional enablers and fragmented cross-border data. Criminals exploit differences in national laws, identity standards and reporting practices.

No system detects all illicit activity. False positives impose cost and customer friction; false negatives create legal, financial and social harm. Models trained on historical reports may reproduce institutional bias. Automated exclusion can disproportionately affect migrants, small firms and customers with limited documentation. Ethical compliance therefore requires reasoned proportionality, appeal or review mechanisms where appropriate, secure handling of data and attention to financial inclusion.

Contemporary programmes increasingly use interoperable identity systems, real-time payment controls, network analytics and public–private information sharing. These tools are valuable only when supported by lawful governance, data quality and human accountability. Regulatory effectiveness should be judged by the quality of risk reduction and decision-making, not by the quantity of alerts or reports alone.

Best-practice implementation framework

A practical implementation cycle is:

1. map legal obligations and institutional exposure;
2. perform and document the enterprise risk assessment;
3. define risk appetite, prohibited relationships and escalation criteria;
4. design CDD, beneficial-ownership, sanctions and monitoring controls;
5. validate data, scenarios, models and vendor services;
6. train staff according to their roles;
7. investigate, report and remediate consistently;
8. test effectiveness through sampling, audits and thematic reviews; and
9. revise controls as products, threats, law and technology change.

The ultimate objective is not procedural perfection. It is a defensible, intelligence-led and continually improving system that prevents the institution from becoming an enabler of financial crime while preserving legitimate access to banking.

Chapter Summary

AML/CFT, sanctions and financial-crime compliance are interconnected but distinct disciplines. A risk-based programme begins with an evidence-based assessment of customer, geographic, product, channel and transaction risk. CDD must identify customers, understand the purpose of relationships and establish beneficial ownership through ownership and control analysis. Monitoring should detect meaningful typologies, support investigation and lead to timely escalation or SAR filing where the applicable standard is met. Sanctions controls require accurate list management, contextual matching, ownership analysis and operational resilience. Correspondent banking demands enhanced understanding of respondent institutions and underlying risks. Fraud prevention combines preventive, detective and corrective controls. Governance, data quality, model validation, human judgment, privacy and proportionality determine whether technology produces effective rather than merely voluminous compliance. Boards and managers must treat the framework as an ongoing risk-management system supported by independent assurance and continuous learning.

Key Terms

AML: Measures designed to prevent and detect money laundering.

CFT: Measures designed to prevent and detect terrorist financing.

Proliferation financing: Financing connected with the proliferation of weapons of mass destruction and related systems.

Sanctions: Legal restrictions imposed on persons, entities, countries, sectors, goods or activities.

Risk-based approach: Allocation of controls and resources in proportion to assessed risk.

CDD: Processes for identifying customers, understanding relationships and conducting ongoing monitoring.

Enhanced due diligence: Additional investigation and controls applied to higher-risk relationships.

Beneficial owner: Natural person who ultimately owns, controls or benefits from a customer or transaction.

PEP: Person entrusted with a prominent public function, together with relevant associated risk considerations.

Source of funds: Origin of particular money used in a transaction or relationship.

Source of wealth: Origin of a person’s total accumulated wealth.

Transaction monitoring: Review of activity to identify unusual or suspicious patterns.

SAR: Report submitted to an authorised financial-intelligence or law-enforcement authority concerning suspected illicit activity.

Tipping off: Improperly revealing that a suspicious-activity report or investigation exists.

Sanctions screening: Comparing relevant persons, entities or transactions with sanctions data and restrictions.

Correspondent banking: Banking services provided by one institution to another institution.

Nested relationship: Indirect access to a correspondent through an intermediary respondent.

False positive: Alert that appears relevant but is not a true risk match after investigation.

Residual risk: Risk remaining after controls are applied.

Model risk: Risk that a model is unsuitable, incorrectly implemented or poorly governed.

Review Questions

Short Answer Questions

1. Distinguish money laundering from terrorist financing.
2. What is the purpose of beneficial-ownership identification?
3. Why is a sanctions match not automatically a sanctions violation?
4. What is the function of transaction monitoring?
5. State two governance responsibilities of a bank’s board.

Long Answer Questions

1. Explain how a bank should apply a risk-based approach across customers, products, geographies and delivery channels.
2. Discuss the stages and evidential requirements of a robust CDD and beneficial-ownership process.
3. Evaluate the design and governance of a transaction-monitoring programme.
4. Explain the distinctive risks and controls of correspondent banking.
5. Critically assess the benefits and limitations of artificial intelligence in financial-crime compliance.

Analytical / Application Questions

1. A small company receives many unrelated payments and rapidly transfers funds to several countries, while its ownership records are incomplete. Identify the principal risks, evidence required and immediate control actions.
2. A payment produces a name-screening alert, but the customer’s date of birth and address differ from the listed individual. Explain how the bank should investigate and document the disposition.
3. A bank has a very high alert-closure rate but repeated regulatory findings on data quality. Analyse why closure rates alone are inadequate and propose a more balanced effectiveness framework.

Multiple Choice Questions with Answers

Question 1

Which statement best describes a risk-based AML approach?

A. Apply identical controls to every customer

B. Allocate controls in proportion to assessed risk

C. Accept all customers below a monetary threshold

D. Rely only on automated screening

Correct Answer: B. Allocate controls in proportion to assessed risk

Question 2

Who is generally the beneficial owner of a company?

A. The company’s external auditor

B. The customer-service officer

C. The natural person who ultimately owns or controls it

D. Any employee authorised to make payments

Correct Answer: C. The natural person who ultimately owns or controls it

Question 3

Which statement correctly distinguishes sanctions compliance from AML?

A. Sanctions compliance is identical to transaction monitoring

B. Sanctions can apply even where activity is not otherwise suspicious

C. AML applies only to cash transactions

D. Sanctions apply only after a SAR is filed

Correct Answer: B. Sanctions can apply even where activity is not otherwise suspicious

Question 4

What is the appropriate basis for a suspicious activity report in many legal systems?

A. Proof beyond reasonable doubt

B. A customer’s refusal to answer one question

C. Reasonable suspicion under applicable law

D. Any transaction exceeding a fixed amount

Correct Answer: C. Reasonable suspicion under applicable law

Question 5

Which control is particularly important before establishing a correspondent relationship?

A. Ignoring the respondent’s customer base

B. Understanding the respondent’s ownership, controls and reputation

C. Allowing anonymous shell-bank access

D. Screening only the correspondent’s chief executive

Correct Answer: B. Understanding the respondent’s ownership, controls and reputation

Question 6

Why should a bank investigate a sanctions alert rather than automatically treating every alert as a confirmed violation?

A. All sanctions lists are unreliable

B. A name match may be a false positive requiring contextual comparison

C. Sanctions apply only to domestic payments

D. Customer explanations are always conclusive

Correct Answer: B. A name match may be a false positive requiring contextual comparison

Question 7

Which action is most consistent with effective beneficial-ownership analysis?

A. Stop at the first corporate shareholder

B. Use only the customer’s marketing brochure

C. Trace ownership and control to natural persons and document the rationale

D. Assume the account signatory is always the owner

Correct Answer: C. Trace ownership and control to natural persons and document the rationale

Question 8

What is a principal danger of using alert-closure rates as the sole compliance metric?

A. They measure customer profitability

B. They may conceal excessive false positives or weak investigations

C. They eliminate the need for independent testing

D. They prove that models are unbiased

Correct Answer: B. They may conceal excessive false positives or weak investigations

Question 9

Which is a preventive fraud control?

A. Post-incident root-cause analysis

B. A customer warning and payee-verification control before payment

C. A retrospective SAR review only

D. Deleting disputed transaction records

Correct Answer: B. A customer warning and payee-verification control before payment

Question 10

Under the chapter’s illustrative heuristic, if inherent risk is 0.8 and control effectiveness is 0.75, what is residual risk?

A. 0.05

B. 0.20

C. 0.60

D. 1.55

Correct Answer: A. 0.05