Picture a payment firm's alert queue at 9:00 (an illustrative case). Two alerts are waiting. The first is a sanctions screening hit on a customer onboarded yesterday: the name matches a list entry, but the entry's date of birth is 14 years off. The second is a transaction monitoring alert on a customer of three years: $18,000 arrived from four senders and left for one account within six hours.
The first alert will probably close within minutes, with a reason on file. The second may end on the reporting officer's desk. Both reach the AML analyst first. The rules that raised them come from the financial crime risk analyst, who decides what the firm's transaction monitoring looks for. What each alert means is the AML analyst's call.
What are the roles and responsibilities of an AML analyst?
An AML analyst works the alert queue of a firm's anti money laundering controls. It is the usual entry seat of an AML career. Read as a job description, the role comes down to five duties: review each alert, pull the customer file, check the history and the counterparties, close the alert with a written reason or escalate it, and tell the rule owner which rules keep producing noise.
Reporting sits outside the seat. In the UK the decision to report belongs to the nominated officer, often titled money laundering reporting officer (MLRO).
A US bank files its own suspicious activity reports and, under 31 CFR 1020.210, designates an individual to coordinate and monitor its day to day compliance, the AML compliance officer.
Neither 31 CFR 1020.210 nor the UK's Money Laundering Regulations 2017 mention an analyst. They require an AML compliance program with monitoring and reporting, and the analyst seat is where its daily work gets done. Take the 9:00 screening hit. The analyst compares the list entry's date of birth and nationality with the customer's and finds both different. The closing note reads "name match only; date of birth 14 years apart; nationality differs", and a reviewer can still follow it a year later.
Which queues do AML analysts work?
The job is the same in every seat; the queue changes. A watchlist screening analyst clears sanctions, politically exposed person (PEP) and adverse media hits at onboarding and after list updates. Alerts that rules raise on payments and account activity go to a transaction monitoring analyst.
A know your customer (KYC) analyst builds the customer file at onboarding and updates it when a review falls due or a trigger fires. In countering the financing of terrorism (CFT), the seat is often titled AML/CFT analyst and looks for signs of terrorist financing, which can hide in small amounts.
Harder cases go to AML investigators, and firms bring in AML consultants for remediation work or a backlog.
How does one alert move from the queue to a decision?
Table 1. One alert from the queue to the record (illustrative workflow; the last column lists complead features as published)
| Stage | Input | Output | Who decides | What the platform changes |
|---|---|---|---|---|
| Queue | Alerts from screening and monitoring rules | A list ordered by risk | Team lead | A rule can be limited to one alert per day for the same customer (October 2026 release) |
| Triage | The alert, the rule and the matched data | Clear match, clear miss, or needs work | Analyst | Shows the rule that fired and the signals that matched |
| File review | KYC file, history, counterparties, news | Facts for and against suspicion | Analyst | One risk score per customer; graph hops kept as case evidence |
| Decision | The facts gathered | Closed with a reason, or escalated | Analyst | Agents close routine cases with the evidence attached |
| Escalation | The analyst's note and evidence | A case for the officer | Officer takes it on | A narrative in the examiner's format and a work log |
| Report | The case | SAR or STR filed, or no report | MLRO, nominated or compliance officer | Reporting support within case management |
| Record | Every step above | A file a reviewer can follow | The firm's procedures | Every screening search logged with who, what, when and the result |
The analyst's decisions end at escalation. From there the case is the officer's, and every row adds to the record.
The EU's anti money laundering authority sets the same order. Paragraph 75 of AMLA's draft guidelines on ongoing monitoring asks that monitoring outputs be assessed "without undue delay" and prioritized by risk. Outputs that need more analysis go to staff who know the customer and have the expertise.
The 9:00 transaction alert needs that expertise. Its file review covers the expected activity in the KYC file, three years of history, the four senders and the receiving account. In complead, onboarding, screening, monitoring, fraud and investigation share one engine, complead Fusion, so the analyst sees the customer's single risk score whichever check raised the alert. The connections graph adds the network around the customer, with every hop sourced and kept as case evidence.
Why do alerts close as false positives, and what clears them?
The New York State Department of Financial Services found that by late 2021 Coinbase, Inc. had "a significant and growing backlog of over 100,000 unreviewed transaction monitoring alerts", and that numerous SARs were "filed months after the suspicious activity was first known". Under the settlement announced on 4 January 2023, Coinbase, Inc. agreed to pay a $50 million penalty and to invest $50 million more in its compliance function over two years.
Alert volume starts with design. Rules are written wide so they miss little. Names repeat across customers and lists, and thin data leaves nothing to rule a match out with, so a share of every queue closes as legitimate. Each false positive still needs a reason. Missing data cuts both ways: an empty date of birth turns a clear miss into a long check, and a missing counterparty can hide the case that matters.
Three habits cut the noise without lowering the guard. Earlier decisions on the same customer and name stay attached, so nobody clears the same match twice. Fuzzy matching thresholds are set per list type, or per list, with a lower threshold on sanctions lists than on watchlists. Analysts report rules that only produce noise. The rule owner tunes them, for example by limiting a rule to one alert a day for the same customer.
AMLA's draft asks firms to identify, monitor and address any build up of pending outputs that may affect how well monitoring works (paragraph 76), so queue volume has to be planned for. At Moldcell, Moldova's leading telecom operator, about 10,000 of about 100,000 transactions screened on complead went to review, figures the company reported in July 2026.
When does an AML analyst escalate, and who decides to report?
An analyst escalates when the file review leaves a suspicion the facts cannot explain. In the 9:00 transaction alert, the file shows salary income and nothing explains four new senders and an exit within six hours. The analyst writes what was checked and what remains unexplained, attaches the evidence and passes the case on.
From there the officer decides. In the UK regulated sector, staff disclose to a nominated officer, or to the National Crime Agency, "as soon as is practicable" under section 330 of the Proceeds of Crime Act 2002.
The officer "must consider" each internal disclosure and determine whether it gives rise to knowledge or suspicion, or reasonable grounds for either, under regulation 21(5) of the Money Laundering Regulations 2017. Section 331 then sets the officer's own duty to disclose to the National Crime Agency.
A US bank must file its suspicious activity report within 30 calendar days of initial detection. When no suspect was identified, it may take 30 more days to find one, but never more than 60 in all (31 CFR 1020.320).
The joint SAR FAQs that FinCEN and four federal regulators issued on 9 October 2025 say no separate review is required after a SAR to see whether activity continued. Firms that choose to follow the continuing activity guidance of the Financial Crimes Enforcement Network (FinCEN) file at Day 30 and, if the activity continued, again at Day 150; a firm that files its first SAR at Day 60 because no suspect was identified files again at Day 180.
What goes in the case record?
A US bank keeps each SAR filed and its supporting documentation for five years from filing, under paragraph (d) of the same section. For a decision not to file, the 2025 FAQs say there is "no requirement or expectation" to document it. Where a bank chooses to, "a short, concise statement ... will likely suffice" in most cases. AMLA's draft leans the other way for EU firms: they should be able to explain, on request, how outputs were assessed, escalated and acted upon, including the "documented rationale for decisions taken".
The FAQs tie the depth of any such record to what the institution's own policies, procedures and controls need. A usable reason names what was checked, what was found, the decision, who made it and when.
What skills make a good anti money laundering analyst?
Neither rulebook above sets a qualification for the seat. Where appropriate to the size and nature of the business, UK regulation 21 asks firms to screen relevant employees for "the skills, knowledge and expertise" their functions need, and for conduct and integrity. In the queue, four skills show:
- Knowing the firm's business. An alert only makes sense against what that kind of customer is expected to do: salary in and rent out is normal, four new senders are not.
- Writing. The closing reason and the escalation note are what the officer acts on and what an examiner reads later.
- Knowing the reporting rules. For a US bank, the SAR duty needs a transaction that "involves or aggregates at least $5,000" plus knowledge, suspicion or reason to suspect, for example that the money comes from illegal activity. A UK disclosure turns on knowledge or suspicion, or reasonable grounds for either.
- Knowing the data sources. A missing field can decide whether a case is caught, so the analyst knows where else to look: the KYC file, payment details, company registers and the news.
Certifications help a candidate into the job. A team lead sampling closed alerts looks for these four.
How can a company support its AML analysts?
Support starts with the queue: fewer repeat alerts, evidence gathered before the case opens, and a clear line on what software may close alone. AMLA's draft draws that line for EU firms. Automated closure should apply only to outputs that show no suspicious or unusual activity or other material risk indicators, never where heightened risk shows (paragraph 78). The decision logic should be understood and documented, with "effective human oversight" such as periodic validation through sampling (paragraph 79). Responsibility for monitoring decisions should stay "clearly assigned" (paragraph 88), and a firm should be able to explain a tool's role and outputs to the authorities in a way that lets them understand, assess and challenge those outputs, "without requiring full technical interpretability of the underlying model" (paragraph 90).
In complead, agents close the routine cases, each with its evidence, a narrative and the work log, and analysts open the cases that need judgment. Since the October 2026 release, an agent is measured in shadow mode against the analysts' decisions before it goes live. Each alert shows which rule fired and which signals matched. The record names who decided. Before a rule change reaches the queue, the rules engine backtests it over 30, 60 or 90 days of real history and reports alert volume, clearance rate and true positives.
How does AML software work for the analyst?
AML software runs the checks that fill the queue and the case screens that empty it. The analyst's test is whether each alert arrives with its reason and evidence, and whether every decision traces to a person.
Which 2026 rule changes reach an AML analyst's desk?
- 28 January 2026. The OFSI Consolidated List closed and is no longer updated. Since that day every UK sanctions designation comes from one source, the UK Sanctions List (gov.uk notice).
- 13 February 2026. Under FinCEN's exceptive relief, covered US financial institutions no longer identify and verify a legal entity customer's beneficial owners each time it opens a new account. They do it when the customer first opens an account, when facts reasonably call earlier information into question, or as their risk based procedures require.
- 3 June 2026. AMLA published its draft guidelines on ongoing monitoring, with paragraphs 75 to 79 on how alerts and other monitoring outputs are assessed. The consultation closed on 3 September 2026; on 7 November 2026 its page still said results will follow.
Back to the five duties in the job description. The last one, the note telling the rule owner which rule sent only noise, starts the next piece of work. On the rule owner's desk it turns into a question: how do you write a monitoring rule whose alerts are worth an analyst's morning?
Sources. Fact checked by Ufuk Gürdaş, Compliance Specialist; reviewed on 8 November 2026. The Coinbase, Inc. lines come from the New York State Department of Financial Services release of 4 January 2023. The US reporting rules come from 31 CFR 1020.210 and 1020.320 and the joint SAR FAQs of 9 October 2025, the UK lines from sections 330 and 331 of the Proceeds of Crime Act 2002 and regulation 21 of the Money Laundering Regulations 2017. The EU lines quote AMLA's consultation paper of 3 June 2026 (paragraphs 75 to 79, 88 and 90). Each source was reread on 7 November 2026.
