Three questions from New York's Part 504 frame an examiner's review of an AML tool: which detection scenario raised this alert, what threshold fired it, and who decided whether it became a suspicious activity report (504.3(a)(4), (6) and (7)). A tool is judged by whether its own records answer them, and the questions start in transaction monitoring, the module that raises the alerts.
What does AML software do, module by module?
Table 1. The five modules of AML software and who decides in each.
| Module | Input | Output | Who decides |
|---|---|---|---|
| Customer risk scoring | Onboarding data, owners, countries, products | A risk rating and the CDD level it sets | The analyst approves or escalates; the compliance officer owns the method |
| Screening | Names, payments and counterparties | Possible sanctions and PEP matches | The analyst confirms or clears each match |
| Transaction monitoring | Transactions over time, against scenarios and thresholds | Alerts | The analyst reviews; the firm sets the thresholds |
| Case management | Alerts, documents, notes | An investigated case with its decision trail | The investigator decides; a second reviewer may sign off |
| Regulatory reporting | The case record | A suspicious activity report or STR to the financial intelligence unit | A named officer approves and files |
The modules hand over in that order: the risk rating sets how closely monitoring watches a customer, an alert becomes a case, and a case that holds up becomes a report. Some tools add models or agents that rank alerts or draft a case narrative; a person still makes each decision, and the case file names that person.
What types of AML solutions are there?
AML solutions come in four broad types. On premise software runs on the firm's own servers, cloud software on the vendor's; a modular tool covers one job, such as screening or KYC, and an end to end tool runs all five modules on one customer record. The type changes who maintains the data, not what the examiner asks.
How much work does an AML tool create?
Picture a payments firm (illustrative) with 2 million transactions a month. At an alert rate of 0.3 percent its tool raises 6,000 alerts. If 95 percent are false positives, 300 are worth a closer look, but every one of the 6,000 still needs a review: at 15 minutes each, that is 1,500 analyst hours a month. Tune the rate to 0.2 percent and the queue falls to 4,000 alerts and 1,000 hours.
The FCA's guide expects that "many alerts will be false alarms", above all from automated systems (FCG 3.2.5). So the benefit of a tool depends on its tuning: the scenarios and thresholds a firm sets decide the workload, and the transaction monitoring rules behind each alert need a written reason a supervisor can read.
Each threshold change is a test first. complead, formerly Sanction Scanner, lets a team backtest a rule change in its transaction monitoring software on a 30, 60 or 90 day window of real history, so the alert volume, the clearance rate and the true positives of the new setting are known before it ships.
What do regulators expect of an AML tool?
New York's Part 504 is a rule written for the monitoring system itself. It lets the monitoring system "be manual or automated", then asks that it rest on the institution's risk assessment and carry detection scenarios with threshold values, testing from end to end before and after go live, model validation where relevant, written records of the scenarios and their "assumptions, parameters, and thresholds", and protocols for which alerts become a filing (504.3(a)). Each year by 15 April a board resolution or senior officer compliance finding certifies the program (504.4).
US banking agencies expect the same sound risk management whether a bank calls its system "a model, a tool, or an application", and their 2021 interagency statement says it sets no new supervisory expectations. In the EU, the AML Regulation applies from 10 July 2027.
FCG 3.2.5 gives the FCA's good practice. A firm using automated monitoring "understands their capabilities and limitations"; "Small firms are able to apply credible manual procedures to scrutinise customers' behaviour"; and the "rules" behind monitoring systems "are understood by the relevant staff and updated to reflect new trends".
A firm choosing a tool can test it on those clauses: does it show the scenario, the threshold, the test record and the person who decided? None of these texts requires software; they require monitoring that works and can be shown. Buying an AML tool moves that work into testing, tuning and records rather than removing it.
What did 2026 bring for AML tools?
- 10 April. FinCEN proposed its AML/CFT program rule, citing the AML Act's purpose to "encourage technological innovation and the adoption of new technology by financial institutions"; comments ran to 9 June, and no final rule had followed by 29 October.
- 3 September. AMLA's consultation on its draft guidelines on ongoing monitoring of business relationships, including the transaction and activity monitoring framework (AML Regulation Article 26(5)), closed.
- 20 September. Its consultation on the draft format for reporting suspicions and providing transaction records (Article 69(3)) closed.
Which businesses need AML software?
Picture a money remitter sending 40,000 transfers a month and a casino logging 3,000 cash transactions a day (illustrative). Both must monitor that activity. At that volume a manual review would need more staff than either business has.
The duty itself comes from the FATF Recommendations: financial institutions, from banks to payment firms and life insurers, virtual asset service providers, and DNFBPs such as lawyers, accountants, real estate agents, casinos and dealers in precious metals and stones all run AML checks. Volume decides whether that takes AML compliance software or a spreadsheet and a careful team, since the FCA accepts credible manual procedures at small firms.
For a team that already runs a tool, this week's checks:
- List the products and channels that feed the tool, and the ones that do not.
- Read the last threshold change and the test record behind it.
- Check that the newest product has scenarios before it launches.
Related terms
- False positives and false negatives. Alerts on legitimate activity, and suspicious activity that raises no alert.
- Customer risk assessment. Rating each customer's money laundering risk to set the checks it gets.
- Suspicious activity report. What a firm sends its financial intelligence unit when it suspects laundering.
- Anti money laundering. The laws, controls and checks that stop criminal money entering the financial system.
- Risk based approach. Matching the strength of AML controls to the risk each customer or product carries.
- AML policy. The written statement of how a firm meets its AML duties and who owns each one.
How this entry was checked. No vendor is named or ranked here. The regulator lines were held to the clause each one quotes, from New York's 3 NYCRR Part 504 (504.3 and 504.4), the US interagency statement on model risk management for BSA/AML systems of 9 April 2021, the FCA Financial Crime Guide (FCG 3.2.5), Regulation (EU) 2024/1624, AMLA's two consultation pages and FinCEN's proposed rule of 10 April 2026, all reread on 29 October 2026, and Fatih Coşkun, Founder and CEO of complead, compared the module table with those rules after Sinan Tekin (Regional Sales Manager, complead) drafted it. The payments firm, the remitter, the casino and the workload figures are illustrative. Last reviewed: 30 October 2026.
