An examiner reviewing a firm's transaction monitoring asks two things about every threshold: what analysis set it, and who approved it. The person who can answer is the financial crime risk analyst, one of the AML careers that sits between detection and strategy.
What does a financial crime risk analyst do?
In 2018, FinCEN found weaknesses in the automated system UBS Financial Services used to monitor foreign currency wires. The firm assured FinCEN it would fix them. It did not. Over 50,000 foreign currency wires worth more than $10 billion then went without proper monitoring, and the firm did not tell FinCEN, which learned of it through its own investigation after an examination. On 3 August 2026 FinCEN assessed a $125 million penalty, which it called the "largest penalty ever imposed against a broker-dealer for BSA violations".
What failed is the work this role exists to do. A financial crime risk analyst decides where the financial crime risk sits, designs the monitoring that matches it, tests that the monitoring still fires and records who approved each change. When a fix is promised, the analyst is the one who can show it shipped.
Job titles vary: financial crime analyst, fincrime or fin crime analyst, financial crime operations analyst or financial crime business analyst. The outputs define the role.
What are a financial crime risk analyst's responsibilities?
Five key actions, each with an output tied to a rule the firm must meet
- The business wide risk assessment. Risks by customer, country, product, transaction and channel, documented and kept current, as FATF's Interpretive Note to Recommendation 1 (paragraph 12) and UK regulation 18 require; the firm gives it to its supervisor on request.
- Scenarios and thresholds with a written reason. Each of the transaction monitoring rules needs the analysis behind its value.
- Tuning and testing. Below the line tests and back tests against past cases show the balance of false positives and false negatives.
- Customer risk factors. The weights and tiers of the customer risk assessment that customer due diligence (CDD) feeds; sanctions and PEP screening results are one input.
- Management information. The FCA expects MI to "provide senior management with sufficient information to understand the financial crime risks" (FCG 2.2.2), "regularly and ad hoc, as risk dictates".
No AML rule names the job. The FATF standard, the UK regulations, the EU directive and its 2027 regulation, and FinCEN's April 2026 proposal require a documented, current risk assessment that the firm can show a supervisor. The duty sits with the firm, which is why every threshold needs a written reason, a test against past cases and a named approver.
complead, formerly Sanction Scanner, shows fincrime analysts a queue sorted by risk and grouped by customer, with the reason for each alert on its row, so a threshold's effect shows where the work happens.
How is a financial crime risk analyst different from an AML analyst or the MLRO?
Table 1. Four financial crime roles compared.
| Role | Main question | Output | Who decides |
|---|---|---|---|
| Financial crime risk analyst | Where is the firm exposed, and do the controls match? | Risk assessment, rules, thresholds, MI | Senior management approves the resulting policies and controls (Directive (EU) 2015/849, Article 8(5)) |
| AML analyst | Is this alert unusual? | A closed or escalated alert | The analyst, within written procedures |
| Investigator | What happened in this case? | A case file and narrative | Passes the case to the reporting officer |
| MLRO or BSA officer | Is there knowledge or suspicion to report? | The SAR decision | The officer; in the UK, staff disclose to a nominated officer (POCA s. 330) |
The four roles sit on one line from design to decision. Financial crime risk analysts set what the system looks for. The AML analyst works the alerts it raises, the investigator builds the case, and the MLRO decides whether to report.
Internal suspicion reports from branches go to the nominated officer, and the officer decides. The analyst's part is to support that decision with the data that showed the pattern.
What skills does a financial crime risk analyst need?
A job description for the role should ask for skills that map to the outputs above:
- Data analytics on the firm's own transactions. Query the history, size a segment and measure how a threshold change moves alert volume.
- Typology knowledge. Know how laundering and fraud schemes look in the firm's products.
- The rulebooks and standards. FATF Recommendation 1, the national regulations and, in the US, the program rule in 31 CFR 1020.210.
- Writing a reason a supervisor can test. One paragraph per threshold: the risk, the data, the result of the test.
- Change control. A dated version history for every rule.
What challenges does a financial crime risk analyst face?
Picture a rule on cash deposits into small business accounts (illustrative). The analyst proposes moving the weekly threshold from $10,000 to $7,500 and back tests it on 12 months of history. It would have raised 40 more alerts a month, so managing the workload is part of the decision, and it would have caught two past SAR cases the old value missed. The change goes on file with that result and the approver's name.
The challenges faced in the role are rarely about the model. They are about keeping the reason, the test and the approver attached to each change while products, rules and record keeping duties move.
The 2026 rule changes the role works to
- 10 April. FinCEN proposed that firms "identify, assess, and document" their risks through risk assessment processes updated promptly after significant change.
- 16 April to 15 July. AMLA consulted on draft guidelines on business wide risk assessment under Article 10(4) of the AMLR, with four minimum requirements.
- June. FATF published an updated edition of its Recommendations.
- 3 August. The UBS order put a price on monitoring left unfixed.
Related terms
- AML compliance officer. The person who runs the AML program.
- MLRO. The officer who decides whether a suspicion is reported.
- Customer risk assessment. The rating of each customer's money laundering risk.
- False positives and false negatives. Alerts that fire without cause, and risk that fires no alert.
- AML risk assessment. The firm's own assessment of its money laundering risks.
- CFCS certification. A financial crime specialist credential.
How this entry was checked. Sources reread on 29 October 2026: the FATF Recommendations as updated in June 2026 (Interpretive Note to Recommendation 1), regulation 18 of the UK Money Laundering Regulations 2017, the FCA's Financial Crime Guide (FCG 2.2.2), section 330 of the Proceeds of Crime Act 2002, 31 CFR 1020.210 and FinCEN's proposal of 10 April 2026, AMLA's consultation on business wide risk assessment, and FinCEN's UBS release of 3 August 2026. No law names the job title, so the duties described are the firm's, assigned to the role. The reviewer, Fatih Coşkun, Founder and CEO, checked each rule and date against its source after the author, Barbaros Sercan (Customer Success Specialist at complead), wrote the entry. Last reviewed: 30 October 2026.
