the largest single AML penalty in US banking history
Paid in 2025 for monitoring failures a batch process didn't catch in time.
For both traditional banks and neobanks, compliance is handled on a single platform, covering every stage from the first interaction to the final filing; the same customer record is used for onboarding, screening, risk scoring, transaction monitoring and case management.
Onboarding, screening, risk assessment, transactions, and investigations are not distinct events but rather different stages making up the same customer journey, most compliance failures occurring at the point where two of these stages meet.
Paid in 2025 for monitoring failures a batch process didn't catch in time.
Most of a compliance team's day goes to alerts that were never real
"Why did we clear this" has no answer six months later, when a regulator asks.
There is a single workflow covering both retail and corporate banking, and risk is identified at the time the account is opened and remains visible throughout the duration of the relationship.
Screening, as well as those relating to ownership and sanctions, are carried out during the account-opening call, whether it's for retail or corporate customers.
Applicants, directors, beneficial owners, and counterparties are matched against sanctions, PEP, and adverse media in one query.
Existing customers are rescreened with every list update. A new sanctions or PEP designation reaches your queue in the next update cycle, not the next batch run.
The rules created by the compliance team in plain English are tested using the data from last month before they are put into action, and each alert is automatically linked to the customer and their current risk profile.
Each case has its source material, the written reasons behind it and the approvals associated with it; the SAR and STR documents are prepared from that file, enabling your team to take action when a customer's risk changes rather than having to rebuild the entire picture from scratch.
The bank doesn't get fined for a slow system, but it is fined when a decision is based on out-of-date records or when two teams work from different versions of the same customer record. We started by creating one data layer that screening, risk scoring, monitoring, and case management all drew from, with data refreshed every 15 minutes.
The customer's information is entered into the onboarding process and checked against existing records, identity data, and ownership structures; retail and corporate customers go through the workflows and checks defined for their profile type.
As part of the onboarding process, sanctions, PEP, and adverse media checks are carried out; screening rules and thresholds are set in line with your risk appetite, and the relevant results are provided before the customer proceeds further with the relationship.
Customers remain included within the scope when new sanctions, PEP exposure, adverse media, or other risk indicators appear. Routine alerts follow established workflows, while complex issues are escalated with the customer's profile, risk history, and previous decisions already in context, so your team can focus on the areas where judgment matters most.
All decisions include a clear record of the sources used, the reasoning applied, and the actions taken; from the first alert through to the final resolution, each step is documented and ready for examination or audit.
With every decision, three things remain: the sources it was based on, a written explanation in the format your auditor requires, and a record of all the steps taken to reach that decision.
EU data residency available in the contract, not as a workaround.
Longer where your regulator requires it.
Every source the agent opened, in the order it opened them. Exportable.
Who changed which threshold, when, and what the dry run on last month's data showed before it went live.
On every closed case, by policy. Not by habit, not by whoever was on shift.
The sources checked, the scores, and the version of each list on the date of the decision.
Supervisors rarely ask whether screening works. They ask how you know it worked on a given date, and where that is written down.
Papara is one of Türkiye's largest digital banking platforms, licensed by the BRSA. Its onboarding runs at consumer-app speed, so the AML and KYC check had to run inside that flow rather than after it. The customer never waits for compliance.
Yes. Retail and corporate banking run on one workflow and one customer record, each segment with its own thresholds and checks. A customer who holds both a personal and a business relationship appears as one person, not two. The setup works the same way for traditional banks and neobanks.
Yes. Sanctions, PEP and ownership checks run as one step inside your own onboarding flow, with a screening response under 200 ms. The result arrives before the account exists, not in a queue someone clears after the customer is already live.
Applicants, directors, beneficial owners and counterparties, against sanctions, PEP and adverse media in one query. For corporate accounts, the people behind the company are screened together with the company, because exposure usually sits one or two layers below the applicant.
With one file or one API sync. Duplicates across your core banking system, card system and CRM are merged on the way in, so each customer is screened once and raises one alert. This matters most at migration, when the same customer often exists under three spellings in three systems.
Existing customers are rescreened as lists change, and a new designation reaches your queue within fifteen minutes of publication. A name published at midnight is in your morning check, not in next month's batch. For sanctions this matters because freezing obligations apply from the moment of designation.
Spellings such as "Mohammad Al-Hussain" and "Muhammad Alhusayn" resolve to one profile and raise one alert, not two. Entity resolution runs before matching is scored, so analysts review people rather than spelling variants. In bank screening, spelling variants are one of the largest sources of false positive volume.
Yes. Spouses, children and business partners are linked to each PEP, across four tiers from heads of state down to municipal officials. PEP data is built from official gazettes and parliamentary records, country by country. The link is what exposes a relative who opens an account under a different surname.
Yes. The compliance team writes rules in plain English and tests them on last month's data before they go live, so the alert volume a rule creates is known in advance. Each alert links to the customer and their current risk profile, and the analyst sees the transaction next to the onboarding and screening history.
Only what you configure. The agent closes routine cases with a written reason and a full log, and anything outside its remit or below your confidence threshold goes to an analyst. Each closure keeps the sources used, the reasoning and the steps taken, in the format your auditor requires.
Yes. complead runs alongside your existing system on the same customer file until you switch the traffic over, so screening never stops and both systems' alerts can be compared on real names before cutover. The parallel period also gives your model risk and audit teams the evidence they need to approve the change.
Bring a sample of your customer file. In thirty minutes you will see the matches, the scores, and the audit export they produce.