Your FREE CAMS Flashcards 2026 – 250+ Cards

The process of disguising the illegal origin of criminal proceeds so they appear to come from a legitimate source.

Placement, layering, and integration.

The first stage of money laundering: introducing illicit cash into the financial system (e.g., bank deposits, currency exchange, buying assets).

The second stage: moving funds through complex layers of transactions to obscure their origin and break the audit trail.

The third stage: reintroducing laundered funds into the legitimate economy as apparently clean money (e.g., real estate, businesses).

Providing or collecting funds to carry out terrorist acts; funds may come from legitimate or illicit sources, and amounts are often small.

Money laundering disguises the illegal SOURCE of funds; terrorist financing disguises the illegal USE or DESTINATION of funds, which may be legitimately sourced.

The underlying criminal activity (e.g., drug trafficking, fraud, corruption) that generates the proceeds being laundered.

Breaking a large transaction into smaller amounts to evade reporting or recordkeeping thresholds; a federal crime in the U.S.

A form of structuring using multiple people (smurfs) to make many small deposits below the reporting threshold.

Disguising proceeds and moving value through trade transactions using techniques like over- or under-invoicing, multiple invoicing, or misrepresenting goods.

Stating a price higher than the true value of goods to transfer extra value to the exporter; a TBML technique.

Stating a price lower than the true value of goods to transfer value to the importer; a TBML technique.

An informal value transfer system that moves money based on trust and a network of brokers (hawaladars), often outside the formal banking system.

A money-transfer network that operates outside or parallel to regulated financial institutions (e.g., hawala, hundi, fei ch'ien).

A company with no significant operations or assets, often used to hide beneficial ownership and obscure the flow of funds.

A pre-registered company that has been 'on the shelf' for a period and is then sold to give an appearance of longevity and legitimacy.

A business with legitimate operations that is used to launder illicit funds by commingling them with real revenue.

A fraud scheme in which credit is built up and maxed out with no intent to repay, common with credit cards and trade credit.

Moving funds out of a country and bringing them back disguised as foreign investment to legitimize the money.

A person who transfers illegally acquired money on behalf of others, often recruited unwittingly, to launder proceeds.

A laundering method that exploits legitimate remittance transfers by depositing illicit funds into the account of an unwitting recipient.

Rapidly moving funds among accounts and jurisdictions, often through correspondent banks, to obscure the source.

Physically transporting large quantities of currency across borders to place illicit proceeds outside reporting systems.

A trade-based laundering scheme that uses peso brokers to convert drug dollars into pesos through legitimate trade purchases.

Using property purchases (often with cash, shell companies, or third parties) to integrate illicit funds into the legitimate economy.

Casinos can be used to launder cash by buying chips, gambling minimally, and cashing out as 'winnings' (chip walking, minimal play).

Cryptocurrencies can enable pseudonymous, cross-border value transfer; risks include mixers, tumblers, and unhosted wallets.

Services that pool and redistribute cryptocurrency to obscure the link between sending and receiving addresses.

Prepaid cards, e-money, mobile and internet payments that can pose AML risk through anonymity, speed, and limited oversight.

Providing funds or services for the manufacture, acquisition, or transfer of weapons of mass destruction in breach of international obligations.

Proceeds of human trafficking and migrant smuggling are laundered through cash businesses, money services, and front companies.

Misuse of public office for private gain; corrupt officials launder proceeds via shell companies, real estate, and offshore accounts.

Illegally avoiding taxes; under many regimes (and FATF) tax crimes are designated predicate offenses for money laundering.

Using policies (e.g., single-premium products, early surrender for a refund) to launder funds through the insurance sector.

Using brokerage accounts, securities trades, and wash trading to layer and integrate illicit funds.

Internal omnibus accounts that commingle funds and can obscure the identity of the underlying customers if not properly tracked.

An account in one location that receives many cash deposits, often below the threshold, then quickly withdrawn elsewhere.

An unusual or suspicious indicator in customer behavior or transactions that may signal money laundering or terrorist financing.

Multiple cash transactions just below the reporting threshold, especially across branches or days.

Funds deposited and quickly wired out with no apparent business purpose ('pass-through' activity).

A customer who avoids identification, gives inconsistent details, or resists due-diligence requests.

Transactions inconsistent with the customer's profile, or accounts used by unrelated third parties.

Transactions involving jurisdictions known for weak AML controls, secrecy, or sanctions exposure.

A threat is the criminal actor or activity; a vulnerability is a weakness (e.g., a product, channel, or control gap) that the threat can exploit.

The level of risk before controls are applied — driven by customer, product, geography, and channel factors.

The level of risk that remains after mitigating controls are applied.

Money exchangers can be used to convert illicit cash into other currencies or instruments, layering proceeds with limited oversight.

Removing or altering originator/beneficiary information in a payment message to evade sanctions screening; an illegal layering technique.

Mixing illicit funds with legitimate business revenue to disguise their criminal origin, common in cash-intensive front companies.

A business with high legitimate cash flow (restaurants, car washes, parking) that is attractive for commingling illicit cash.

Laundering in which a launderer 'lends' themselves their own illicit funds (often through an offshore entity) to create an appearance of legitimacy.

A professional (lawyer, accountant, trust/company service provider) whose services can be abused to launder funds or hide ownership.

A provider that forms companies, supplies directors, or administers trusts; a DNFBP that can be exploited to obscure beneficial ownership.

Shares owned by whoever physically holds the certificate, with no register of ownership; a high-risk vehicle for hiding beneficial owners.

A person who acts as a front for the true owner of a company, concealing the real beneficial owner.

A low-tax, high-secrecy jurisdiction used (legitimately or abusively) to hold assets and obscure ownership.

Using stolen or fabricated identities to open accounts and move illicit funds while evading KYC.

Fraud targeting older adults; proceeds are laundered and institutions are expected to detect and report it.

Extortion payments (often in cryptocurrency) are laundered through mixers and exchanges; subject to OFAC advisories.

Illegal trade in protected species and resources generates proceeds laundered through trade and shell companies; a growing FATF focus.

Non-profit organizations can be misused to raise, move, or disguise funds for terrorist financing (FATF Recommendation 8).

Small-value funding (self-funding, social media solicitation, money remitters) to support individuals traveling to conflict zones.

Breaking transactions into very small amounts across many channels or instruments to stay under monitoring thresholds.

The Financial Action Task Force — the global standard-setter for AML, CFT, and counter-proliferation financing; issues the 40 Recommendations.

FATF's comprehensive framework of measures countries should implement to combat money laundering, terrorist financing, and proliferation financing.

A peer review assessing a country's technical compliance with the FATF standards and the effectiveness of its AML/CFT system.

FATF's list of jurisdictions under increased monitoring that have strategic AML/CFT deficiencies and have committed to address them.

FATF's list of high-risk jurisdictions (call for action) with serious deficiencies; members apply enhanced due diligence or countermeasures.

FATF's core principle: identify, assess, and apply AML/CFT resources and controls in proportion to the risks present.

Regional organizations (e.g., APG, MONEYVAL, GAFILAT) that promote and assess FATF standards within their regions.

The Basel Committee on Banking Supervision; issues 'Sound management of risks related to money laundering and financing of terrorism' guidance for banks.

An association of global banks that publishes AML/CFT best-practice guidance, including the correspondent banking and CBDDQ standards.

The Correspondent Banking Due Diligence Questionnaire — a standardized form for assessing correspondent banking relationships.

The global network of Financial Intelligence Units (FIUs) that facilitates secure information sharing on money laundering and terrorist financing.

A national agency that receives, analyzes, and disseminates suspicious activity reports and other financial intelligence (in the U.S., FinCEN).

The 1970 U.S. law (the Currency and Foreign Transactions Reporting Act) requiring recordkeeping and reporting to detect and prevent money laundering.

The Financial Crimes Enforcement Network — the U.S. FIU and BSA administrator within the Department of the Treasury.

2001 U.S. law that strengthened AML rules, including customer identification (Section 326), correspondent account controls, and Section 311/312/313.

Allows the U.S. Treasury to designate a jurisdiction, institution, or transaction type as a 'primary money laundering concern' and impose special measures.

Requires enhanced due diligence for correspondent accounts of foreign banks and for private banking accounts of non-U.S. persons.

Prohibits U.S. banks from maintaining correspondent accounts for foreign shell banks.

A FinCEN information-sharing process letting law enforcement request, via FinCEN, that institutions search records for named subjects.

A voluntary safe harbor allowing financial institutions to share information with each other to identify and report ML/TF.

The U.S. Office of Foreign Assets Control — administers and enforces economic and trade sanctions based on U.S. foreign policy.

OFAC's Specially Designated Nationals and Blocked Persons List — parties whose assets are blocked and with whom U.S. persons are generally prohibited from dealing.

Restrictive measures (asset freezes, trade bans, travel bans) imposed by governments or bodies to influence behavior or punish conduct.

Comprehensive sanctions broadly restrict dealings with a whole country; targeted (smart) sanctions focus on specific persons, entities, or sectors.

An entity owned 50% or more, directly or indirectly, by one or more blocked persons is itself treated as blocked, even if not separately listed.

Sanctions targeting specific sectors of an economy (e.g., finance, energy) rather than a whole country or individual.

A series of EU directives (notably the 4th, 5th, and 6th) harmonizing AML/CFT requirements across member states.

The EU's Fourth AML Directive — introduced a risk-based approach, beneficial ownership registers, and expanded PEP requirements.

The Fifth AML Directive — extended AML rules to virtual asset service providers and prepaid cards and enhanced beneficial-ownership transparency.

The Sixth AML Directive — harmonized the definition of money laundering, listed 22 predicate offenses, and extended liability to legal persons.

The UK's principal money-laundering law, creating the SAR regime and offenses for concealing, arranging, and acquiring criminal property.

The 1988 Vienna Convention (drug trafficking) and 2000 Palermo Convention (transnational organized crime) underpin international AML obligations.

A formal agreement between countries to gather and exchange evidence for criminal investigations and prosecutions.

U.S. law requiring many companies to report beneficial ownership information to FinCEN to combat the misuse of anonymous shell companies.

Non-bank sectors with AML obligations: casinos, real estate agents, dealers in precious metals/stones, lawyers, notaries, and accountants.

A business that transmits or converts money (money transmitters, currency dealers, check cashers, prepaid issuers); subject to BSA registration.

A regulator supervises institutions for AML compliance; the FIU receives and analyzes suspicious activity reports and financial intelligence.

A FATF/BSA requirement that institutions pass originator and beneficiary information along with qualifying funds and virtual asset transfers.

BSA rules requiring institutions to retain CDD, transaction, and reporting records (generally five years) for examination and investigation.

A country deemed to have AML/CFT standards comparable to one's own, which can affect the level of due diligence applied.

A jurisdiction offering strong financial secrecy and minimal transparency, posing elevated AML risk.

Measures to prevent financing of the proliferation of weapons of mass destruction; part of the FATF mandate.

An enterprise-wide program ensuring consistent AML/CFT standards and information sharing across all branches and subsidiaries of a group.

Requires financial institutions to undertake customer due diligence and prohibits anonymous accounts.

Requires originator and beneficiary information to accompany wire and virtual-asset transfers.

Addresses the terrorist-financing risk to non-profit organizations, calling for a risk-based, proportionate response.

An entity that exchanges, transfers, or safeguards virtual assets; subject to FATF AML/CFT obligations including the Travel Rule.

Major U.S. reform that created the beneficial ownership registry, expanded whistleblower rewards, and modernized the BSA.

The U.S. interagency manual that guides examiners and institutions on BSA/AML compliance expectations.

An authorization permitting an otherwise-prohibited category of transactions without a specific application.

A case-by-case written authorization from OFAC permitting a particular transaction that would otherwise be prohibited.

Sanctions targeting non-U.S. persons who engage with sanctioned parties, extending reach beyond U.S. jurisdiction.

OFAC's list of parties subject to non-SDN sanctions programs, screened alongside the SDN List.

Binding sanctions (e.g., asset freezes, arms embargoes) adopted by the UNSC that member states must implement.

The European Union's list of persons and entities subject to EU restrictive measures.

The UK's Office of Financial Sanctions Implementation, which administers and enforces UK financial sanctions.

UK regulations implementing AML/CFT obligations for regulated firms, including CDD and risk assessment.

A FinCEN notice alerting institutions to emerging threats, typologies, or jurisdictions, often with related red flags.

A FinCEN order imposing additional recordkeeping/reporting on transactions in a specific area or sector (e.g., high-value real estate).

Five graduated measures Treasury can impose on a primary money-laundering concern, up to barring correspondent accounts.

A country with AML/CFT controls deemed comparable, which can permit reliance on its institutions' CDD.

A requirement to declare currency or bearer instruments above a threshold when crossing borders (FATF Recommendation 32).

FATF reports describing methods and trends in ML/TF used to inform risk assessments and red flags.

The BSA framework: (1) internal controls/policies, (2) a designated compliance officer, (3) ongoing training, (4) independent testing/audit, and (5) risk-based CDD.

The designated individual responsible for day-to-day oversight of the AML program; must have authority, resources, and independence.

The policies, procedures, and processes designed to limit and control risks and to ensure compliance with AML/CFT laws.

A periodic, objective review of the AML program's adequacy and effectiveness, performed by qualified parties not involved in its operation.

Ongoing, role-appropriate training so staff can recognize red flags and understand their reporting and compliance obligations.

The process of identifying and verifying customers, understanding the nature of the relationship, and conducting ongoing monitoring.

Policies and procedures to verify a customer's identity and assess risk; a foundation of CDD.

The BSA requirement (PATRIOT Act 326) to collect and verify identifying information (name, DOB, address, ID number) before opening an account.

Additional scrutiny applied to higher-risk customers, products, or geographies, such as PEPs and correspondent banking relationships.

Reduced measures permitted for lower-risk customers or products where the ML/TF risk is demonstrably low.

The natural person who ultimately owns or controls a customer or on whose behalf a transaction is conducted.

The natural person at the top of an ownership chain who ultimately owns or controls a legal entity (FinCEN: 25%+ ownership and a control prong).

FinCEN's rule requiring covered institutions to identify beneficial owners of legal entity customers: each 25%+ owner plus one control person.

An individual entrusted with a prominent public function, who poses higher corruption/bribery risk and warrants enhanced due diligence.

FATF distinguishes foreign PEPs (always higher risk, requiring EDD) from domestic PEPs and international-organization PEPs (risk-based EDD).

Source of funds is the origin of the specific money in a transaction; source of wealth is how the customer's total assets were accumulated.

A documented analysis of an institution's ML/TF risks across customers, products, services, geographies, and channels to drive controls.

Assigning customers and relationships a risk level (e.g., low/medium/high) to determine the intensity of due diligence and monitoring.

Continuously reviewing transactions and updating customer information to ensure activity is consistent with the known profile.

A report filed with the FIU/FinCEN when an institution knows, suspects, or has reason to suspect activity involves illegal funds or ML/TF.

The international term equivalent to a SAR — a report of suspicious activity filed with the national FIU.

Generally 30 calendar days after detecting facts that constitute a basis for filing (60 days if no suspect is identified).

Unlawfully disclosing to a customer (or a third party) that a SAR/STR has been or will be filed; prohibited in most regimes.

The requirement to keep the existence and content of a SAR confidential, sharing only as permitted by law (the SAR safe harbor protects filers).

A BSA report filed for cash transactions exceeding USD 10,000 in a single business day, by or on behalf of one person.

Combining multiple same-day cash transactions by or for the same person to determine whether the USD 10,000 CTR threshold is met.

A FinCEN report required of U.S. persons with foreign financial accounts exceeding USD 10,000 in aggregate during the year.

A BSA record of cash sales of monetary instruments (e.g., money orders, cashier's checks) between USD 3,000 and USD 10,000.

A report (filed with the IRS/FinCEN) for cash received over USD 10,000 in a trade or business.

CIP, beneficial ownership identification, sanctions/PEP screening, and risk rating performed before or at account opening.

Scheduled refresh of customer due diligence based on risk (e.g., high-risk annually) to keep information current.

A CDD refresh prompted by a change such as new ownership, a large or unusual transaction, or adverse news.

Reviewing negative news sources for information linking a customer to financial crime, corruption, or sanctions exposure.

Terminating or restricting relationships with customers or categories deemed high-risk to avoid managing the risk, rather than mitigating it.

A governance model: (1) the business owns and manages risk, (2) compliance/risk oversees it, and (3) internal audit independently assures it.

Leadership's responsibility to set the AML culture, approve the program and risk appetite, and ensure adequate resources.

An organizational environment where leadership and staff prioritize ethical conduct and AML obligations across the institution.

The compliance function's ability to act without undue influence from the business lines it oversees.

Channels allowing employees to report concerns; many regimes (e.g., AMLA) provide whistleblower protections and rewards.

Categories of PEPs (foreign, domestic, international organization) plus close associates and family members, each with risk-based scrutiny.

Where one bank (correspondent) provides services to another (respondent); higher-risk because the correspondent relies on the respondent's KYC.

When a respondent bank gives its own customers access to a correspondent account, obscuring the underlying parties (heightened risk).

A correspondent account a foreign bank's customers can use directly to transact; high-risk and subject to enhanced due diligence.

A bank with no physical presence and no affiliation with a regulated financial group; U.S. institutions are prohibited from dealing with them.

High-touch services for wealthy clients; higher AML risk requiring EDD, including source-of-wealth verification (PATRIOT Act 312).

A supervisory review verifying that an institution's AML program meets legal requirements and operates effectively.

A retrospective review of past activity (often regulator-mandated) to identify unreported suspicious activity after a program failure.

A monetary fine imposed by regulators (e.g., FinCEN, OFAC) for AML or sanctions violations.

A formal settlement between a regulator and an institution requiring corrective actions and often penalties for compliance failures.

The amount and type of ML/TF risk an institution is willing to accept, set by the board to guide the program.

Inputs such as customer type, occupation, products used, geography, and transaction behavior used to assign a risk level.

Categories warranting EDD: PEPs, cash-intensive businesses, MSBs, NPOs, non-resident customers, and complex ownership structures.

CDD is performed at onboarding and refreshed through ongoing monitoring and periodic/trigger reviews thereafter.

FinCEN's CDD Rule requires identifying each natural person owning 25% or more of a legal entity customer, plus a control person.

The CDD Rule requirement to identify one individual with significant managerial control over a legal entity customer.

Permitting another regulated party to perform elements of CDD, while the relying institution remains ultimately responsible.

Identifying PEPs, their family members, and close associates to apply enhanced due diligence and senior-management approval.

Required to onboard or continue higher-risk relationships such as foreign PEPs and certain correspondent accounts.

A risk-based program with management commitment, risk assessment, internal controls, testing/audit, and training (per OFAC's framework).

OFAC's framework for a sanctions compliance program: management commitment, risk assessment, internal controls, testing/auditing, and training.

Proactively reporting an apparent sanctions or BSA violation to regulators, which can mitigate penalties.

Conduct that may constitute a sanctions violation, evaluated against OFAC's Economic Sanctions Enforcement Guidelines.

OFAC's classification of a violation's seriousness, which (with self-disclosure) drives the base penalty calculation.

The board of directors must approve the AML program and ensure it is implemented with adequate resources.

The BSA officer needs sufficient seniority, independence, resources, and direct access to the board.

The internal process for raising a potential SAR from frontline staff to investigators to the decision-maker.

A body that reviews investigations and decides whether to file a SAR, documenting the rationale either way.

A follow-up SAR filed (often every 90 days in the U.S.) when previously reported suspicious activity continues.

Recording the rationale when an alert or investigation does not result in a SAR, to defend the decision to examiners.

Periodic re-screening and source-of-wealth review of PEP relationships throughout their lifecycle.

A policy defining which customers the institution will and will not onboard based on risk.

Procedures for terminating relationships that exceed risk appetite, ideally targeted rather than wholesale de-risking.

AML training should be at least annual, role-specific, and refreshed when laws, typologies, or systems change.

Audit should cover the risk assessment, CDD/EDD, monitoring, screening, reporting, training, and prior-finding remediation.

Automated and manual review of transactions against rules, thresholds, and behavioral patterns to detect suspicious activity.

Predefined rules or models (e.g., structuring, rapid movement, high-risk geography) that generate alerts for review.

Detection using fixed thresholds and logic (e.g., cash > USD 9,500); simple and transparent but can produce many false positives.

Models that flag activity deviating from a customer's established baseline or peer group.

An automated flag generated when activity meets a monitoring scenario's criteria, requiring analyst review and disposition.

The investigator's decision to close an alert as a false positive or escalate it for further investigation or a SAR.

An alert that, after review, turns out not to indicate suspicious activity; a major operational cost in AML monitoring.

Software that consolidates alerts, customer data, and investigation notes to support analysts and document decisions.

Comparing customers and transactions against sanctions lists (e.g., OFAC SDN, UN, EU) to prevent prohibited dealings.

Screening parties against sanctions, PEP, and adverse-media lists at onboarding and on an ongoing basis.

A screening technique that detects approximate matches to account for spelling variations, transliteration, and aliases.

Name screening checks parties against lists; transaction (payment) screening checks payment messages in real time before processing.

A true match correctly identifies a listed party; a false hit (false positive) is a non-match flagged due to similar data.

Keeping sanctions and watchlists current and configuring screening thresholds to balance detection and false positives.

Tools for identity verification, document checks, beneficial ownership mapping, and risk scoring during onboarding.

Confirming a customer is who they claim to be using documents, databases, biometrics, or electronic verification.

Electronic KYC — digital identity verification using data sources, document scanning, and biometrics, common in remote onboarding.

Using fingerprints, facial recognition, or other physical traits to verify identity and reduce impersonation fraud.

Technology confirming a real, live person is present during remote onboarding to defeat photos, masks, or deepfakes.

Machine learning used to improve detection, reduce false positives, segment customers, and prioritize alerts; requires explainability and governance.

An algorithm trained on data to detect patterns; in AML, used for risk scoring, anomaly detection, and alert triage.

Governance ensuring analytics and monitoring models are validated, documented, tuned, and free of bias or error.

Independent testing to confirm a monitoring or screening model performs as intended and detects the intended risks.

Adjusting monitoring rule thresholds (often via above- and below-the-line testing) to balance detection against false positives.

Sampling alerts at and just below thresholds to confirm thresholds capture suspicious activity without excessive noise.

Accurate, complete, and timely data; poor data quality is a leading cause of monitoring and screening failures.

The documented flow of data from source to system, essential for reliable monitoring, reporting, and audits.

Software bots that automate repetitive AML tasks such as data gathering, alert enrichment, and report population.

Visualizing relationships among accounts, entities, and transactions to uncover hidden connections and complex schemes.

Linking records that refer to the same person or entity across systems to build a single, accurate customer view.

Tools that trace cryptocurrency flows across the blockchain, attribute addresses, and flag exposure to illicit wallets or mixers.

Technology that helps institutions comply with regulations more efficiently (e.g., automated reporting, screening, monitoring).

Technology used by supervisors and regulators to collect and analyze data and oversee compliance.

Electronic submission of SARs/CTRs to the FIU (in the U.S., via the FinCEN BSA E-Filing System).

A UNODC software platform many FIUs use to collect, manage, and analyze STRs and other reports.

A structured review that gathers facts, analyzes transactions and KYC, and determines whether to file a SAR or take other action.

Alert triage, information gathering, transaction and relationship analysis, conclusion, and documentation/escalation.

A legal demand for records that institutions must handle while preserving confidentiality and the integrity of any investigation.

Technology-enabled, voluntary sharing among institutions under a safe harbor to better detect and report ML/TF.

Ongoing, automated review of customer activity to keep risk ratings and monitoring aligned with current behavior.

A complete, retrievable record of decisions and actions, essential to defend dispositions and demonstrate compliance to examiners.

Reviewing a sample of alert and SAR decisions to confirm consistency, accuracy, and adherence to procedures.

Reporting (alert volumes, SAR counts, aging, false-positive rates) that lets leadership oversee program effectiveness.

The process of ingesting changes to sanctions lists and rescreening affected customers and pending payments.

Pausing a payment that hits a sanctions or watchlist alert until an analyst clears or blocks it.

Blocking freezes prohibited funds in a segregated account; rejecting refuses a transaction without freezing; both must be reported to OFAC.

Triaging alerts and cases by risk so the most serious potential ML/TF is investigated first.

The 'who, what, when, where, why, and how' written in a SAR so the FIU and law enforcement can act on it.

A useful SAR has a clear, complete narrative, correct subject and transaction data, and supporting documentation retained.

A SAR identifies the subject(s) where known and describes the suspicious activity even when no subject is identified.

Account records, transaction logs, KYC files, and correspondence gathered to support an investigation's conclusion.

Publicly available information (corporate records, news, social media) used to enrich and corroborate investigations.

Reports linking a subject to crime, sanctions, or corruption, reviewed during EDD and investigations.

Cooperation with authorities on requests, joint investigations, and feedback, while maintaining SAR confidentiality.

A legal instrument compelling an institution to produce records relevant to an investigation.

Restraining funds pursuant to a court order, regulatory action, or sanctions designation pending investigation.

The legal process by which authorities permanently confiscate proceeds and instruments of crime.

Rebuilding the flow of funds across accounts and entities to establish the source and movement of value.

Tracing how money moved among parties and accounts to identify the origin, layering, and destination of funds.

Controlling the volume of unworked alerts so suspicious activity is reviewed within required timeframes.

Reviewing a screening hit to confirm a true match, then blocking/rejecting and reporting to OFAC as required.

Confirming whether a PEP screening alert is a true match and applying the appropriate enhanced measures.

Separating who detects, investigates, and approves SAR filings to reduce error and conflicts of interest.

Using SAR outcomes and investigation results to refine monitoring scenarios and thresholds over time.

Mapping monitoring scenarios to the institution's risks to confirm all key typologies are detectable.

Adding context (KYC, prior alerts, related parties) to an alert so investigators can decide efficiently.

Ongoing screening of customers and payments as lists and customer data change, not just at onboarding.

Using better matching logic, good-guy lists, and tuning to cut non-genuine hits without missing true matches.

Recording the evidence, analysis, and conclusion for every case so decisions are defensible and auditable.

Sharing investigation outcomes with frontline and onboarding teams to improve future detection and CDD.