How to build an AML and fraud monitoring system
How transaction monitoring, sanctions screening and fraud detection fit together, the case work behind them, the rules they serve and an order to build them in.
What an AML and fraud monitoring system does
An AML and fraud monitoring system watches customers and transactions for signs of money laundering, sanctions breaches and fraud. It raises alerts, groups them into cases for analysts, and supports the reports firms must file with authorities.
Fraud and AML share data but differ in speed: fraud checks often decide in real time whether a payment goes through, while AML monitoring looks for patterns over days and weeks.
The modules you need
Most teams need all of these in the end. The phased plan below sets the order.
Data intake
Customers, accounts and transactions from core, payments and cards, in near real time.
Rules and scenarios
Monitoring scenarios such as structuring or rapid movement, with versioned thresholds.
Risk scoring
Scores from rules and models that rank alerts, with reasons shown.
Sanctions and PEP screening
Customers and payments screened against lists, with fuzzy matching tuned to cut noise.
Real-time fraud checks
Payment decisions in milliseconds, with step-up authentication or holds.
Alert triage
Alerts grouped by customer, with duplicates merged and context attached.
Case management
Investigation, notes, evidence and four-eyes decisions.
Regulatory reports
Suspicious activity reports and their deadlines tracked on the case.
How the parts fit together
- 01
Streaming and batch together
Real-time checks on payments and batch scenarios over history, on the same data.
- 02
Rules as versioned configuration
Every scenario and threshold change is versioned, tested and approved.
- 03
Explainable scoring
Every score comes with the factors behind it, so analysts and auditors can follow it.
- 04
Case store
Cases with full history, separate from alert generation.
- 05
Tuning environment
Run new rules on past data before they go live, and measure the change.
Data model sketch
- 01
Customer and risk rating
Customer details, KYC status and risk rating with its reasons.
- 02
Transaction
Amount, parties, channel, location and device.
- 03
Alert
Scenario, score, the transactions behind it and status.
- 04
Case
Linked alerts, analyst, notes, decision and approver.
- 05
Report
Report filed, deadline, submission and reference.
Systems it has to talk to
- 01
Core, payments and cards
Transaction feeds in real time and in batch.
- 02
Sanctions and PEP data
List providers and official lists.
- 03
KYC system
Customer risk and due diligence data.
- 04
Authority reporting portals
Electronic filing of suspicious activity reports.
- 05
Device and identity signals
Device, location and behaviour data for fraud scoring.
Rules to design for
Which rules apply depends on your market and product.
- 01
AML laws
The Bank Secrecy Act in the US, the EU AML directives and Regulation, and national laws set monitoring and reporting duties.
- 02
Sanctions
EU, UK, UN and US sanctions lists must be screened, with no delay for true matches.
- 03
Report confidentiality
The fact that a suspicious activity report was filed must be kept from the customer.
- 04
Fraud and payments rules
Payment rules such as PSD2 set authentication and refund duties that fraud checks feed.
- 05
AI rules
Models that affect customers need explanation and oversight. Fraud detection is excluded from the EU AI Act's credit-scoring high-risk entry, but other uses may not be.
From prototype to production
Build in this order so something real is in users' hands early.
- 01
Clickable prototype
The alert queue and case screen, tried by analysts on real-looking cases.
- 02
First scenarios live
Data feeds, a core set of scenarios, case management and report deadlines.
- 03
Screening and fraud
Sanctions screening and real-time fraud checks on payments.
- 04
Tuning and models
Tuning on past data, risk scoring and models behind the same decision flow.
What drives the cost
These decide most of the budget. For a number based on your own scope, use the cost tool. OceanLab bills $30-50/hr or per milestone.
- 01
Data quality
Clean, complete transaction data is the biggest factor in alert quality.
- 02
Real-time requirements
Millisecond fraud decisions need a different design from batch AML.
- 03
Number of scenarios
Each scenario needs design, tuning and documentation.
- 04
Jurisdictions
Each regulator brings its own reports and expectations.
- 05
Model governance
Validation, monitoring and documentation for any model in the loop.
Product builds that match this guide
Plumbline - AML Transaction Monitoring with Alerts, Cases and SAR Deadlines in One System
Designed and built a clickable AML transaction monitoring system for a US neobank and its sponsor bank: scenario alerts ranked by a transparent priority score, an investigation workspace that shows why each alert fired, real-time payment holds, and cases that count down to the SAR filing deadline.
Tamis - Sanctions and PEP Screening Platform with Four-Eyes Decisions
Designed and built a clickable sanctions and PEP screening platform for a Luxembourg private bank and fund administrator: rescreening as soon as a list changes, a payment hold queue against currency cut-offs, side-by-side alert review with four-eyes approval, and true hit cases that track the freeze and every report to the authorities.
Tidemark - Fraud Detection and APP Scam Reimbursement Dashboard
Designed and built a clickable fraud operations workspace for a UK building society: scored payment alerts with hold deadlines, the scam conversation with the member, and APP scam reimbursement claims tracked against their business-day deadline.
Two ways to work with OceanLab
Project build
We design and build the system as one project. It starts with a clickable prototype your team tries before any production code is written. Pay per milestone (outcome-based) or hourly at $30-50/hr, depending on role and seniority.
Embedded engineers
Our engineers join your team on a flexible monthly retainer. Part-time is fine and it runs month to month, with hours that overlap the US, UK and Europe, the Middle East, and Australia and Asia. Outcome-based or $30-50/hr.
Questions
Rules or machine learning?
Start with rules your regulator understands, then add models to score and rank alerts. Models work best behind the same case flow, with reasons shown.
How do you cut false positives?
Better data, tuned thresholds tested on past data, merging alerts by customer and adding context so analysts close clear cases fast.
Can one system do fraud and AML?
They can share data, screening and case management. The real-time fraud decision usually needs its own fast path.
