How AML works
You don't need a compliance background to use Sentinel. This page covers the basics.
The problem
Criminals make money from fraud, scams, theft, corruption and drugs. That money is risky to spend while it's obviously dirty, so they push it through the financial system until it looks ordinary. That's money laundering. Using the financial system to move money to terrorists is terrorist financing.
Fintechs attract launderers. Accounts open in minutes, money moves instantly, and there are lots of small transfers to hide among. A wallet opened yesterday can receive money from 20 scam victims and cash it all out by tonight.
So governments require every company that moves money to run an anti-money laundering (AML) programme. In practice that means four things:
- Know your customers. Find out who they are and whether they're risky.
- Watch the money. Look for patterns that suggest crime.
- Investigate and report. When something looks wrong, look into it. If it's still suspicious, tell the authorities.
- Prove it. Keep records that show a regulator you did all of the above.
The loop
Every AML programme follows roughly the same loop, whatever software it uses.
Onboard
When someone signs up, you collect their details: name, date of birth, ID number, address, occupation. This is Know Your Customer (KYC). An identity verification provider usually checks that the ID is real. Sentinel doesn't do that part; it uses the result.
Screen
You check the customer's name against lists of people you mustn't deal with, or must be careful with:
- Sanctions lists: people and companies governments have banned (UN, US OFAC, EU, UK, plus your own country's list).
- PEP lists: politically exposed persons, such as ministers, senior officials and their families. Dealing with them is allowed, but they get extra scrutiny because of bribery risk.
- Adverse media: news reports linking someone to crime.
Names are messy, so screening gives each possible match a score and a person decides.
Monitor
Every transaction is checked against rules that describe suspicious patterns, which the industry calls typologies. For example:
- 23 different people send money to one brand-new wallet in 40 minutes (fan-in, typical of scam proceeds collected by a mule).
- Someone makes nine transfers of 4,900 when anything over 5,000 gets reported (structuring).
- A card is tried with dozens of small purchases to see if it works (card testing).
Alert
When rules fire, the system raises an alert. Most alerts turn out to be innocent. These are false positives, and the more a system produces, the more analyst time it wastes.
Investigate
An analyst looks at the alert. Who is this, what else have they done, who are they connected to? Related alerts are grouped into a case.
Decide
The analyst proposes an outcome: close as innocent, keep watching, or report. Because this is serious, a second person, the reviewer, has to approve it. This is called four-eyes.
Report
If it's still suspicious, the company files a Suspicious Transaction Report (STR) with the country's Financial Intelligence Unit (FIU), the government agency that collects these reports. Many FIUs receive reports through goAML, a system from the UN. Some countries also require a Cash Transaction Report (CTR) for every cash transaction above a threshold, suspicious or not.
Keep records
Everything is logged and kept for years. Regulators, auditors and partner banks will ask you to prove the programme works: which rules you run, how many alerts you had, how fast you closed them, which reports you filed.
Sentinel is built to run every step from screening to records. Today it covers screening, monitoring, alerts and the audit log. Cases and reporting are planned.
Two hard rules
The report goes to your FIU, not the police. The FIU decides what happens next.
Where each part of Sentinel fits
| Loop step | Sentinel part |
|---|---|
| Onboard | Uses your KYC provider's result, sent as entity attributes |
| Screen | Screening |
| Monitor, alert | Monitoring and Rules |
| Investigate, decide | Alerts today; Cases (planned) |
| Report, keep records | The audit log today; Reporting (planned) |