Also known as: AML transaction monitoring and sanctions screening
Banks search account and payment data for money laundering patterns and check all parties against sanctions lists.
Understand the use case
Machine learning supplements fixed rules: it assesses customers and accounts by behaviour and recognises names despite spelling variations. Banks and payment service providers must detect unusual flows, report suspicious cases and prevent payments to sanctioned people.
This page describes a typical system design. Actual data flows and permissions depend on your implementation.
System design and data flows
The system receives customer records, account movements, payer and payee details, and current sanctions lists.
Customers and third parties, including those seeking to launder money, determine payments, references and counterparty names. The system assesses customers, beneficial owners and counterparties using names and account details.
The system assesses accounts and payments against laundering patterns and compares names with list entries.
Depending on the system design, processing combines transaction patterns, relationships between parties and checks against relevant lists. This produces matches and prioritised anomalies for investigation. A technical match must be distinguished from the professional assessment of a suspicion.
The system raises alerts with risk scores and explanations and stops payments when a sanctions list matches.
The result describes the defined model task. A match, category or forecast acquires its professional significance only in conjunction with the underlying data and intended use.
Specialists review alerts and decide whether to report suspicion, release a payment or end a business relationship.
Integration determines whether the result is simply displayed, adopted after approval or written directly into a business application. These variants differ in their data flows and permissions.
Explore the system design: Select a component to see its task, incoming and outgoing data, and role in the use case. The guided walkthrough explains each phase. Then use Yes, Uncertain and No to represent your specific system variant.
9 review first10 clarify6 baseline threats
The diagram shows the typical architecture. Select a component to see what happens there and adapt its features to your system. Enable “Analysis guidance” to see which threats need reviewing for this architecture. The page's checklist continues to describe the typical case.
None yet. Each change will appear here.
In this system design: 9 to review first, 10 to clarify, 6 baseline threats.
External access: Depends on your system
To clarify
Input: Part of every AI system
Review first
Third-party content: Present
AI model: Part of every AI system
Review first
To clarify
Provider service: Depends on your system
To clarify
Document collection: Depends on your system
To clarify
Training and feedback: Present
Review first
Result: Part of every AI system
Baseline for every AI system
Business application or equipment: Depends on your system
To clarify
person: Part of every AI system
Review first
Affected person: Present
Unapproved AI services: Depends on your system
To clarify
Supply chain and technical foundations: 5 baseline threats applying to every AI system
Baseline for every AI system
Checks individual payments in real time for fraud
Customers and third parties, including those seeking to launder money, determine payments, references and counterparty names. The system assesses customers, beneficial owners and counterparties using names and account details.
Many institutions use vendors' products; others develop their own models.
Sanctions screening searches names in sanctions and embargo lists, sometimes in a separate search repository. Models are trained on the institution's account and payment data, even when a provider supplies the service.
A sanctions match can automatically stop a payment; transaction monitoring generally only produces an alert. Cloud screening sends customer and payment data outside the institution.
Using a provider does not automatically determine where processing takes place. Storage location, subcontractors, deletion periods and use for training must be checked for the specific deployment.
Assess risks and determine measures
Record data, participants, interfaces and permissions. Resolve uncertain characteristics in the model.
Relate review candidates to actual data flows: what could happen, and who would be affected?
Assess impacts and likelihood in the deployment context. The number of review candidates is not a risk score.
Select appropriate controls, assign responsibilities and define effectiveness checks. Document residual risks and approvals.
A total of 25 threats from the threat catalogue may be relevant to this use case.
Also review: whether the system disadvantages groups
Check whether selection, ranking or assessment disadvantages people with protected characteristics, such as sex, age or origin.
Money launderers spread amounts across many accounts or vary name spellings. The system then fails to recognise the pattern or match the name to a list entry.
With many false alarms, specialists begin dismissing alerts hastily and treating unflagged accounts as normal. Incorrect model assessments then go unnoticed.
New laundering methods and payment channels are absent from training data. The model treats them as ordinary until retrained on new cases.
Targeted Poisoning / Label Poisoning
The model learns from case decisions. Incorrectly closed cases teach it not to flag those patterns in future.
Your own training or operational feedback can introduce manipulated data into training datasets.
Listed because of these characteristics
Training data or an adopted base model can introduce hidden triggers for misbehaviour.
Listed because of this characteristic
Targeted queries can recover some personal or protected training data from the model.
Listed because of these characteristics
Sensitive Information Disclosure
Confidential content can appear in answers, supplied context or logs.
Listed because of these characteristics
Exfiltration from ML Application
Protected data can leak through tools, network connections, storage or insiders.
Listed because of this characteristic
Up to 10 further threats may apply, depending on your system design. Nine threats need to be reviewed for every AI system. Three of these are particularly important here and are therefore listed above.
Each Yes adds further threats to your checklist, up to 10 in total. If you cannot yet answer a question, include its threats in your review.
How your system is built
How you operate the system
Sanctions screening searches names in sanctions and embargo lists, sometimes in a separate search repository.
If yes, add
Some systems represent customers, accounts and counterparties as a network of relationships to detect concealed money flows.
If yes, add
A sanctions match can automatically stop a payment; transaction monitoring generally only produces an alert.
If yes, add
If yes, add
These questions arise for almost every AI system.
If yes, add
If yes, add
If yes, add
If yes, add
If yes, add
Measures for the priority review areas are expanded. Each linked measure explains how to implement it.
Controls for the remaining threats are available on their pages in the threat catalogue.
Applies if staff or appointed representatives operate or use AI systems.
Applies since 2 February 2025.
Detailed obligations
Money laundering detection does not assess creditworthiness. Annex III, point 5(b), also expressly excludes systems for detecting financial fraud.
Detailed obligations
Classify your system with the quick checker All obligations in the obligations compass
Review these threats for every AI system, whatever its purpose.
If any of these features does apply to your system, add the listed threats.
Does the system generate its own text, such as answers, drafts or summaries?
The system produces alerts and risk scores; a person writes the suspicious activity report.
If yes, add
Does the system generate or edit images, sounds, voices or videos?
If yes, add
Does the system create new content from open-ended requests that people read, see or hear directly? Translation, reading aloud and transcription do not count.
If yes, add
Can users give the system natural language tasks that it then performs?
The model assesses accounts and payments and does not accept natural language instructions.
If yes, add
Does the system formulate answers from retrieved documents?
If yes, add
Does the system remember content from earlier conversations or tasks and reuse it later?
If yes, add
Does the system call other programs, interfaces or search services itself, even if only to read?
If yes, add
Does the system determine its next steps itself based on earlier results?
If yes, add
Does the system delegate tasks to other AI agents or incorporate their results?
If yes, add
Is the system connected to tools or data sources through the Model Context Protocol (MCP)?
If yes, add
Do documents from several customers, departments or permission groups share one search store?
If yes, add
Can people outside your organisation use the system, including without login?
The system works in the institution's background and is not accessible to customers.
If yes, add
Does the system process several input types together, such as text with images or speech?
If yes, add
Does the system generate code, scripts or database queries for further use?
If yes, add
Does the system execute programs, scripts or commands itself?
If yes, add
BaFin, Big data and artificial intelligence: principles for algorithms in decision-making, 2021
BaFin cites sanctions screening as an example in its principles for big data and AI.
EBA, Follow-up report on machine learning for IRB models, 2023
The European Banking Authority identifies anti-money laundering and counter-terrorist financing as major uses of machine learning.
Google Cloud, Google Cloud Launches AI-Powered Anti-Money Laundering Product for Financial Institutions, 21 June 2023 According to the manufacturer
The manufacturer names HSBC as a user of its money laundering detection service.
Updated: 30 September 2026. Review checklist rules version 0.3.2, threat catalogue version 2026.10.24.2. How these pages are structured