AML Screening and Monitoring: Complete Guide for 2026

Anti-money-laundering (AML) laws have been on the books in the U.S. for more than 50 years, and financial institutions have relied on AML screening and monitoring to identify and prevent these crimes. AML regulations have expanded as the Financial Crimes Enforcement Network (FinCEN) continues to update its rules and priorities after the passing of the Anti-Money Laundering Act in 2020.

Enforcement actions are increasing, watchlists are growing, and smaller institutions are coming under scrutiny alongside big banks and financial enterprises. At the same time, regulators expect these updates to be integrated into screening and monitoring systems in near real time. And the stakes have only gotten higher over the years, with the costs of noncompliance heading into billions of dollars in fines.

This all makes implementing AML screening and monitoring more critical than ever. But too many organizations conflate the two, which can leave them vulnerable. The result: not only expensive fines but damaging hits to brand integrity and customer trust.

Understanding the intricacies and nuances of AML screening vs. monitoring helps ensure you apply the appropriate tools and processes to meet AML requirements, as well as to continuously and consistently prevent your organization from being used for money laundering and similar financial crimes.

Key Takeaways

• AML screening and monitoring are separate processes that are most effective at preventing and combating financial crime when designed to work together.
• AML screening includes checking sanctions lists and other watchlists, screening for politically exposed persons (PEPs), and conducting adverse media research.
• AML monitoring involves assessing customer behavior consistently against historical data for unusual patterns that could suggest fraud.
• A risk-based approach to AML screening and monitoring requires calibrating thresholds to minimize false positives and combining traditional rule-based systems with AI-powered solutions.

What Is AML Screening and Monitoring?

While many compliance teams treat AML screening and monitoring as separate processes, they are both integral processes that work together to protect financial organizations from fraud over time.

AML Screening

AML screening refers to the effort of vetting individuals and organizations to assess their risk of committing financial crime, either during customer onboarding or to recheck them at defined points. Information is checked against sanctions lists, politically exposed person (PEP) registries, watchlists, and media information. The financial institution then decides whether to establish or maintain the business relationship.

Note that AML screening is a required component of customer due diligence (CDD), a pillar of Know Your Customer compliance regulations. Understanding the distinction between KYC vs. AML is important: KYC establishes who a customer is, while AML programs monitor for suspicious activity and financial crime risk throughout the customer relationship.

AML Monitoring

Unlike AML screening, which takes place at specific intervals, AML monitoring involves continuously analyzing customer transactions and behaviors. This enables financial organizations to detect patterns and actions that can suggest money laundering or other financial crimes. They can then investigate and, if warranted, flag affected accounts and transactions.

Monitoring also helps organizations collect and document evidence when submitting a Suspicious Activity Report (SAR) or other filing. Ample, accurate documentation helps authorities with investigations and developing a potential case for pursuing legal action or other remedies.

How They Work Together

AML screening and monitoring are not either/or: They are most effective when deployed together as an integrated workflow. AML screening is conducted as part of new customer onboarding, during which the financial organization assesses the risk involved. If the customer passes the screening, their activity is monitored for unusual behaviors or actions. These might trigger another screening or even an investigation.

The institution may also implement re-screening at certain points in time, such as quarterly or yearly, when the customer opens a new or different type of account, or when the value of their assets reaches a certain amount. Our AML compliance program guide provides insights into how regular screening and ongoing monitoring help organizations align with applicable requirements.

Types of AML Screening

Initial screening for AML involves checking various databases and lists, as well as conducting media research to uncover potential risk.

Sanctions Screening

Sanctions screening refers to the task of checking customers and counterparties against official sanctions lists. These are published and maintained by world governments and international entities, such as the UN Security Council, the EU, the U.S. Office of Foreign Assets Control (OFAC), and others.

This baseline task helps protect financial firms from conducting business with sanctioned entities, individuals, or jurisdictions, protecting them from financial and legal liability as well as disruptions related to frozen transactions or blocked payments.

PEP Screening

People who hold or have held high-ranking roles in government or the military are at increased risk for corruption, bribery, and other illicit financial activities. Screening for these PEPs helps organizations implement enhanced due diligence (EDD) throughout the business relationship.

Watchlist Screening

Similar to sanctions screening, watchlist screening involves checking customers against databases and lists for individuals who are suspected of financial crime, financing terrorists, or other highly illegal activities. These watchlists are typically compiled in collaboration by governments and international organizations, although they can vary significantly in the quality of their data, how often they are updated, and jurisdiction. AML watchlist screening and monitoring solutions can help financial firms ensure they are working with critical and up-to-date watchlists.

Adverse Media Screening

Adverse media refers to news stories, social media posts, and other publicly available information about an individual or entity’s illegal, unethical, or otherwise suspicious activities. These could include fraud or corruption allegations; associations with sanctioned individuals, organizations, or governments; or criminal proceedings. Screening for these can surface issues that are missing from formal sanctions lists and watchlists.

Payment Screening

Payment screening, which refers to checking individual transactions against sanctions lists, watchlists, and other databases before processing them, is designed to block illegal or suspicious payments before they go through. It’s particularly critical for transactions involving cross-border payments, correspondent banking, and others where any sanctions must be identified prior to transferring funds.

AML Transaction Monitoring

Transaction monitoring goes beyond screening to assess customer behavior by comparing historical data with real-time activity. By flagging unusual patterns as they happen, financial firms can investigate potentially suspicious activities quickly.

How Transaction Monitoring Works

AML transaction monitoring uses rules and machine learning models to review customer transactions and compare them to known patterns associated with money laundering. These include:

• Breaking down a large transaction or sum into smaller transactions to stay below regulatory reporting thresholds, a tactic known as structuring
• Layering, which makes tracing illicit funds highly complex by transferring them among various accounts, asset types, institutions, and jurisdictions
• Unusual transaction velocity or volume, such as many transactions within a short period of time
• Geographic anomalies, such as transactions from locations not typically associated with the customer’s business history
• Transfers to or from high-risk jurisdictions, such as countries with high incidences of money laundering

Rule-Based vs. AI-Driven Monitoring

While historically, AML monitoring involved rules-based systems with static “if-then” scenarios, solutions using AI and machine learning can quickly recognize complex patterns and adapt to emerging patterns of fraud. Not only are AI-driven tools faster and able to analyze information at scale, but they also help reduce false positives that can occur when rules haven’t been adjusted to actual customer behavior. However, AI and machine learning approaches must hold up to regulatory scrutiny and provide transparency in how they operate.

Today, most mature AML monitoring programs incorporate both approaches for maximum efficacy, as rules-based monitoring provides foundational knowledge of customer behavior that can feed machine learning models.

Alert Management and SAR Filing

Alert management is a critical component of successful AML monitoring. High rates of false positives can cause organizations to overlook real risks when resources are stretched thin. Instead, they should implement a structured workflow to efficiently assess and address alerts:

• A triage system prioritizes alerts by risk score. This enables firms to allocate resources to the most pressing alerts.
• An analyst reviews the incident as well as the full customer history, providing a complete context in which to evaluate unusual activities or behaviors.
• A decision is made to escalate the issue or close it.
• The investigation is documented to record the incident and the rationale for the decision to pursue an investigation, submit a Suspicious Activity Report (SAR), or close it.

Building a Risk-Based AML Screening and Monitoring Program

Organizations like FinCEN and the intergovernmental Financial Action Task Force (FATF) require financial organizations to institute a risk-based approach to AML screening and monitoring. However, many institutions implement one-size-fits-all thresholds that can actually increase risk and result in inefficient use of resources, such as high numbers of false positives from low-risk customers.

Instead, organizations should segment their customers into different categories and conduct separate risk assessments to set thresholds for each. Factors to consider include:

• Customer profiles (such as whether they are PEPs or where the customers are located), transaction patterns
• Business type (such as large enterprises vs. small businesses)
• Financial products or business sectors that are associated with higher rates of financial crime (e.g., cryptocurrency, gambling, payment processing)

Each institution should also incorporate its own tolerance for risk when setting thresholds. For example, a large multinational financial institution is typically able to tolerate a higher level of risk than a small local or regional bank.

Calibrating these thresholds requires an iterative approach to make the monitoring system sensitive enough to identify real risks without causing a flood of false positives or unnecessary friction in low-risk scenarios. Adjusting thresholds up and down via above-the-line (ATL) and below-the-line (BTL) testing helps organizations find this spot.

This calibration should be ongoing based on both historical and real-time data, protecting institutions from emerging risks and tactics.

Where AML Screening and Monitoring Programs Break Down

When AML screening and monitoring programs fail, it’s usually because they’re treated as compliance requirements to check off instead of ongoing systems to manage risk. Understanding the operational weaknesses most frequently identified by auditors and regulators can help organizations build programs that are both effective and compliant over the long term.

Common pitfalls include:

• Failing to identify customer risk during onboarding due to insufficient enhanced due diligence, beneficial ownership verification, or source-of-funds checks
• Not updating sanctions lists and other watchlists frequently enough, which can leave institutions exposed to emerging risks
• Setting monitoring thresholds too high, resulting in excessive false positives and alert fatigue that may cause investigators to overlook genuine suspicious activity and result in unnecessary friction for low-risk customers
• Using only rules-based monitoring, which may miss emerging patterns that suggest fraud, and failing to use AI models that can analyze transactions at scale
• Operating screening and transaction monitoring systems in silos, preventing teams from developing a complete view of customer risk, transaction activity, and suspicious patterns
• Neglecting to re-screen customers regularly, which can lead to missed changes in behavior, geography, ownership, or other factors that warrant a revised risk rating and enhanced scrutiny
• Maintaining incomplete documentation for investigations and Suspicious Activity Reports (SARs), including gaps in customer due diligence records or transaction histories, which can delay or jeopardize regulatory filings

Building an AML Screening and Monitoring Program That Holds Up

As regulators assess AML screening and monitoring programs more carefully, financial institutions need to make sure their programs hold up to increased scrutiny and that they adequately alert them to money-laundering activities and other financial crimes.

Integrating anti-money laundering solutions like orchestrated verification and global coverage for identity and verification form the operational foundation of an effective AML screening and monitoring program that holds up to increasing regulatory demand. Financial services and fintech companies, payment and digital wallet solutions, crypto and digital asset platforms, and gaming and online marketplaces benefit from Entrust’s experience and expertise in complex regulatory environments with flexible, configurable tools that strengthen compliance and support scalability.

Financial, payment, digital, and gaming services benefit from Entrust’s experience and expertise in complex regulatory environments. Entrust navigates KYC and AML requirements with advanced screening solutions and a watchlist monitoring program.

FAQs

What is AML screening and monitoring?

AML screening and monitoring refers to the process of vetting customers for the risk of money laundering at onboarding and ongoing monitoring of their transactions to prevent financial crime.

How does transaction monitoring work?

Transaction monitoring works by incorporating thresholds for risk, such as deposits or withdrawals over specific amounts or a large number of transactions in a short time. The system then creates an alert for further investigation.

What are sanctions and watchlist screenings?

Sanctions and watchlist screenings refer to when financial institutions and organizations in related sectors check customer information against databases and lists maintained by governments and international organizations. These help institutions identify individuals or entities suspected of illegal activities or who are under government sanctions for doing so.

Why is ongoing AML monitoring necessary?

Ongoing AML monitoring is necessary to review customer behaviors and transactions, keep customer records and risk assessments up to date, and maintain compliance with AML regulations.

How can AI improve AML compliance processes?

AI can improve compliance processes by monitoring and analyzing customers’ identities, financial data, and transactions at scale and speed, making risk identification, alerts, and investigations much faster, more accurate, and more efficient.

Discover What’s Next for AML Screening and Monitoring

Stay up to date on evolving AML compliance requirements with our guide to identity verification for KYC.

Download Now