AML Analyst

An anti-money laundering (AML) analyst reviews the alerts a monitoring system raises on live bank accounts and decides which look like crime, not noise. Each alert closes with a written disposition, and the worst of them turn into a Suspicious Activity Report.

AML is a reporting duty, not a loss-prevention one. The bank itself may lose nothing at all; the obligation is to tell the authorities what it saw, in writing, inside a legal deadline.

The work happens on live accounts, after the relationship has already started. Patterns matter more than single payments — a dozen cash deposits just under a threshold say more than any one of them does.

Most alerts turn out to be false positives. A strong analyst closes those quickly and with a clean rationale, so the handful of real cases get the hours they need — and the filings get written properly.

Key takeaways

• An AML analyst turns system alerts into closed cases or filed reports.
• Disposition quality counts as much as detection: every close needs a written reason.
• Structuring, layering and pass-through activity are the typologies that fill most queues.
• A high false positive rate is normal; an unexplained close never is.
• Filing a Suspicious Activity Report is the escalation point, and it carries hard deadlines.

How it works

Monitoring systems score transactions against rules and behaviour models, then raise alerts. An AML analyst triages the queue, pulls the account history, decides whether the pattern has a lawful explanation, and records a disposition a later reviewer can follow.

An alert is thinner than outsiders expect. It carries a rule name, a date range and a list of transactions — the context that turns it into a decision still has to be fetched by hand.

Thresholds sit in law rather than policy. A US bank must report a suspicious transaction that involves or aggregates at least $5,000 in funds when it knows or suspects illicit activity.

The clock is tight as well. That same rule allows 30 calendar days from initial detection to file, with a single 30-day extension when no suspect has yet been identified.

Filing itself is electronic. Reports go in on FinCEN SAR Form 111 through the BSA E-Filing System, which replaced paper submissions on 1 April 2013.

Examiners then check the work. The Office of the Comptroller of the Currency conducts regular examinations of national banks covering Bank Secrecy Act and anti-money laundering programmes.

False positive rate is the number every team argues about. Tune the rules down and genuine cases slip through; tune them up and the queue swallows the whole team.

Second-level quality analyst sampling keeps dispositions honest. Someone re-reads a slice of closed alerts each month and asks whether the written reason would survive an examiner reading it cold.

Escalation separates a good analyst from an average one. The good one escalates early with the narrative already drafted; the average one escalates late, attaching a screenshot and a shrug.

Writing that narrative is the real craft. A filing has to say who moved what, when, through which account, and why the bank found it odd — in language a law-enforcement reader can act on.

Examples

AML analysts staff banks, money service businesses, brokerages, insurers and crypto platforms. Typologies differ by sector, but the shape of the job holds: an alert arrives, evidence gets gathered, and a decision is written down.

A Philippine remittance operator sees structuring in small, frequent transfers from overseas workers. Most of those are entirely genuine, which is exactly why the analyst has to read the history and not the amount.

A Nordic correspondent bank watches pass-through activity between non-resident customers. One account cycling millions while holding almost no balance is the alert that gets escalated first.

An Australian brokerage tracks clients who fund an account, trade once, then withdraw. The signal is thin on any single client but it recurs, so the firm maintains it as a named typology.

A UK building society runs the whole function with three people and a vendor system. Small firms carry the same duty as large ones, which is why shared desks and part-time officer cover are common at that end of the market.

Offshore teams in Manila, Bengaluru and Kraków now run first-level triage for global banks under anti-money laundering outsourcing arrangements, escalating to an onshore officer who signs the filing.

Related terms

AML work sits inside a wider financial-crime function, and these neighbouring terms define where an analyst’s remit stops. They are the ones that appear most often in job adverts, vendor proposals and the handover notes between a monitoring team and its supervisors.

• Compliance Officer: the accountable person who signs filings and owns the programme.
• Governance Risk Compliance: the combined discipline a monitoring team usually reports into.
• Escalation: the handover of a case to a more senior decision-maker.
• Financial Services Company: the kind of firm most likely to employ the role.
• Back Office Outsourcing: the delegation of non-customer-facing processing work, triage included.

FAQ

What does an AML analyst do?

They review alerts raised on customer accounts, gather the supporting history, and decide whether the activity has a lawful explanation. Each decision is recorded as a written disposition.

What is an alert disposition?

It is the documented outcome of an alert: closed as explained, closed with monitoring, or escalated for reporting. The written reason is what an examiner reads months later.

How is an AML analyst different from a fraud analyst?

An AML analyst reports suspected crime to the authorities, even when the bank loses nothing. A fraud analyst stops the bank or its customers losing money in the first place.

What is structuring?

Breaking a large sum into several smaller transactions to stay beneath a reporting threshold. It is one of the oldest patterns a monitoring system looks for.

When does a Suspicious Activity Report have to be filed?

US rules allow 30 calendar days from initial detection, extended by another 30 days only when no suspect has been identified.

Can alert review be outsourced offshore?

Yes, and first-level triage is the layer that moves offshore most often, with final sign-off kept onshore.

Compare providers running offshore financial-crime teams in the Outsource Accelerator directory.