Compliance, AML & watchlist screening
On this page
Anti-money-laundering and sanctions programs are rule-driven by law: every transaction and customer must be checked against thresholds, typologies, and watchlists. The hard part is doing it precisely: flagging real risk without burying a compliance team in noise.
The stakes🔗
Rules-based monitoring is notorious for false alarms: AML false-positive rates typically run 85–95%, and global AML compliance is estimated to cost the industry over $274 billion a year, much of it spent investigating low-quality alerts (Facctum). Each alert can take hours to clear. Better-targeted rules (combining several conditions instead of a single blunt threshold) are the most direct lever on that cost.
How it works🔗
Each typology or watchlist check is a rule, evaluated against every transaction or customer record. For example, "flag a transfer of $10,000+ (amount in cents) to a higher-risk jurisdiction where the payee name contains a watchlisted term, unless the customer is already in the lowest-risk band." Name screening is a text match; amounts and velocity are number checks; jurisdictions and product types are category checks.
🤖 With AI in the loop
Modern AML programs pair machine learning with an explicit rule layer; they need both. HSBC, screening over 1.2 billion transactions a month with Google Cloud's AML AI, found 2–4× more suspicious activity with 60% fewer alerts. The model scores every customer, and a threshold policy sized to investigator capacity decides who gets investigated. Vendors like NICE Actimize keep an expert-written red-flag rule library at the core (the part regulators recognize and compliance teams can extend the day a new scheme appears), with ML ranking and de-noising on top. In Winnow, model risk scores are ordinary columns; the typology rules, thresholds, and routing around them are plain text a compliance officer can read, tune, and defend to a regulator. More patterns: Deep Dive: AI + Rules Engines.
Why Winnow fits🔗
- All three signal types in one rule: monetary thresholds, jurisdiction and product categories, and watchlist name matching, including short or one-off terms added on the fly.
- Precision through combination: joining conditions with
AND/OR/NOTnarrows alerts to genuine risk, directly attacking the false-positive problem. - Batch and real-time: screen the day's transactions in one pass, or check a single payment inline before it settles.
- Auditable and adjustable: rules are explicit text a compliance officer can read and revise, applied to a live system with no downtime, which matters when regulations change.
🧪 In simulation — 200,000 screening rules, 1 million transfers
To put numbers on the above, we built a monitoring book in the shape a compliance program grows into: 200,000 standing rules — high-risk corridor thresholds, channel typologies, origin-side amount bands, per-customer enhanced monitoring, structuring bands sitting just under reporting thresholds, and a payee-name watchlist screened inline on every payment — then ran 1 million transfers, $14.0 billion of volume, against all of it, amounts held as exact money so no rounding drift can reach a threshold. 4.3% of transfers matched at least one rule, routing 362 alerts per 10,000 transfers to the analyst queue — and at $40 of analyst time per cleared alert, that queue costs about ten orders of magnitude more than the compute underneath it. Precision, not speed, is what clears an AML budget; what the engine buys is that the extra conditions which halve the false-positive queue are free at evaluation time.
What this is: a test run on a generated rule book and a generated payment stream, not a customer deployment — the rules and transfers are invented, the speeds and costs are measured. It ran on one ordinary 16-core desktop computer, priced at a standard cloud rate of $0.043 per processor-hour running around the clock, the same basis as the Deep Dive: Cost Savings. Every disposition was double-checked against a slow, exhaustive pass over all 200,000 rules before any stopwatch started — that slow way takes about 13 times longer — so no alert (and no all-clear) comes from a rule quietly skipped. Treat the speeds as approximate, moving by about a fifth with machine load, and the money and counts as exact; the test ships with Winnow for your team to re-run on your own typologies.