The customer looks legitimate. The transaction does not.
A clean KYC file does not always mean a clean transaction. Your customer may pass every check, but their activity can tell a different story. KYC tells you who the customer is. Transaction monitoring tells you what they are doing.
At a glance
- A verified identity does not make every transaction low risk.
- Monitoring compares what the customer does with what you expected from them.
- Funds that arrive and are moved on quickly, split, or sent to higher-risk places deserve a closer look.
- Know your customer, and know their activity.
A verified customer profile beside a chain of transfers that looks suspicious.
The detail, step by step
Start from the customer profile
KYC gives you the customer's identity, ownership, business and expected activity. That expected activity is the yardstick monitoring measures against.
Follow the money
The illustration shows a payment received and then moved on: part to an offshore account, then split between third parties, and some to a higher-risk jurisdiction. Each step on its own may look ordinary. Together they form a pattern.
Know the red flags
Signs that a transaction does not fit the customer include:
- Unusual transaction patterns.
- Unexpected counterparties.
- Activity that does not match the customer profile.
- Sudden spikes in transaction volume or value.
- Frequent round-value or repetitive transactions.
- Rapid movement of funds without a clear economic purpose.
- Transactions involving higher-risk jurisdictions or entities.
Review the alert
Ask what the transaction is for, check it against the customer's profile and history, and gather any supporting information. Record what you found and your decision.
Escalate where it is not explained
If the activity remains unexplained, escalate to the compliance officer or MLRO, who decides whether there are grounds to report through goAML.
Update the customer's risk
Whatever the outcome, consider whether the customer's risk rating and expected activity still reflect reality, and update them if not.
Mistakes to avoid
- Assuming a verified customer cannot be involved in suspicious activity.
- Monitoring rules that do not reflect the business's own risks.
- Closing alerts with no written rationale.
- Never updating the expected activity recorded at onboarding.
Evidence to keep
- Customer profiles with expected activity recorded.
- Monitoring rules or scenarios and why they were chosen.
- Alert reviews with their outcomes and reasoning.
- Escalations to the MLRO and any reports filed.
Where Adventant can help
General information only, not legal or compliance advice. The examples and figures are invented for illustration. Your obligations depend on your activities and your regulator, so check the current rules that apply to you or speak to Adventant about your situation.