Inside an AML team: the four functions and the way in

Transaction monitoring, KYC refresh, sanctions screening and case escalation — what each team does, and which is the most common way in.

The short answer: An AML function is four teams doing different jobs. Transaction monitoring reviews alerts raised by the bank's detection systems and decides which need investigating. KYC and client due diligence establishes and refreshes who customers are and what they do. Sanctions screening checks names and payments against restricted lists and clears the matches that are not real. Investigations takes the escalations, builds the case, and produces the report that goes to the authorities. Transaction monitoring and KYC take the most entrants, are learnable on the job, and are the largest single entry route into risk and compliance in most large banks — which is why this is the door most career changers come through.

Key points

Four functions — monitoring, KYC, sanctions, investigations — with different rhythms and different skills.
Most alerts are not suspicious, and the daily skill is distinguishing unusual from suspicious without over-escalating.
The written case is the product: an investigation that cannot be read and followed has not been completed.
Volume roles are the entry point; the progression is toward investigation, quality assurance, tuning and advisory.

The four functions

What each team does, and where entrants usually start
Function	The work	Entry level?
Transaction monitoring	Review system-generated alerts; close with rationale or escalate	Yes — the largest entry route
KYC / client due diligence	Establish and periodically refresh who a customer is and what they do	Yes — high volume, structured
Sanctions screening	Clear name and payment matches against restricted lists; escalate true matches	Sometimes — often needs prior exposure
Investigations	Build the case on escalated matters and produce the regulatory report	Rarely direct — usually a progression

The four are usually separate teams with separate managers, even though the work flows between them. Which one you join shapes the first two years considerably, and it is worth establishing at interview which queue the role actually sits on.

Unusual is not suspicious

Detection systems raise alerts on patterns, and most patterns have ordinary explanations. A customer whose account activity jumps sharply may have sold a property, received a bonus, or started a business. The analyst's job is not to find wrongdoing in every alert; it is to determine whether an explanation consistent with what the bank knows about the customer exists.

Both failure directions are real. Escalating everything makes the queue unworkable and buries the genuine cases; closing everything defeats the control. What separates a good analyst is the ability to be consistent about where that line sits, and to write down the reasoning so a reviewer can agree or disagree with it on the evidence rather than on the conclusion.

Where it leads

Investigations. Complex cases end to end, with the regulatory report as the output. The natural next step from monitoring and the point at which the work stops being queue-shaped.
Quality assurance. Reviewing other analysts' decisions and rationales. Develops the judgement fastest, because you see the full distribution of how a case can be handled.
Tuning and analytics. Working on the rules and thresholds that generate the alerts in the first place. Analytical, closer to data work, and much less crowded.
Advisory and framework. Policy, risk assessment and advising the business — the bridge into broader compliance roles.

The move that opens most of these is the same one: noticing something structural in the queue — a rule producing false positives, a customer segment consistently misclassified — and writing it up. That is the observable difference between someone working the alerts and someone thinking about them.

Two practical things make that observation possible rather than lucky. Keep a private note of patterns you notice, dated, over a few weeks — a single odd alert is an anecdote and twenty of the same shape is a finding. And learn what the rule that generated your alerts is actually looking for, which is usually documented internally and almost never read by the people working its output. An analyst who can say "this rule fires on X and roughly a third of those are the same benign pattern" is describing something the tuning team can act on.

The pace is worth setting expectations about. The first three months are almost entirely learning the systems, the customer types and the internal escalation language, and it is normal to feel slow. Productivity in these roles is measured on quality-assured decisions rather than raw volume, and the analysts who last are the ones who resist the temptation to speed up before the judgement is reliable — because a fast analyst with an inconsistent record generates more rework than they save.

Frequently asked questions

What does an AML analyst do all day?

In a monitoring role: works a queue of alerts, each flagging activity that met a rule. For each one you review the customer, the account history and the payment context, decide whether the activity is explicable, and either close it with a written rationale or escalate it. Volume is real and the closing rationale is the part that is quality-assured — a correct decision recorded badly counts as a defect in most teams.

Is it repetitive work?

Parts of it, honestly, yes — particularly in high-volume monitoring and in periodic KYC refresh. The work becomes considerably more varied at the investigation stage, and in tuning and quality assurance roles. Most people spend twelve to twenty-four months in a volume role before moving, and the ones who move fastest are those who noticed a pattern in the queue and said so.

Do I need financial services experience to start?

No. These teams recruit widely from graduates and career changers precisely because the domain is taught internally and the underlying skills — careful reading, consistent judgement, clear written reasoning — are not finance-specific. Backgrounds in law enforcement, audit, journalism, research and customer operations all transfer well.