anti-money laundering Archives

How to Know If Your AML Software Is Not Working Well

Posted on August 31, 2026 - 9:35 am by Sohini Majumder

Anti-money laundering (AML) software helps simplify day-to-today compliance operations, by enabling them to spot risks easily, and review customers. However, it is simply not enough to just have a system in place as it does not automatically mean that it is working well. Poor data, excessive alerts and changes can make software less useful.

This matters because compliance is already expensive. A LexisNexis Risk Solutions study found that financial crime compliance costs increased for 98% of financial institutions surveyed in EMEA in 2023, reaching an estimated $85 billion.

Why AML Software Stops Working Properly

AML software does not usually stop working overnight. Problems often build slowly as the business changes.

You may start serving new types of customers, enter different markets, introduce new products, or process different transaction volumes. If the software rules, thresholds, customer information, and workflows are not reviewed alongside those changes, the system may no longer reflect your actual risk.

Even regulators have highlighted this issue. In one enforcement case, the UK’s Financial Conduct Authority found weaknesses in HSBC’s transaction monitoring controls, including problems around keeping monitoring scenarios up to date and ensuring data was accurate.

How to Know Your AML Software Is Not Working Well

There is rarely one single sign that tells you the system is failing. Instead, look at how the software performs during everyday compliance work.

1. You Are Getting Too Many False Positive Alerts

Are most alerts turning out to be normal business activities? If yes, then your AML software is increasing your work load. A false positive happens when legitimate activity is flagged as suspicious.

While some false positives are expected, constant flow of low-value alerts make it difficult for your team to focus on the priorities.

2. Not Prioritising Important Activity

If your compliance team notices unusual transactions or customer behaviour manually, then it is concerning. If it happens regularly, check whether the monitoring rules match your current customers, product, locations and transaction patterns. FATF guidance continues to emphasise a risk-based approach rather than treating every customer or activity in the same way.

3. Customer Risk Scores Do Not Make Sense

A customer marked as low risk should not repeatedly show behaviour that clearly requires closer review. Likewise, ordinary customers should not constantly receive high-risk ratings without a clear reason.

Compare the software’s rating with your team’s assessment. Frequent differences could point to incomplete customer information or weak scoring rules.

4. Sanctions Screening Produces Poor Matches

If searching a common name creates a long list of unrelated matches, your screening process may be too broad. But settings that are too narrow may increase the risk of missing a relevant match.

OFAC itself recognises that automated screening can produce false positives and recommends evaluating the quality of a potential match using additional identifying information.

5. Your Rules and Thresholds Have Not Been Reviewed

Ask a simple question: when were your transaction monitoring rules last checked?

If nobody knows, that is a warning sign. Rules and thresholds should still make sense for the business you operate today, and monitoring systems may need recalibration as customer behaviour and risk exposure change.

6. Your Team Still Does Too Much Work Manually

Good AML software will not remove human judgement, nor should it. But employees should not have to repeatedly copy information between systems, update spreadsheets, or manually perform tasks the software is supposed to support.

Look at how much time your team spends on administration compared with actual review and investigation. Too much manual work may point to poor setup, weak integration, or software that no longer suits the business.

7. You Cannot Explain Why an Alert Appeared

An investigator should be able to understand why a transaction or customer was flagged.

If an alert simply appears without a clear reason, reviewing it becomes unnecessarily difficult. The same applies to risk ratings: your team should be able to understand the main factors behind a high-, medium-, or low-risk result.

8. Customer Data Is Missing or Outdated

AML software functions on the basis of the information it is fed. Old KYC records, missing customer details or incorrect transaction data can affect the quality of screening and monitoring.

Before you blame the software, check the data you are feeding. A capable system does not function properly without the right information.

How Often Should You Review AML Software?

There is no specific review schedule that works for every business. It depends on your risk level, customer base, transaction activity, products, and regulatory requirements.

What matters is that the review is not treated as a one-time exercise. The system should also be checked when there is a meaningful business change, such as entering a new market, offering a new product, changing customer types, or seeing a major shift in transaction behaviour.

A review should look beyond whether the software is technically running. Check alert quality, customer risk ratings, screening results, rules, thresholds, data quality, and how much manual work your team still performs.

Can You Fix Poor AML Software Performance?

Not every problem means you need new software.

Sometimes the system is okay, but the setup isn’t. Much of the problem may be solved by adjusting rules, cleaning customer data, reviewing risk-scoring logic, improving system connections, or training users.

Begin by finding the biggest gaps. Track practical metrics like false positive alerts, time taken to review cases, overdue customer reviews, and number of manual steps in typical compliance tasks.

If performance improves after these changes, then replacing the platform may not be necessary.

When To Replace Your AML Software?

Replacement should be considered when the existing platform cannot accommodate how your business now works.

For example, the system may not cope with your current transaction volumes, have limited options for customer risk assessment, not have the right screening capabilities, or require too much manual work. It can also be difficult to change if your risk profile changes.

Don’t just pick a replacement because it has more features. Find software that fits your actual AML workflow, customer types, business risks, and compliance requirements.

FATF has also acknowledged that technology may improve the effectiveness of AML/CFT when it is implemented responsibly and as part of a risk-based approach.

Conclusion

AML software should make compliance work clearer and more manageable. If your team is dealing with endless false alerts, questionable risk scores, missed activity, outdated rules, or too much manual work, it is worth reviewing how the system is performing. Sometimes a few changes are enough; in other cases, a different solution may be needed.

Looking for a better way to manage customer checks and AML risks? Explore Vertex Compliance’s KYC & AML Software or contact us to discuss your requirements.

What Is a Business Risk Assessment, and Why Does It Matter?

Posted on August 27, 2026 - 3:38 pm by Sohini Majumder

A business can have anti-money laundering (AML) policies, customer checks, and monitoring systems in place and still overlook where its biggest risks actually sit. A business risk assessment helps bring those risks into view. It looks across the organisation to understand where exposure to money laundering, terrorist financing, and other financial crimes may come from.

This matters in the UAE, where regulators follow a risk-based approach to AML/CFT (Counter-Financing of Terrorism) supervision. The CBUAE’s sectoral risk assessment, for example, looks at factors such as customers, products and services, delivery channels, geographic exposure, and business activities when assessing financial crime risk.

What Is a Business Risk Assessment?

A business risk assessment reviews the money laundering, terrorist financing, and other financial crime risks faced by the organisation. It considers areas such as customer types, products and services, geographic exposure, transactions, and delivery channels. The assessment looks at the risk before controls are applied, checks how well existing controls reduce that risk, and identifies what risk remains. This gives the business a clearer basis for deciding whether its AML/CFT controls are proportionate to the risks it actually faces.

Why Is a Business Risk Assessment Important?

A useful business risk assessment does more than produce a risk score. It helps management understand which risks deserve more attention and where current controls may need to change.

It Shows Where the Highest Risks Sit

A business rarely distributes risk evenly. One customer group may present very little concern, while another could involve complex ownership structures, high-risk jurisdictions, or unusual transaction activity.

A business risk assessment helps separate those areas instead of treating everything the same. Management can then see which parts of the organisation need closer attention. That makes AML risk management much more focused.

It Supports a Risk-Based Approach

A risk-based approach means applying stronger controls where the risk is higher rather than using the same level of scrutiny everywhere. Financial Action Task Force (FATF) describes this approach as identifying, assessing, and understanding money laundering and terrorist financing (ML/TF) risks and applying measures that match the level of exposure.

The assessment gives businesses the information needed to make those decisions. Higher-risk areas may need enhanced due diligence or closer monitoring, while lower-risk areas may be managed through standard controls.

It Helps Compliance Teams Use Resources Better

Compliance teams have limited time and resources. If every customer, transaction, and business activity receives the same attention, teams can end up spending too much time on low-risk areas.

A clear risk assessment helps prioritise the work. Staff can focus more closely on areas where a control failure would create greater regulatory or financial crime risk. FATF also notes that a risk-based approach can help organisations focus their resources where the risks are greatest.

What Should a Business Risk Assessment Cover?

A standardised assessment is not effective in all situations. The risk factors should reflect how the organisation operates, who it deals with, and where its exposure comes from.

Customer Risk

Start with the people and businesses you deal with.

Look at the types of customers you serve, their business activities, ownership structures, and overall risk profiles. Politically exposed persons, complex legal structures, cash-intensive businesses, or customers operating in higher-risk sectors may require closer consideration. CBUAE guidance also treats customer risk as an important part of institutional-level risk assessment.

The point is not to label an entire customer group as risky. It is to understand where additional controls may be appropriate.

Products and Services Risk

Certain products or services inherently face a higher risk of financial crime than others.

Think about whether a service allows rapid movement of money, large-value payments, international transfers, cash transactions, or complex financial arrangements. New products can also introduce risks that existing controls were never designed to manage.

For relevant UAE financial institutions, AML/CFT requirements specifically call for ML/TF risks linked to new products, practices, and technologies to be identified and assessed.

Geographic Risk

Where the business operates matters, but so does where its customers and transactions are connected.

A company may need to consider customer locations, the source and destination of funds, counterparties, and exposure to higher-risk jurisdictions. Geographic risk does not automatically make a relationship unacceptable. It tells the business when closer review may be needed.

The risk should also be considered alongside other factors rather than in isolation.

Delivery Channel Risk

How a customer reaches your business can affect the level of risk.

Remote onboarding, digital platforms, intermediaries, agents, and face-to-face relationships can each create different challenges. For example, a fully remote relationship may require stronger identity verification than a straightforward in-person interaction.

The assessment should look at whether existing controls are suitable for each channel and whether new technology has changed the exposure.

Transaction Risk

The way money moves through the business can reveal risks that are not obvious from the customer profile alone.

Consider transaction size, volume, frequency, payment method, cross-border activity, and whether behaviour matches what the business knows about the customer. Large or complicated transactions are not automatically suspicious, but they may require stronger monitoring depending on the circumstances.

This is why transaction information should feed into the wider business risk picture rather than being reviewed separately.

How Do You Conduct a Business Risk Assessment?

A good assessment needs a clear method, but it does not need to become an unnecessarily complicated exercise.

Identify the Inherent Risks

Start with the risks that exist because of the nature of the business, before considering the controls already in place.

Use real business information wherever possible. Customer profiles, transaction volumes, geographic exposure, products, services, previous incidents, and internal data can all help.

CBUAE’s sectoral assessment model similarly considers inherent risk factors before assessing control effectiveness and residual risk.

Review Your Existing Controls

Once the risks are clear, look at what the organisation is doing to manage them.

This may include KYC and customer due diligence, enhanced due diligence, sanctions screening, transaction monitoring, staff training, internal approvals, and suspicious transaction reporting processes. The important question is not simply whether the control exists.

You also need to consider whether it is working properly in day-to-day practice.

Assess the Remaining Risk

Even good controls do not remove every risk.

After considering the strength of existing controls, the business can assess the residual risk, which is the exposure that remains. The CBUAE’s sectoral methodology follows this general approach by considering inherent risk together with control effectiveness to arrive at residual risk.

If the remaining risk is higher than the organisation is prepared to accept, further controls or changes may be needed.

Document the Findings and Actions

The assessment should leave a clear record of what was reviewed and what happens next.

Document the risk factors considered, the reasoning behind the ratings, existing controls, any weaknesses found, and actions that need to be taken. CBUAE guidance expects risk assessment methodologies and findings to be documented for relevant regulated institutions.

This also makes the assessment much easier to explain during an internal audit or regulatory inspection.

Business Risk Assessment vs Customer Risk Assessment: What Is the Difference?

The two are closely related, which is why they are often confused, but they answer different questions.

A Business Risk Assessment Looks at the Organisation

A business risk assessment asks, ‘Where is our organisation exposed to financial crime risk?’

It takes a broad view across customers, products, services, transactions, jurisdictions, and delivery channels. The results help shape AML policies, controls, monitoring, and the organisation’s overall risk-based approach.

It is about understanding the risk profile of the business rather than one individual relationship.

A Customer Risk Assessment Looks at One Customer

A customer risk assessment asks a narrower question: How much risk does this particular customer present?

It may look at factors such as the customer’s occupation or business, ownership, location, expected activity, transaction behaviour, and other relevant information. Customers can then be placed into suitable risk categories and receive the appropriate level of due diligence.

Customer risk assessment results can also provide useful data for the wider business risk assessment.

What Happens If a Business Risk Assessment Is Weak?

A poorly designed or outdated assessment can affect far more than the risk rating itself.

High-Risk Areas Can Be Missed

If the assessment does not reflect the real business, important risks may never receive the attention they need.

For example, the organisation may expand into a new market but continue using a risk assessment based on its old customer base. Controls could then remain unchanged even though the underlying exposure has increased.

The problem is not simply an inaccurate document. It can influence the controls that come after it.

Controls May Not Match the Risk

AML controls should make sense for the risks they are supposed to manage.

If risk has been assessed poorly, the business may apply unnecessary controls in some areas while leaving genuine weaknesses elsewhere. That can create extra work for staff without actually improving compliance.

A stronger assessment helps connect controls to a clear reason for using them.

Regulatory Reviews Become Harder to Defend

During a regulatory inspection, simply saying that the organisation considers itself low risk is unlikely to be enough.

The business should be able to show how risks were identified, what information was used, how controls were assessed, and why particular ratings were reached. CBUAE’s supervisory approach itself uses risk assessments and control assessments to guide regulatory attention.

A clear methodology makes those discussions much easier.

When Should You Update a Business Risk Assessment?

A business risk assessment should reflect the business you operate today, not the business you had when the document was first written.

When the Business Changes

Review the assessment when you launch a new product, enter a new market, change your customer base, introduce a new delivery channel, or significantly change how transactions are handled.

These changes can create risks that were not included in the previous assessment. Updating the assessment early gives the compliance team time to decide whether existing controls remain suitable.

Risk should be considered as part of the change, not months afterwards.

When New Risks Emerge

Financial crime methods, sanctions exposure, technology, regulations, and sector risks continue to change.

New information from regulators, national or sectoral risk assessments, FATF publications, internal incidents, or industry trends may all affect the organisation’s risk profile. CBUAE guidance also expects relevant external information, including national and sectoral assessments, to feed into risk assessment methodology.

If new information changes your view of the risk, the assessment should change too.

During Regular Compliance Reviews

Even if nothing dramatic has happened, the business risk assessment should still be reviewed periodically.

Customer behaviour can shift gradually. Transaction volumes may grow. A product that once represented a small part of the business may become much more important.

Regular reviews help catch those changes before the assessment becomes disconnected from what the organisation actually does.

Conclusion

A business risk assessment gives your AML/CFT programme a starting point. It shows where financial crime exposure sits, whether existing controls are doing enough, and which areas need more attention. More importantly, it helps the business make risk decisions based on evidence rather than assumptions.

Vertex Compliance provides business risk assessment services for organisations that need a clearer view of their AML risks, controls, and remaining exposure. Its approach uses business, customer, geographic, transaction, and other relevant risk information to support practical risk management.