What AML/KYC Actually Means

AML: Anti-Money Laundering. Detect and report suspicious transactions.

KYC: Know Your Customer. Verify identity of customers.

CDD: Customer Due Diligence. Ongoing risk assessment.

Regulatory Framework

Israel: FIU (Financial Intelligence Unit) requirements.

International: FATF (Financial Action Task Force) standards.

EU: 5th and 6th AML Directives.

US: Bank Secrecy Act, FinCEN requirements.

KYC Process Flow

Identity verification: ID document + selfie + liveness check.

Address verification: utility bill, bank statement.

Sanctions check: OFAC, UN, EU lists.

PEP check: Politically Exposed Persons.

Adverse media check: negative news search.

Technical Architecture

ID verification vendors: Onfido, Jumio, Sumsub. Never build from scratch.

Screening: Refinitiv, ComplyAdvantage for sanctions/PEP.

Case management: your custom system for review workflow.

Audit trail: every action logged, immutable.

Risk Scoring

Multi-factor risk score per customer.

Factors: geography, transaction patterns, business type, PEP status.

Dynamic: recalculate on new information.

Tiered response: low/medium/high risk = different processes.

Transaction Monitoring

Rules-based: predefined thresholds (e.g., >$10K).

Pattern-based: unusual behavior for that customer.

ML-based: detect anomalies statistically.

All three combined = comprehensive coverage.

Suspicious Activity Reports (SAR)

Legal requirement: report suspicious activity within 30 days.

Structured format required (e.g., XML for Israeli FIU).

Automate submission to reduce compliance burden.

User Experience Challenge

KYC is friction. Users hate it.

Balance: legal compliance vs user experience.

Progressive: minimal KYC for low-value, thorough for high-value.

Case Management System

Every alert needs review.

Queue with priority levels.

SLA tracking: high-risk cases within 24 hours.

Documentation: why case was closed/escalated.

Regulatory Reporting

Multiple report types: SARs, currency reports, wire transfers.

Each regulator has own format.

Automated generation critical – manual = errors + missed deadlines.

Data Retention

Legal requirement: 5-7 years typically.

Includes: transactions, alerts, investigations, communications.

Encrypted storage. Access logs. Purge on schedule.

Audit Preparation

Regulators audit compliance programs.

Must produce: policies, procedures, logs, training records.

System must generate audit-ready reports on demand.

Building In-House vs Buying

ID verification: ALWAYS buy. Regulated vendors have compliance stamps.

Screening: buy – lists change constantly.

Case management: often build custom – your workflows.

Combined platform: strategic decision. Depends on scale.

Based on Real Projects

This guide is based on our work with:

• Platforma365
• Nasca

Further Reading

If this guide helped you, you might also want to read our comprehensive guide on Custom SaaS Development.