Phase 1 of 7
Scoping & Obligations
Define your regulatory perimeter, entity types screened, and jurisdictional requirements before any model work begins.
0/16
Phase Progress
Required Recommended Optional Open-Source Proprietary Trinidy
Regulatory Perimeter
Identify applicable AML regulatory frameworks
Why This Matters
Getting this wrong at the start cascades through every subsequent decision — model thresholds, list sources, data residency, and SAR filing timelines all differ by framework. Examiners will ask which regulations you are subject to within the first ten minutes of any BSA/AML exam. A common mistake is assuming only US frameworks apply when correspondent banking relationships trigger OFAC obligations internationally.
Note prompts — click to add
+ Which regulator has primary examination authority over us?+ Do our correspondent banking relationships create additional jurisdictional obligations?+ Who internally owns the regulatory mapping and keeps it current?Confirm which regulations govern your screening obligations.
Select all that apply
Define entity types to be screened
Why This Matters
Scope creep in the other direction — screening too few entity types — is one of the most common exam findings. FATF guidance requires screening beneficial owners at the 25% threshold, but many programs only screen direct account holders. Third-party vendors are increasingly in scope under OCC guidance after several enforcement actions involving vendor-facilitated money laundering.
Note prompts — click to add
+ Do we screen employees and contractors or only customers?+ What is our current UBO resolution threshold and process?+ Are third-party vendors and suppliers in scope for our program?Determine which entity categories are in scope for screening.
Select all that apply
Define screening trigger events
Why This Matters
List update triggers are the most frequently missed. When OFAC adds a new entity, your obligation to screen against that addition is essentially immediate — not at the next scheduled review. Several 2024–2025 enforcement actions cited failures to re-screen existing customers after list updates as a primary violation. Name and address changes are also commonly overlooked trigger events.
Note prompts — click to add
+ How quickly do we screen after a list update — is this automated or manual?+ What is our process when a customer changes their name or address?+ Who approves manual override triggers and is that documented?Specify what events initiate a screening check.
Select all that apply
Establish screening latency SLA
Why This Matters
Your latency SLA directly determines which model architectures and infrastructure approaches are viable — you cannot make this decision after model selection. FedNow and RTP both require payment decisioning well under one second. Cloud-routed screening APIs with unpredictable network latency frequently fail to meet sub-100ms requirements under load, which is why edge inference is often the only viable architecture for real-time rails.
Note prompts — click to add
+ What payment rails are we on today and what are we adding in the next 12 months?+ What is our current p99 screening latency and where does it break under peak load?+ Have we stress-tested our screening stack at peak transaction volume?Real-time payment rails (SWIFT, FedNow, RTP) impose hard latency constraints. Define your SLA before model selection.
Single choice
Trinidy — Real-time payment screening at sub-100ms is the hardest infrastructure problem in AML. Trinidy runs the full screening stack on-node with local list indexes — no network round-trip to a cloud screening API in the critical path.
Define false positive tolerance thresholds
Why This Matters
Industry benchmarks show rules-based programs run 85–95% false positive rates — meaning 85–95 analyst hours spent investigating non-issues for every real match found. Defining your tolerance before model tuning ensures you are optimizing for a real operational target rather than minimizing false negatives at any cost. Regulators increasingly expect FP rates to trend downward year-over-year as programs mature.
Note prompts — click to add
+ What is our current FP:TP ratio and do we formally track it?+ How many analysts do we have and what alert volume can they sustain?+ At what FP rate do we need to add headcount vs. improve the model?AML screening generates high false positive rates by design. Define your acceptable analyst workload (FP:TP ratio) before model tuning.
Single choice
Identify data residency and sovereignty constraints
Why This Matters
Choosing a cloud-hosted screening vendor before mapping data residency constraints is one of the most expensive architectural mistakes an institution can make. GDPR Article 44 restricts transfers of EU personal data to third countries without adequate protection. Several institutions have had to rebuild their screening infrastructure mid-deployment after discovering their chosen vendor's data center locations violated residency requirements.
Note prompts — click to add
+ Which countries do our customers reside in and which data centers does our screening vendor use?+ Have we obtained a legal opinion on our current data flows vs. GDPR and MAS requirements?+ Who in legal or compliance owns data residency sign-off for vendor contracts?Map each list source and screening workflow to its jurisdictional data constraint: GDPR Article 44 (EU transfer restrictions), MAS Notice 626 (Singapore), Swiss banking secrecy (FINMA), and UK GDPR. Architecture decisions must follow this map — 47% of institutions cite cross-border data sharing as a key compliance challenge.
Trinidy — EU GDPR, Swiss banking secrecy, and MAS Notice 626 each restrict exporting customer screening data. Trinidy's edge inference keeps all screening computation within the institution's own infrastructure — no PII crosses jurisdictional lines for any screening operation.
2025–2026 Regulatory Developments — Action Required
Assess FATF Recommendation 1 rewrite (Feb 2025)
Why This Matters
The February 2025 amendment was the most significant change to FATF's core standards in a decade. It explicitly requires institutions to avoid uniform "one size fits all" AML controls and to differentiate measures based on assessed risk level. Examiners in FATF member jurisdictions are expected to reference the updated standard in mutual evaluations from 2025 onward — meaning programs that apply the same threshold to a rural grocery store and a high-risk MSB will face findings.
Note prompts — click to add
+ Have we mapped our customer base into risk tiers and applied different controls to each tier?+ Who owns the risk-based approach documentation and when was it last updated?+ Does our program document explain why our controls are proportionate to our specific risk profile?FATF's February 2025 Plenary amended Recommendation 1 to explicitly require institutions to differentiate AML/CFT controls by type and level of risk — moving the standard from "apply controls" to "calibrate controls proportionately." Institutions applying uniform thresholds across all customers face examiner scrutiny under the new standard.
Single choice
Assess FATF 2025 Financial Inclusion guidance exposure
Why This Matters
FATF's June 2025 guidance marks a genuine shift — institutions can now face examiner criticism for being too aggressive in excluding customers, not just for being too permissive. Regulators are specifically looking at whether geographic flags, demographic proxies, or blanket country-level blocks are applied without individual risk assessment. For institutions in retail banking or serving immigrant communities, this is an immediate fairness and compliance risk.
Note prompts — click to add
+ Do we apply any blanket geographic or demographic flags that exclude entire customer segments?+ Have we reviewed our de-risking decisions with legal counsel against the June 2025 guidance?+ Is financial inclusion risk formally documented in our BSA/AML program?FATF's June 2025 guidance formally reframes financial inclusion as a compliance objective. Over-exclusion of unserved or underserved customer segments is now an examiner concern. Document your de-risking decisions and ensure your model does not apply blanket geographic or demographic flags without individual risk assessment.
Single choice
Map EU AMLA applicability (cross-border EU firms)
Why This Matters
AMLA represents a fundamental change to EU AML supervision — for the first time, a supranational authority will directly supervise select cross-border financial institutions rather than delegating entirely to national regulators. Institutions directly supervised by AMLA will face a single harmonized standard rather than managing 27 different national implementations. Getting ahead of AMLA's documentation expectations now avoids emergency remediation when direct supervision begins.
Note prompts — click to add
+ Do we meet the thresholds for AMLA direct supervision (cross-border activity, risk profile)?+ Who is tracking AMLA's supervisory methodology publications and risk indicator releases?+ Have we mapped our current model documentation to the EU's consolidated AML regulation?The EU Anti-Money Laundering Authority (AMLA) began operations in 2025 and will directly supervise high-risk cross-border firms. If your institution operates across EU member states, assess direct supervision exposure and align model documentation to AMLA's emerging supervisory standards — including harmonized risk indicators.
Single choice
Assess FinCEN proposed AML Program Rule (active 2026)
Why This Matters
The proposed rule is the most consequential FinCEN rulemaking in over a decade. The explicit protection for institutions with sound programs — where only "significant or systemic failures" trigger major enforcement — is a meaningful safe harbor, but it requires documented evidence of a risk-based approach. Institutions with well-documented programs will have a defensible position under examiner scrutiny; those with undocumented or process-driven programs will not.
Note prompts — click to add
+ Does our BSA/AML program document articulate how our controls are calibrated to our specific risk profile?+ Have we conducted a formal AML/CFT risk assessment in the last 12 months?+ Who is monitoring the FinCEN rulemaking process and tracking the comment period and final rule date?FinCEN's proposed AML Program Rule codifies a mandatory risk assessment process as one of the four BSA core pillars and establishes FinCEN as the primary gatekeeper for significant supervisory actions. The rule rewards institutions with documented, risk-based program design. Only "significant or systemic failures" would trigger enforcement — sound programs with isolated issues are explicitly protected.
Single choice
Apply OCC community bank AML recalibration (Nov 2025)
Why This Matters
The November 2025 OCC guidance explicitly tells examiners to stop applying the same prescriptive procedural baseline to all banks regardless of risk profile. For community banks, this is permission to simplify overly conservative programs — but only if the simplification is documented with risk-based rationale. Eliminating the MLR system also removes a compliance burden that many community banks found disproportionate to their actual risk.
Note prompts — click to add
+ Are we below the $30B threshold and subject to the revised community bank examination procedures?+ Which of our current controls are more conservative than our actual risk profile warrants?+ Do we have documented rationale for each threshold and control decision?The OCC revised BSA/AML examination procedures for community banks (up to $30B assets) in November 2025, eliminating the MLR reporting system and directing examiners to focus on actual risk profile. Community banks should recalibrate screening thresholds where risk profile supports it and document the rationale for each adjustment.
Single choice
Benchmark program against 2024–2025 enforcement patterns
Why This Matters
The 2024–2025 enforcement cycle revealed consistent failure patterns across institutions of very different sizes and geographies. TD Bank's $3B penalty was driven primarily by transaction monitoring failures and failure to file SARs — both of which are among the most mechanical and documentable compliance obligations. Benchmarking your program against actual enforcement findings is more valuable than benchmarking against regulatory guidance because it shows what examiners actually penalize in practice.
Note prompts — click to add
+ Have we reviewed the TD Bank and other major 2024-2025 consent orders and mapped findings to our program?+ When did we last audit our SAR filing timeliness and completeness against FinCEN requirements?+ Who owns correspondent bank EDD and how often is it refreshed?AML/CFT penalties totaled over $1.1B in 2025. The TD Bank action in 2024 reached $3B across DOJ, FinCEN, OCC, and FRB. Dominant failure patterns: inadequate transaction monitoring, failure to file SARs, and weak correspondent bank EDD. Assess your program against each failure pattern and document gap remediation.
Select all that apply
Assess FATF virtual asset and VASP obligations (R.15)
Why This Matters
Even institutions that do not directly custody or transact in crypto can have VASP exposure through correspondent banking relationships, wire transfers to crypto-adjacent businesses, or customer transactions that pass through exchanges. FATF's 2025 update found that many jurisdictions still have not implemented basic VASP supervision, creating regulatory gaps that examiners are now specifically probing. Informal assessments that conclude "no exposure" without documented analysis are insufficient.
Note prompts — click to add
+ Do any of our correspondent banks have material VASP business or crypto custody operations?+ Have we reviewed our wire transfer volumes for flows to or from known crypto exchanges?+ Does our onboarding process identify customers who are VASPs or crypto businesses?FATF's 2025 targeted update on virtual assets found many jurisdictions still struggle with Recommendation 15 fundamentals. If your institution has any exposure to crypto payments, digital asset custody, or VASP correspondent relationships, a formal VASP risk assessment is required even if direct crypto activity is prohibited.
Single choice
List Landscape Assessment
Inventory all sanctions and watchlist sources
Why This Matters
Most institutions know they screen OFAC SDN but undercount their full list obligations. The EU Consolidated list and UN Security Council list are legally mandatory for regulated entities in those jurisdictions and are often overlooked by US-centric programs. Internal watchlists of prior SAR subjects are frequently absent despite being high-value — a previously flagged customer is statistically more likely to generate the next SAR.
Note prompts — click to add
+ When did we last formally audit all list sources we are required to screen vs. what we actually screen?+ Do we maintain an internal watchlist of prior SAR subjects and declined customers?+ How are new list sources identified and onboarded when regulatory requirements change?Catalog every list you are obligated to screen against and their update frequencies.
Select all that apply
Assess list update propagation speed requirement
Why This Matters
OFAC does not define "reasonable" numerically, but enforcement actions and industry guidance have converged on 15 minutes as the practical standard for institutions on real-time payment rails. A newly added SDN entity could conduct transactions in the window between list publication and your index updating — that window is your liability exposure. Cloud-based screening services that batch list syncs hourly or daily create computable exposure windows that examiners can and do calculate.
Note prompts — click to add
+ What is our actual current list update lag from OFAC publication to our system reflecting it?+ How do we handle transactions that occurred during a list update window if a new SDN is later found to match?+ Is our list propagation time formally documented and included in our model risk documentation?When OFAC adds a new entity, how quickly must your screening reflect the update?
Single choice
Trinidy — List updates from OFAC, EU, and UN are distributed as delta files. Trinidy ingests and re-indexes updated list entries in-node — live transactions are screened against a current list without a cloud dependency for index propagation.
Define retroactive re-screening policy
Why This Matters
Retroactive re-screening policy is a formal regulatory expectation — not having one is itself an exam finding. OFAC's 50% rule complicates this: if a newly sanctioned entity owns 50%+ of an entity you have an existing relationship with, that relationship becomes prohibited even if the entity itself was not directly added to the SDN list. Automated retroactive screening within 24 hours is the gold standard but requires efficient list indexing to be operationally feasible at scale.
Note prompts — click to add
+ How long does a full retroactive re-screen of our customer base take with current infrastructure?+ Do we have documented procedures for the 50% rule — screening entities owned by newly added SDN entries?+ Is retroactive re-screening automated or does it require manual analyst initiation?When a new entity is added to OFAC, do you re-screen existing customers? Define scope and automation.
Single choice