How to Choose an AML Software Vendor?

The modern financial landscape is diverse and achieving effective AML compliance requires firms to manage vast amounts of customer and transaction data in order to address money laundering threats. Similarly, financial regulations change constantly while criminal money laundering methodologies grow more sophisticated or adapt to exploit new technologies. Given the complexity of the challenge, and the potential for heavy noncompliance penalties, AML should be a priority for every financial institution and the technology and software on which you build your AML solution. Leveraging an AML software vendor is therefore an important consideration. 

Effective AML means balancing the regulatory requirements of your jurisdiction with your firm’s commercial and business needs. Ideally, your AML solution fulfils your compliance obligations in the most efficient manner possible, minimizing false positive alerts along with the other time and resource drains that make compliance so costly and affect customer experiences adversely. 

With that in mind, in order to find the right AML software vendor, you’ll need to consider a range of relevant factors.

Compliance Requirements

Your AML software vendor must meet the fundamental needs of your AML program, which will be based on the customers you serve and the financial environment in which you operate. From a regulatory perspective, an AML program should feature a number of essential risk-based controls including customer due diligence (CDD), transaction monitoring, sanctions list and PEP screening, and adverse media monitoring. In addition to those fundamentals, important considerations for your software solution include:

• Data coverage: An AML software solution should capture the spectrum of customer and transaction data that a firm needs to fulfill its regulatory responsibilities. 
• Speed of updates: As customer data changes and evolves, your AML software solution should be capable of updating rapidly to reflect new risk levels.
• Matching algorithms Search algorithms should be able to identify and assess risks effectively when a match is found during the AML process. The name transliteration process, for example, should consider language differences, ethnic spelling variations, misspellings, aliases and so on.
• Proactive monitoring: When a customer’s risk profile changes, your AML software should alert your compliance teams quickly and efficiently, with minimal need for manual intervention.

False Positives

False positive AML alerts represent a significant time and efficiency drain for every financial institution, however, the right AML software vendor can help firms reduce their false positive rates. Certain features of an AML software solution are specifically useful in this regard:

• Risk-based: Ideally, AML software solutions should be configurable to the risk profiles of customers, transactions, and industrial sectors, so that firms can deliver a more specific, focused, and accurate AML response depending on context. 
• Profile-based: Software that incorporates profile-based screening can reflect the risk profiles presented by individual customers. Profile-based screening allows firms to apply simplified AML measures to lower-risk customers while subjecting higher-risk customers to an enhanced level of scrutiny. 
• Usability: AML software solutions should be user-friendly and accessible so that compliance teams can address alerts quickly without the need to consult IT teams.
• Sensitivity: Compliance teams should be able to tailor the sensitivity of their AML software to screen only for relevant data attributes, ignoring variables that do not pose a risk to the firm’s AML compliance responsibility.  
• Whitelisting: Software solutions that integrate whitelists of approved customer names may be able to remediate false positive alerts more quickly. 

API

Your AML software’s representational state transfer (REST) application programming interface (API) will determine how effectively employees interact with it and ultimately affect your compliance performance. Firms should assess the potential of an AML software vendor’s REST API to enhance their existing AML infrastructure:

• API integration: Your REST API should allow for seamless sync with existing AML systems such as case management and customer records. 
• Availability: Your API must make the necessary AML data available to compliance employees in an accurate and timely manner so that essential information, such as monitoring alerts, are addressed effectively. 
• Security and capacity: Your API must meet industry-level security standards while also being able to handle the capacity and speed requirements of your firm’s AML search volumes.

Human Expertise

The AML software vendor that your firm implements should complement the skills and expertise of the human compliance employees who work with it every day. However powerful or innovative your solution, it’s effectiveness will depend on the way in which it supports your compliance team and advances your compliance objectives. 

Practically, this means assessing the strengths and weaknesses of your AML program and the teams that use it. Similarly, your firm’s leadership must have the AML experience and expertise to build an effective compliance program and select the technology best suited to it.

Software Deployment

Firms must consider how their AML software solution will be deployed within their existing business infrastructure. Some software deployments will require on-premises installation while others may be able to run off-premises in the cloud. 

While there is no one-size-fits-all solution, both types of deployment have benefits and drawbacks: 

On-premises software deployments: While software solutions deployed on-premises offer a greater degree of control over compliance infrastructure, that control ultimately means more regulatory exposure for firms. On-premises solutions also entail higher professional service costs, longer implementation periods, and may require an IT department capable of performing all necessary maintenance, updates, back-ups and security processes. 

Cloud software deployments: Cloud software solutions offer firms less direct control of their AML infrastructure  but also reduce regulatory exposure by handling maintenance and security needs as part of their service offering. Cloud-solutions also provide a degree of flexibility when firms need to scale their AML program up and down and can be deployed rapidly compared to on-premises solutions. 

Security

AML requires firms to collect and store a range of sensitive customer information. Accordingly, the AML software vendor you choose must offer a suitable level of protection from cyber-threats and comply with jurisdictional privacy regulations such as the EU’s GDPR and California’s Consumer Privacy Act.  

Similarly, your solution should also help your firm achieve ISO27001 certification: the globally-recognized standard of information security management. ISO27001 certification involves both technological and physical security controls but the protection your AML software confers will constitute a significant part of the accreditation process.

With this in mind, firms should ensure they have reviewed, and are comfortable with, their software vendor’s security policies. Vendors should also have disaster recovery and business continuity strategies in place to ensure that services and compliance responsibilities are not disrupted by unforeseen circumstances.

AI and Machine Learning

Artificial intelligence (AI) and machine learning tools can significantly enhance a firm’s AML compliance performance in a number of ways, not least by processing large amounts of data much faster than compliance employees ever could. AI tools, for example, may automate crucial CDD, transaction monitoring, and screening processes, helping to organize and prioritize unstructured data in a way that enhances the alert remediation process. 

Similarly, software solutions that integrate machine learning models add an even greater degree of efficiency by exploiting previously collected data to optimize the AML process. Machine learning tools may allow firms to identify redundant or duplicate information during customer due diligence in order to identify emerging risks, speed up alert remediation, and reduce false positives.