Anti-money laundering (AML) is the set of checks that banks and other financial firms must run to stop criminals from hiding where their money came from. Hiding the origin of criminal money is called money laundering. In India, the Prevention of Money Laundering Act (PMLA) requires banks to run these checks, and the software that helps them is part of compliance: following the rules a bank is legally required to follow.
A bank must do several things by law. It must know who each customer is. It must watch every transaction for fraud and money laundering. It must check every name against sanctions lists, the lists of people and companies that banks are forbidden to deal with. And it must report suspicious transactions to the authorities, and send regular reports on its risks to its regulator, some every day and others every month or quarter.
Take, for example, a college student in Pune who opens a savings account from her phone. The bank checks her PAN and Aadhaar details and a photo of her face. This is KYC (know your customer), and identity verification software does much of it.
A month later, ₹9 lakh arrives in her account from a stranger and leaves again within the hour. AML transaction monitoring software scores the transfer as it happens and raises an alert. Money that arrives and leaves this quickly is a common sign of a mule account, an account used to pass stolen money along. Every name in the transfers is also checked by sanctions screening.
An investigator then works through the alert in AML case management software. Now an AI model gathers her history and writes the first draft of the case. The investigator reviews it and decides. This is human in the loop. If the transfer looks suspicious, the bank must report it to the Financial Intelligence Unit, India (FIU-IND).
Behind this, the bank also checks itself. Model risk management checks that the models that flagged the transfer still work as they should. Data reconciliation checks that the bank's numbers are right. Employee compliance monitoring watches the bank's own staff. And regulatory reporting software sends the bank's reports to its regulator, in the regulator's own formats.