For a professional subject to anti-money laundering and counter-terrorism financing regulations (AML-CFT), a regulatory compliance solution encompasses know-your-customer procedures, screening, risk scoring, transaction monitoring, and transaction filtering. Its effectiveness is judged by the evidence it produces during an audit. Every alert, every decision, and every adjustment must be traceable.
| Function | What She Needs to Do | Documentation to Be Provided During an Inspection | Question for the Editor |
| Know Your Customer and Screening | Identify the customer and their Beneficial Owners, and screen them against sanctions and asset freeze lists, as well as PEP | Record of screening dates, reasoned decision for each alert | Who sets the reconciliation thresholds, and how is the adjustment tracked? |
| Risk Rating | Classify each client based on documented risk factors and review the rating | Justification for each grade, revision history | Can the score be broken down factor by factor? |
| Operations Monitoring | Detect unusual transactions using scenarios and prioritize alerts | Current scenarios, alerts generated, follow-up actions taken | Who creates or edits a scenario? |
| Stream Filtering | Monitor payments for sanctions, embargoes, and restricted countries and currencies | Log of blocked or unblocked messages, with the reason for each | What message formats are supported? |
| Alert Management | Assign, investigate, validate, and close each alert within a defined workflow | Author, date, and reason for each decision | Can the validation circuit be configured without any development work? |
| Audit Trail | Record every action and generate reports for management and the regulatory authority | Reconstructible audit trail, dated exports | Can an old decision be reconstructed using the rules that were in effect at the time? |
| Regulatory Monitoring | Incorporate changes to the texts and lists without a specific project | Release and Update Log | How often is the solution updated, and who is responsible for it? |
| Integration and Hosting | Connect to the information system and host the data | Integration plan, accommodation, security tests | Where is the data hosted, and by whom? |
Choosing a compliance solution means determining what you’ll be able to present on the day of an audit. The demonstrations may seem similar, but differences become apparent as soon as you ask who sets a threshold, how a past decision can be reconstructed, and who is responsible for regulatory updates.
What is expected of a regulatory compliance solution?
A regulatory compliance solution equips the system AML-CFT for a regulated professional. It centralizes data, applies rules, generates alerts, and retains evidence. It does not replace either the procedure or human judgment.
The Prudential Supervision and Resolution Authority (ACPR) verifies the quality of the anti- AML-CFT system at the institutions under its supervision, using a risk-based approach. The professional remains responsible for classification, investigating alerts, and deciding whether to report a suspicion. The solution assists the professional by automating screening, assessing risks, monitoring data flows, and tracking decisions.
An effective tool reduces the time spent on false positives, documents every decision, and updates itself without unnecessarily tying up the technical team. The project is structured according to the steps involved in achieving compliance.
What features should a compliance solution include?
A comprehensive solution covers eight functions, from establishing a relationship to monitoring operations and preserving evidence.
Know Your Customer, Risk Screening, and Risk Rating
Know Your Customer (KYC) enables the identification of the customer, its representatives, and its Beneficial Owners. Screening compares these identities against international sanctions lists, asset freeze lists, and lists of politically exposed persons. Risk scoring classifies the customer based on documented factors such as country, industry, products, and amounts.
These three functions come into play when a business relationship is established and continue throughout the duration of the relationship, particularly during periodic reviews. They enable the application of appropriate due diligence. Simplified due diligence may be implemented, under certain conditions, when the risk is low, while enhanced measures are required when the profile presents high-risk factors.
The compliance officer must be able to explain how each client was classified and why an alert was triggered, confirmed, or closed. A solution that generates a score without detailing the factors does not allow for this justification. For screening, a 10-criteria grid helps compare offers.
Operations Monitoring and Data Flow Filtering
Transaction Monitoring (transaction monitoring) detects atypical behavior, such as unusual amounts, abnormal frequency, or transactions to countries that are inconsistent with the customer’s profile. It is based on configurable scenarios that generate alerts.
The filtering system monitors payments and financial messages within its scope at the time they are issued or processed. It blocks or flags—depending on the defined rules—transactions involving individuals, entities, countries, or currencies subject to sanctions or restrictions. The solution must support the formats used by the institution, particularly ISO 20022 or MT when they are present in its payment chain. These two functions generate a significant volume of alerts, which an effective solution must prioritize while reducing false positives so that the team can give priority to cases presenting the highest risks.
Essential features of a compliance tool AML-CFT : alerts, audit trail, updates
Beyond screening and monitoring, three cross-functional roles are key to the system’s effectiveness. Alert management oversees the assignment, investigation, and closure of alerts. Each decision is accompanied by the name of the person who made it, the date, and the reason.
The audit trail maintains a history of actions, including the screened customer, the person who performed the screening, the date, the result, and the settings in effect at the time. It allows you to reconstruct a past decision, which serves as important evidence during an audit. Regulatory monitoring tracks changes to regulations and lists without unnecessarily burdening the technical team. Check the publication schedule and determine who is responsible for this task.
Integration with the information system and hosting affect the implementation timeline and data control.
What evidence must the solution provide in the event of an audit?
An audit by the competent authority (for example,the ACPR for institutions under its supervision) may, in particular, focus on the traceability of decisions. For its part, Tracfin has the right to request information, allowing it to ask a regulated professional for records and documents related to a transaction. The institution must therefore be able to provide complete files, fully investigated alerts, well-reasoned analyses, and evidence of the consistent application of its rules.
The audit trail must make it possible to reconstruct each step, including the date of the customer screening, the result obtained, the identity of the person who raised the alert, and the basis for that person’s decision. If a threshold has been modified, the date, the person who made the change, and the reason for the change must be retained. A system that deletes previous settings or retains only the final result undermines the institution’s ability to demonstrate the accuracy and consistency of its due diligence procedures.
There is a growing expectation that results be explainable. An algorithm that generates a score without detailing the factors involved functions like a “black box.” In the event of an audit, the institution may then have difficulty justifying the classification of a client as high-risk. Solutions based on an “Glass Box” Augmented Intelligence approach make the factors used and their weights visible, provided that appropriate configuration and governance are in place.
How does the solution integrate with your information system?
A compliance solution must integrate with existing applications, including customer management, thecore banking system, and the document management system. The integration timeframe depends on the deployment model, data quality, data volumes, available interfaces, and the expected level of configuration. In SaaS mode, the application is hosted by the vendor or its hosting provider.
The provider generally does not manage application servers or backups, in accordance with the division of responsibilities set forth in the contract. Data can be transmitted via REST API, files, or other connectors. The pure API mode integrates the solution as a service called by applications, while the hybrid mode combines a web portal and an API.
An on-premises installation deploys the application on the institution’s servers. It offers greater control over the infrastructure but requires the necessary skills to manage and secure it. The division of responsibility for updates depends on the contract and the maintenance model selected. If your system is outdated, find out how to modernize an obsolete AML-CFT system.
Before making a decision, ask yourself three questions:
- What is the integration timeframe for your volumes?
- How much work does the configuration involve?
- Who handles version upgrades?
International expansion, internal development, or RegTech: What should be compared?
The solutions fall into three categories: software suites from long-established international vendors, in-house solutions, and recent RegTech solutions. The following table outlines the criteria to consider for each of them.
| Criterion | Historic International Suites | In-house solutions | Recent RegTech Developments |
| Configuration | Rich; check what the compliance team can change on its own | Custom; depends on the development team | Often accessible from the interface; check the resolution |
| Integration | Project to be defined; get a time estimate | Built for the existing system; to be maintained | Via API; verify load-bearing capacity |
| Regulatory Monitoring | Included in maintenance; verify the scope and frequency | Paid for by the institution | Often included in the subscription; check the scope and frequency |
| Support and Hosting | Check the language, time zone, and country of the host | In-house staff | Check the language and country of the hosting server |
| Total cost | License, integration, and maintenance to be added | Development, Maintenance, and Technical Debt | Subscription and Integration; Track Progress |
| References | Check references in your area | Not applicable | Check the team's experience and references |
An international software suite typically offers broad coverage and a wide range of features. Check where the data is hosted, what language the support is provided in, and whether the settings can be accessed without needing to consult a specialist.
An in-house solution can be designed to precisely meet specific needs. However, it requires maintaining the team, monitoring industry developments, and implementing updates. Technical debt accumulates if resources are lacking.
A RegTech solution can provideagility and frequent updates. Check the team’s experience, its track record, and the solution’s scalability for your volume. The RegTech solutions overview outlines the different categories.
How do you assess the total cost of ownership of a compliance solution?
The total cost includes all expenses incurred over the term of the contract. A solution that is inexpensive to purchase may turn out to be costly once integration, maintenance, and alert handling are taken into account.
The positions to be considered include:
- the license or subscription;
- integration, configuration, and training;
- maintenance and updates;
- the time spent handling alerts.
This last factor varies depending on the engine’s ability to reduce false positives. A solution that generates a high volume of false positives ties up the team’s time with irrelevant matches. Conversely, an engine that reduces false positives through refined criteria and appropriate matching techniques frees up time for analysis.
Regulatory updates are an often-overlooked expense. A solution that requires custom development for each new list necessitates budgeting for workdays. A solution that incorporates monitoring and regularly publishes new versions can significantly reduce this expense.
Data reversibility must be negotiated before signing the agreement. The institution must be able to retrieve the complete history in a usable format. A solution that does not allow for this extraction may require maintaining two systems in parallel.
What questions should you ask a publisher before signing a contract?
Before signing, ask to see the solution in action using a representative dataset. A generic demonstration does not allow you to verify the precision of the configuration or the relevance of the alerts.
Write down the following questions:
- Where is the data hosted, who has access to it, in what language is the support provided, how often are updates released, and who implements them?
- For the screening process, which sets the thresholds, under what circumstances is an alert triggered, and is a history of the settings retained?
- Regarding grading, can each grade be explained, and can the school add a criterion without providing further details?
- For monitoring—which creates the scenarios—how are alerts prioritized, and can the approval workflow be configured without coding?
- For filtering, what message formats, countries, currencies, and transaction types are supported?
Ask for references in your industry with comparable volumes. Get a quote for the timeline and integration workload. The applicable requirements are summarized in the regulatory compliance guide for subject professionals.
How does AP Solutions IO handle these functions?
AP Solutions IO offers four add-on modules, each designed for a specific function. They integrate via REST API or in hybrid mode, with hosting in France. The vendor releases a new version of the application every four months, which is automatically deployed in SaaS mode.
| Module | Function | Use Cases | Features | Product Sheet |
| AP Scan | Screening and Detection | KYC, Onboarding | Automated screening for sanctions, asset freezes, and PEP ; fuzzy logic-based false positive reduction engine; real-time REST API; audit trail | AP Scan |
| AP Scoring | Risk Rating | Risk-based approach | Customer and transactional risk scoring; configurable factors without the need for development; automatic review; explainable scoring | AP Scoring |
| AP Monitoring | Continuous monitoring | KYT, Analysis of Atypical Operations | Real-time monitoring; configurable scenarios; detection of atypical behavior; prioritization; approval process | AP Monitoring |
| AP Filter | Sanctions Filtering | Payment Flow | Filtering based on sanctions, embargoes, countries, and currencies; compatible with ISO 20022 and MT formats; integration into the payment chain | AP Filter |
The four modules share the following characteristics:
- accommodations in France;
- a no-code setup;
- traceability of actions;
- a REST API secured by OAuth 2.
They can be deployed together or separately. The “Glass Box” Augmented Intelligence makes the results produced by the tool explainable. A match is justified by the trigger criteria, a score is broken down into visible factors, and a scenario outlines its thresholds. This traceability helps meet the expectations of regulatory authorities.
AP Solutions IO supports financial compliance organizations such as Bpifrance. Data is hosted in France, technical support is provided in French, and new versions are automatically deployed via SaaS. AP Solutions IO offers four AML-CFT that complement one another.
Start by listing, function by function, the evidence your current tool can generate. If a function does not retain a history, it will not allow you to fully demonstrate your due diligence during an audit. Request a demonstration to compare the evidence.
FAQ
What is the difference between a regulatory compliance solution and " AML-CFT " software?
The term “regulatory compliance solution” refers to any tool that helps a company meet its obligations. Anti-Money Laundering ( AML-CFT ) software is a specialized form of such a solution. It covers, in particular, know-your-customer (KYC) procedures, screening, risk scoring, and monitoring—all of which are required for regulated professionals. For a financial institution, it can serve as the core of the solution.
Does a compliance solution replace the compliance officer's analysis?
No. The solution sorts, matches, flags, and generates alerts, but the decision remains a human one. The professional, through authorized personnel, confirms a match, classifies an atypical transaction, or decides to file a suspicious activity report. An effective solution saves time on sorting and provides the information needed to justify the decision, including the source of the alert, the rule applied, and the history.
Should we use a single platform or several specialized modules?
Both approaches have their merits. A single platform simplifies management and provides an audit trail. Specialized modules allow you to first equip the most exposed function and then expand the system. In either case, make sure that the functions can share the same customer file and a consistent history.
Is a SaaS solution compatible with hosting data in France?
Yes, if the provider commits to this in the contract and structures its infrastructure accordingly. The SaaS model alone provides no indication of where the data is hosted. Ask for the country, the hosting provider, the location of the backups, and the terms of access to the data. AP Solutions IO states that it hosts data in France. Make sure these points are included in the contract.
How can you verify that a solution complies with regulatory changes?
Ask how the publisher manages its monitoring, how often it releases new versions, and who is responsible for updates. Also ask to see the release log and how a new list was integrated. AP Solutions IO announces a new version of its application every four months.
