Certified public accountants are among the professionals subject to obligations regarding AML-CFT, anti-money laundering, and countering the financing of terrorism. In a firm, however, these obligations often must be managed without having a team dedicated exclusively to compliance.
The question, then, is a very practical one: How can we implement a system that is proportionate to the risks, well-documented, and sufficiently traceable, without increasing the amount of manual processing as the client portfolio grows?
Choosing software AML-CFT for certified public accountants isn’t always the first solution that comes to mind. Depending on the volume of files, their turnover, and the firm’s organizational structure, several approaches can coexist: documented manual processing, functionality integrated into a line-of-business tool, a dedicated screening solution, or a system organized at the network or group level.
For AP Solutions IO, automation is most valuable when the volume of checks becomes large enough that manual processes make it difficult to track, update, and handle alerts.
When is it in a firm’s best interest to implement “ AML-CFT ” software?
The regulations do not, as such, require the use of any specific software. However, the certified public accountant must carry out the due diligence procedures required by the regulations and standards applicable to the profession: identifying and assessing risks, exercising due diligence when establishing and maintaining a client relationship, retaining information, and reporting to Tracfin when the conditions are met.
The level of tooling must therefore be consistent with the firm's actual organizational structure.
| Organizational Structure | Context in which to consider it | Key Strength | Point to Watch For |
| Documented Manual Processing | A limited and relatively stable portfolio | Direct control of the process | Presentation and Preservation of Evidence |
| Feature integrated into the business application | Intermediate need | Continuity in the Workplace | Carefully verify which controls are covered |
| Dedicated Screening Solution | Large volumes or high inspection frequencies | Automation, Configuration, and Traceability | Deployment and Alignment with Needs |
| Shared Organization | Network, consortium, or multi-entity organization | Centralization of Certain Resources | Responsibilities and Governance to Be Formalized |
Screening can be used, in particular, to cross-reference information about customers or other relevant individuals against various compliance databases. However, it is important to distinguish between checks related to politically exposed persons (PEP) and specific obligations regarding international sanctions and asset freezes.
Documented Manual Treatment
For a limited and stable portfolio, certain checks may still be conducted manually, provided that the chosen method ensures the necessary due diligence is performed and that supporting documentation is retained.
The difficulty increases as the number of cases grows: it is necessary to be able to track what has been verified, when, based on what information, and with what conclusion.
Manual processing is therefore not inherently unsuitable. It becomes particularly difficult to maintain when the volume and frequency of audits exceed the practice’s organizational capacity.
The feature integrated into a business solution
Some industry-specific software includes features that allow users to perform some compliance checks without leaving the environment already used by the firm.
This continuity offers an operational advantage. However, it does not eliminate the need to verify what the feature actually checks: What data is used? Which data sources are covered? How often are they updated? Is the history of checks and decisions accessible?
Since the level of vigilance also depends on the identified risk, our guide to the different levels of customer due diligence helps place this tool within the broader framework.
The Dedicated Screening Solution
When volumes become significant, a specialized solution can facilitatethe automation of checks, the management of alerts, and the retention of their history.
That’s the roleof AP Scan, our automated screening solution. Together with AP Solutions IO, we’ve designed the engine to handle large volumes while allowing for configuration tailored to each organization’s data and risks.
Access can be provided via a SaaS interface or an API, allowing the screening process to be integrated into existing systems. A dedicated interface minimizes the amount of application development required, while an API allows the screening process to be embedded directly into a business process. In both cases, configuration and deployment planning are still required.
Shared organization within a network
A network or consortium may also choose to centralize certain technical resources in order to standardize tools and practices.
However, this shared approach requires clear governance: Who sets up the system? Who handles alerts? Who retains the evidence? How are decisions linked to the firm or entity in question?
Simply sharing a tool is not, in and of itself, sufficient to transfer the obligations incumbent upon regulated professionals. The division of roles must therefore remain explicit.
What does the “ AML-CFT ” program offered by an accounting firm entail?
Compliance is not limited to screening. The professional standards for certified public accountants include , among other things:
- the organization of the structure;
- risk identification and assessment;
- due diligence procedures;
- reporting requirements;
- the retention of the information necessary for monitoring the program.
Identify the customer and its beneficial owner
Due diligence begins withidentifying the customer and, where applicable, the beneficial owner—that is, the individual who ultimately controls the entity in question according to the criteria set forth in the regulations.
This information must be sufficiently reliable to allow for subsequent audits.
A high-performance tool cannot compensate for poor-quality KYC data. This is also the approach we advocate at AP Solutions IO: technology should leverage and enhance a properly structured system, not replace the professional’s due diligence.
Assess the level of risk
Vigilance is then based on a risk-based approach. Not all clients and situations present the same level of exposure.
The firm must therefore have criteria in place to assess and update the level of risk in order to adjust its monitoring measures. Our content on the regulatory framework AML-CFT outlines the main obligations applicable to regulated professionals.
Maintain vigilance throughout the business relationship
Due diligence does not end once a business relationship is established. Information must be kept up to date, and the relationship must be monitored in accordance with the identified risks.
This is precisely where volume can affect the necessary organizational structure: managing a few hundred relatively stable relationships does not entail the same constraints as updating and monitoring a portfolio containing several thousand files.
How can you organize compliance monitoring without a dedicated compliance team?
The first step is to clearly define roles and procedures. Automation is then applied to repetitive or high-volume tasks.
Focus on cash flow as much as portfolio size
The total number of customers is not the only indicator.
It is also important to note:
- the number of new clients;
- the frequency of changes involving existing customers;
- the number of individuals or entities to be audited per case;
- the frequency of updates to the repositories;
- the number of alerts requiring analysis.
A relatively stable portfolio can remain manageable using simple methods. Conversely, an organization facing frequent changes in its portfolio can quickly reach the limits of manual processing.
That is why AP Solutions IO primarily targets entities, networks, and organizations for which automation is truly valuable due to the volume of their operations. Our value proposition is not to replace a manual process that works on a small scale, but to address the challenges that arise when that method can no longer scale.
Identify the signs that an organization has become too labor-intensive
There are several situations that should prompt a review of the system:
- inspections that are taking more and more time;
- daily portfolio updates that are difficult to organize;
- historical evidence that is difficult to find;
- excessive dependence on a single person;
- a proliferation of processing steps across different files or tools;
- a challenge in maintaining consistent practices within a network.
The framework governing the freezing of assets and its implementation illustrates, in particular, the importance of being able to adapt to changes in the relevant standards.
What must a firm be able to demonstrate in the event of an audit?
A device must not only exist; it must also be possible to reconstruct how it works.
This requires retaining sufficient information to demonstrate the organizational structure that has been established and the due diligence that has been performed.
Keep a record of inspections
Depending on the audit conducted, it may be appropriate to retain, in particular:
- the date;
- the information or reference materials used;
- the result obtained;
- the analysis performed when an alert is triggered;
- the decision that was made;
- the identity or position of the person who handled the case.
An audit for which no record has been kept becomes much more difficult to justify later on.
This traceability requirement is at the heart ofAP Solutions IO’s solutions. Our tools log actions and results to enable teams to review the progress of an audit and the factors involved in a decision.
Documenting the risk-based approach
The customer classification system must also remain easy to understand and review.
The criteria applied must be appropriate to the business activity and the identified risks, and not result from a rating that cannot be explained. This is the approach outlined in our guide on the risk-based approach to AML-CFT , and customer classification.
What criteria should you use when choosing " AML-CFT " software for a certified public accountant?
When a dedicated solution becomes a viable option, there are several criteria that can help you avoid basing your decision solely on a list of features.
In particular, the following should be examined:
- coverage of the standards required for inspections;
- their update method and frequency;
- the ability to handle the actual volume of the portfolio;
- reducing false positives;
- traceability of alerts and decisions;
- the available configuration level;
- integration into the information system;
- the interpretability of the results;
- the total cost relative to actual usage.
With AP Solutions IO, AP Scan relies in particular on a configurable engine based on more than 90 criteria, designed to minimize false positives generated by reconciliations while maintaining an explainable logic.
Our Glass Box technology aims to make decisions traceable, understandable, and auditable, rather than providing an opaque result that the user would be unable to reconstruct.
When is AP Solutions IO a good fit for a firm or a network?
Tools should be implemented only after the obligations, risks, and existing processes have been identified.
AP Solutions IO is a French RegTech company founded by experts with over fifteen years of experience in AML and AML-CFT compliance tools. Our suite includes AP Scan for screening, AP Scoring for risk assessment, AP Monitoring for transaction monitoring, and AP Filter for sanctions and embargo screening.
Our solutions are available as SaaS and via API, with data hosted in France.
For accounting professionals, our technology is particularly valuable when the number of clients, entities, or audits makes robust automation—which can be integrated into the existing system—necessary: large firms, groups, networks, or organizations with a significant portfolio.
Regulatory responsibility remains with the regulated professional. Our role is to provide them with the technical tools to automate, track, and explain the controls, without allowing the software to replace their own analysis.
If your volume is starting to make manual checks difficult to manage, talk to our team about the organization and volume of your operations will help us assess whether a dedicated tool is truly the right solution for your situation.
