AML and Financial Crime Analyst Career Guide

Financial crime compliance hires at scale, but job titles such as KYC analyst, transaction monitoring analyst, sanctions analyst and financial intelligence officer describe different work, and newcomers often apply for the wrong one. This guide explains what each anti-money laundering (AML) and financial crime role actually does, the skills and tools employers test for, realistic routes in for graduates, career changers and cyber or fraud practitioners, which certifications help at which stage, and how people progress to investigator, team lead and money laundering reporting officer (MLRO). It is written for people considering the field and for managers building teams. It does not give salary figures, because no official statistics source publishes them for these titles. The legal duties referred to are summarised from the primary sources listed at the end and checked on 8 November 2026.

Key takeaways

The work is defined by law, not by the employer. Customer due diligence, monitoring, suspicious activity reporting and sanctions screening exist because regulations such as the UK Money Laundering Regulations 2017 and the US Bank Secrecy Act require them, and every analyst decision must be defensible against those rules.
Four entry families, one core skill. KYC and onboarding, transaction monitoring, sanctions screening and investigations all reward the same skill: building a clear, evidenced written rationale for a decision.
The top of the ladder is a legal role. In the UK the nominated officer, usually called the MLRO, is a post the regulations require a firm to appoint, and the person carries personal accountability for reporting decisions.
Certifications help, experience decides. CAMS and national qualifications show commitment and shared vocabulary, but hiring managers test case judgement with written exercises.
Cyber and fraud skills transfer directly. Mule networks, account takeover, crypto tracing and identity fraud now sit at the centre of financial crime, so analysts who understand identity and digital channels are in demand.

What the role does

Financial crime teams in banks, payment firms, crypto-asset businesses, insurers, gambling operators, law firms and accountancy practices carry out the controls that anti-money laundering law places on "relevant persons" or covered institutions. The main roles:

Role	What the work involves	Typical output
KYC or CDD analyst (onboarding and periodic review)	Verifies who a customer is, who owns and controls a company (beneficial ownership), the nature and purpose of the relationship, and the customer's risk rating	A completed customer file with risk rating and rationale
Enhanced due diligence (EDD) analyst	Deeper review of high-risk customers: politically exposed persons (PEPs), complex ownership, high-risk jurisdictions, adverse media, source of wealth and source of funds	An EDD report recommending accept, accept with conditions or exit
Transaction monitoring analyst	Reviews alerts produced by monitoring rules or models, decides whether activity is consistent with what is known about the customer, escalates what is not	Alert dispositions; escalations to investigators
Sanctions screening analyst	Reviews name and payment screening hits against sanctions lists, resolves false positives, escalates true matches for blocking or freezing and reporting	Hit decisions; blocked payment and reporting records
Financial crime investigator	Investigates escalated cases across accounts and counterparties, decides whether there is knowledge or suspicion of money laundering	Case file and, where suspicion exists, a draft suspicious activity report (SAR)
FIU analyst (in-house or government)	In-house: the reporting function that reviews internal reports and files SARs. Government: analyses SARs received nationally and disseminates intelligence	Filed SARs; intelligence products for law enforcement
Quality assurance and testing analyst	Samples completed cases to check they meet policy; tests controls for the second or third line	QA findings, control test results
MLRO and deputy MLRO	Owns the decision to report suspicion to the authorities, the AML programme and reporting to senior management and the regulator	Reporting decisions, annual MLRO report, policy

Government FIUs: the Egmont Group describes a financial intelligence unit as a national body that receives and analyses suspicious transaction reports and other information on money laundering, associated predicate offences and terrorist financing, and disseminates the results. In the UK that is the UK Financial Intelligence Unit within the National Crime Agency, which states it has sole national responsibility for receiving, analysing and disseminating SARs and receives more than 850,000 SARs a year. In the US, FinCEN, a bureau of the Treasury, describes its mission as protecting the financial system through the collection, analysis and dissemination of financial intelligence.

Where the rules come from: the FATF Recommendations (last amended June 2026, according to FATF) set the international standard; national law implements them, such as the UK Money Laundering Regulations 2017, the US Bank Secrecy Act and the EU AML package. See the FATF Recommendations Guide, the Bank Secrecy Act Guide and the EU AML Regulation and AMLA Guide.

Core skills and tools

Skills employers test

Written rationale: stating facts, the risk they indicate, the information considered and the decision, so a reviewer or regulator can follow it months later. This is the skill most interview case studies test.
Corporate structure analysis: reading registry filings and ownership charts to find the natural persons who own or control an entity.
Typology knowledge: how layering, trade-based laundering, mule accounts, structuring, sanctions evasion through front companies and crypto mixing look in data. See the Money Mule Detection Guide.
Sanctions logic: for US sanctions, OFAC states that property of blocked persons must be frozen, that blocked property must be reported to OFAC within 10 business days, and that entities owned 50 percent or more by blocked persons are blocked even if not listed. Analysts must apply ownership rules, not only list matching.
Data handling: spreadsheets as a minimum, SQL and a scripting language for monitoring tuning and investigations roles.
Judgement under volume: clearing false positives quickly while catching the case that matters.

Tools you will meet

Tool category	Used by	What to learn
Customer onboarding and case management platforms	KYC, EDD, investigations	Workflow, evidence attachment, audit trail
Identity verification and document checks	KYC	Liveness, document authenticity, database checks. See the Identity Proofing and KYC Guide
Name and payment screening (sanctions, PEP, adverse media)	Sanctions, EDD	Fuzzy matching, thresholds, list management
Transaction monitoring systems	Monitoring, investigations	Rule logic, segmentation, tuning, model governance. See the AML programme and transaction monitoring guide
Company registries and open source research	All	Corporate filings, beneficial ownership registers, court records, news archives
Blockchain analytics	Crypto-asset firms, investigators	Address clustering, exposure to sanctioned or illicit services, travel rule data
Regulator reporting portals	FIU, MLRO	SAR filing, defence requests, record keeping

Routes into the role

Graduate or apprentice intake into KYC or onboarding teams. Large banks and consultancies run cohort programmes; degrees in law, economics, criminology, accounting or languages are common but not required.
Internal move from operations or customer service. Staff who have handled payments, account opening or complaints already know products and systems; many first-line KYC analysts arrive this way.
Contract remediation projects. Periodic review and look-back exercises hire analysts on fixed-term contracts. They are an accessible entry point but build narrow experience: move to a permanent team within one or two years.
From fraud. Fraud analysts already investigate accounts and payments; the step to AML is learning the legal framework for suspicion and reporting. See the Fraud Analyst career guide.
From cyber security. SOC, threat intelligence and DFIR analysts bring log analysis, scripting and adversary thinking. Crypto-asset firms and fintechs value this combination, as do teams investigating account takeover proceeds and ransomware payments. See the Fraud and Cyber Convergence Guide.
From law enforcement, tax or audit. Investigators and auditors often join at investigator or QA level.

Screening applies to you. In the UK, regulation 21 of the Money Laundering Regulations 2017 requires firms, where appropriate to their size and nature, to screen relevant employees before appointment and during employment, assessing both their skills, knowledge and expertise and their conduct and integrity. Expect background and credit checks.

Interview preparation

Case study: you are given a customer profile and transactions and asked to write a disposition. Practise writing 150-word rationales.
Typology questions: "What are the three stages of money laundering?" (placement, layering, integration), "What makes a customer high risk?", "What is the difference between a PEP and a sanctioned person?"
Tipping off: know that you must not tell a customer that a report has been made or an investigation is under way, and how to handle a customer who asks why a payment is delayed.
Scenario on pressure: what you would do if a relationship manager pushes to onboard a client before checks are complete.

Certifications that help

Stage	Certification	Why it helps
Entry, first year	Employer and national foundation-level AML training; ICA certificate-level qualifications in the UK and Commonwealth markets	Shared vocabulary; shows commitment before experience
Analyst with some experience	CAMS (ACAMS). Eligibility is points-based on education, experience and training	The credential most often named in job adverts. See the CAMS Certification Guide
Sanctions specialists	ACAMS specialist sanctions credential (CGSS)	Depth on sanctions regimes and screening
Crypto and fraud specialists	ACAMS specialist crypto and fraud credentials; CFE (ACFE) for fraud examination	Signals specialism in fast-growing areas. See the CFE Certified Fraud Examiner Certification Guide
Senior and specialist	ACAMS advanced credentials in audit, financial crimes investigation and risk management	Supports moves into QA, audit, investigations leadership and programme risk

Check fees, eligibility and recertification on the certifying body's own pages before paying: they change. For certifications that overlap with cyber governance, see the GRC and Risk Certifications Compared Guide.

Progression

Level	Typical titles	What changes
1. Analyst	KYC analyst, alert reviewer, screening analyst	Works cases to procedure; decisions checked by QA
2. Senior analyst or specialist	EDD analyst, investigator, senior screening analyst	Handles complex cases, coaches analysts, drafts SARs
3. Team lead or subject matter expert	Investigations lead, sanctions SME, monitoring tuning lead	Owns queues, metrics, procedures; works with model and data teams
4. Manager, second line	Financial crime advisory, FCC assurance manager	Sets policy and risk appetite, challenges the first line, prepares regulator responses
5. Deputy MLRO, MLRO, head of financial crime	Nominated officer, MLRO	Legal accountability for reporting decisions and the AML framework

The MLRO in law: in the UK, regulation 21(3) of the Money Laundering Regulations 2017 requires an individual in the firm to be appointed as nominated officer, and regulation 21(1)(a) requires, where appropriate, a board member or senior manager to be appointed as the officer responsible for compliance with the regulations. In FCA-regulated firms the MLRO role also falls within the Senior Managers and Certification Regime, so it needs regulatory approval. To reach it, candidates typically need broad experience across onboarding, monitoring, investigations and SAR decision-making, plus regulator-facing work and the ability to report clearly to a board.

Side moves: financial crime data science and model risk, regulatory technology product roles, consulting, internal audit, and the regulator or FIU itself. Cyber-minded analysts can move into fraud and cyber fusion teams.

Where identity fits

Most financial crime now starts with an identity problem: synthetic or stolen identities at onboarding, mule accounts recruited online, and account takeover that turns a legitimate customer into a conduit. Analysts who understand authentication, device signals and API-driven onboarding read cases better. Firms that automate KYC with AI agents and service accounts also create new non-human identities with access to customer data, which financial crime and security teams must govern together.

Common failure patterns

Box-ticking rationales: "No concerns identified" without saying what was checked. QA and regulators reject these, and analysts who write them do not progress.
Staying in remediation too long: years of periodic review on contract build speed but not investigative judgement.
Collecting certifications instead of cases: three credentials and no SAR drafting experience is a weaker profile than one credential and a strong case portfolio.
Ignoring data skills: monitoring and investigations increasingly expect SQL and basic scripting.
Treating sanctions as list matching: missing ownership and control, or evasion through intermediaries, is the error that leads to enforcement.

Practitioner checklist

Pick an entry family (KYC, monitoring, sanctions, investigations) and tailor your CV to its outputs.
Read the primary rules for your market: the FATF Recommendations and your national AML law.
Practise written case rationales against public typology reports until you can write one in 15 minutes.
Learn to trace beneficial ownership through a company registry.
Build spreadsheet and SQL skills; add Python if you aim for monitoring or investigations.
Take a foundation qualification in year one and plan CAMS once eligible.
Within two years, aim for SAR drafting or investigation work, not only first-line review.
Keep a log of case types, typologies and decisions (without customer data) to evidence progression.

AML and Financial Crime Analyst Career Guide: Roles, Skills and the Route to MLRO