How should compliance teams structure AML oversight when suspicious activity reporting, customer due diligence, and transaction monitoring all sit in the same function?

How AML Oversight Works Best When One Function Owns CDD, Monitoring, and SARs

The central design choice is whether the function is acting as a processing queue or a control function. When customer due diligence, transaction monitoring, and suspicious activity reporting sit together, the structure should make escalation, review, and decision ownership explicit. That means one team can coordinate the workflow, but each control step still needs clear criteria, traceability, and separate accountability.

A good structure starts with a single oversight model: intake, analysis, decision, filing, and remediation. The value is not in collapsing every activity into one desk, but in ensuring that the same risk picture informs onboarding, ongoing monitoring, and post-alert response. FATF Recommendations — AML and KYC Framework is the clearest external reference point for aligning those obligations into one programmatic view.

That structure should also preserve the distinction between customer facts and transaction behaviour. CDD should define the expected profile, risk rating, and beneficial ownership or source-of-funds context; monitoring should test behaviour against that baseline; SAR handling should record why the case crossed the reporting threshold. When those functions are combined, the main control risk is not overlap, but blurred judgment, where alerts are closed without enough evidence or customer files are not updated after a material event.

What Good Governance Looks Like in a Combined AML Function

The strongest model uses documented decision rules so analysts do not improvise thresholds case by case. CDD rules should state what evidence is required at onboarding and refresh, monitoring rules should explain which scenarios or typologies are in scope, and SAR rules should define who approves filing, what must be documented, and how exceptions are escalated. If those rules are not written down, the function becomes too dependent on individual judgement and too hard to defend under review.

A combined function also needs a clean split between operational work and oversight. Day-to-day analysts can triage alerts and draft cases, but independent review should confirm whether the logic is consistent, whether the risk rating still fits, and whether prior SAR decisions have changed the customer profile. FinCEN is a useful reference for the US reporting environment, while EBA AML/CFT Guidance helps anchor the European supervisory expectation that firms maintain demonstrable, risk-based controls.

For compliance teams, the practical test is whether the function can show a chain from alert to conclusion. A reviewer should be able to see the customer risk basis, the transaction pattern that triggered review, the rationale for closure or escalation, and the evidence preserved for audit or regulatory inquiry. If any one of those elements is missing, the function is operating, but not governing.

Why Traceability and Feedback Loops Matter More Than Volume

When several AML activities sit in the same function, the real performance issue is usually feedback, not throughput. The same facts should inform onboarding decisions, alert tuning, periodic refresh, and SAR escalation, otherwise the organisation keeps rediscovering the same risk in different queues. Strong teams treat cases as a source of control learning, not just case resolution.

That means the programme should feed SAR outcomes and adverse findings back into monitoring logic and customer risk scoring. If a segment repeatedly produces false positives, the tuning needs to change. If a customer profile shifts materially, the CDD record should change. If a transaction pattern appears in multiple cases, investigators should be able to see the pattern across time rather than only inside one alert. The operational lesson is that consistency is worth more than speed when the function owns all three controls.

Where the business runs multiple products or channels, one oversight function should still preserve segment-level review so risk is not averaged away. Different products can create different alert patterns, different documentation burdens, and different filing thresholds in practice. The oversight model should therefore standardise judgment, not force identical handling for every customer or channel.

Practitioner Guidance

What to prioritise: define the handoffs first. If analysts cannot tell when a case moves from monitoring to SAR review, or when a customer file must be refreshed, the combined function will drift into inconsistent decisions.

What to verify: make sure every closed alert leaves an audit trail that links the customer profile, the monitoring rationale, the decision owner, and any follow-up action. That evidence should let an internal reviewer reconstruct the case without relying on memory.

Decision rule: if the customer profile changes materially, treat that as a CDD update trigger even if the alert itself is closed. If the transaction pattern is the concern but the customer file is stale, do not let the SAR workflow substitute for basic due diligence.

Practitioner takeaway: the best AML operating model is integrated at the workflow level but separated at the decision level, so the firm gets one risk view without losing control discipline.

Related resources from NHI Mgmt Group

• How should compliance teams implement customer due diligence under Kenya’s AML framework in higher-risk onboarding flows?
• What breaks when transaction monitoring and suspicious activity reporting are too weak in AML programmes?
• How should compliance teams implement risk-based customer due diligence under South Africa’s AML rules?
• How should compliance teams structure transaction monitoring training for mixed-experience AML and fraud staff?