KYC/AML Monitoring Workflow: Continuous Screening with an Auditable Trail
Compliance teams drown in screening hits, most of them false positives, each needing a documented decision. The workflow runs screening at onboarding and on a schedule against sanctions, PEP and adverse-media sources, applies your rules to transactions, assembles each alert into a case with the evidence, and has an AI agent draft the case narrative — the analyst decides, and every decision is logged in the form regulators expect.
Written by Max Zeshut
Founder at Agentmelt · Last updated Sep 11, 2026
The problem
Screening produces hundreds of name-match hits a week, nearly all false. Analysts spend their time on paperwork rather than judgement. Continuous monitoring is quarterly at best, and audit trails are reconstructed after the fact.
What changes when it runs
Hits arrive as cases with the match evidence, the customer's profile and the agent's draft assessment of whether the match is genuine. Analysts clear false positives in seconds and spend time on real risk. Monitoring is continuous, and the audit trail is generated as the work happens.
Trigger, then 8 steps
Trigger
Onboarding webhook + daily screening + transaction webhooks
New customers screened at onboarding; the full book re-screened daily against list updates; transaction events evaluated in near real time.
Screen the customer
HTTP RequestName, DOB, nationality, addresses and beneficial owners screened against sanctions (OFAC, EU, UN, UK), PEP and adverse-media providers (ComplyAdvantage, Dow Jones, Refinitiv); results with match scores.
Pre-assess matches
AI AgentFor each hit the agent compares the customer profile to the list entry — dates, locations, identifiers, context — and drafts an assessment: likely true match, likely false positive, or needs more information, with the reasoning.
Evaluate transactions
CodeRule set (structuring patterns, velocity, high-risk corridors, unusual counterparties) applied to transaction events; rules versioned and owned by compliance.
Build the case
SetAlert, customer profile, screening evidence, transaction history and the agent's draft assembled into a case record.
Route to the analyst
SlackCases queued by risk score; low-risk likely-false-positives can be batch-cleared with a review sample; anything involving sanctions goes to a senior analyst.
Record the decision
PostgresAnalyst decision, rationale, reviewer and timestamp recorded on the case in a tamper-evident log; SAR/STR drafts generated for confirmed suspicious cases.
Continuous re-screening
Schedule TriggerDaily re-screen against list updates; changes in a customer's risk (new PEP status, adverse media) reopen a case automatically.
Regulatory reporting
Google DocsMonthly MI: alerts by type, false-positive rate, clearance times, open cases by age, and the rule-tuning log.
Data it touches
- Onboarding system / CRM (customer profiles)
- Screening providers (ComplyAdvantage, Dow Jones, Refinitiv, OpenSanctions)
- Core banking / payments (transactions)
- Compliance rule set and risk policy
Guardrails
- No case is closed without an analyst's recorded decision; the agent drafts, never decides.
- Sanctions matches always reach a senior analyst regardless of the draft assessment.
- Every decision is logged in a tamper-evident store with actor, rationale and timestamp.
- Rules and thresholds are versioned; changes require compliance-officer approval and are logged.
False positives are the cost centre
Name screening matches 'Mohammed Ali' against thousands of list entries. The analyst's real work on 95% of hits is confirming it is not the same person, from dates, places and identifiers — exactly the comparison the agent drafts. The analyst still decides, but starts from a reasoned draft instead of two raw records, and the false-positive clearance time drops from minutes to seconds. The senior-analyst rule for sanctions and the audit log are what keep that acceleration defensible.
Continuous, not periodic
Regulators increasingly expect ongoing monitoring: a customer who becomes a PEP or appears in adverse media should trigger a review that week, not at the annual refresh. Daily re-screening against list deltas is cheap for a workflow and a large effort by hand. Reopened cases carry the original assessment, so the analyst sees what changed.
Tools in the stack
| Tool | Role in this workflow |
|---|---|
| n8n (self-hosted) | Screening orchestration, rules, case building, logging |
| Claude | Match pre-assessment and case narratives |
| ComplyAdvantage / Dow Jones / OpenSanctions | Screening data |
| Postgres | Case store and audit log |
Want this running without building it?
Automation workflow
$297/month
We set up, host and maintain this workflow on n8n and connect it to your tools. Setup included, cancel monthly, you keep the JSON.
Custom build
$8,000–15,000 one-time
Your systems, your rules, your edge cases. A one-off build on Claude and n8n, delivered with documentation and a walkthrough.
The subscription suits small regulated firms with one screening provider and under 5,000 customers; most deployments are custom because of core-system integration and regulator-specific reporting.
Frequently asked questions
Which screening providers are supported?
ComplyAdvantage, Dow Jones Risk & Compliance, Refinitiv World-Check and OpenSanctions via API; others as a custom integration.
Does it file SARs?
It drafts the narrative for confirmed cases in the regulator's format; filing is done by the MLRO or compliance officer through the official channel.
How is model use justified to a regulator?
The model only pre-assesses and drafts; every decision is human and logged with rationale, the rules are deterministic and versioned, and the audit log is tamper-evident. That architecture is documented for your regulator during setup.
Case study
AI Compliance Agent for Fintech: 60% Faster Regulatory Reviews
How a 200-person fintech startup used an AI compliance agent to automate SOC 2, GDPR, and PCI-DSS reviews—cutting cycle time by 60%.
Calculator
Put your own numbers in
Estimate the cost of the current process and what this workflow changes.
The pillar
AI Compliance Agent
Monitor regulatory changes, enforce policies, manage audits, and automate compliance reporting.