KYC/AML Monitoring Automation Continuous screening with the case written and the trail kept
Customers are screened at onboarding and every day after; analysts get built cases, not raw hits.
- Installed for you · one-time$249
- Custom build · this process$8,000–15,000 one-time
- Starts whenOnboarding event + daily screening + transaction event
The subscription suits small regulated firms with one screening provider and under 5,000 customers; most deployments are custom because of core-system integration and regulator-specific reporting. Custom builds start at $2,000 site-wide; this band is for this process and its integrations.
KYC/AML Monitoring Automation is an automation Agentmelt installs in Postgres. The free template is a file you import yourself; the kit ($49) adds the setup guide and prompts. Installed for you costs $249 one-time and is live within two working days of access, with a recorded walkthrough and 30 days of fixes. A custom build of this process is $8,000–15,000 one-time; custom builds start at $2,000 site-wide. No call is needed for any option. Written by Max Zeshut; last revised 2026-09-21.
Reference stack: Claude + n8n. Node names are on each step; the file is under the template.
Founder at Agentmelt
Reviews every build before it goes live; the workflow escalates to a person, never past one.
What is kyc/aml monitoring?
KYC/AML monitoring automation runs the screening a compliance team drowns in and writes up what it finds: customers are screened at onboarding and on a schedule against sanctions, PEP and adverse-media sources, transactions are evaluated against your rules, each hit is pre-assessed and assembled into a case with the evidence, and an AI agent drafts the case narrative for the analyst to decide, edit and record. Every decision is logged with its reason, re-screening is continuous, and regulatory reports are prepared from the cases. Because the data is regulated, the workflow runs self-hosted in your own account with your screening provider — never hosted by us — which is also why most deployments are custom.
- Every screening hit takes an analyst twenty minutes to clear, and most are false positives.
- We cannot say, today, which customers were re-screened this month.
- Case notes are written differently by every analyst.
- Transaction rules fire on everything, so they are ignored.
- The audit asks for the decision trail and it is in six systems and an inbox.
If two of these are yours, this is the process to look at first. Free audit — or read on.
What it looks like once it runs.
Compliance teams drown in screening hits, most of them false positives, each needing a documented decision. The workflow runs screening at onboarding and on a schedule against sanctions, PEP and adverse-media sources, applies your rules to transactions, assembles each alert into a case with the evidence, and has an AI agent draft the case narrative — the analyst decides, and every decision is logged in the form regulators expect.
- On signup Name, date of birth and owners are screened against sanctions, PEP and adverse-media lists.
- Each hit The customer profile is compared to the list entry and a likely-match or likely-false-positive note is written.
- Continuously Transactions are tested against the rules; an alert becomes a case with the profile, evidence and draft assessment.
- Analyst queue Cases are ordered by risk; decisions are recorded on a tamper-evident log. Every day, everyone is re-screened against list updates.
Screening produces hundreds of name-match hits a week, nearly all false. Analysts spend their time on paperwork rather than judgement. Continuous monitoring is quarterly at best, and audit trails are reconstructed after the fact.
Hits arrive as cases with the match evidence, the customer's profile and the agent's draft assessment of whether the match is genuine. Analysts clear false positives in seconds and spend time on real risk. Monitoring is continuous, and the audit trail is generated as the work happens.
Trigger, then 8 steps.
Seven of the eight steps run without anyone. Step 05 waits for a person.
Onboarding event + daily screening + transaction event
Screen the customer
Name, DOB, nationality, addresses and beneficial owners screened against sanctions (OFAC, EU, UN, UK), PEP and adverse-media providers (ComplyAdvantage, Dow Jones, Refinitiv); results with match scores.
Pre-assess matches
For each hit the agent compares the customer profile to the list entry — dates, locations, identifiers, context — and drafts an assessment: likely true match, likely false positive, or needs more information, with the reasoning.
Evaluate transactions
Rule set (structuring patterns, velocity, high-risk corridors, unusual counterparties) applied to transaction events; rules versioned and owned by compliance.
Build the case
Alert, customer profile, screening evidence, transaction history and the agent's draft assembled into a case record.
Route to the analyst
Cases queued by risk score; low-risk likely-false-positives can be batch-cleared with a review sample; anything involving sanctions goes to a senior analyst.
Record the decision
Analyst decision, rationale, reviewer and timestamp recorded on the case in a tamper-evident log; SAR/STR drafts generated for confirmed suspicious cases.
Continuous re-screening
Daily re-screen against list updates; changes in a customer's risk (new PEP status, adverse media) reopen a case automatically.
Regulatory reporting
Monthly MI: alerts by type, false-positive rate, clearance times, open cases by age, and the rule-tuning log.
Hits arrive as cases with the match evidence, the customer's profile and the agent's draft assessment of whether the match is genuine
Hits arrive as cases with the match evidence, the customer's profile and the agent's draft assessment of whether the match is genuine.
One decision, at step 05. Seven steps ran without you.
Each pattern page explains it in plain words and lists every automation that uses it.
The template is built on n8n (how the n8n AI Agent node works); the same steps run on Make, Zapier or plain code. The tool is chosen to fit your accounts, you own the result, and the template comes in all three formats.
Data it touches
- Onboarding system / CRM (customer profiles)
- Screening providers (ComplyAdvantage, Dow Jones, Refinitiv, OpenSanctions)
- Core banking / payments (transactions)
- Compliance rule set and risk policy
Guardrails
- No case is closed without an analyst's recorded decision; the agent drafts, never decides.
- Sanctions matches always reach a senior analyst regardless of the draft assessment.
- Every decision is logged in a tamper-evident store with actor, rationale and timestamp.
- Rules and thresholds are versioned; changes require compliance-officer approval and are logged.
False positives are the cost centre
Name screening matches 'Mohammed Ali' against thousands of list entries. The analyst's real work on 95% of hits is confirming it is not the same person, from dates, places and identifiers — exactly the comparison the agent drafts. The analyst still decides, but starts from a reasoned draft instead of two raw records, and the false-positive clearance time drops from minutes to seconds. The senior-analyst rule for sanctions and the audit log are what keep that acceleration defensible.
Continuous, not periodic
Regulators increasingly expect ongoing monitoring: a customer who becomes a PEP or appears in adverse media should trigger a review that week, not at the annual refresh. Daily re-screening against list deltas is cheap for a workflow and a large effort by hand. Reopened cases carry the original assessment, so the analyst sees what changed.
What it connects to.
| Tool | Role in this workflow |
|---|---|
| n8n (self-hosted) | Screening orchestration, rules, case building, logging |
| Claude | Match pre-assessment and case narratives |
| ComplyAdvantage / Dow Jones / OpenSanctions | Screening data |
| Postgres | Case store and audit log |
Want this running without building it?
$249
This one handles regulated data, so it is not hosted by us: we install the standard version in your own account within two working days of access, with a recorded walkthrough and 30 days of fixes, and it stays yours. Ongoing maintenance is scoped with the plan.
$8,000–15,000 one-time
Your systems, your rules, your edge cases. A one-off build delivered into your accounts to keepon Claude and n8n, delivered into your accounts to keep, with documentation and a recorded walkthrough.
The subscription suits small regulated firms with one screening provider and under 5,000 customers; most deployments are custom because of core-system integration and regulator-specific reporting.
Also sold one-time, installed in your own accounts, as part of the cybersecurity analysts package — do it yourself $49 · installed for you $249 · done for you $490.
When this becomes a custom build.
The subscription covers the standard version — $297/month, setup and maintenance included. Three things move it to a custom build ($8,000–15,000 one-time), delivered into your accounts to keep. If one of them is you, say so on the audit and the plan prices both.
Core-system integration — most regulated firms need it, and it is a build against your own system.
Regulator-specific reporting formats and audit trails.
More than one screening provider, or above 5,000 customers.
Running the standard version first is the usual path: the exceptions it logs in the first month are the scope of the custom build, with your own numbers. How custom builds work.
Frequently asked questions.
Which screening providers are supported?
ComplyAdvantage, Dow Jones Risk & Compliance, Refinitiv World-Check and OpenSanctions via API; others as a custom integration.
Does it file SARs?
It drafts the narrative for confirmed cases in the regulator's format; filing is done by the MLRO or compliance officer through the official channel.
How is model use justified to a regulator?
The model only pre-assesses and drafts; every decision is human and logged with rationale, the rules are deterministic and versioned, and the audit log is tamper-evident. That architecture is documented for your regulator during setup.
Which screening providers does it work with?
ComplyAdvantage, Refinitiv World-Check, Dow Jones and LexisNexis as sources through their interfaces; the workflow orchestrates the calls, assembles the case and keeps the trail. More than one provider, or core-system integration for the transaction rules, is a custom build against your own systems.
Does it file suspicious activity reports?
It prepares the report from the case — the facts, the evidence, the narrative in the regulator’s format — for the compliance officer to review and file. Filing stays with the licensed person, and the workflow records who filed what and when.
How is model use justified to a regulator?
The model drafts narratives and pre-assesses matches; it never decides, and every draft is reviewed and recorded with the analyst’s decision. Screening and rules are deterministic and versioned; the model’s inputs and outputs are logged per case. That is the model-governance story regulators ask for, and it fits on a page.
What this blueprint is built on.
Vendor documentation the steps rely on, and the rules the guardrails are written against.
- FATF — The FATF Recommendations www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html
- OpenSanctions — documentation www.opensanctions.org/docs/
- FinCEN — Financial Crimes Enforcement Network www.fincen.gov/