Match the compliance rota to the hours money moves. If payments run around the clock, screening holds arrive around the clock, and someone trained must be on duty to decide them. Tier the rota: first-level reviewers discount clear false positives, second-level reviewers decide possible matches, and a named MLRO or deputy is reachable for anything that may need reporting.
What does a compliance rota have to cover?
A compliance agent screens customers and payments against sanctions and PEP lists, reviews transaction monitoring alerts, and drafts the case notes. It discounts nothing it cannot discount within its bounds, and it holds possible matches, unusual patterns and anything that points towards a suspicious activity report. Some of those holds stop a payment; the customer and the counterparty are waiting.
The head of compliance or MLRO owns the rota. Operations is consulted on payment hours and volumes. The guide to AI agent skills by role sets out what compliance reviewers need to know, and what a reviewer rota is explains the basic idea. Who counts as a reviewer, and what they answer for, is covered in what an AI agent reviewer is.
What are the steps?
- Agent, depth 1: reports holds by type, hour and channel. Sanctions possible matches, PEP matches, monitoring alerts, adverse media.
- Person (head of compliance): defines the hours. If the organisation offers instant payments at weekends, screening holds will arrive at weekends.
- Person (head of compliance): sets response targets. Payment-stopping sanctions holds within a short window measured in minutes or hours, not days; onboarding screening holds within a working day; monitoring alerts within the period policy sets.
- Agent, depth 2: drafts the case note for each hold. The list entry, the customer data, the points of match and mismatch, and the provenance of each fact.
- Person (first-level reviewer): discounts clear false positives. With a written reason. Anything unclear goes up.
- Person (second-level reviewer): decides possible matches. Confirm, discount with evidence, or escalate.
- Person (MLRO or deputy): decides on reporting. Named on the rota for every hour the queue runs, reachable by phone outside office hours.
- Person (head of compliance): reviews the rota monthly, against targets and second-level backlog.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Screening | Screens and holds possible matches | 2 | Deciding every hold |
| Case note | Drafts match analysis with sources | 2 | Checking it against the evidence |
| Clear false positives | Holds; does not discount alone | 2 | First-level discount with reason |
| Possible matches | Holds; payment stays stopped | 2 | Second-level decision |
| Reporting | Drafts the report | 2 | MLRO decision and submission |
| Release after clearance | Releases the payment once cleared | 4 | The clearance that permits it |
How should the tiers be staffed?
Every hour the queue runs needs a first-level reviewer and access to a second-level reviewer. They need not sit together; out of hours, a second-level reviewer on call is enough if the response target allows it. The MLRO line is thinner but must never be empty: a deputy covers leave, and the rota names both.
Rotating people through the tiers spreads skill, but only in one direction at a time. Second-level reviewers should also take an occasional first-level shift, so they stay close to the volume and to the quality of the agent's case notes. A first-level reviewer moves up when the competency record supports it, not to fill a gap on a busy weekend. Under FATF's risk-based approach, the depth of review should follow the risk; the rota is where that principle becomes a staffing plan.
Which controls matter, and what evidence do they leave?
- No hold is discounted without a person. Evidence: a reviewer's name and reason on every discounted verdict.
- Possible matches get second-level review. Evidence: two names on each possible-match verdict.
- The MLRO line is always staffed. Evidence: the rota for every hour of operation.
- Provenance is weighed. A registry record of a director's date of birth is stronger than the customer's declared one. Evidence: provenance shown on the case note and the reviewer's reason.
- Payments stay stopped until cleared. Evidence: the release verdict follows the clearance verdict in the record.
What should be measured?
- Response targets met for payment-stopping holds, by hour and day.
- Second-level backlog and its age.
- Discount reasons: a reviewer whose reasons are always identical may not be reading.
- Escalations to the MLRO, and the time to decision.
- Holds discounted at first level later reopened.
Where does it usually go wrong?
Weekend gaps. Instant payments run at weekends; compliance teams often do not. Every weekend hold then waits until Monday, or someone untrained clears it.
First level becomes the only level. Under pressure, first-level reviewers start deciding possible matches. The rota should make second-level cover visible so that is never necessary.
The MLRO is the single point of failure. Name a deputy and test that they can be reached.
Payments operations and IT teams face similar always-on queues; compare the rotas for the payments operations team and the IT team. For the reviewer's role in general, see what an agent reviewer is.
Questions people ask
Can the agent discount obvious false positives on its own?
Only if the organisation has certified that capability through Attest and set it within the agent's bounds. Many compliance teams keep every discount with a person, at least until the agent's evidence on their own cases supports more.
How long should a sanctions hold wait out of hours?
No longer than the response target the head of compliance has set and staffed. If the target cannot be staffed, either staff it or tell customers how long a held payment may take.
Should compliance reviewers also handle fraud alerts?
Some teams combine them. Keep the rota lines separate even if the people overlap, because the response targets and escalation routes differ.