The financial crime team's drill should test the failure regulators care most about: screening alerts closed as false positives against a sanctions list that stopped updating. Over about two hours, AML investigators practise pausing the triage agent to draft-only, escalating to the money laundering reporting officer, rescreening, recording decisions and making reporting calls without tipping anyone off.
Why does financial crime need its own drill?
AML investigators review alerts from transaction monitoring and sanctions screening, investigate customers and decide whether to escalate suspicion. Agents typically gather the facts for an alert, compare names and dates of birth against lists, and draft a recommendation at depth 2. Some firms let an agent close obvious false positives at depth 3 within narrow bounds, such as an exact match to a previously cleared customer.
The stakes are high. FATF Recommendations set the international standard: a risk-based approach, customer due diligence and suspicious transaction reporting. Sanctions breaches carry severe penalties in most markets. And tipping off a customer that they are under suspicion is itself prohibited in many jurisdictions.
The money laundering reporting officer (MLRO) or head of financial crime owns the drill. A senior investigator facilitates. Investigators, the screening system owner and compliance take part. For the format, see what an incident drill is.
The scenario
Thursday, 16:00. During routine quality assurance, a senior investigator notices that a name added to a sanctions list nine days ago is not in the screening source the agent reads. The list update job has failed silently since then. In that time the agent closed 600 alerts at depth 3 as false positives and drafted recommendations on 200 more, which investigators approved.
The drill step by step
- Person (facilitator): reads the scenario and starts the clock.
- Person (senior investigator): escalates to the MLRO at once.
- Person (MLRO or delegate): pauses the triage agent to draft-only. Closures at depth 3 stop; every alert is held for an investigator. The verdicts name the firm's own limits as the deciding bound.
- Person (screening system owner): restores the list and confirms the window.
- Person (investigators): rescreen every customer and payment cleared in the window against the current list. The agent can redraft at depth 2 on the corrected source; investigators decide.
- Person (MLRO): decides on any true matches. Freeze where required, report to the relevant authority, and handle customer contact with care so nothing tips anyone off.
- Person (MLRO): decides on regulatory notification of the control failure, separate from any report on a customer.
- Person (senior investigator): records each decision, its owner, its time and its reasons.
- Person (facilitator): runs the debrief.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Alert | Has closed and drafted on stale source | 3 and 2 | Spotting in QA |
| Pause | Holds every alert | Dropped to 2 | Tightening limits |
| Restore list | Nothing | 2 | Screening system owner |
| Rescreen | Redrafts on corrected source | 2 | Investigator decisions |
| True matches | Nothing | 2 | Freeze and report |
| Notify | Nothing | 2 | Control failure notification |
| Record | Files verdicts | 2 | Reasons for every decision |
What makes this drill harder than most?
Two features. The sanctions source is sealed: it comes from the firm's own screening system and is tamper-evident. The agent was right to trust it. The failure was that the system of record itself was stale. Investigators must learn that sealed means authentic, not necessarily current.
And remedy must avoid tipping off. If a true match emerges, the team cannot simply write to the customer to explain an error. The drill should rehearse the MLRO's guidance to customer-facing staff in that case.
A second difficulty is volume. Eight hundred alerts must be rescreened while new alerts keep arriving, and the triage agent is now drafting everything at depth 2. The MLRO should decide early how to split investigators between the backlog and live alerts, and whether to borrow trained staff from other teams. Untrained helpers must not close alerts, even under pressure.
Which controls does the drill test, and what evidence do they leave?
The pause. Evidence: the limit change in the record.
Rescreening. Evidence: every rescreened alert with the investigator's decision and the source version used.
Reports and freezes. Evidence: each one with time and reasons.
Source freshness. Evidence: a new rule, agreed in the debrief, that the agent holds all closures if the list update is older than a set period.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What should the MLRO measure?
- Time from QA finding to the pause.
- Time to rescreen every alert in the window.
- Whether any true match was missed in rescreening.
- Whether staff knew what they could and could not say to customers.
Where do financial crime drills go wrong?
Rescreening only agent closures. Investigators approved 200 recommendations built on the same stale source. Those need rescreening too.
Customer contact before the MLRO decides. A well-meant call can tip someone off.
No freshness rule afterwards. Without one, the same silent failure can happen again.
Compare neighbouring drills: the risk team drill focuses on the oversight view, and the support team drill on customer contact. New reviewers can learn the steps through the reviewer onboarding checklist for a financial crime team, and expected skills by level are in the AI agent competency matrix for a financial crime team. The full approach is in training teams for AI agents.
Questions people ask
Should an agent ever close sanctions alerts?
Some firms allow depth 3 closures within narrow bounds, such as exact matches to previously cleared customers. The drill shows why a freshness check on the list must be part of those bounds.
Can the agent file a suspicious activity report?
No. It can gather facts and draft. The decision to report, and the report itself, belong to the MLRO or a person they authorise.
How often should financial crime teams drill?
Twice a year at least, and after any change to screening sources, lists or the agent's depth.