From signal to decision: improving the quality of AML automation

The value of automation does not lie in generating more alerts. It lies in bringing analysts cases that are more relevant, easier to understand and easier to verify. To achieve this, known risk, emerging signals and context need to work together.

Imagine two customers carrying out the same transaction.

The same type of transaction, the same amount, the same type of counterparty.

For one customer, it may be entirely consistent with what is already known about them. For the other, it may warrant further investigation.

Now imagine something different: the transaction itself remains perfectly ordinary, but what we know about the counterparty has changed in the meantime.

The transaction is the same. What has changed is the context in which we need to interpret it.

It is in this relationship between what we already know and what is emerging that AML automation can create greater value.

1. Known risk and emerging risk should reinforce each other

Part of AML control activity focuses on information we already know we need to look for: a restrictive measure, a judicial or enforcement action, or other observed and qualified risk information.

Another part needs to help us recognise what is emerging: a change in behaviour, a relationship that takes on a different significance, a combination of factors that departs from what we would normally expect, or a new risk element concerning a counterparty.

These two dimensions are not alternatives.

A restrictive measure is explicit information. An anomaly is a hypothesis that needs to be interpreted.

The value increases when the two can inform each other. What we already know about a subject helps us interpret a signal. What changes may require us to reassess what we thought we knew.

For an AML team, the desired outcome is therefore not simply to detect more information.

It is to understand sooner which elements genuinely deserve attention and bring them into the right context.

Understand risk without rebuilding the context from scratch.

Identity data, risk information, evidence, relationships and corporate data help analysts assess an individual or organisation within a more complete picture. WatchBase™ brings together proprietary AML/KYC data including sanctions, PEPs and public functions, adverse media, and legal and enforcement information; BusinessBase™ adds the corporate and KYB dimension to deepen the understanding of companies, ownership structures and counterparties.

2. Signal quality starts with identity

Before deciding how relevant a piece of information is, we need to answer an apparently simple question well: are we looking at the right subject?

For an analyst, the ideal outcome is to receive an already clearer picture: less ambiguity around identity, fewer false positives to review and greater visibility over the connections that actually matter.

This is the practical value of carrying out entity resolution upstream on the data. Information from different sources is attributed to the correct subject, while similar individuals or organisations are kept separate where they are not the same entity.

Better identity resolution improves everything that follows — matching, relationships, scoring and monitoring — reducing the uncertainty that would otherwise fall back on the analyst.

It also changes the way we think about screening.

A name is only the starting point. What really helps the analyst is the profile built around that name: identifying information, evidence, context and relationships.

The objective is not simply to make matching narrower.

It is to give the system enough context to discriminate more effectively.

From a name to the right subject.

Profiles enriched with identifying information, evidence and relationships help reduce ambiguity and focus review efforts on the results that deserve attention. Dataware proprietary data can be accessed through DailyControl™ Screener and Batch Screener or integrated directly into existing systems and workflows through APIs and Data On-premise.

3. Continuous monitoring changes the logic of control

A customer’s behaviour does not necessarily need to change for their risk profile to change.

What may change is what we know about a counterparty, a relationship or the context in which the subject operates.

This is where continuous monitoring can move beyond a model based exclusively on periodic review.

The question is no longer simply:

“Is it time to screen this customer again?”

but:

“Has something materially relevant happened that means I should reassess what I thought I knew?”

Moving towards an event-driven approach therefore does not simply mean checking more frequently.

It means changing what triggers the review.

And the intended result should not be a continuous flow of additional alerts.

It should be the ability to focus attention when something changes that could affect the risk assessment.

From periodic review to relevant change.

Rather than relying only on scheduled reviews, analysts can bring a subject back into focus when new potential matches emerge or monitored information changes. DailyControl™ Monitor supports this continuous approach, allowing change — not just the calendar — to become a trigger for reassessment.

4. Some of the most important work happens between detection and decision

Detecting a signal is only one part of the process.

Once something has been identified, someone still needs to understand what it means.

It is precisely in the space between signal and decision that a significant part of an analyst’s work can sit: reconstructing the case, connecting the available information, checking the underlying evidence and understanding what is still missing before reaching an assessment.

Automation can shorten that distance.

This is also where AI can play a practical role: not necessarily by reaching a conclusion autonomously, but by helping the analyst start from an already organised picture rather than from a blank page.

It can help bring together available information, highlight inconsistencies or information gaps and support the structuring of an initial view of the case.

But in AML, one condition is essential: a useful synthesis cannot simply be plausible. It must be traceable back to the evidence on which it is based.

Automating analysis therefore does not mean automating judgement. It means reducing the work that comes before that judgement, allowing the analyst to focus on the part that genuinely requires professional expertise.

Bringing the case closer to a decision.

Bringing information, evidence and context together in the same case reduces the manual work required to reconstruct it and supports more consistent, documentable analysis. With DailyControl™ Investigator (Case Manager), analysts can organise relevant sources and work with DC Agent, the AI agent that operates on user-selected sources to analyse and summarise them, answer questions about the case and surface information relevant to the assessment. Reporting capabilities also provide a first draft based on the material collected in the case, while professional judgement remains with the analyst.

5. An anomaly is not yet a suspicion

This distinction remains fundamental. Automation can identify something that deserves attention. It can place a signal in the context of what we already know about the subject and what has changed over time. But an anomaly and a suspicion are not the same thing.

Further analysis may show that there is a coherent explanation.

Or it may reveal additional elements that make the picture more significant and require further checks. In both cases, the value of technology lies in bringing the analyst closer to the point at which their judgement is genuinely required.

The question we ask a system should therefore not simply be:

“Is this case suspicious?”

but rather:

“What should I consider to understand whether what I am seeing can be explained or requires further investigation?”

This keeps the distinction clear between what technology can prepare and what requires professional assessment.

Improve the signal, not the number of alerts

The evolution of AML automation does not require a choice between lists, anomaly detection and AI.

It requires a process in which known risk, emerging signals and context reinforce each other.

Data helps identify the right subject and qualify what is already known.

Monitoring helps detect what changes.

Analysis and investigation tools help turn those elements into a case that is easier to understand and verify.

The outcome is very practical:

less noise, less manual work and more relevant, understandable and documentable cases for analysts to review.

The real objective is not to generate more alerts. It is to improve the quality of the signal.

Make the data work within the processes you already use.

Organisations do not need to move every activity into a new platform to use Dataware intelligence. WatchBase™ and BusinessBase™ can feed existing systems, software and workflows directly through APIs or Data On-premise, helping reduce manual steps and duplicated work. Where a dedicated environment is preferred, the DailyControl™ Suite provides screening, monitoring and investigation tools built on the same proprietary data.