How to Do AML (Anti Money Laundering) Testing: A Step-by-Step Guide for Compliance

Anushree Chatterjee

AML testing is the bare minimum, mandatory exercise for independent assessment of your financial compliance program from top to bottom. The issue is that for numerous institutions, historical AML testing has overwhelmed them. Manual sampling and basic reviews cannot keep up with the volume of transactions conducted globally or evolving criminal typologies. That leads to testing, which is inefficient and resource-draining, and which fails to successfully uncover the hidden vulnerabilities, causing compliance officers and internal auditors to constantly feel a shortage of time.

This article will demystify AML testing and show you how automation and AI can help.

Before we look at AML, let’s quickly revise what happens in money laundering.

What is Money Laundering?

Money laundering is a three-stage process used to “clean” dirty money:

1. Placement: The profits of the illicit activity are inserted into the financial system (in a similar way but on a smaller scale) so that they appear to come from legitimate sources.
2. Layering: The money (which has already been laundered in the first stage) is transferred to get it away quickly, often put through a series of financial transactions or other mechanisms (e.g., buying/selling assets or trading complex financial instruments) to hide its original source. This is just making the audit trail more confusing.
3. Integration: The cash is then passed back to the criminal as what appears to be clean money. One could accomplish this, for example, by liquidating an asset that he has bought or by purchasing a bona fide business.

What is Anti Money Laundering (AML)?

AML (Anti Money Laundering) is an umbrella term for the laws, regulations, and procedures that are designed to prevent criminals from making illegal money legal. Its main aim is to prevent illegal money from being laundered through the regular financial system after it has been acquired by activities such as drug-dealing, fraud, corruption, or terrorism.

How Does AML Fit into the Finance Sector?

AML fits in through three main functional areas:

The AML Control: Regulatory Compliance

• Mandate: Banks, credit unions, brokerages, insurance companies, and even some non-bank entities (like money service businesses) are legally obligated to establish and maintain a robust AML program. This requirement is imposed by governments and international bodies like the Financial Action Task Force (FATF).
• Consequences: Failure to comply leads to severe penalties, including massive fines (often in the hundreds of millions or billions), criminal charges, and the loss of operating licenses.

The AML Process: Pillars of AML Testing

• Know Your Customer (KYC) / Customer Due Diligence (CDD): It is a measure to verify and identify the clients’ risk rating and business relationship. When you open a bank account, for instance, AML rules lay out why the bank needs your identification, proof of address, and occupation.
• Transaction Monitoring (TM): Banks use TM to monitor their customers’ accounts for specific activities that are unusual and suspicious, based on past behavior (i.e., a customer who writes small checks begins to receive large amounts of international funds).
• Suspicious Activity Reporting (SAR): Should a transaction or pattern be identified as suspicious, and the institution is legally obligated to file a confidential report with a financial intelligence unit without tipping off customers.

Risk Management due to AML

• Reputational Shield: A strong AML program protects the institution’s reputation. Being publicly associated with money laundering or terrorism financing can destroy customer and investor confidence.
• System Integrity: It ensures that the bank’s services and infrastructure are not exploited by criminals, preserving the stability and safety of the financial system for legitimate users.

Who Performs AML Testing?

An external team does the AML audit. If AML testing is to be relied on for regulatory purposes, it should not be conducted by the same people who design, implement, and maintain day-to-day AML controls. This ensures that there is objectivity and prevents the team from grading their own homework.

The AML Compliance Testing Process

Scoping and Planning (Setting the Target)

• Risk-Based Approach: The investigation team starts by reviewing the institution’s latest Enterprise-Wide Risk Assessment and identifying which products (e.g., correspondent banking, international transfers), customers (e.g., casinos, shell companies), and geographies pose the highest risk of money laundering. This information helps the team to prepare a suitable sample.

Testing the Customer Defenses (KYC/CDD)

• File Review: In each sample case, auditors review whether all the required documentation (ID, proof of address, source of wealth, etc.) is thoroughly verified and is up to date.
• Enhanced Due Diligence (EDD) Check: For high-risk clients, the audit verifies that the mandated deeper investigations – like background checks or site visits – were performed and thoroughly documented.

Testing the Gatekeeper Systems (Screening)

This ensures the automated systems are correctly blocking or flagging sanctioned individuals (Sanctions) and politically connected persons (PEPs).

• Fuzzy Logic Check: Testers input lists of names that are near matches (misspellings, aliases, reversed names) to actual sanctioned individuals to ensure the screening software’s “fuzzy logic” correctly flags them without fail.
• List Maintenance: Confirmation that all required sanctions lists (e.g., OFAC, UN) are received immediately upon release and effectively implemented into the customer screening process.

Testing the Alert System (Transaction Monitoring)

• Rule Validation: Auditors attest to the logic of monitoring rules (scenarios) and the coverage of common criminal methodologies (typologies).
• Below-the-Line (BTL) Analysis: The auditors deliberately lower alert thresholds using historical data to find suspicious activity that the system missed. This reveals if the system is tuned too conservatively, hiding major risks.
• Alert Disposition Review: A sample of alerts already generated is reviewed to ensure analysts investigated the activity correctly, documented their findings thoroughly, and escalated or filed a Suspicious Activity Report (SAR) when warranted.

The Final Review: Reporting and Remediation

• Report Generation: All findings, categorized by severity (High, Medium, Low risk), are documented in a formal report presented to Senior Management and the Board.
• Corrective Action Plan (CAP): The management team must create a Corrective Action Plan with clear deadlines to fix every weakness identified. The auditor’s job is not complete until they confirm that these corrective actions have been properly and sustainably implemented.

The Role of Software Testing in AML Testing

AML compliance relies heavily on specialized software, and software testing verifies that these systems are reliable gatekeepers, not sources of risk. The overall AML audit focuses on policies and procedures, but software testing focuses purely on validating the performance and reliability of the automated systems.

Validating the “Gatekeepers”: KYC and Screening Systems

The moment a customer begins an interaction, they engage with software. Software testing ensures these initial defenses are flawless.

• KYC (Know Your Customer) Onboarding: Automated tests can simulate a new customer signing up. These tests verify that the software successfully captures and verifies identity documents, correctly performs necessary database checks (like address validation), and assigns the appropriate risk rating based on the customer’s input.
• Sanctions and PEP Screening: These systems must check names against watchlists instantly. Software testing verifies the speed and accuracy of this process. It ensures the system pulls the correct, most recent watchlists and that the matching engine (the part that finds names even with minor typos or aliases) is working exactly as intended.

Ensuring the “Lookout”: Transaction Monitoring Systems

Transaction monitoring (TM) software analyzes millions of transactions to spot suspicious patterns.

• Rule Logic Testing: Software tests validate that the complex rules designed to find criminal activity are coded and implemented correctly. For example, if the policy is to flag deposits over $10,000, software testing confirms the system doesn’t accidentally flag deposits of $9,999 or only flags those over $100,000.
• Threshold and Tuning Validation: Testing helps confirm that the system’s performance is stable. It ensures the TM system can handle the huge volume of daily transactions without crashing or significantly slowing down, which is critical for real-time monitoring. It also validates that any recent changes to alert thresholds didn’t introduce errors.
• Data Integrity: The TM system is useless if it’s fed bad information. Software testing verifies that transaction data from all source systems (like core banking, card systems, etc.) flows completely, accurately, and without corruption into the monitoring system.

Guaranteeing the Audit Trail: Reporting and Case Management

When suspicious activity is found, the system must create an indisputable record for regulators.

• Workflow Validation: Software testing ensures the seamless flow of a potential case, from alert generation to its assignment to an analyst and to the final decision. The test confirms all mandatory steps and sign-offs are enforced by the software.
• Regulatory Report Accuracy: When an analyst generates a Suspicious Activity Report (SAR), the software test validates that the final report format (e.g., the XML file) contains all the required fields and accurate transaction details needed for submission to government agencies. A technical error here can result in a regulatory violation.

Also read: Automated Testing in the Financial Sector: Challenges and Solutions.

How AI-Based Testing Improves AML Testing

Tools for Detecting AML (AML System’s AI)

Traditional AML systems rely on rigid, pre-set rules (e.g., “Alert if a customer deposits more than $\$10,000$”). These systems are easy for criminals to circumvent and generate a massive number of false alerts. AI and Machine Learning (ML) fix this by learning criminal behavior patterns, not just simple transaction totals.

• Reducing False Positives: In traditional systems, a large number of alerts can be “false positives” – legitimate activity flagged incorrectly. This forces analysts to waste time reviewing countless harmless cases. AI models, however, learn from historical outcomes. They analyze thousands of past alerts that were eventually dismissed as legitimate and those that turned into actual Suspicious Activity Reports (SARs). The model uses this context – like a customer’s normal behavior, source of funds, and business type – to prioritize only the truly high-risk alerts. This allows human analysts to focus their efforts where they matter most.
• Finding the “Unknown Unknowns”: Rule-based systems can only catch the types of crimes they are programmed to look for. If criminals invent a new way to launder money (typology), the old system will miss it entirely. ML models use unsupervised learning to spot anomalies. They look for behavior that deviates significantly from the rest of the customer base, even if that behavior doesn’t fit a known rule. This helps institutions catch new, complex, and evolving money laundering schemes that no human auditor could have anticipated or manually programmed a rule for.
• Continuous, Dynamic Tuning: Traditional systems require constant manual “tuning” by a team of experts, which is slow and costly. AI systems can automatically suggest optimal alert thresholds and rule changes based on recent data. The model can be tested silently in a “shadow mode” before being deployed, ensuring any change improves detection rates and reduces false alerts without risk. This creates a powerful feedback loop where the system continuously learns and improves its own testing methodology.
• Better Compliance with Explainability (XAI): Regulators need to know why a system flagged a transaction (or, crucially, why it didn’t). Historically, AI was seen as a “black box”. Today’s Explainable AI (XAI) tools provide a clear, traceable audit trail for every risk score. When an analyst files an SAR, the system can instantly produce the variables and data points that led to the alert, giving regulators the transparency and proof they require.

Companies like NICE Actimize, SAS AML, Oracle, Napier, and ThetaRay are some of the few that offer AML testing services like sanction screening and transaction monitoring.

Tools for Validating AML Detection Systems

Apart from these tools that execute the AML process, you have other AI-based testing tools like testRigor that automate the validation of your AML technology itself. Since financial institutions rely on complex software for customer screening, transaction monitoring, and reporting, the testing process must confirm that these tools are reliable. This is where AI-based testing platforms, which allow for testing without complex programming, revolutionize the audit process.

• Validating the End-to-End AML Workflow in Plain English: testRigor allows compliance officers, business analysts, and manual testers to write comprehensive, end-to-end tests in simple, plain English (e.g., “log in as analyst,” “search for customer ID 123,” “verify alert appears”). This makes test creation immensely faster than old-school coding methods. This speed and ease mean that whenever a regulator demands a change to the KYC process or a new sanctions list is published, the institution can create and run the validation tests immediately, guaranteeing compliance much faster.
• Cross-System Integration Testing: AML systems often integrate with core banking platforms, KYC/CDD repositories, and sanctions screening lists. With testRigor supporting API and database testing in plain English, the process becomes even simpler.
• Ensuring Regulatory Compliance of the UI and Reporting:
  • Mandatory Fields and Processes: The tool can enforce that all regulatory requirements for customer due diligence (CDD) forms, Know Your Customer (KYC) documents, and investigation reports (like SARs) are correctly implemented in the user interface.
  • Report Generation and Auditing: Automate the process of generating compliance reports (like SARs) and validating that the output (PDF, XML, etc.) contains all the necessary data fields and an accurate audit trail, which is essential for regulatory audits.
• Enhancing Test Stability and Maintenance:
  • Self-Healing Tests: testRigor uses technology that doesn’t rely on brittle locators (like XPath or CSS). This means that if the UI slightly changes – which is common during rapid development cycles – the test scripts often automatically adjust and do not break, ensuring continuous compliance validation with minimal maintenance effort. This means the test only fails if the functionality breaks (e.g., the SAR form doesn’t appear), not because of a simple UI change. Testers can trust that if the test passes, the critical regulatory workflow is intact.
  • Accessibility and Security Testing: testRigor can include checks for accessibility compliance (e.g., ADA, Section 508), which are also part of a financial institution’s overall compliance posture.

run SQL query "SELECT CustomerID TransactionID FROM transactions WHERE amount > 100000"
enter stored value "CustomerID" into "Customer ID"
enter stored value "TransactionID" into "Transaction ID"
click "Generate SAR Report"
verify that page contains "AML Alert"
click “Download SAR Report”
check that file "SAR_Report.pdf" was downloaded
check that downloaded file "SAR_Report.pdf" contains "AML Alert"

The future of Anti-Money Laundering (AML) Testing

Companies are moving more towards modern technology like AI, machine learning, and big data analytics to assist with the rising challenges of money laundering. We’re likely to see:

• Moving from Periodic Audits to Continuous Compliance: Rather than an auditor reviewing a sample once every few months, we’re likely to see a continuous audit happening, thanks to technology. AML testing becomes a daily function embedded into the technology. Tools constantly monitor for “trigger events”. When a trigger happens, the system automatically initiates a re-verification of that customer, and the test validates that this automation worked correctly.
• Testing the Logic Behind the Decisions (Explainability): As auditors are relying more on AI, explainability is becoming a mandate to be able to justify the AI model’s decisions.
• Focus on Data Quality and Integration with Graph Analytics: Future AML tests will spend less time on manual reviews of paper files and more time validating the data pipelines. Auditors will look for evidence that the system can connect dots across the entire institution. For example, testing will ensure the system recognizes that the beneficial owner of a high-risk corporation is the same person who just opened a new private banking account, effectively collapsing two seemingly separate entities into a single, high-risk profile.
• Testing for Novel Threats: Testing must adapt from checking for old crimes to anticipating new ones.
  • Typology-Based Testing: Regulators are pushing institutions to move beyond simple threshold rules (e.g., alert over $\$10,000$) and test for actual criminal typologies – the complex patterns used in money laundering today (like trade-based schemes or using gaming platforms).
  • Predictive Models: The highest standard of future AML testing will involve validating predictive models that try to anticipate where the next attack will come from, rather than just reacting to where the last one was. This makes testing a strategic exercise, not just a historical compliance check.

Conclusion

Money laundering has been an age-old problem. It isn’t just AML testing that is trying to leverage modern technology; criminals are too! With criminals constantly innovating and finding new ways to carry out their operations, AML testing is more crucial than ever before. The AML testing of tomorrow won’t be about verifying checklists; it will be about continuously proving that the institution’s automated defenses are smarter, faster, and more integrated than the organized financial crime networks trying to break them.

“We spent so much time on maintenance when using Selenium, and we spend nearly zero time with maintenance using testRigor.”

Keith Powe VP Of Engineering - IDT