How We Built an AML System for 21 Banks: From Rules to AI

The problem

Anti-money-laundering compliance is the unglamorous backbone of every bank. Every transaction, every new customer, every wire transfer must be screened against sanctions lists, watched for suspicious patterns, and documented for regulators.

For decades, banks handled this with rule-based systems. If a name matched a watchlist entry within a certain Levenshtein distance (a measure of how many character edits separate two strings), the system flagged it. If a transaction exceeded a threshold, the system flagged it.

The problem: rule-based systems are blunt instruments. They catch the obvious cases, miss the subtle ones, and drown compliance teams in false positives. An analyst might review 100 flagged transactions in a day, and 98 of them are legitimate. The real threats (the ones using aliases, transliteration variants, and deliberately obscure structures) slip through.

Across 21 banks, we were processing $250M+ in transactions through these legacy systems. The accuracy ceiling was around 80%. That meant one in five genuine threats was not being caught.

What we built

We replaced the rule-based stack with an AI-driven AML platform covering five modules:

1. Transaction screening. Every transaction is screened against sanctions lists, PEP databases, and adverse media. The AI does not just match strings. It understands that “Muhammad” and “Mahmoud” and “Mohammad” are the same name in different transliterations. It understands that “Levin” and “Levine” might be the same person. This semantic name matching is where the biggest accuracy jump came from.

2. Transaction monitoring. The system watches for patterns across time: structuring (breaking large transfers into smaller ones to avoid thresholds), rapid movement through multiple accounts, unusual geographic flows. The AI models learn what normal looks like for each bank and flag deviations.

3. KYC (Know Your Customer). Onboarding workflows that verify customer identity, assess risk profiles, and continuously monitor for changes in status (a customer becomes a PEP, appears in adverse media, changes jurisdiction).

4. KYB (Know Your Business). Entity-level screening that traces ownership structures, identifies ultimate beneficial owners, and flags shell companies or high-risk jurisdictions in the ownership chain.

5. PEP screening. Continuous monitoring of customers against politically exposed persons databases, with risk scoring based on role, jurisdiction, and exposure.

The evolution: three generations

The system did not start as AI. It evolved through three generations, and the story of that evolution is the story of why AI matters in compliance.

Generation 1: Rules (80% accuracy)

The original system was pure rules. Levenshtein distance for name matching, regex patterns for transaction patterns, fixed thresholds for amount-based alerts. It worked, sort of. It caught 80% of genuine threats in our test data. But the 20% it missed were the dangerous ones: sophisticated actors using name variants, alias networks, and transaction structures designed to evade blunt matching.

The false positive rate was brutal. Compliance analysts spent most of their time clearing legitimate transactions that the rules flagged because a name was almost similar to a watchlist entry.

Generation 2: BERT transformers (90-95% accuracy)

The first AI layer was a BERT-based transformer model. This was before the GPT era: we were building on the first generation of transformer architectures that understood language semantically rather than just character-by-character.

The jump was significant. Name matching improved because the model understood that “Muhammad” and “Mahmoud” share semantic meaning even though they differ in characters. Transaction pattern detection improved because the model could learn what “normal” looked like for each bank and flag genuine anomalies instead of threshold violations.

Accuracy went from 80% to the 90-95% range. False positives dropped. Analysts could focus on genuine investigations instead of clearing noise.

Generation 3: Full LLM-based screening (99.6% accuracy)

The current generation uses full transformer-based LLMs that understand context, aliases, and entity relationships at a level the earlier models could not.

The key breakthrough was not raw model size. It was the training approach: we taught the system to understand name networks. A person might appear in a sanctions list as “Mohammad bin Salman,” in a transaction as “M. Al-Salman,” and in a KYC record as “Mohammed Salman.” A rule-based system sees three different names. A Levenshtein matcher sees moderate similarity. A semantic model with alias training sees one person.

The system now catches 99.6% of genuine positive signals in our labeled test data. The 0.4% it misses are edge cases so unusual that human analysts would likely miss them too, and the system flags them as “low confidence, review recommended” rather than letting them pass silently.

Results

Metric	Rule-based	AI (current)
Recall (threats caught)	~80%	99.6%
False positive rate	High (analyst overload)	60% lower
Name variant matching	Levenshtein only	Semantic + alias networks
Transaction pattern detection	Fixed thresholds	Learned baselines per bank
Banks deployed	N/A	21
Transactions processed	N/A	$250M+

What we learned

The model is 20% of the work. The other 80% is data engineering, integration, and regulatory validation. Banks do not buy models. They buy systems that integrate with their core banking platform, produce audit trails regulators accept, and do not break at 3 AM. The AI is the flashy part. The plumbing is what makes it ship.

Semantic name matching is the highest-ROI AI application in compliance. Not chatbots. Not document summarization. The ability to understand that two different strings refer to the same person. That single capability, deployed across screening, monitoring, and KYC, accounts for most of the accuracy improvement.

False positives are the real cost driver. A system that catches 99.6% of threats but floods analysts with false alerts is worse than one that catches 90% with clean alerts. The AI’s job is not just to catch more. It is to catch more precisely.

Regulatory acceptance is a feature, not a hurdle. We designed the system from day one with explainability built in. Every flag comes with a reason: which name variant matched, which pattern triggered, which source was referenced. Regulators do not accept black boxes. They accept systems that can explain their decisions.

---

This system was built by the team at Cone Red. If you are evaluating AI for compliance, AML, or banking operations, let’s talk.