AML Reporting and Investigation Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends AML Investigators, Financial Crime Analysts and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-FFC-034

Before you join: Participants should understand the purpose of AML/CFT controls and have some exposure to customer due diligence, transaction monitoring, fraud review, payments operations or compliance processes.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Financial institutions and regulated businesses face difficult decisions when unusual activity appears legitimate at first review, customer information is incomplete, or several weak indicators combine into a credible suspicion. Investigators must assess risk quickly, establish facts from transaction and customer data, record reasoning, and escalate or report without tipping off the subject. Poorly documented decisions create regulatory exposure, missed financial-crime risk, inconsistent case outcomes and weak audit trails.

This course develops the reporting and investigation techniques used in AML/CFT operations. Participants apply FATF risk-based principles to customer due diligence, transaction-monitoring alerts, investigative planning, relationship mapping, evidence assessment and suspicious-activity reporting. The programme covers common typologies involving trade finance, money mules, cash-intensive businesses, virtual assets, correspondent banking and human trafficking. It also addresses the points where AML investigations intersect with sanctions screening, beneficial ownership analysis, data privacy and case governance.

Teaching combines concise technical briefings with realistic case files, facilitated group analysis, alert-triage simulations, report-writing practice and peer review. Participants work through the decisions required from alert intake through investigation, escalation, reporting and closure. They leave with a reusable investigation-plan template, alert-triage model, evidence log, suspicious-activity narrative structure, case-quality checklist and personal ninety-day application plan. The course is available as a five-day classroom programme in 50+ cities or live online, with 6.5 contact hours each day. Participants receive a certificate of completion.

The course suits professionals who already work with customer due diligence, AML alerts, fraud referrals, payments investigations or financial-crime controls and need stronger investigation and reporting judgement.

What you will be able to do

  • Apply FATF risk-based principles to prioritise AML/CFT cases and escalation decisions
  • Assess customer due-diligence evidence using beneficial ownership, PEP and source-of-wealth methods
  • Configure transaction-monitoring scenarios using segmentation, thresholds, behavioural rules and tuning evidence
  • Plan and conduct alert investigations using hypotheses, transaction chronology and relationship mapping
  • Draft defensible suspicious-activity narratives using the 5Ws and How structure
  • Identify major AML/CFT typologies through transaction patterns, customer information and external intelligence
  • Document case evidence, rationale and quality controls for audit and regulatory review
  • Build an investigation-improvement plan for workplace procedures, handoffs and reporting quality

Benefits of attending

For you

  • Produce clearer suspicious-activity reports with factual chronology and defensible rationale
  • Make faster alert-triage decisions using documented risk and materiality criteria
  • Investigate complex customer relationships through beneficial ownership and link analysis
  • Recognise typologies that ordinary threshold-based monitoring may miss
  • Build credible case files that withstand quality assurance and management challenge

For your organisation

  • Improve consistency of alert disposition, escalation and suspicious-activity reporting decisions
  • Reduce avoidable false positives through better segmentation and scenario-tuning evidence
  • Strengthen audit trails for regulatory examinations, internal audit and quality assurance
  • Identify higher-risk customer activity through structured typology and relationship analysis
  • Improve handoffs between operations, AML investigations, sanctions and compliance teams

Course modules

10 modules over 5 days

Participants can apply AML/CFT obligations and risk-based principles when assessing investigative priorities.

  • FATF Recommendations, national law and internal policy obligations mapped together
  • Money-laundering stages linked to placement, layering and integration indicators
  • Risk-based approach applied to products, customers, channels and geographies
  • Predicate offences and beneficial ownership concealment patterns examined systematically
  • Terrorist-financing indicators distinguished from conventional criminal-proceeds activity patterns
  • Three lines model assigns financial-crime accountability and escalation duties

Participants can evaluate customer due-diligence information and identify gaps requiring further enquiry.

  • Customer acceptance criteria translated into proportionate due-diligence requirements
  • CDD files tested against identity, ownership and purpose evidence
  • Beneficial ownership traced through corporate chains, trusts and nominees
  • Enhanced due diligence triggered by PEP, jurisdiction and product risk
  • Source-of-funds and source-of-wealth enquiries documented credibly
  • Periodic review cycles set from residual customer risk ratings

Participants can assess monitoring alerts, identify meaningful risk signals and prioritise investigation work.

  • Transaction-monitoring scenarios aligned with stated customer activity and risk
  • Threshold rules, behavioural rules and network rules compared
  • Alert volumes assessed using false-positive rates and disposition data
  • Segmentation separates retail, corporate, correspondent and private-banking populations
  • Scenario tuning decisions recorded with rationale, testing and approval
  • Data-quality controls identify missing fields, duplicates and delayed feeds

Participants can plan a focused AML investigation and reach evidence-based case conclusions.

  • Alert triage applies risk scoring, materiality and time sensitivity
  • Investigation plans define allegations, scope, hypotheses and evidence sources
  • Account activity reconstructed through transaction chronology and relationship mapping
  • Link analysis exposes common counterparties, devices, addresses and controllers
  • Open-source intelligence checked for adverse media, entities and associates
  • Case conclusions distinguish suspicion, concern, explanation and closure rationale

Participants can prepare clear, factual and defensible internal escalation packs and suspicious-activity reports.

  • Suspicion thresholds distinguished from proof standards and internal escalation tests
  • 5Ws and How structure clear, chronological suspicious-activity narratives
  • Material facts separated from inference, allegation and unsupported speculation
  • Transaction tables reconcile amounts, dates, accounts, counterparties and currencies
  • Internal SAR escalation packs document rationale, urgency and approvals
  • Confidentiality controls prevent tipping-off, improper disclosure and record compromise

Participants can identify and investigate common money-laundering and terrorist-financing typologies.

  • Trade-based money laundering identified through invoice, shipment and pricing anomalies
  • Money-mule networks recognised through rapid movement and account-link patterns
  • Cash-intensive business activity tested against expected turnover and deposits
  • Virtual-asset typologies assess wallet exposure, mixers and exchange flows
  • Correspondent-banking red flags include nested relationships and payment opacity
  • Human-trafficking indicators combined from payment behaviour and customer information

Participants can identify sanctions issues arising during AML investigations and escalate them appropriately.

  • Sanctions screening distinguished from AML transaction monitoring and investigation
  • Name-matching logic evaluated using identifiers, aliases and transliteration
  • Potential sanctions hits investigated through ownership, control and payment facts
  • Targeted financial sanctions assessed under applicable legal and policy rules
  • Asset-freeze decisions escalated with documented legal and operational rationale
  • AML and sanctions cases coordinated without contaminating separate reporting duties

Participants can maintain complete case records that support quality review, audit and regulatory inspection.

  • Case files preserve audit trails from alert generation to disposition
  • Evidence logs record source, retrieval date, relevance and reliability
  • Chain-of-custody principles protect electronic records and investigative integrity
  • Data minimisation balances investigative need, privacy and retention requirements
  • Quality assurance samples test completeness, timeliness and decision consistency
  • Management information tracks ageing, conversion, productivity and quality metrics

Participants can assess investigation governance and recommend targeted improvements to AML/CFT controls.

  • Operating procedures define handoffs between operations, investigations and compliance
  • Escalation matrices assign authority for closure, filing and urgent action
  • Second-line challenge tests rationale, evidence sufficiency and policy adherence
  • Root-cause analysis converts recurring investigation defects into control improvements
  • Regulatory examination requests answered through traceable case-file production
  • Training records and competency assessments support investigator authorisation

Participants can manage an end-to-end AML case workflow and define practical workplace improvements.

  • End-to-end case workflow integrates intake, analysis, escalation, reporting and closure
  • Prioritisation matrices allocate investigator time by risk, urgency and complexity
  • Case handover notes preserve outstanding questions, deadlines and investigative rationale
  • Remediation actions address customer risk, monitoring gaps and control failures
  • Personal application plans define first ninety-day workplace improvements
  • Peer review criteria strengthen factual writing and defensible decisions

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. AML investigation-plan template
  2. Alert-triage risk-scoring model
  3. Suspicious-activity narrative structure
  4. Case evidence-log template
  5. Investigation quality-assurance checklist
  6. Ninety-day AML improvement plan

Who should attend

  • AML Investigators — need structured methods for alert review, evidence assessment and case conclusions
  • Financial Crime Analysts — need stronger judgement when triaging alerts and escalating suspicions
  • Compliance Officers — need defensible reporting processes and effective second-line challenge
  • Transaction Monitoring Analysts — need to connect scenario alerts with customer risk and typologies
  • Fraud Investigators — need to distinguish fraud indicators from wider money-laundering concerns
  • Internal Auditors — need to assess AML investigation files, governance and control evidence

Skills and tools covered

AML case investigationSuspicious activity reportingTransaction monitoringBeneficial ownership analysisFinancial crime typologiesCase quality assurance

Tools and standards

FATF Recommendations, FATF Risk-Based Approach, Wolfsberg Group CBDDQ, 5Ws and How

How the course runs

Training methodology

The course uses short instructor briefings to establish required AML/CFT concepts, followed by realistic case work based on customer records, payment activity, alerts and external intelligence. Participants assess case facts in groups, conduct alert-triage and investigation simulations, draft reporting narratives, and review decisions against defined quality criteria. Facilitated discussion compares alternative conclusions and escalation routes. Individual application planning converts the methods into practical improvements for participants' own investigation, reporting and quality-assurance procedures.

Requirements and prerequisites

Participants should understand the purpose of AML/CFT controls and have some exposure to customer due diligence, transaction monitoring, fraud review, payments operations or compliance processes. Familiarity with common customer records, account transactions and basic risk ratings is assumed. Participants should be comfortable reading transaction data and writing concise factual notes. Prior investigation experience is helpful but not essential. No legal qualification, programming skill, specialist data-analysis software or prior suspicious-activity reporting experience is required.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

You should understand basic AML/CFT controls and be familiar with customer records or transaction data. Previous investigation or suspicious-activity reporting experience is useful but not required.

Bring a laptop if your delivery format permits, plus any non-confidential examples of alert workflows, reporting forms or investigation challenges you want to discuss. Do not bring customer data, live case files or restricted documents.

The course is designed for AML investigators, transaction-monitoring analysts, compliance officers, fraud investigators and internal auditors. It is most valuable for professionals who already encounter alerts, customer-risk issues or financial-crime casework.

General AML awareness training explains obligations, red flags and employee responsibilities. This course concentrates on operational investigation methods, transaction analysis, evidence handling, escalation decisions and suspicious-activity reporting.

Participants can use the investigation-plan template, alert-triage model, evidence log and narrative structure immediately in casework. The final application plan identifies specific changes to reporting quality, handoffs or case controls.

Each day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The ten modules progress from AML/CFT risk and due diligence through monitoring, investigation, reporting, typologies, governance and application planning.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.