AML automation for screening hits and alert triage
Verkflo runs your written AML procedures on top of the screening, monitoring and case tools you already use. The agent gathers the context for each hit or alert and drafts the note for an analyst.
Works with

- Custom REST
- Monitoring system · via Custom REST
- Case tool · via Custom REST
and any system with an API via Custom REST
Where Verkflo sits in your AML operations
Verkflo does not replace your screening provider, your transaction monitoring system or your case management tool. Those systems keep generating the hits and alerts and holding the cases. Verkflo runs the procedure your analysts follow when an alert lands: it collects the customer profile, the transaction history and the list entry, applies your disposition rules and puts a recommendation in front of an analyst.
Screening runs through ComplyAdvantage today. A monitoring or fraud system connects through Custom REST when it exposes an API, so the agent can read the alert and the account history it needs.
Onboarding checks that feed your AML program are on KYC automation and KYB automation.
Who does what in AML operations
The procedure
Your AML procedures set how a sanctions hit is cleared, which monitoring alerts can be closed with a standard rationale, what a fraud analyst checks first and when a case goes to your MLRO or compliance officer.
What the agent does
Screens names for sanctions, PEP and adverse media in ComplyAdvantage
Fetches the listed entry behind each screening hit
Gathers the customer profile and transaction history for a monitoring alert
Applies your disposition rules and drafts the case note
What your team decides
Whether a screening hit is a true match
Closure of any monitoring alert, including ones the agent recommends closing
Holds, blocks and other account actions on a fraud alert
Which cases go forward for a reporting decision
AML procedures you can run today
Open one to see example runs, the rules behind them and where a reviewer steps in.
-
Sanctions screeningScreen counterparties before the first payment and send each possible match to a person.
-

Transaction monitoring alert triageGather the alert, customer profile and history, apply your disposition rules and route what needs a person.
-
Fraud alert triageCollect the device, account and transaction context for each fraud alert and put a decision in front of an analyst.
-

PEP and adverse media reviewCompare each PEP or adverse media hit with the customer file and put the evidence in front of a reviewer.
Closing an alert stays with an analyst
For monitoring alerts, the agent can recommend closure where your rules allow it, for example alert.rule in low_risk_rules && customer.risk_rating == "Low". The recommendation waits in the review queue until an analyst confirms or overrides it.
The analyst's name, the rule that fired and the evidence the agent gathered are logged together with the run. The ComplyAdvantage integration page lists the screening calls.
Controls your auditors will ask about
These controls apply to each agent you build. Sample data
Admin
Author
Reviewer
Auditor
Role-based access
Admin, Author, Reviewer and Auditor roles, scoped to each workspace.
- 41
7c2e… - 42
a91f… ← 7c2e - 43
03d8… ← a91f
Hash-chained audit log
Each entry carries the hash of the one before it. Verifying the log recomputes the chain and flags entries that no longer match.
- 41
- v1.1v1.2v1.3Published
Versioned specs
Each run records the exact version it followed; old versions stay readable.
- vault/sumsub/key
Secrets in a vault
Steps point to a vault path, and the key stays in the vault.
- Signed delivery accepted
- Unsigned delivery rejected
Signed webhook triggers
Unsigned or stale deliveries are rejected before a run starts.
- SandboxLive
Sandbox before live
New versions run on test data first. Going live is a separate step.
AML automation questions
Does Verkflo replace our transaction monitoring system?
No. Your monitoring system keeps generating alerts. Verkflo runs the triage procedure on each alert it receives and hands the case to an analyst with the context gathered.
Can the agent close an alert by itself?
Closure stays with an analyst. The agent can recommend it where your rules allow, and the recommendation waits in the review queue until a person confirms or overrides it.
Which screening provider does it work with?
ComplyAdvantage today. A provider with an API can be added through Custom REST.
How do we test a procedure change before it reaches live alerts?
Publish the new version to the sandbox and run your eval scenarios, such as a true match and a near miss. A failing scenario blocks publishing.
Bring an alert you worked last week
We'll run it through your triage procedure as an agent and show the case note an analyst would review.
Book a demo