Most money transfer operators that run into trouble with a regulator have a compliance policy. What they lack is a programme that runs every day: controls that fire on every transfer, decisions that a named person makes and records, and a file that shows both. This guide is for MLROs, compliance heads and operations leads at established MTOs who want a framework they can check their own programme against: who owns what, what the platform should do on its own, and where a person has to decide. The examples use illustrative figures.
The principle: automate coverage, keep judgment human, and record both. A machine should screen every name and count every limit; a person should decide what a hit or a pattern means, and why.
Not legal advice: obligations differ by jurisdiction and licence. Confirm current requirements with your regulator or adviser.
What to automate, and what a person must decide
Every control in an AML/CTF programme has two halves: the part that must happen every time, and the part that needs judgment. Mixing them up is the most common design fault. Automating a decision hides it from scrutiny; leaving coverage to people means some transfers are never checked.
| Control | Automate | A person decides | In RemitSo |
|---|---|---|---|
| Identity | ID, selfie and live face check; document expiry checks | Overrides and rejections, with a reason | Checks inside the first transfer; a reviewer can override with the reason kept; expiry checked nightly |
| Due diligence | Asking for more documents as totals grow | Whether enhanced due diligence is satisfied | AML rules with tiers that name the documents asked for; enhanced due diligence on demand inside the customer's app |
| Sanctions | Screening every sender and recipient; re-screening when lists change | Whether a possible match is the listed person | 8 lists reloaded every night; everyone re-screened, staff included; nothing blocked by a match on its own; rulings kept per person |
| Monitoring | Scoring every transfer; holding the risky ones | Whether a pattern is suspicious | 47 ready-made risk indicators combined into your own rules; risky transfers wait for a person |
| Limits | Counting per transfer, over 90 days and over a year | Raising a customer's own limit | Limits per route and per app; only paid transfers count (since release 2026.10.11); every override recorded in the audit log |
| Reporting | Building reports from the transaction record and checking nothing was left out | Whether to file a SAR, and its narrative | SARs generated, managed and submitted from the console; AUSTRAC IFTI-E built in, checked against every in-scope transfer |
| Rule changes | Keeping the history of every change | Whether a change is right | AML rule changes reviewed before saving and kept as history, with who made them and why |
| Oversight | Counting what is waiting | What to clear first | Compliance Dashboard, granted part by part; Scout's compliance figures match it |
The right-hand column is what RemitSo, a white label remittance platform, provides. Your team still writes the policy, tunes the rules, forms the suspicion and files with the regulator.
When a corridor's risk changes overnight
A framework proves itself when something changes. Suppose FATF adds one of your payout countries to its list of jurisdictions under increased monitoring. FATF updates these lists three times a year, so this will happen to most operators sooner or later. The corridor carries about a tenth of your transfers. Here is what a well-run programme does in the following week. The thresholds are illustrative.
| Day | Action | Owner | Evidence |
|---|---|---|---|
| 1 | Update the business-wide risk assessment: the corridor's inherent risk moves from medium to high | MLRO | Dated revision with reasoning |
| 1 | Check the country now counts as high-risk in the platform, so identity documents, payment details or sign-in IPs from it fire the indicator | Compliance analyst | The high-risk country list and who changed it |
| 2 | Tighten the AML rule for the corridor: proof of address from 1,500 instead of 3,000 over 90 days; source of funds from 10,000 instead of 50,000 | MLRO approves; analyst edits | The rule change, reviewed before saving, kept in history |
| 2 | Add a risk rule: a transfer to the corridor from a customer less than 30 days old, combined with frequent transfers to the same recipient, waits for review | Compliance analyst | Rule history |
| 3 to 5 | Review customers already sending to the corridor above the new tiers; ask for documents through the app | KYC team | Requests and KYC decisions |
| 5 | Brief front-line and payout staff on the change and the typologies that matter for the corridor | MLRO | Training record and sign-off |
| 30 | Look back: how many transfers were held, how many cleared, any reports filed. Tune if most holds clear for the same reason | MLRO | Review note for the compliance committee |
On day 2, a customer who has sent 2,200 to the corridor in the last 90 days is asked for proof of address on their next transfer, where last week they would not have been. The rule applies at once, and the customer's limit card shows the limits that actually apply. That is the programme working: one decision by the MLRO, applied to every transfer by the platform, with a record of both.
The three lines of defence in a mid-sized MTO
The three-lines model does not disappear in a business of 20 or 150 people. It compresses. What matters is that every control has an owner and that nobody audits their own decisions.
| Line | Who | Owns |
|---|---|---|
| First | Onboarding, customer service, payout desks, agents | Due diligence at the point of contact; spotting and escalating unusual behaviour |
| Second | MLRO and compliance team | Policy, risk assessment, monitoring rules, screening rulings, SAR decisions, testing first-line controls |
| Third | Internal audit or an external reviewer | Independent assurance that the first two lines work, reported to the board |
The most common failure is one person running all three lines while also handling customer escalations. They cannot review their own decisions independently. If budget is tight, an external reviewer engaged once a year is the usual minimum. Roles on the platform should mirror this split: on RemitSo, roles decide who sees each page and uses each button, and staff sign in with two-step sign-in. Our guide to the three lines of defence for MTOs goes further.
A risk assessment that drives the rules
FATF Recommendation 1 requires a risk-based approach, and it reaches operators through national law: the Bank Secrecy Act in the US, the Money Laundering Regulations 2017 in the UK, the Proceeds of Crime (Money Laundering) and Terrorist Financing Act in Canada, and the AML/CTF Act in Australia. Each expects a documented risk assessment, not one held in someone's head.
The business-wide risk assessment sets out inherent risk by customer type, corridor, product and channel, the controls against each, and the residual risk left. FATF's guidance for money or value transfer services is the reference text. Assess each corridor on its own, not only each country: volume, average size and sender profile can differ sharply between two corridors into the same country. Review the assessment whenever the business or the threat changes, as in the worked example above.
The assessment is only useful if it shows up in the rules. Each high-risk rating should map to something you can point to: a lower document tier, an extra risk rule, a shorter review cycle.
KYC tiers that match risk
| Tier | Typical customer | What you collect |
|---|---|---|
| Simplified | Low value, low-risk corridors, where your rules allow it | Name and one government ID |
| Standard | Most retail senders | Full name, date of birth, address, photo ID; source of funds as totals grow |
| Enhanced | PEPs, high-risk corridors, high-value or unusual activity | Standard plus source of wealth, purpose of the relationship and senior approval |
FATF Recommendation 12 calls for enhanced measures for foreign PEPs, and for domestic PEPs where the relationship is higher risk, extending to family members and close associates. Write down the events that send a customer back for review whatever their schedule: a sharp rise in volume, a new purpose, adverse media, a sanctions list change. On RemitSo, enhanced due diligence is asked for only when required, and withdrawing a KYC approval or an expired document sends dependent transfers back to ask for a replacement instead of failing at the payout partner days later.
Monitoring that is tuned, and screening that is calibrated
An examiner tests whether monitoring detects what matters on your corridors, not whether a tool exists. A threshold borrowed from a bank will either bury analysts in false positives or let real activity through. If 800 alerts a month are closed within a day with no escalation, the rules are too loose. If a book of high-risk corridors has produced no reports in 18 months, they may be too tight, or not built around the typologies those corridors actually see. Document who receives an alert, how fast it is reviewed, when it goes to the MLRO, and what is kept when it closes. See our guides to transaction monitoring rules and working an AML case from alert to SAR.
Sanctions are different in kind. Transacting with a designated party can be a violation even without knowledge. Most operators screen against OFAC, the UN Consolidated List, the EU financial sanctions list and the UK Sanctions List (the single UK list since 28 January 2026), plus DFAT in Australia and Canada's consolidated autonomous list where licensed. Name matching must catch transliterations and spelling variants, so calibrate it on your own customer names and record the rationale. RemitSo screens against 8 lists, including all of these, reloaded every night, and keeps possible and confirmed matches apart.
Suspicious activity reporting by jurisdiction
| Country | Report and recipient | Deadline | Threshold |
|---|---|---|---|
| United States | SAR to FinCEN | 30 calendar days from initial detection | $2,000 or more for MSBs |
| United Kingdom | SAR to the NCA | As soon as practicable; a DAML request before proceeding with a suspect transaction | None: suspicion-based |
| Canada | STR to FINTRAC | As soon as practicable after the measures that establish reasonable grounds to suspect | None: suspicion-based |
| Australia | SMR to AUSTRAC | 3 business days after forming the suspicion; 24 hours for terrorism financing | None: suspicion-based |
Quality matters as much as timing. "Customer made several large transactions" gives an investigator nothing. Dates, amounts, the stated purpose, the gap between purpose and behaviour, and the indicators that fired give them something to use. Do not tell the customer a report has been or may be made.
Training and governance an examiner can see
FINTRAC and AUSTRAC both describe training as ongoing, set by role and risk. AUSTRAC gives every 6 to 12 months as an example interval for compliance officers and senior management. Training should be specific to your corridors, and the board should understand its own obligations and the few figures that show programme health: alert volumes, reports filed, findings open.
Examiners will ask for compliance committee minutes, board reports and proof that audit findings were tracked to closure. On RemitSo, the staff training programme is an optional add-on: assign, remind, sign off, with nobody signing off their own training and signed records kept. Every staff member can see and complete their own training.
Doing it with RemitSo
RemitSo keeps identity checks, sanctions screening, risk rules, limits, suspicious activity reports, regulator reporting and the Compliance Dashboard in one admin panel, so the framework above runs on one set of records. Records an examiner will ask for are there: screening and KYC decisions, AML rule history, login sessions and a searchable, plain-language audit log of who changed what, and when. RemitSo is ISO 27001:2022 and ISO 9001:2015 certified. See the admin features or book a demo.
Sources
- The FATF Recommendations (Recommendations 1, 10 to 12, 14 and 16) and FATF Guidance for a Risk-Based Approach for Money or Value Transfer Services
- 31 CFR 1022.320, Reports by money services businesses of suspicious transactions
- National Crime Agency, Suspicious Activity Reports
- FINTRAC, Reporting suspicious transactions to FINTRAC and FINTRAC, Compliance program requirements
- AUSTRAC, Suspicious matter reports and AUSTRAC, AML/CTF training
- GOV.UK, The UK Sanctions List; DFAT, Consolidated List; Government of Canada, Consolidated Canadian Autonomous Sanctions List
Checked October 2026. Regulations change; confirm current requirements with the regulator or your adviser.
Frequently asked questions
What is compliance risk for a money transfer operator?
The risk that the business fails its AML/CTF, sanctions, due diligence, reporting or record-keeping obligations, leading to enforcement, penalties or loss of licence. It usually comes from weak controls rather than deliberate wrongdoing, which is why it is largely within management's control.
Which compliance decisions should never be automated?
Whether activity is suspicious, whether a sanctions hit is the listed person, whether enhanced due diligence is satisfied, and whether to raise a customer's limit. The platform should surface and hold; a named person should decide and record why.
How is sanctions compliance different from AML?
AML is risk-based: you detect and report suspicious activity. Sanctions are a prohibition: you must not deal with designated parties, and a violation can occur without knowledge. Most programmes run them as separate, parallel workstreams.
How often should we review our risk assessment?
Whenever the business or the threat changes, such as a new corridor, a new product or a FATF list update, and at least on the cycle your policy sets. Each review should show up as a change to your rules or a recorded decision that none was needed.
What does RemitSo do, and what does our team still do?
RemitSo screens, scores, counts limits, holds risky transfers, keeps the records and builds reports. Your team writes the policy, tunes the rules, rules on hits, forms suspicion and files with the regulator.