Skip to main content

AML Compliance Officer Playbook

Turn Typology Reports Into Detection Scenarios

The six core typologies, their key risk indicators, and the review cadence that keeps your library a compliance asset, not a liability.

Your rules have gaps you cannot see

Most programs lack documented detection indicators for each core typology, so transaction monitoring rules drift out of alignment with the schemes they are supposed to catch. FinCEN advisories and FATF publications describe emerging methods, but translating them into detection scenarios, training content, and risk indicators your team can actually use is where programs fall short.

A typology library that was current three years ago is not a compliance asset; it is a liability waiting to surface during your next exam.

Get instant access

Instant access to the full 20-page playbook. Enter your details and the PDF lands in your inbox.

What is inside

The six core typologies with documented key risk indicators for each
The three stages, placement, layering, integration, and the controls each demands
Embezzlement and insider risk indicators: alert overrides, SAR suppression, sole-contact relationships
The formal review cadence: quarterly advisories, annual rule audits, event-driven updates
How to review alert closure rates by analyst, not just overall system performance

What changes once you have read it

Close the gaps in your monitoring rules

Map each core typology to documented detection indicators so your rules match the schemes they are meant to catch.

Calibrate controls to each laundering stage

Tune structuring detection for placement, beneficial ownership checks for layering, and connect the dots before integration makes funds look clean.

Surface insider-enabled laundering

Embed override, SAR-suppression, and sole-contact indicators into employee monitoring, and review alert closures by analyst rather than overall system performance.

Keep the library current by design

Run a formal cadence tied to new advisories, annual rule audits, and sector enforcement actions, so nothing goes stale between exams.

Why this playbook

The whole program connected end to end

Risk assessment, typologies, sanctions, fraud, training, and exams sit in one operating logic instead of isolated chapters.

Concrete, tunable parameters

CTR aggregation logic, 30 to 50 percent velocity alerts, sub-$10,000 structuring windows, 10-business-day OFAC reports, and SAR deadlines you can apply.

Written from the personal-liability perspective

What makes documented escalation and active remediation defensible for the officer accountable for the program.

Current as of November 2026

Reflects the OFAC ten-year recordkeeping extension and the move toward unified fraud and AML case platforms.

Grounded in primary sources

Every claim traces to named regulation and examiner guidance, not generalities.

Cites 31 CFR Chapter X, 18 U.S.C. §§ 1956 and 1957, and 31 CFR Part 501
References the FFIEC BSA/AML Examination Manual as the examiner procedure source
Grounded in the FinCEN CDD Rule (May 11, 2018) and the five BSA program pillars
References FATF Recommendations 3, 18, and 32 throughout
Specific parameters: $10,000 CTR threshold, 10-business-day OFAC blocked property reports, 30/60-day SAR deadlines, OFAC ten-year recordkeeping extended March 12, 2025
Names the examining bodies: OCC, FDIC, Federal Reserve, NCUA, and the FCA in the UK

Frequently asked questions

Typologies lead, but the playbook connects them to risk assessment, cash and courier oversight, sanctions screening, fraud and mule coordination, training, and exam readiness across eight chapters, each closing with key takeaways.

Build a typology library that survives the next exam

Instant access to the full 20-page playbook.