AML Transaction Monitoring AI: SAR Writing, Alert Triage, KYC, and OFAC Screening with Claude

Claude for AML, BSA, and Financial Crime Professionals

BSA officers and AML analysts spend a disproportionate amount of their time on documentation rather than investigation. Writing a SAR narrative takes 2–4 hours for a case that took 20 minutes to identify as suspicious. OFAC screening generates hundreds of false positives that each need a documented clearance analysis — the same analysis, written out slightly differently, case after case. KYC files for complex entities require assembling ownership maps and risk rationales from scratch every time. None of this requires judgment. It requires structured writing.

That's where Claude helps. ClaudeFinanceLab's AML & RegTech templates encode the professional standards (FinCEN's 5W SAR format, the BO collection rules under the CDD Rule, the OFAC match quality analysis framework) so Claude produces compliant documentation instead of generic summaries. The investigative judgment stays with the analyst. The writing doesn't have to.

SAR Narrative Writing

FinCEN's own research has found that SAR narratives are frequently inadequate — missing key transaction details, lacking the typology analysis, or written so vaguely that law enforcement can't act on them. The 5W format (who, what, when, where, why suspicious) isn't complicated, but under time pressure and caseload pressure, analysts produce the minimum. Claude follows the structure precisely and produces the full narrative from the facts you provide. The analyst verifies the facts; Claude handles the writing.

• "SAR narrative for structuring: Customer XYZ LLC (business checking account, customer since 2019) made the following cash deposits over 7 days: March 3 $9,800, March 4 $9,500, March 5 $9,700, March 7 $9,400, March 8 $9,900, March 10 $9,600, March 11 $9,850. Total: $67,750. No CTR was filed as each deposit was below $10,000. Customer is a landscaping company with expected cash deposits of $2,000–$5,000/week. When queried by the branch manager, the owner said he 'didn't want to fill out paperwork.' Write a complete SAR narrative following FinCEN 5W format: who, what, when, where, why suspicious. Include the structuring analysis."
• "SAR narrative for business email compromise: Customer ABC Corp received wire transfer instructions via email purporting to be from their CFO directing a $185,000 wire to an account at a bank in Hong Kong. The wire was executed by an AP clerk before the instructions could be verified. Subsequently, the customer's actual CFO denied sending the instructions — the email was a spoof. The Hong Kong account received the funds and was immediately emptied. Write the SAR narrative covering: (1) the fraud typology (BEC), (2) the sequence of events with specific dates and amounts, (3) the red flags, (4) investigation steps taken, (5) law enforcement contact."
• "SAR narrative for structuring + layering (complex): Individual customer deposited $48,000 in cash over 6 weeks in amounts averaging $7,800. Funds were immediately transferred to three different cryptocurrency exchanges (Coinbase, Kraken, Binance) in equal thirds. Customer is stated occupation: food truck operator, expected cash volume $3,000–$5,000/week. Crypto conversions were to Bitcoin and then transferred to an unhosted wallet. Write the SAR covering both the structuring element and the layering through crypto."

KYC and Customer Due Diligence

Simple KYC is fast. The challenge is the complex entity — a multi-layer LLC structure where the managing member is another LLC owned by a Cayman company whose UBO is a Liechtenstein foundation. Tracing that to the 25% beneficial owner threshold, determining what enhanced due diligence is required, and assembling the complete file takes hours. Claude maps the ownership structure, identifies the EDD triggers, and drafts the risk-rated CDD summary.

• "KYC file assembly for a complex business entity: Customer: Westbrook Holdings LLC. Managing Member: Sunrise Capital Management LLC (another LLC). Sunrise Capital is owned 60% by John Davis (DOB 1965, US citizen) and 40% by Clearview International Ltd (a Cayman Islands company). Clearview is owned by a Liechtenstein foundation whose beneficiaries are not disclosed. Map the ownership structure. Which individuals reach the 25% beneficial owner threshold? What additional due diligence is required for the Cayman/Liechtenstein structure? Is this a high-risk structure requiring EDD?"
• "Risk rating for a new commercial customer: Landscaping company, cash-intensive, annual revenue $2.4M. Owner is a naturalized US citizen born in Mexico. Business operates in a border state (Texas). Prior adverse media: owner was named (not charged) in a 2019 local news story about a labor contractor dispute. No OFAC matches. No prior SAR history. Apply the risk rating matrix: score geography risk, business type risk, product risk, customer risk, adverse media factor. Produce the overall risk rating and list all EDD triggers."
• "CDD refresh analysis: Existing customer — money services business (check casher/remittances), annual transaction volume has grown from $800K to $3.2M since onboarding 3 years ago. No KYC refresh done. New FinCEN guidance on MSBs requires enhanced scrutiny for high-volume remittances to Mexico, Guatemala, El Salvador. List all the documents and information that need to be collected in the CDD refresh. Draft the outreach email to the customer requesting the information."

OFAC Sanctions Screening

OFAC screening is a high-volume, high-stakes false positive problem. Common names — Mohammed, Hassan, Li, Garcia — hit the SDN list constantly, and every hit requires a documented disposition. The legal risk runs both ways: blocking a transaction without proper analysis exposes the bank to liability for wrongful denial, and missing a true hit exposes it to OFAC enforcement. Claude structures the match quality analysis — name similarity, DOB, nationality, address, entity type — and produces the written disposition rationale that the compliance file requires.

• "OFAC false positive analysis: Our screening system flagged 'Mohammed Al-Hassan' (wire recipient, DOB unknown, UAE address) against an SDN entry for 'Mohammed Ali Hassan' (Iranian national, DOB 1962, Tehran Iran). Compare: Name similarity: partial (first and middle name transposed). DOB: no match (we have no DOB for our customer). Nationality: UAE vs Iran — different. Address: UAE vs Iran — different. Is this a false positive? Document the analysis following OFAC compliance guidance and state the disposition: CLEAR / ESCALATE."
• "OFAC true hit analysis: Our customer 'Sinaloa Export Services LLC' is flagged against an OFAC SDNTK designation (Specially Designated Narcotics Trafficker) for 'Sinaloa Exportaciones SA de CV' (a Mexican entity). Both are in the same sector (import/export). Same geographic origin (Sinaloa, Mexico). Our customer was opened 2 years ago. OFAC designation date: 18 months ago. Our customer's account shows $2.4M in cross-border wire transfers to Mexico in the past 18 months. Document: (1) the match analysis, (2) whether this is a true hit, (3) blocking requirement (must block and file report within 10 business days if true hit), (4) required reporting to OFAC."

Transaction Monitoring Alert Triage

False positive rates of 90–95% are common in transaction monitoring. That means L1 analysts are clearing nine false alarms for every real alert — and each clearance requires a documented rationale. The typology analysis (is this structuring or just a coincidence of amounts? is this a funnel account or a business with multiple cash customers?) is the core judgment call, but the documentation takes as long as the analysis. Claude handles the documentation once you've made the call.

• "Alert triage: Transaction monitoring alert — Rule 'Structuring Indicator' triggered on account 12345 (ABC Restaurant LLC). Transactions: six ACH debits to 'US FOODS' between $8,200 and $9,600 over 10 days totaling $51,400. Customer profile: Full-service restaurant, expected payment size $8,000–$15,000 to food distributors, monthly basis. Is this structuring? What is the difference between legitimate recurring vendor payments and structuring? What additional information do I need to make the disposition? Write the investigation report if this is a false positive."
• "High-priority alert triage: Customer (auto dealer, sole proprietor) received 12 cash deposits totaling $95,000 in 30 days from 8 different individuals. Amounts range from $5,000 to $12,000. Customer explanation: 'customers are paying car deposits in cash.' Auto dealers do receive cash deposits — but what are the red flags here? Apply the 'funnel account' typology: multiple individuals depositing cash that is then consolidated. Draft the Level 2 investigation report with a SAR recommendation."

Regulatory Exam Management

A BSA/AML exam is one of the most high-stakes events a compliance team faces, and the preparation is logistically complex — tracking 30+ document requests, ensuring every file meets the examiner's expectations, and coordinating across multiple departments. Claude helps structure the tracking, identifies the gaps that tend to cause exam failures, and drafts management responses to findings in the format examiners expect: root cause, corrective action, timeline, validation method.

• "BSA exam preparation: Our bank is undergoing a federal BSA/AML examination next month. The examiners have provided a pre-exam document request list. Key items: BSA/AML Policy (current, board-approved), Risk Assessment (latest), SAR filing log (12 months), CTR filing log (12 months), training completion records, OFAC screening procedures, and sample of 20 customer files across risk tiers. Organize these requests into a tracking table with: document name, owner, due date, status (not started/in progress/complete), and location. Identify any gaps — which documents typically cause exam failures?"
• "Draft a management response to an examiner finding: Finding: The bank's Customer Due Diligence procedures do not require collection of beneficial ownership information for all legal entity customers in compliance with FinCEN's CDD Rule (31 CFR 1010.230). Specifically, sole proprietorships were exempted from the CDD rule in the bank's procedures, but this is incorrect — sole proprietorships are not legal entities and are exempt from the BO collection requirement, but the procedures were poorly written and created confusion. Write the management response: root cause, corrective action plan with timeline, and validation method."

Where to Start

The AML & RegTech category has seven templates. For most BSA officers, the SAR Narrative Writer delivers the most immediate time savings — start there. If OFAC alert volume is your biggest pain point, load the OFAC Sanctions Screening analyzer next. For teams going into an exam, the Regulatory Exam Management template is built specifically for that preparation process. Copy any template into Claude's Projects system prompt; no installation required, works directly in Claude.ai.