What Does a Good AML File Note Actually Look Like?

“Reviewed. Satisfactory.” “SOF checked.” “Client explained discrepancy. All okay.”  Technically, these are file notes. But if someone else opened that file six months from now, would they have any idea what you actually considered, what information you relied on or why you reached your decision? Probably not.

Now that Tranche 2 is well underway, businesses are getting more comfortable with completing Customer Due Diligence (CDD), assessing risk and undertaking Enhanced Customer Due Diligence (ECDD). But one part of the process can easily be overlooked (and cannot be outsourced to any software): documenting the thinking that sits behind those actions.

AUSTRAC requires your CDD records to demonstrate not only what information you collected and how it was verified, but also the analysis and decision-making that explains why the level of CDD was applied. And this is where a good AML file note becomes incredibly valuable.

What should your AML file notes actually do?

A simple test is to write your file note for the person who wasn't in the room.  Simply by reading your file note, that hypothetical person should be able to understand:

• What happened
• What information or evidence you considered
• What that information told you
• What you decided
• Why you reached that decision

Don’t mistake this for needing to write an essay every time you interact with a customer.  Routine processes may require little or no additional narrative beyond the records your systems already create. But when something unusual occurs, you exercise professional judgement or additional due diligence is undertaken, documenting that reasoning is key.

Let’s consider a poor file note vs good file note

Imagine you’re a conveyancer acting for a purchaser whose funds are coming from overseas.  A poor file note might say:

“Overseas funds queried. SOF provided and satisfactory.”

The problem isn't necessarily the conclusion. This is a judgement call you need to make, but it’s the fact that there's nothing showing how you reached that particular conclusion.

Compare that with:

“Customer advised $280,000 of purchase funds are proceeds from the sale of an investment property in Singapore. Requested evidence of Source of Funds due to overseas origin. Customer provided settlement documentation showing the property sale and bank statement showing receipt of corresponding proceeds. Name and transaction details are consistent with information provided by customer. Satisfied that the information reasonably supports the customer's explanation of the Source of Funds.”

Now we have context around the source of funds.  Someone reviewing that file at any point in the future can understand the issue, the enquiries undertaken, the evidence considered and why the person making the decision was satisfied.

Document the thinking, not just the documents

This is where businesses can confuse evidence and document collection with good record keeping.  Imagine a file containing five bank statements, a company extract, and a property sale contract.  Without context, anyone looking at this information in the future would have to reverse-engineer why those documents were collected.

A short, considered file note can connect those pieces together.  This is particularly important where you've exercised professional judgement. The documents demonstrate what you had available to you and the file note demonstrates what you did with that information.  A good note doesn't need to record every thought that crossed your mind, but it should capture the material facts and reasoning that led to the decision.

What about unusual activity that doesn't result in an SMR?

We’ve said it before and we’ll say it again: not everything unusual is suspicious.  AUSTRAC specifically acknowledges that unusual transactions and behaviours may have very legitimate explanations. It is up to the individual business to consider the circumstances and determine whether further action is necessary.

Imagine a long-standing accounting client unexpectedly asks for assistance establishing several new companies.  A poor file note might say:

“Checked. No SMR required.”

A more useful note could say:

“Customer requested establishment of three new companies, which differed from services historically provided and was reviewed as unusual activity. Customer advised entities are being established to separate three new business divisions following expansion of existing operations. Reviewed proposed structure and existing business information. Explanation is consistent with customer's known business activities and no indicators of suspicious activity identified. On information currently available, no reasonable grounds for suspicion identified. No SMR submitted.”

AUSTRAC says that where an initial assessment finds no reasonable grounds for suspicion, a business may choose to make a written record of its reasoning. That record can help if further unusual activity occurs later and can demonstrate that customer behaviour is being monitored.

So, while every slightly unusual interaction doesn't necessarily need a lengthy formal assessment, where something has caused you to stop, investigate and make a judgement call, recording your reasoning can be extremely valuable.

What should an ECDD file note include?

Documentation becomes even more important when Enhanced Customer Due Diligence is required.  A useful ECDD note should connect four things:

The risk identified → The ECDD that was applied → The information considered → The conclusion reached.

For example:

“Customer assessed as high ML/TF risk due to complex ownership structure and connection with a higher-risk jurisdiction. ECDD undertaken, with additional beneficial ownership information obtained and corporate records reviewed to establish ownership and control. Source of Wealth information also requested. Customer advised wealth was primarily accumulated through ownership and subsequent sale of their business, which is supported by sale documentation and financial information provided. Information reviewed was consistent with customer's explanation. Risk remains high due to identified jurisdictional factors and structure. Comfortable to continue subject to ongoing monitoring.”

Notice in this case that the customer's risk hasn't magically become “low”.  That's not the purpose of ECDD.  AUSTRAC says ECDD measures should be targeted to the customer's particular risks, proportionate to the level of risk and effective at managing and mitigating it. AUSTRAC also specifically requires businesses to document ECDD measures, including the circumstances that triggered ECDD, why particular measures were applied, additional information collected, verification undertaken and relevant resulting decisions. The file note helps demonstrate that connection.

A few practical rules for better AML file notes

Your file notes should ideally be made at the time of the review or as soon as practicable afterwards. Include the date and identify the person who made the assessment or decision.  Keep the language factual. “Client seemed dodgy” tells that hypothetical future person very little and introduces a subjective judgement.  Instead, “Client was asked twice to explain the origin of the funds and provided different explanations on each occasion” records the behaviour that caused concern.

Similarly, distinguish between what the customer told you and what you independently established.  “Customer owns several investment properties” isn't the same as “Customer advised they own several investment properties.”  If you subsequently verify that information, record how.

And avoid hindsight. Your file note should reflect the information available and the decision made at the time.

Your file should tell the story

Good AML record keeping is about leaving a clear trail.  If someone from your Compliance Officer to an independent reviewer picked up the file tomorrow, next month, or next year, they shouldn't have to guess why documents were requested, why ECDD was undertaken or why unusual behaviour didn't ultimately result in an SMR.  The file should tell them the story.

easyAML brings your customer information, risk assessments, CDD and ECDD, supporting documentation and compliance decisions together, helping you maintain the context behind your decisions rather than leaving that information scattered across emails, documents and separate systems.

Because six months from now, you probably won't remember exactly why you made that call either, so make sure your file does.  

Ready to make AML compliance easier to manage? Get started with easyAML for free today.