The flow catalogue

Escrow work moves between two companies and Wolf. Compliance work moves between lines of defence inside one firm, which is a different separation and a harder one to show. The same file passes from the person who noticed something, to the unit that investigates it, to the people who decide what to do about it, and in one place to a second reviewer whose only job is to check the first.

A supervisor does not audit the conclusion on its own. It audits who reached it, on what basis, and whether that person was also in a position to approve it. A firm that can produce a plausibility check but cannot show that the analyst who wrote it did not also sign it off has documented an opinion, not a control.

So the order is the substance. The first line analyses and comments; the AML Special Unit investigates, documents and recommends; Management decides; the Special Unit then executes what Management decided. No one of those acts stands in for another, and the workspace will not let one of them be skipped.

There is no authentication in the demo, and the seat is a hat rather than a login: the bar names the seat each step belongs to, and since the whole workspace belongs to the AML function there is nobody to hand it over to. What makes the separation real here is a refusal rather than a password. Set a hit to Plausible before a clarification carries a written result and the workspace declines and says what is missing. Confirm a screening disposition you recorded yourself and nothing is written to the file.

A hit is not an accusation. It is a transaction that met one of the policy’s own criteria: a value threshold breached, a jurisdiction on either FATF list, a politically exposed person involved, an unusual volume or frequency, a considerable change of pattern, cash introduced at onboarding, a transaction that is unusual or unexplained, or a transfer reaching CHF 5,000 with no permanent business relationship behind it. There are 8 such criteria, and each hit records which of them it triggered.

Thresholds are not one number for the whole book. They follow the customer’s risk category, which makes classification and monitoring the same mechanism seen from two ends: reclassify a customer upwards and the amount that trips the next transaction falls with it.

The first line writes what it checked, in its own words, against the hit. Only then can the AML Special Unit record that it has reviewed that analysis. The statuses on a hit are not free-text chips an officer sets at will: each one has prerequisites, and the workspace names the missing one rather than simply greying out a control.

Removing a status is always allowed, because a wrong entry has to be correctable. What is gated is claiming a conclusion the file does not yet support.

Escalation to the AML Special Unit creates a 902.14e special clarification against that transaction, sets the hit to Investigation, and applies the scoring-3 investigation criterion to the customer’s risk profile. That last part surprises people, and it is deliberate: the policy applies the criterion because an investigation was conducted, irrespective of its outcome. A clarification that ends in a clean explanation still leaves the customer classified as high risk while it ran, and the criterion is withdrawn as an act rather than lapsing quietly.

The form has three substantive parts, and they unlock in order.

Then the summary and the plausibility check. This is the field the template exists for: a written assessment of whether the explanation holds against what was collected. The result options stay locked until it has been written, because a conclusion with no reasoning behind it is precisely what an AMLA file may not contain. Source of funds documents attach to the comments on the clarification rather than to a separate library, so the evidence sits beside the sentence it supports.

Finally the result, which is where the file stops being an internal note and starts carrying a legal consequence. Each result names its own follow-up.

Where a clarification ends in suspicion, the AML Special Unit writes a recommendation and sends it to Management. The recommendation carries who made it and when. Management then records its decision and the reasoning behind it, under its own name and its own date. The Special Unit executes what was decided; it does not decide.

The asymmetry worth noticing is that a decision not to report is documented as carefully as a decision to report. Where the Company declines to exercise its right to notify in a matter involving significant assets, the reasoning goes on the AMLA file, because the absence of a report is the thing an examiner asks about later.

MROS accepts reports through goAML in XML, so the last step of flow 1 builds that file from the case record and shows it. The point of showing it is not the XML. It is which fields the platform can populate from what it already holds and which it cannot: anything the record cannot source is emitted as an explicit marker rather than a plausible-looking invention, and the file is checked for completeness before it is offered at all, because an incomplete report is worse than a late one.

Four items are open, and every one of them is a dependency on MROS or on a decision nobody has taken yet.

• Reporting entity identifiers issued by MROS on registration: the goAML organisation ID and the reporting person's user ID.
• The report-type code list version in force at filing, which MROS publishes and updates.
• Whether the filing is submitted through the goAML web portal or the machine-to-machine channel, which decides whether the file is uploaded by a person or transmitted by the platform.
• Attachment handling: goAML accepts supporting documents alongside the XML, and the retention copy in Switzerland must cover both.

There is no tunable model here and no percentage. A criterion assigns a weight of three or one, the total decides the category, and the category decides the measures. 7 criteria carry a weight of three and 5 carry a weight of one, and each names its basis in the ordinance, the VQF regulation or the firm’s own policy.

The flow applies a criterion with an evidence note and then withdraws it again, which is the quickest way to see that none of the four columns above is a field anybody typed. The score, the category, the monitoring intensity, the approval requirement and the review cycle are all recomputed from what is on the file, so withdrawing the criterion returns the profile to exactly where it started.

The criteria the policy chose not to use are recorded too, with the reason, because an auditor asks about those as readily as about the ones you applied.

Every involved person carries three screening outcomes, kept apart rather than averaged into one verdict: the international lists, the Swiss SECO list, and adverse media. Each has its own result, and the set carries the date it was last run, so a stale screen is visible as a stale screen.

A hit is disposed of in two acts. One reviewer records the disposition, false positive or true match, and it then waits. A second reviewer confirms it, and the engine refuses the confirmation where it comes from the same person: not by hiding the control, but by writing nothing when it is pressed. Recording a fresh disposition clears any confirmation already on the record, so a changed conclusion goes back through the second pair of eyes instead of inheriting the approval given to the old one.

The escrow lifecycle generates compliance work on its own: money arriving, parties changing, a payout about to leave. That work appears in this workspace, and it is not a copied queue. The compliance surface reads the escrow transactions directly, which is why lifting a hold here removes the block from the escrow record itself, readiness is recalculated on the escrow side, and the clients stop seeing a review status. Putting the hold back does the same in reverse. The secured amount never moves in either direction, and nothing is released automatically at any point.

Each case names the duty it discharges rather than presenting an undifferentiated list of alerts.

The VQF 902.8 client list is not a spreadsheet kept beside the system. Its columns are fields on the customer record: the reference number of the AMLA file, the customer or its internal designation, the acquisition date, the exit date and the comments. Adding a comment on the list and recording an exit are edits to the file, which is why both appear immediately and why the list and the file cannot disagree.

The list keeps closed relationships as well as open ones, and relationships that were refused before they ever opened, because the point of the document is the history rather than the current book.

• Nothing is transmitted. No report reaches MROS or SECO from this demo. The goAML file is built from the record so that it can be read, and the fields the platform cannot source are marked as such.
• There is no authentication. The seat is a hat the bar names. The four-eyes rule on a screening disposition is enforced against the actor recorded with the command, which is the right shape but not a substitute for an identity provider.
• Every flow reseeds the whole workspace when it starts. The AML side is one workspace rather than one transaction, so a second run would otherwise begin on a file the first run had already changed, and the opening steps would read as satisfied before anybody had done anything.