There is one sentence that is sometimes said with pride by companies subject to anti-money laundering requirements – “We have never filed a suspicious transaction report.”

At first glance, it sounds great — no suspicious clients, no suspicious transactions, no problems.

For an MLRO, however, the absence of reports is not always a reason for satisfaction. It raises a much more uncomfortable question – is there really nothing to report — or are we simply not seeing it?

Zero by itself means nothing

There is no “correct” number of reports. A small business with a limited number of clients, a low-risk profile and a simple product may quite realistically have no grounds for reporting. Likewise, a company with many reports is not automatically an example of excellent compliance — quantity and quality are two different things.

The problem begins when zero is not the result of low risk, but of a system that is practically incapable of detecting suspicious behaviour.

“All our clients pass KYC”

Great. But successfully passing identification does not mean a “clean client”. It describes the moment when the business relationship is established — not everything that will happen afterwards.

Six months later, the same client may look completely different:

• A company with a declared business activity of “IT consulting” starts receiving dozens of payments from individuals in different countries.
• A client with an expected monthly turnover of EUR 20,000 suddenly processes EUR 400,000.
• A company that claims to operate only in the domestic market regularly sends funds to high-risk jurisdictions.
• A client receives funds and almost immediately transfers them to a third party without any obvious economic rationale.

None of these examples, on its own, proves money laundering. But each of them deserves at least one question – why?

If your system never asks that question, the problem is probably not with the clients.

The most dangerous AML control is the one everyone assumes is working

Imagine a company with internal rules, a risk assessment, a transaction monitoring system, sanctions screening, enhanced due diligence procedures, annual training and a designated MLRO. On paper — flawless.

Except that over the past three years there has not been a single internal report from an employee, not a single escalated transaction and not a single report to the competent authorities.

It is possible that the clients really are excellent. But something else is also possible:

• employees do not know what to look for;
• the monitoring scenarios are poorly configured;
• alerts are closed mechanically;
• the commercial team does not want to upset a valuable client;
• Compliance is seen as a function that is supposed to “approve”, rather than challenge.

Or perhaps the entire system has simply been designed to generate green ticks.

“Alert closed. Next.”

One of the biggest illusions in AML is that having a monitoring system means having effective monitoring. Software can generate hundreds of alerts — the real question is what we do with them.

A typical example – the system detects an unusual increase in turnover. The analyst opens the profile — the client has been with the company for two years, there is no negative media, there are no sanctions matches, the documents are valid. The alert is closed with the rationale – “Known client. Activity is not considered suspicious.”

Except that nobody checked why the turnover increased fivefold, nobody compared the transactions with the declared business model, nobody looked at the new counterparties, nobody requested supporting documents and nobody documented the economic rationale.

Technically, the alert was reviewed. In practice, almost nothing was done.

One of the most powerful AML tools costs EUR 0

It is called curiosity (professional scepticism).

A good analyst does not only check whether a transaction breaches a rule — they try to understand the story behind it. Where did the funds come from? Why were they sent? Why to this particular recipient? Does this correspond to the client’s activity? Why has the behaviour changed?

If there is a reasonable explanation — great, document it. If there is not — the analysis should continue.

AML is not simply about looking for criminals. AML is the ability to recognise behaviour that does not make sense in light of what you know about the client.

Friday, 16:47

The system generates an alert concerning one of the largest clients. There are several unusual transactions and Compliance/AML wants additional information. However, a major deal with this client is due on Monday and the commercial team insists that the issue be resolved quickly: “We have worked with them for years.” “We have never had a problem.” “We know the owner.”

And the MLRO suddenly faces a much more interesting question than whether the transaction matches a particular scenario – how independent is Compliance when independence starts costing money?

It is precisely in moments like these that you see whether an AML system works. Not when everything is easy, but when the right decision is uncomfortable.

Almost every organisation will tell you that its MLRO is independent. The more interesting question is – if your most profitable client became the subject of serious AML suspicion tomorrow, would you genuinely be prepared to terminate the relationship?

Sometimes companies simply do not want to report

There is another topic that is not discussed openly enough. Sometimes the suspicious transaction has been identified, the questions have been asked and internally there is a clear feeling that the case should be escalated. But then fear appears – what if the client finds out and leaves? What if the company’s reputation suffers? What if the report triggers an inspection?

This is dangerous logic. Reporting starts to be viewed not as part of risk management, but as a reputational threat. And sometimes the result is silence — not because there is no suspicion, but because nobody wants the consequences of formally acknowledging it.

The absence of a report does not remove the risk. It leaves it inside the company — with no trail, no decision and no explanation for later.

During a future inspection, the question may no longer be “Why did you file this report?”, but “Why didn’t you file it?”. And that is a much more difficult conversation.

And who actually reports?

The Bulgarian Measures Against Money Laundering Act defines a broad range of obliged entities — banks and other financial institutions, payment companies, insurers, accountants, lawyers, notaries, intermediaries and a number of other professions and businesses.

In practice, however, a substantial part of reporting is concentrated within a very small number of categories — around 5–6.

Is it really the case that there are simply no suspicious cases among all the others? Or is there another reason — that warning signs are not recognised, that it is unclear when suspicion should be escalated, that internal mechanisms exist only formally, or that fear of the consequences is stronger than the obligation?

Put more simply – criminals are unlikely to have read the Bulgarian AML Act and decided to work only with five or six categories of obliged entities…..

The decision not to report is still a decision

If you have reviewed a case and concluded that there are insufficient grounds for suspicion, that may be a perfectly legitimate outcome. But only if it is a decision, not an omission.

The difference can be seen in the file. A reasoned decision, made by a competent person, dated and supported by the information on which it is based, can be defended. An alert closed with a one-line rationale that nobody can explain six months later is something entirely different.

Document why you do not report with the same seriousness with which you would document why you do report.

Perhaps employees see the warning signs but do not report them

Ask ten employees what they should do if they notice suspicious activity:

• Do they know who to contact?
• Do they know how to submit an internal report and what it should contain?
• Do they know that they do not need to be certain that a crime has been committed in order to escalate a suspicion?
• Do they understand what happens next?

If people hesitate, you have a potential problem. An AML framework that exists only in the Compliance department’s folder is not a functioning AML framework.

“But we do AML training every year”

Great. What does it look like?

If it begins with “Money laundering is a process whereby funds of criminal origin…” and fifty minutes later ends with “Thank you for your attention”, you probably already know why nobody submits internal reports.

Employees should not simply know the definition — they should recognise the situation:

• A client insists that a payment be split into several smaller transactions.
• A new corporate client refuses to explain where the initial funding comes from.
• A long-standing client suddenly changes its transaction pattern completely.
• A client requests a payment to a third party with no apparent connection to the contract.

That is AML training. Not 47 slides of legal definitions copied from the law….

The other extreme is not the answer either

There are organisations that report almost everything: something looks strange — report it; the client did not answer in enough detail — report it; the system generates an alert — report it.

That is not a risk-based approach either. The MLRO is not a machine for forwarding reports — their role is to analyse and determine whether there are sufficient grounds for suspicion.

The goal should never be “this year we need more or fewer reports”. The goal is a system capable of identifying unusual activity, analysing it properly and escalating when necessary. Whether the result is 0, 3 or 300 reports depends on the business, clients, products, geographies and actual risk.

The question every company should ask itself

Instead of “How many reports have we filed?”, ask yourself:

If a genuinely suspicious transaction passed through our company tomorrow, how likely is our system to actually detect it?

Not the policy. Not the presentation. Not the software provider. The system as a whole:

• Will an alert be generated?
• Will the analyst recognise it and have enough information about the client?
• Will they ask the right questions and have the confidence to escalate?
• Will the MLRO receive all the information and be able to decide independently of commercial interests?
• Will the organisation hesitate to report because it fears for its reputation?

If the answer to any of these questions is “We are not sure”, that is far more important than the number of reports filed.

A simple test

Choose any employee and ask them: “If you notice something suspicious tomorrow, who will you report it to and how?”If they cannot answer immediately, without looking for the procedure and without asking a colleague, you have work to do.

Then look at a few real cases from the past year:

• Can your MLRO explain why a particular alert was closed six months ago?
• Can you see cases where commercial considerations influenced AML decisions?
• Are there employees or departments from which internal reports never come?
• What types of alerts are most often closed without additional information?
• Have you ever tested the framework with a realistic case instead of simply checking whether the policy is up to date?

And most importantly – do you know what your system is probably missing?

And most importantly – do you know what your system is probably missing?

“We have never had a problem” is a dangerous sentence

The absence of an identified problem does not prove the absence of a problem. Sometimes it means exactly that — the system works and the risk is low. Other times, it simply means that nobody has looked closely enough.

That is why “we have never had a problem” should not be the end of the conversation, but the beginning of the next question – What is this statement based on?

A good AML programme is not designed to prove that the company has no problems. It should be capable of detecting them. You can have excellent policies, the most expensive monitoring system and a perfectly organised file — but if nobody notices the unusual, nobody asks questions and people are afraid to report, all of that is simply very well-organised documentation.

So the next time someone says: “We have not had a single report in five years.”, perhaps the right answer is not “Great”, but “Interesting. Why?”

A low number of reports is neither good nor bad news in itself. The bad news is when nobody in the organisation can explain why it is low.

How Compliance Navi can help

If any of the questions above made you stop and think, the good news is that the answer rarely requires a new system costing thousands of euros. The problem is almost never a lack of documents — it is the gap between what those documents say and what actually happens on an ordinary Tuesday afternoon.

That gap is difficult to see from the inside. Not because people are not competent — they usually are, and often understand their own business better than any external consultant ever could. The reason is that when you work within the same system every day, it starts to feel natural. Decisions made two years ago are no longer revisited. Wording that everyone uses is no longer really read. Questions that nobody asks are no longer noticed as missing.

That is why sometimes the most useful thing is an independent, unburdened perspective. Someone who has no history with those clients, no interest in defending a previous decision and who can simply ask “why is this done this way?”, without the question sounding like criticism.

That is what we do. We look at the framework as it actually operates in practice — from client onboarding to the point of escalation — and tell you honestly what we see. If it works, we will say so. If there are areas that would be difficult to defend during an inspection, we will point them out while there is still time to put them in order. Everything else — indicators, risk assessments, internal rules, training, support for the MLRO when the uncomfortable moment comes — is shaped around what we find, rather than around a standard methodology.

Because the real question is not whether you have an AML framework. It is whether it works when you actually need it.

If you want to start with the simplest exercise and without us – imagine that tomorrow you receive a notice of inspection. Which three things would you start fixing that same afternoon? Almost everyone has an answer — and almost nobody has fixed them. The difference between a strong and a weak AML programme often comes down to exactly that – whether those three things are addressed before the letter arrives, or after it.

If you already know what those three things are…….