1Tell me about yourself.

Keep it around a minute and make it relevant — your background, what drew you to financial crime compliance, any training completed, and what you are looking for. Finish on why you are in this interview rather than trailing off.

2Why do you want to work in AML?

Give a reason rooted in the work — the investigative element, the fact that decisions matter, the role it plays in stopping serious crime. Avoid "there are lots of jobs in it", which tells the interviewer nothing about you.

3You have no AML experience. Why should we hire you?

Answer it head-on, then evidence transferable strengths — analytical thinking, working to procedure, written clarity, persistence with detail — each with a concrete example. Then reference your training. Do not apologise for the gap; explain what you bring instead.

4What does an AML analyst do day to day?

Reviews alerts generated by monitoring systems, investigates whether transactions have a legitimate explanation, researches customers and counterparties, documents findings, and escalates cases that warrant reporting. Say it in your own words.

5What is the difference between an AML analyst and a KYC analyst?

KYC focuses on who the customer is — onboarding, documents, due diligence. AML focuses on what they do — monitoring transactions, investigating alerts, reporting suspicion. They are related but distinct roles.

6What do you know about our company?

Research it beforehand — what they do, where they operate, and something recent. Failing this question is one of the most common and avoidable entry-level mistakes.

7How did you prepare for this interview?

Be specific about training completed, topics studied and practice done. Effort is visible in the detail of the answer.

8Where do you see yourself in three years?

Show progression within financial crime — senior analyst, investigator, or specialising in a discipline such as sanctions. Framing the role as a stepping stone out of compliance weakens your case.

9This work can be repetitive. How do you feel about that?

Acknowledge it honestly and explain your method for staying accurate — consistent process, treating each alert as new, taking breaks between complex cases. Complacency is the real risk in this role.

10What is your greatest weakness?

Name a genuine one with what you are doing about it. Self-awareness scores; the rehearsed "I am a perfectionist" does not.

11What training or certification have you completed?

Name it and say what you can actually apply from it. Being able to describe an investigation workflow you practised is worth more than the certificate itself.

12How do you handle feedback?

Say you expect it at entry level and give an example of feedback you acted on. Quality assurance reviews are routine in AML, so someone defensive about correction is a poor fit.

13Are you comfortable with targets and deadlines?

Yes, with the caveat that quality cannot be sacrificed to hit them. That balance is exactly what a good answer shows — closing alerts fast but wrongly is worse than being slightly behind.

14What are your salary expectations?

Research the entry-level band for that market and give a realistic range. Showing you have researched sensibly matters more than negotiating hard at this stage.

15What is money laundering?

The process of disguising the origins of money obtained through crime so it can be used as though legitimate. It turns proceeds of crime into apparently lawful assets.

16What is a predicate offence?

The underlying crime that generates the illicit funds — fraud, drug trafficking, corruption, tax evasion, theft. Laundering is what happens to the proceeds afterwards.

17What are the three stages of money laundering?

Placement, where illicit funds enter the financial system; layering, where transactions obscure their origin; and integration, where the funds re-enter the economy as apparently legitimate wealth.

18Which stage is easiest to detect and why?

Placement, because it is where illicit cash first touches the regulated system and triggers controls such as cash reporting and KYC checks. Once money reaches layering it becomes much harder to trace.

19Give an example of placement.

Depositing criminal cash into a bank account, often broken into smaller amounts, or mixing it with the takings of a cash-intensive business such as a restaurant or car wash.

20Give an example of layering.

Moving funds through multiple accounts, shell companies or countries, converting between currencies or assets, so the audit trail back to the original crime is broken.

21Give an example of integration.

Buying property, luxury assets or a business with the laundered funds, so the criminal can hold and spend them openly as legitimate wealth.

22Does money laundering always start with cash?

No. Proceeds may already sit in a bank account — for example fraud proceeds — or be held in cryptocurrency. The three-stage model still applies without physical cash.

23What is terrorist financing?

Providing funds for terrorist activity. It differs from laundering because the money may be lawfully earned and the amounts are often small — the concern is the intended use, not the origin.

24Why is terrorist financing harder to detect?

Because value-based rules are less effective when the sums are small and the source is legitimate. Detection relies more on context, connections and destination than on transaction size.

25What is structuring?

Breaking a large sum into multiple smaller transactions to stay below reporting or detection thresholds. Also called smurfing when spread across several people.

26What is a shell company?

A company with no genuine operations or employees. Shells have legitimate uses but are commonly used to obscure ownership and move funds during layering.

27What is a money mule?

Someone who receives funds into their account and forwards them on behalf of others, often recruited online and sometimes unaware they are committing an offence.

28What is trade-based money laundering?

Moving value through trade by misrepresenting price, quantity or quality — over- or under-invoicing, phantom shipments, or invoicing the same goods multiple times.

29Why is real estate attractive for laundering?

It absorbs large sums in a single transaction, holds value, and can be held through corporate structures that obscure the true owner.

30How is cryptocurrency used in laundering?

Mainly at the layering stage — moving funds through exchanges, mixers and cross-chain transfers to break traceability. Regulated exchanges now apply KYC and monitoring similar to banks.

31What is a cash-intensive business and why does it matter?

A business legitimately handling large volumes of cash, such as restaurants, car washes or convenience stores. It matters because illicit cash can be mixed with genuine takings and appear as normal revenue.

32What harm does money laundering cause?

It allows serious crime to remain profitable — drug trafficking, corruption, human trafficking, fraud. It also distorts markets, undermines legitimate business and erodes trust in the financial system.

33What is the role of a financial institution in preventing it?

To know its customers, monitor activity, detect and report suspicion, and refuse to facilitate transactions it cannot justify. Banks act as gatekeepers to the financial system.

34What is a financial intelligence unit?

The national body that receives suspicious activity reports, analyses them alongside other intelligence, and refers cases to law enforcement where warranted.

35What is AML?

Anti-money laundering — the laws, regulations and internal controls designed to prevent, detect and report money laundering and terrorist financing.

36What is FATF?

The Financial Action Task Force — the international standard-setter for AML and counter-terrorist financing. It issues the Recommendations, evaluates countries and maintains the grey and black lists.

37What is the FATF grey list?

A list of jurisdictions under increased monitoring that have committed to addressing identified deficiencies. Dealings involving them attract greater scrutiny.

38What is the FATF black list?

High-risk jurisdictions subject to a call for action, carrying far stronger measures including enhanced due diligence and in some cases countermeasures.

39Who regulates AML in this country?

Know the answer for the market you are applying in — for example the FCA in the UK, FINTRAC in Canada, MAS in Singapore, FinCEN in the US. Naming the wrong regulator is a poor look.

40What is the risk-based approach?

Applying AML controls in proportion to risk rather than treating all customers identically — greater scrutiny where risk is higher. It is the principle underpinning FATF standards.

41What is CDD?

Customer Due Diligence — identifying and verifying the customer, identifying beneficial owners, understanding the purpose of the relationship, and monitoring on an ongoing basis.

42What is EDD?

Enhanced Due Diligence — deeper checks for higher-risk customers, including source of wealth and source of funds verification, senior management approval and closer monitoring.

43What is a PEP?

A politically exposed person — someone holding or having held a prominent public function. It indicates higher corruption risk and triggers enhanced measures; it is not an accusation.

44What are sanctions?

Restrictive measures imposed by governments or international bodies against countries, entities or individuals, including asset freezes and prohibitions on dealing with designated parties.

45What is the MLRO?

The Money Laundering Reporting Officer — the designated person who decides whether to file suspicious activity reports and acts as the point of contact for the financial intelligence unit.

46What are the three lines of defence?

The business owning risk day to day; compliance and risk providing oversight and challenge; and internal audit providing independent assurance.

47What are the consequences of AML failures for a bank?

Regulatory fines, business restrictions, remediation orders and monitorships, reputational damage, and in serious cases personal liability for individuals.

48How long must AML records be kept?

Retention periods are set by local law, commonly five years from the transaction or the end of the relationship, sometimes longer where an investigation is open.

49What is a red flag?

An indicator that activity may be linked to financial crime. A red flag is a prompt to investigate, not proof of wrongdoing.

50Give some common AML red flags.

Transactions inconsistent with the customer's profile, structuring below thresholds, rapid movement of funds with no purpose, links to high-risk jurisdictions, reluctance to provide information, and unexplained third-party funding.

51What is a pass-through account?

An account where funds arrive and leave almost immediately with little balance retained, suggesting it is being used to move value rather than hold it.

52Why are round-sum transactions a flag?

Genuine commercial payments usually reflect invoices, taxes or negotiated amounts and rarely land on exact round figures repeatedly. Consistent round sums suggest the amount was chosen rather than earned.

53What would concern you about a customer's cash deposits?

Amounts inconsistent with their stated income or business, deposits just below reporting thresholds, deposits at multiple branches, or cash volumes that do not match the sector's normal pattern.

54Why is reluctance to provide information a red flag?

Because legitimate customers usually understand that regulated firms must ask. Persistent evasion about ownership, source of funds or purpose is itself informative.

55What is a high-risk jurisdiction?

A country with weak AML controls, on FATF's lists, subject to sanctions, or associated with high corruption. Transactions involving them warrant additional scrutiny.

56Is a transfer to a high-risk country automatically suspicious?

No. Context matters — if the customer has genuine family or business connections there, it may be entirely normal. It raises risk rather than establishing suspicion.

57What red flags apply to a corporate customer?

Complex or opaque ownership, no apparent business rationale for the structure, transactions unrelated to the stated business, frequent changes to directors or ownership, and a registered address shared with many unrelated companies.

58What is a nominee and why does it matter?

Someone holding an asset or position on behalf of another, concealing the true owner. It matters because it is a standard way of keeping a real controller's name off documentation.

59What would suggest an account is being used by a money mule?

Credits from multiple unrelated senders followed by rapid withdrawal or onward transfer, activity inconsistent with the account holder's age or income, and a dormant account suddenly becoming active.

60What are common fraud-related red flags?

Sudden changes to payment instructions, urgency and pressure to bypass checks, payments to newly created accounts, and account activity that does not match the customer's usual behaviour.

61What red flags suggest sanctions evasion?

Routing through third countries with no commercial logic, vague payment references, intermediaries with no clear role, and counterparties in jurisdictions bordering sanctioned states.

62What are corruption-related red flags?

Payments to officials or their relatives from companies holding public contracts, consultancy fees with no evidence of services, and wealth inconsistent with a known public salary.

63Does one red flag mean you file a report?

No. A red flag prompts investigation. You look for a legitimate explanation consistent with what is known about the customer, and only escalate if the activity remains unexplained.

64How do you learn about new typologies?

FATF typology reports, national FIU publications, regulator enforcement notices and internal training. Enforcement cases are especially useful because they show real failures.

65What is transaction monitoring?

Ongoing review of customer transactions to identify activity that may indicate financial crime, comparing actual behaviour against what is expected for that customer.

66How does monitoring relate to KYC?

KYC establishes what is expected; monitoring tests what actually happens. Weak KYC makes monitoring far less effective because there is no reliable baseline.

67What is an alert?

A flag raised by the monitoring system when transaction data matches a defined risk pattern. It requires human review to determine whether there is a genuine concern.

68What is a rule or scenario?

Coded logic describing a pattern the system looks for — for example cash deposits above a threshold within a set period. When the data satisfies it, an alert is generated.

69What is a threshold?

The value or frequency at which a rule triggers. Set too low, teams are overwhelmed by false positives; set too high, genuine risk is missed.

70What is a false positive?

An alert generated by legitimate activity that superficially matches a risk pattern. They are unavoidable and resolving them is a large part of daily work.

71What is a false negative and why is it worse?

Genuinely suspicious activity the system fails to flag. It is worse because nobody reviews it — false positives cost time, false negatives cost enforcement action.

72How would you investigate an alert?

Understand why it triggered, review the customer profile to establish what is expected, examine the transactions and counterparties, look for a legitimate explanation, check related history, then document a conclusion to close or escalate.

73What do you look at first?

The customer profile. Without knowing what is normal for that customer, you cannot judge whether the alerted activity is unusual.

74How do you decide to close or escalate?

If the activity has a plausible explanation consistent with the profile and I can document it, I close. If it does not, or the explanation cannot be verified, I escalate. The standard is reasonable suspicion, not proof.

75What makes a good case note?

Clear reasoning another reviewer could follow without redoing the work — what triggered the alert, what was reviewed, what was found, and why you reached your conclusion.

76What is real-time versus post-event monitoring?

Real-time screens a payment before it is processed, allowing it to be stopped — typically for sanctions. Post-event reviews transactions afterwards, usually overnight, for behavioural patterns.

77What is a SAR?

A Suspicious Activity Report — a confidential report filed with the national financial intelligence unit where there is reasonable suspicion of financial crime.

78What is an STR?

A Suspicious Transaction Report — the same concept, used in many jurisdictions instead of SAR. The purpose is identical.

79What is the threshold for filing?

Reasonable suspicion. You do not need proof or certainty — only a reasonable basis to suspect the activity may involve illicit funds or purposes.

80Who decides whether to file?

The MLRO or nominated officer. Analysts escalate with documented reasoning; the MLRO makes the decision and files.

81What is tipping off?

Telling the subject, directly or indirectly, that a report has been made or is being considered. It is a criminal offence in most jurisdictions.

82A customer asks why their payment is delayed during an investigation. What do you say?

Follow the firm's approved wording — typically a reference to standard internal checks — and give no indication that a report exists or is being considered. Improvising here risks tipping off.

83What goes into an escalation?

Who is involved, what happened, why it is suspicious, and supporting detail such as dates, amounts, counterparties and jurisdictions. The reasoning matters most.

84What happens after a report is filed?

It goes to the financial intelligence unit, which analyses it alongside other intelligence and decides whether to refer it to law enforcement. The firm usually receives no feedback.

85Is the customer relationship always ended after a report?

No. Exit is a separate decision, and in some cases authorities prefer the relationship to continue so activity can be observed. It is decided at senior level.

86Why is confidentiality so important?

Because disclosure could allow suspects to move funds or destroy evidence, and could expose the firm and individuals to criminal liability.

87What would you do if you suspected a colleague was ignoring suspicious activity?

Raise it through the proper channel — my manager, compliance, or whistleblowing procedures. The obligation sits with the institution, and staying silent could expose both the firm and me.

88Can you discuss cases with friends or family?

No. Customer information is confidential and disclosing it breaches both data protection rules and, potentially, tipping-off provisions.

89A customer receives many small deposits from different people, then withdraws the total in cash. What do you think?

The pattern looks like structuring and possible money mule activity — multiple unrelated senders, amounts kept small, rapid cash extraction. I would review the account history and counterparties, check the customer's profile and income, and escalate with my findings documented.

90A shop's cash deposits double suddenly. Is that suspicious?

Not necessarily — there may be a legitimate reason such as a new location, seasonal trade or extended hours. I would look for evidence of a genuine change and compare cash against card takings. Cash rising sharply while card revenue stays flat is what would concern me.

91You are unsure whether an alert should be escalated. What do you do?

Escalate, or at minimum ask my supervisor. At entry level nobody expects certainty, and the cost of asking is far lower than the cost of closing something that should have been reported.

92Your manager tells you to close an alert you think is suspicious. What do you do?

Explain my reasoning and the evidence, and ask them to reconsider. If they still disagree, I would accept the decision but ensure my view is documented. Escalation routes exist for genuine concerns.

93You have 30 alerts and can only finish 20 today. What do you do?

Prioritise by risk and value rather than order of arrival, complete those properly, and tell my supervisor about the backlog. Rushing all 30 badly is worse than completing 20 well and flagging the gap.

94You recognise a customer as someone you know personally. What do you do?

Declare the conflict immediately and hand the case to a colleague. Reviewing it myself would compromise the decision regardless of my actual objectivity.

95You realise you closed an alert incorrectly last week. What do you do?

Report it straight away so it can be reopened. Concealing an error turns a correctable mistake into an integrity issue, and teams are judged on how errors are handled rather than on never making them.

96What do you find most interesting about AML?

Answer genuinely — many cite the investigative work of piecing together what money is actually doing, or the fact that the work connects to serious real-world crime. Specificity is more convincing than enthusiasm.

97What will you find hardest about this role?

Give an honest answer with a plan — for example the volume of terminology and systems, and how you intend to build your own notes. Claiming nothing will be hard sounds naive.

98How do you stay motivated in detailed work?

Connect it to the outcome — each alert is a genuine check on whether crime is passing through the system — and rely on process rather than mood to stay consistent.

99When can you start?

Give your real availability including any notice period. Do not promise something you cannot deliver.

100Do you have any questions for us?

Always have two or three. Good ones: what a typical day looks like, how new joiners are trained, which monitoring system the team uses, how quality is reviewed, and what progression looks like after the first year.