A fintech AML analyst is the person at a fintech, or at the middleware platform behind it, who reviews transaction monitoring alerts, works identity-verification and due diligence exceptions, screens for sanctions and refers unusual activity. In a banking-as-a-service program that work is done on accounts held at a sponsor bank and often for people who are the bank's customers under its customer identification program, so the analyst is effectively running part of the bank's BSA/AML program. The bank cannot hand off the result: it decides and files every SAR, and it answers to its examiners for the identification and monitoring the partner's analysts perform. Botminds' BaaS Compliance is built for the bank's side of that arrangement: agents re-perform a sample of the partner's work with the bank's own sources, check each referral for timeliness and completeness, and keep the partner from ever learning what the bank decided.
The examples follow a fictional sample bank, Tessaly Community Bank, its 11 partner programs and the people who oversee them; every name and figure in those examples is sample data. Rules and statistics come from the regulators and the Bureau of Labor Statistics.
Four seats around one fintech AML program, and what each keeps
Today
Works alerts and identity exceptions in the partner's tools, writes referrals to the bank, and answers the bank's requests for screenshots each quarter.
With agents
Sends complete referrals inside the agreed window, and sees failed files come back with the bank's evidence and a remediation item with a date.
Still theirs: the first review of every alert and onboarding exception, under the bank's procedures
Today
Requests account lists, picks 25 to 60 files in a spreadsheet, ticks a checklist, and emails the partner about every difference.
With agents
Opens a partner program already re-performed and tied out, agrees or disagrees with each failure with a reason, and submits a drafted, cited finding.
Still theirs: agreeing with each failure and submitting findings; never approving them
Today
Tracks partner findings in a spreadsheet and files change notices without a control review.
With agents
Concurs on findings, sets owners and dates, changes a partner's tier, and sees overdue items escalate on their own.
Still theirs: the program agreement, tiers and remediation
Today
Signs off findings that rest on what the partner reported, and decides SARs on referrals of uneven quality.
With agents
Approves findings and restrictions from a ladder, sees every override and its reason, and decides SARs with the bank's investigators.
Still theirs: every SAR decision and every restriction on a partner
What does a fintech AML analyst do?
A fintech AML analyst reviews the activity and the onboarding that the fintech's systems flag, decides what is unusual, and documents the outcome. The work usually falls into five queues: transaction monitoring alerts on the fintech's scenarios; identity-verification failures and manual reviews at onboarding; enhanced due diligence on customers the program rates high risk; sanctions screening hits; and referrals of unusual activity to the sponsor bank. Where the fintech is itself a money services business, such as a money transmitter, the analyst may also prepare the fintech's own SARs.
The role sits inside a large occupation. The Bureau of Labor Statistics counts compliance officers as a single category, with no BaaS breakdown, so the figures below describe the field the role draws from, not fintech AML analysts as such.
The occupation fintech AML analysts belong to
383,620
compliance officers employed in the US, May 2023
$80,190
mean annual wage for compliance officers, all industries
14,050
compliance officers in credit intermediation (banks and similar lenders)
$82,310
their mean annual wage
What makes the fintech version of the job distinctive is not the queues but the principal. The analyst's employer is the fintech; the customer whose account they are reviewing may be the bank's; and the program whose procedures they follow is, legally, the bank's. A good fintech analyst knows all three and works accordingly.
Who is responsible for AML at a fintech partner bank?
The sponsor bank is. The agencies' 2024 request for information put it without hedging: "Contractual accountability for different aspects of the end-user relationship may be allocated among the parties to a bank-fintech arrangement. However, banks remain responsible for compliance with applicable law" (89 FR 61577). The July 2024 joint statement names the specific functions a partner may perform for the bank, suspicious activity monitoring and reporting, CIP, CDD and sanctions screening, and keeps the responsibility with the bank whether the functions are shared or not (joint statement).
The fintech has its own obligations too, where it is a regulated entity. A money services business must keep "an effective anti-money laundering program" of its own, with a designated compliance person (31 CFR 1022.210). Those duties sit alongside the bank's; they do not replace them. What a sponsor bank's BSA program must reach lays out the bank's side in full.
Can a bank rely on a fintech for CIP?
Usually not in the formal sense. The CIP rule lets a bank rely on another institution's identification work only where "such reliance is reasonable," the other institution "is subject to a rule implementing 31 U.S.C. 5318(h) and is regulated by a Federal functional regulator," and it contracts to "certify annually to the bank that it has implemented its anti-money laundering program" (31 CFR 1020.220(a)(6)). Most fintech apps and middleware platforms are not regulated by a federal functional regulator, so the safe harbour is not available.
What happens instead is agency: the fintech's analysts run the bank's CIP as the bank's agent. That is lawful, and it means the bank must be able to show the CIP was followed. In practice that means the raw identity response for each account, not the fintech's pass rate, and a sample the bank re-performs itself.
BaaS Compliance re-performs the partner's checks on one end-customer file
Who files the SAR in a BaaS program, and can a fintech file one for the bank?
The sponsor bank files the SAR on its own obligation when activity through its accounts meets the rule: a transaction of $5,000 or more that the bank knows, suspects or has reason to suspect involves illicit funds, is designed to evade the BSA, has no apparent lawful purpose or uses the bank to facilitate a crime, filed within 30 calendar days of initial detection, or 60 if no suspect is identified (31 CFR 1020.320). A fintech cannot file the bank's SAR for it. A fintech that is a money services business has its own reporting duty, with a $2,000 threshold (31 CFR 1022.320), and the rules allow institutions to share the underlying facts "for the preparation of a joint SAR."
The confidentiality rule then cuts across the partnership. Neither the bank nor any of its directors, officers, employees or agents may disclose a SAR, or anything that would show one exists (31 CFR 1020.320(e)). Two consequences follow. The bank must not tell the partner whether a referral became a SAR. And a fintech analyst working as the bank's agent is bound by the same rule if they learn of one.
The fintech analyst and the sponsor bank: who may do what with a suspicion
The fintech AML analyst: Works the partner's alerts and onboarding exceptions; notices the pattern.
The sponsor bank: Monitors its own FBO accounts and reviews the partner's monitoring.
The fintech AML analyst: Sends a referral with the facts, inside the agreement's window.
The sponsor bank: Checks the referral is complete and on time, and opens it for its investigators.
The fintech AML analyst: Does not decide the bank's SAR.
The sponsor bank: Investigators and the BSA Officer decide whether the bank files.
The fintech AML analyst: Files only the fintech's own SAR, if it has its own obligation.
The sponsor bank: Files the bank's SAR within 30 days of initial detection (60 with no suspect).
The fintech AML analyst: Hears only that the referral was received or reviewed.
The sponsor bank: Never reveals a SAR's existence to the partner or anyone involved.
Does a sponsor bank review fintech alerts?
It should review enough of them to know the partner's monitoring works, and the enforcement orders show regulators expect it. The Federal Reserve's 2024 order against Evolve Bank & Trust required "measures to ensure that alert dispositions are supported with adequate rationale and documentation to evidence the research performed and the due diligence that was relied upon to arrive at the analyst's conclusion" (Evolve order). The OCC's Blue Ridge order required written standards for disposing of each type of alert and documentation that supports each disposition, across partner accounts and sub-accounts (AA-ENF-2023-68).
Reviewing every partner alert is neither required nor practical for most banks. Reviewing a risk-based sample of closed alerts, against the partner's written rationale and the bank's own data, is both. A SAR lookback at a fintech partner sets out how to sample them and what a failed review means.
A referral, from the partner's alert to the bank's SAR
A referral is the hand-off between the two halves of the program, and its clock matters more than its format. The FFIEC manual says the bank's 30-day period starts only when a review has determined that the activity is suspicious (FFIEC BSA/AML Examination Manual), and the same manual expects that review within a reasonable time. A referral that sits at the partner for two weeks is two weeks the bank did not know it needed to look.
One referral in the sample bank's programs: the agreement's window and the bank's SAR clock
- Partner refers in 1 day
- Bank investigators review and decideReview
- SAR filed, if the bank decides to fileUp to 30 days
- Partner detects and holds9 days
- Bank investigators review and decideReview
- SAR filed, if the bank decides to fileUp to 30 days
Partner SAR referrals in BaaS Compliance, and exactly what the partner sees
What the bank must see of the partner's analysts
The bank must see enough of the partner's analysts' work to judge it, which is more than a monthly count of alerts closed. The 2023 interagency guidance asks banks, during due diligence, to evaluate "the qualifications and experience of a third party's principals and other key personnel," the partner's training "to ensure that its employees understand their duties and responsibilities," and its "processes for holding employees accountable for compliance with policies and procedures" (88 FR 37920). In ongoing monitoring, it adds changes in "key personnel involved in the activity."
What a sponsor bank should see of a partner's AML analysts
- Alert dispositions with their rationale
For a sample of closed alerts: the facts reviewed, the reason for closing, and the data relied on, as the Evolve order required.
- Onboarding exceptions and how they were cleared
Identity failures, manual reviews and overrides, with the evidence that cleared each one.
- Referral timeliness and completeness
Days from detection to referral against the agreement, and whether each referral carries what investigators need.
- Staffing against volume
Analysts, their training and their alert load as the program grows, and changes in the partner's compliance leadership.
- Quality checks the partner runs on itself
Its own second-line testing of analysts' work, and what it found.
- Release notes that touch the analysts' tools
Changes to scenarios, thresholds or onboarding logic before they go live.
In the sample bank, the bank's partner oversight analyst does not watch the partner's analysts work. She opens a program whose files have already been re-performed, sees which failed and why in plain words, and agrees or disagrees with each failure; a disagreement needs a reason code the BSA Officer will see. The neighbouring guide on the third-party risk manager's seat compares those bank roles in lending programs.
What is a fintech compliance officer?
A fintech compliance officer is the person accountable for the fintech's compliance program, including AML; at a money services business the rule requires a designated person "to assure day to day compliance" (31 CFR 1022.210). In a BaaS program that person is the bank's main counterparty on BSA matters: the owner of the partner's procedures, its analysts and the remediation items the bank assigns.
For the bank, the fintech compliance officer is not a substitute for its own BSA officer, who keeps the SAR decisions and the restrictions. In the sample bank, a named owner at the partner holds remediation items such as making the date-of-birth check mandatory and verifying the 212 accounts that missed it, each with a due date and a test that closes it; the bank's BSA Officer approved the finding and the restriction that produced them.
Questions people ask
Is a fintech AML analyst the same as a bank AML analyst?
The skills overlap; the position does not. A bank analyst works the bank's own alerts under its BSA officer, while a fintech analyst works the partner's alerts, often under procedures the bank wrote, and refers rather than decides. Only the bank's investigators and BSA officer decide the bank's SARs.
Does a fintech need its own AML program?
If it is a money services business, yes: 31 CFR 1022.210 requires a written, risk-based program with a compliance officer, training and independent review. If it acts only as the bank's agent or service provider, its AML work runs under the bank's program, which is why the bank tests it.
Can a sponsor bank tell a fintech that a SAR was filed?
No. The SAR rule bars a bank and its agents from disclosing a SAR or anything that would reveal one. In the sample bank, a partner's portal shows only "Referral received" or "Review complete," and the setting that controls it is locked off.
What certifications do fintech AML analysts hold?
Industry certifications exist, including fintech-focused ones, but no federal rule requires a particular credential for an analyst. What the 2023 interagency guidance asks a sponsor bank to assess is the partner's staffing, training, the qualifications of key personnel, and how it holds employees accountable.
Who pays for the sponsor bank's oversight of the fintech's analysts?
The program agreement decides; the 2023 guidance suggests contracts specify which party pays for "legal, audit, and examination fees" and for any additional monitoring of subcontractors. Our estimate of what the oversight work costs by hand is in BaaS risks, priced, and the method that reduces it is on the BaaS Compliance page.