AML Interview Questions

Quick answer

AML interviews test whether you understand how money laundering works, how banks know their customers, how suspicious activity is spotted and reported, and whether you can explain a decision clearly in writing. Most interviews for KYC analyst, transaction monitoring analyst and AML analyst roles start with basics (what AML, KYC and an STR are), move to the three stages of money laundering, KYC, CDD and EDD, then test Indian rules such as PMLA, FIU-IND and RBI's KYC Directions, and finish with an alert or case scenario and HR questions. The 70 questions below cover every round with model answers you can put into your own words.

Key takeaways

1. How AML interviews work in 2026

Short answer: Expect a screening call, one or two technical rounds on AML and KYC concepts, often a scenario or written case exercise, and an HR round, with Excel or a short assessment at some employers.

AML stands for anti-money laundering: the laws, controls and checks that stop criminals from making illegal money look legal. AML roles carry many titles: KYC analyst, CDD or EDD analyst, transaction monitoring analyst, sanctions screening analyst, AML investigator and quality analyst. To see what each role does day to day, read our guide to the AML analyst role.

The interview pattern is similar across banks, global capability centres (GCCs, the India offices of global banks), Big Four firms and BPO/KPO compliance teams. First, a recruiter checks your background, communication and shift flexibility. Second, a team lead asks concept questions on AML, KYC and monitoring. Third, a senior analyst or manager gives you a scenario, such as an alert or a customer file, and asks what you would do. Some employers add an English writing test or an Excel task. Last, HR checks fit, notice period and salary expectations.

If you need the basics first (what money laundering is, the stages in brief, and how PMLA, FIU-IND and RBI fit together), read our pillar guide on anti-money laundering. Then come back to these questions.

A simple answer formula works for almost every technical question:

This guide is for interview preparation and education, not legal advice. For any real case, check the current Act, rules and RBI notifications, or ask a lawyer.

2. Which questions to focus on: freshers, KYC analysts and experienced candidates

Short answer: Freshers should master the basics, stages, KYC and HR questions first; KYC analysts should go deeper on due diligence and beneficial ownership; and monitoring or investigation candidates should focus on alerts, STRs and scenarios.

You do not need all 70 answers on day one. Start with the set that matches your profile.

The questions also lean in different directions depending on the process you are hired for. Treat this as a general pattern, not a promise of what any one company asks:

3. AML basics (Q1 to Q10)

Short answer: These questions check that you understand the language of AML: what money laundering is, why banks fight it, and the core terms you will use every day.

Q1. What is money laundering?

Money laundering is the process of making money earned from crime look like it came from a legal source. Criminals do it so they can spend or invest the money without drawing attention. In India, section 3 of the Prevention of Money-laundering Act, 2002 (PMLA, official text checked October 2026) treats any process or activity connected with proceeds of crime, such as concealing, possessing, acquiring, using or projecting it as untainted property, as money laundering. A simple example is a fraudster pushing stolen money through many accounts and then buying property with it.

Q2. What is AML and why do banks need it?

AML means anti-money laundering: the laws, policies, systems and checks that prevent, detect and report money laundering. Banks need it for three reasons. First, the law requires it: under PMLA, banks are reporting entities with duties to verify customers, keep records and report to FIU-IND. Second, it protects the bank from fines and reputational damage. Third, it protects society by making crime, fraud and terrorist financing harder. As an analyst, you are one of the people who make these controls work in practice.

Q3. What is the difference between AML and KYC?

KYC (Know Your Customer) is the process of identifying and verifying a customer and understanding who they are. AML is the wider framework that includes KYC plus transaction monitoring, sanctions screening, investigations, record keeping and reporting. Think of KYC as the front door: it decides who gets in and what is normal for them. AML continues for the whole relationship, watching whether the customer's activity still matches that profile. KYC is one part of AML, not a separate subject.

Q4. What is CFT and how is it different from AML?

CFT means combating the financing of terrorism. Money laundering cleans dirty money. Terrorist financing often uses clean money, such as small donations or business income, to fund violence. So the direction is different: laundering hides where money came from, while terrorist financing hides where money is going. Banks handle both with the same tools, including KYC, sanctions screening and monitoring, and FIU-IND's definition of a suspicious transaction includes transactions that may involve terrorist financing.

Q5. What is a reporting entity under PMLA?

A reporting entity is an organisation that has AML duties under PMLA. FIU-IND's FAQs (October 2026) define it as a banking company, financial institution, intermediary, or a person carrying on a designated business or profession. Banks, NBFCs, insurance companies and stockbrokers are common examples. Each reporting entity must keep records, verify customers, report prescribed transactions to FIU-IND, and name a Designated Director and a Principal Officer. As an analyst, you work inside a reporting entity and support these duties.

Q6. Who is a Principal Officer and who is a Designated Director?

The Principal Officer is the senior official responsible for reporting to FIU-IND, including filing STRs and making sure reports are complete and on time. The Designated Director is the director the reporting entity names to make sure the whole organisation complies with its PMLA obligations. Every reporting entity must tell FIU-IND who holds both roles. In interviews, the key point is that analysts escalate cases upward and the Principal Officer's team takes the final reporting decision.

Q7. What is a red flag in AML?

A red flag is a sign that a customer or transaction may be linked to money laundering or other crime. It is a reason to look closer, not proof of guilt. Common red flags include cash deposits just below a reporting threshold, sudden large activity in a dormant account, funds moving in and out on the same day, transactions with no business purpose, reluctance to share documents, and links to high-risk places. FIU-IND issues sector-specific red flag indicators to reporting entities.

Q8. What is a risk-based approach?

A risk-based approach means spending more effort where the risk is higher and less where it is lower, instead of treating every customer the same. RBI's KYC Directions require banks to categorise customers as low, medium or high risk and to apply stronger checks to higher-risk customers. For example, a salaried customer with a simple savings account gets standard checks, while a customer with large cross-border flows and a complex business gets enhanced due diligence and closer monitoring.

Q9. What is a predicate offence or scheduled offence?

A predicate offence is the original crime that produced the dirty money, such as fraud, corruption, drug trafficking or tax evasion. Under PMLA, these are called scheduled offences because they are listed in the Schedule to the Act. The Schedule has Part A (offences under the Indian Penal Code and other listed Acts), Part B (a Customs Act offence) and Part C (offences with cross-border implications). Money laundering under PMLA is always linked to proceeds of a scheduled offence.

Q10. What are L1, L2 and L3 in AML operations?

L1, L2 and L3 are levels of review in an AML team. L1 analysts do the first review: they look at an alert or file, check basic facts and close clear false positives or escalate. L2 analysts or investigators do a deeper review of escalated cases, research the customer, write narratives and recommend whether to file an STR. L3 is usually a senior reviewer, quality team or compliance officer who approves decisions and handles complex cases. Exact names vary by employer.

4. Stages of money laundering and typologies (Q11 to Q17)

Short answer: Interviewers want you to explain placement, layering and integration with simple examples, and to recognise common methods (typologies) such as structuring, mule accounts and trade-based laundering.

A typology is a known pattern or method criminals use to launder money. Our detailed guide to the stages of money laundering is a good companion to this section.

Q11. What are the three stages of money laundering?

The three stages are placement, layering and integration. UNODC describes placement as moving funds away from direct association with the crime, layering as disguising the trail to foil pursuit, and integration as making the money available to the criminal from what seem to be legitimate sources (UNODC, October 2026). UNODC also notes that real cases may skip, combine or repeat stages. Mention that point in interviews, because it shows you know the model is a simplification.

Q12. Can you give an example of each stage?

Here is a fictional example. Placement: a person deposits cash from illegal betting into several accounts in small amounts. Layering: the money moves quickly through many accounts, some in other people's names, and is partly sent abroad as fake payments for services. Integration: the money comes back as a "loan" from an overseas company and is used to buy a flat and a car. Each stage has controls: KYC and cash reports at placement, monitoring at layering, and source-of-funds checks at integration.

Q13. What is structuring or smurfing?

Structuring means breaking a large amount into smaller transactions to avoid a reporting threshold or attract less attention. Smurfing is structuring done through many people, called smurfs, who each make small deposits. In India, cash transactions above ₹10 lakh must be reported in a cash transaction report, and FIU-IND's FAQs say integrally connected cash transactions below ₹10 lakh each but above ₹10 lakh in total within a month must also be reported. So splitting cash does not escape reporting, and the pattern itself is a red flag.

Q14. What is a money mule account?

A money mule is a person whose bank account is used to receive and pass on criminal money, often fraud or cyber-fraud proceeds. Some mules are paid for "renting" their account, some are tricked with fake job offers, and some open accounts with stolen identities. Red flags include a new or low-activity account suddenly receiving many credits from unrelated people and sending the money out within hours. Mule accounts are a common source of transaction monitoring alerts in Indian banks today.

Q15. What is trade-based money laundering?

Trade-based money laundering (TBML) uses trade transactions to move value across borders while hiding its illegal origin. Common methods include over-invoicing or under-invoicing goods, invoicing the same shipment more than once, misdescribing goods, and fake shipments that never happen. In a fictional example, a company pays ₹1 crore for goods worth ₹20 lakh, quietly moving the difference abroad. Red flags include prices far from market value, unusual routes, and goods that do not fit the customer's business.

Q16. How are shell companies used in money laundering?

A shell company is a company with little or no real business, staff or assets. Launderers use shell companies to hide who owns the money, to create fake invoices and loans, and to add layers between the crime and the final beneficiary. That is why beneficial ownership checks matter so much in corporate KYC. Red flags include many companies at the same address, nominee directors, circular payments between related companies, and turnover that does not match the company's visible activity.

Q17. What is hawala and why is it a risk?

Hawala is an informal money transfer system where value moves through a network of brokers based on trust, often without money crossing borders through banks. A person pays cash to a broker in one city and a partner broker pays the receiver in another city or country, settling later. It is a risk because there is little or no paper trail, it sits outside regulated channels, and it can hide both laundering and terrorist financing. In bank data, hawala may show up as unexplained cash deposits and payments to many unrelated parties.

5. KYC, CDD and EDD (Q18 to Q26)

Short answer: These questions are the core of every KYC interview: the difference between CDD, EDD and SDD, risk categories, beneficial ownership, PEPs, periodic updation, V-CIP and CKYCR, all as per RBI's KYC Directions.

For commercial banks, the current rule is the Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025, dated 28 November 2025, with the RBI page showing it updated as on 1 October 2026 (RBI, October 2026). It replaced the earlier Master Direction on KYC, 2016, for commercial banks. Other entities such as NBFCs and co-operative banks have their own KYC Directions, so in interviews say "RBI's KYC Directions" when speaking generally. Our customer due diligence guide walks through the full process step by step.

Q18. What is CDD?

CDD means customer due diligence. RBI's KYC Directions 2025 define it as identifying and verifying the customer and the beneficial owner using reliable and independent sources of identification. In practice, CDD covers collecting identity and address documents, understanding the purpose of the account and the nature of the customer's business, and checking ownership for non-individual customers. Banks do CDD when opening an account and for occasional transactions of ₹50,000 or more, single or connected, under the 2025 Directions.

Q19. What is the difference between CDD, EDD and SDD?

CDD is the standard level of checks for normal customers. EDD, or enhanced due diligence, means extra checks for higher-risk customers, such as source of funds and wealth, senior management approval and closer monitoring. SDD, or simplified due diligence, means lighter checks for specific lower-risk cases allowed by the rules. RBI's 2025 Directions have separate sections for enhanced and simplified due diligence. In an interview, give an example of each: a salaried saver (CDD), a PEP (EDD) and a low-risk category the rules permit (SDD).

Q20. When is EDD required?

EDD is required whenever the customer's risk is higher than normal. Under RBI's KYC Directions, examples include politically exposed persons (PEPs) and customers onboarded through non-face-to-face digital channels, who are treated as high risk and monitored more closely until verified face to face or by V-CIP. Section 12AA of PMLA is also titled "Enhanced due diligence". In practice, banks also apply EDD to customers with complex ownership, high-risk business types, large cross-border flows or adverse media.

Q21. How are customers risk-categorised, and how often is KYC updated?

RBI's KYC Directions require banks to categorise customers as low, medium or high risk, based on factors such as identity, social and financial status, nature of business, location, products and channels. Periodic KYC updation under the 2025 Directions must happen at least once every 2 years for high-risk customers, once every 8 years for medium-risk customers and once every 10 years for low-risk customers, counted from account opening or the last KYC update (RBI, October 2026). Risk ratings should also change when the customer's behaviour changes.

Q22. What is a beneficial owner, and what are the thresholds in India?

A beneficial owner is the natural person who ultimately owns or controls a customer, even if the account is in a company's or trust's name. Under RBI's 2025 Directions, for a company it is a person holding more than 10 percent of shares, capital or profits, or exercising control such as the right to appoint most directors. For a partnership, it is more than 10 percent of capital or profits. For an unincorporated association or body of individuals, it is more than 15 percent. If no such person is found, the senior managing official is identified.

Q23. Who is a PEP and how do banks handle PEP accounts?

A PEP, or politically exposed person, is someone who is or has been entrusted with a prominent public function. RBI's KYC Directions describe PEPs as individuals entrusted with prominent public functions by a foreign country, such as heads of state or government, senior politicians, senior government, judicial or military officers, senior executives of state-owned corporations and important political party officials. Banks may open PEP accounts only with risk systems to identify PEPs, reasonable steps to establish source of funds and wealth, and senior management approval. These rules extend to family members and close associates.

Q24. What is V-CIP?

V-CIP means Video based Customer Identification Process. Under RBI's KYC Directions, it is an alternative way to identify a customer where an authorised bank official identifies the customer with facial recognition and completes CDD through a seamless, secure, live, informed-consent audio-visual interaction. In simple words, it is a live video KYC call, not a recorded video. In interviews about video KYC, mention that the customer must consent, the interaction must be live, and the official must be authorised by the bank.

Q25. What is CKYCR and the KYC Identifier?

CKYCR is the Central KYC Records Registry, the entity under the PML Rules that receives, stores, safeguards and retrieves customers' KYC records in digital form. The KYC Identifier is the unique number CKYCR gives a customer. According to FIU-IND's Annual Report 2024-25 (October 2026), a rules amendment notified on 19 July 2024 (G.S.R. 419(E)) requires reporting entities to fetch KYC records from CKYCR using the KYC Identifier instead of asking customers to submit documents again, with some exceptions. This saves time for customers and banks.

Q26. What is source of funds versus source of wealth?

Source of funds is where the money for a particular transaction or account comes from, for example salary, a property sale or a business payment. Source of wealth is how the customer built their total wealth over time, for example years of business profits, inheritance or investments. EDD often needs both. For a PEP buying a large property, you would check the source of the payment (source of funds) and whether their overall wealth fits their known income and history (source of wealth).

6. Indian law: PMLA, FIU-IND and RBI (Q27 to Q34)

Short answer: Indian interviewers often ask about PMLA, the reports filed with FIU-IND, their timelines, and record-keeping rules. Know the key numbers and what they mean for daily work.

Our PMLA Act guide covers the law section by section. The figures below come from the official PMLA text and FIU-IND's FAQs, checked in October 2026. Laws and rules change, so always check the current Act and notifications, or a lawyer, before relying on any point for a real case.

Q27. What is PMLA and when did it come into force?

PMLA is the Prevention of Money-laundering Act, 2002, India's main anti-money laundering law. The official PMLA text shows it as Act No. 15 of 2003, dated 17 January 2003, and FIU-IND records that it came into force on 1 July 2005 (October 2026). It defines the offence of money laundering, sets punishment, allows attachment and confiscation of proceeds of crime, and places duties on reporting entities such as banks to verify customers, keep records and report to FIU-IND.

Q28. What is the punishment for money laundering under PMLA?

Under section 4 of PMLA, money laundering is punishable with rigorous imprisonment of at least 3 years, which can extend to 7 years, plus a fine. Where the proceeds relate to offences under the NDPS Act (narcotics), listed in paragraph 2 of Part A of the Schedule, the maximum rises to 10 years. Section 3 defines the offence itself, and its Explanation, added in 2019, says laundering continues as long as a person keeps enjoying the proceeds of crime.

Q29. What is FIU-IND and what does it do?

FIU-IND, the Financial Intelligence Unit – India, is the central national agency that receives, processes, analyses and disseminates information on suspect financial transactions. According to FIU-IND's own website (October 2026), it works under the Ministry of Finance and reports to the Economic Intelligence Council headed by the Finance Minister. Reporting entities send it reports such as STRs, CTRs, NTRs, cross-border wire transfer reports, immovable property reports and counterfeit currency reports. FIU-IND analyses them and shares intelligence with enforcement and intelligence agencies. It became a member of the Egmont Group of FIUs in 2007.

Q30. What is a CTR and what is the threshold?

A CTR is a cash transaction report. Under the PML (Maintenance of Records) Rules, as explained in FIU-IND's FAQs, reporting entities must report cash transactions above ₹10 lakh (or the foreign currency equivalent), and integrally connected cash transactions that are each below ₹10 lakh but add up to more than ₹10 lakh within a month (FIU-IND, October 2026). CTRs are filed monthly, by the 15th of the following month. Unlike an STR, a CTR is based on a threshold, not on suspicion.

Q31. What is an STR and what is the filing timeline?

An STR is a suspicious transaction report. FIU-IND defines a suspicious transaction as one, including an attempted transaction, that gives reasonable grounds to suspect it involves proceeds of a scheduled offence regardless of value, has unusual or unjustified complexity, has no economic rationale or bona fide purpose, or may involve terrorist financing. FIU-IND's FAQs say the STR must be filed not later than seven working days after the Principal Officer is satisfied that the transaction is suspicious. There is no minimum amount for an STR.

Q32. What other reports go to FIU-IND, and when?

Besides STRs and CTRs, reporting entities file NTRs for receipts by non-profit organisations above ₹10 lakh, counterfeit currency reports for cash transactions involving forged notes, cross-border wire transfer reports above ₹5 lakh where the origin or destination is in India, and reports on purchase or sale of immovable property valued at ₹50 lakh or more registered by the reporting entity. FIU-IND's FAQs say CTRs, NTRs, counterfeit currency, cross-border wire and integrally connected cash reports are filed monthly by the 15th of the next month. Reporting entities register and file through FIU-IND's FINnet system.

Q33. How long must records be kept under PMLA?

Under section 12 of PMLA, as explained in FIU-IND's FAQs, records of transactions must be kept for 5 years from the date of the transaction. Identity records, account files and business correspondence must be kept for 5 years after the business relationship ends or the account is closed, whichever is later. Records must allow individual transactions to be reconstructed and must be kept confidential. For an analyst, this means your case notes and evidence must be complete and saved properly, because they may be reviewed years later.

Q34. What happens if a reporting entity fails to comply?

Under section 13 of PMLA, FIU-IND's Director can impose a fine of ₹10,000 to ₹1 lakh for each failure on a reporting entity, its designated director or its employees, according to FIU-IND's FAQs. FIU-IND can also issue directions and compliance orders. Its Annual Report 2024-25 records 8 compliance orders with an aggregate penalty of ₹30,48,65,000, about ₹30.5 crore, in FY 2024-25 (FIU-IND, October 2026). Interviewers ask this to see whether you understand why accurate, timely work matters.

7. FATF and sanctions (Q35 to Q40)

Short answer: You need a clear, simple view of what FATF does, where India stands, and how sanctions screening works, including the lists Indian banks must screen against.

FATF is the Financial Action Task Force. Sanctions are legal restrictions on dealing with named people, entities or countries.

Q35. What is FATF?

FATF, the Financial Action Task Force, is an inter-governmental body set up in 1989 that sets global standards to combat money laundering, terrorist financing and proliferation financing. It checks how countries apply its Recommendations through mutual evaluations. FIU-IND's Annual Report 2024-25 says FATF has 39 full members, made up of 37 countries plus the European Commission and the Gulf Co-operation Council, and 9 FATF-style regional bodies. Banks use FATF standards as the base for their own AML policies.

Q36. What is India's position in FATF?

FIU-IND's Annual Report 2024-25 says India was an FATF observer from 2006 and became a full member in 2010. India is also a member of two FATF-style regional bodies, the Asia/Pacific Group (APG) and the Eurasian Group (EAG). India's 2024 mutual evaluation placed it in the "regular follow-up" category. In plain words, that is the better outcome, with less frequent follow-up reporting than "enhanced follow-up", which applies to countries with significant weaknesses. Keep your answer factual and avoid comparing India with other countries.

Q37. What is sanctions screening?

Sanctions screening means checking customers, beneficial owners, counterparties and payments against sanctions lists to make sure the bank does not deal with banned people or entities. Screening happens at onboarding, when lists are updated, and on payments in real time. When a name looks similar to a listed name, the system raises a potential match, and an analyst must decide whether it is a true match or a false positive, using details such as date of birth, nationality, address and identity numbers.

Q38. Which sanctions lists must Indian banks screen against?

Under section 51A of the Unlawful Activities (Prevention) Act, 1967, RBI's KYC Directions require banks to ensure that no account exists in the name of individuals or entities on UN Security Council lists, namely the ISIL (Da'esh) and Al-Qaida Sanctions List and the Taliban Sanctions List. Freezing follows the UAPA order dated 2 February 2021. Banks also screen against the Ministry of Home Affairs list of terrorists under UAPA. Many global banks in India also screen against other lists, such as the US Treasury's OFAC SDN list, under group policy.

Q39. What do you do if you find a true sanctions match?

You stop and escalate immediately, without telling the customer. A true match means the person or entity really is on a sanctions list, so the bank must not process the transaction or continue the relationship as normal. Follow your bank's procedure: escalate to the sanctions or compliance team, preserve all evidence, and let them handle freezing and reporting to the authorities as the law requires. Never "tip off" the customer, and never release a payment while a potential true match is still under review.

Q40. What is the difference between a sanctions alert and a PEP alert?

A sanctions alert means a possible match to a person or entity the bank is legally restricted from dealing with. A confirmed match usually means blocking or freezing, not just extra checks. A PEP alert means a possible match to a politically exposed person. Being a PEP is not illegal; it simply makes the customer higher risk, so the bank applies EDD, source of funds and wealth checks and senior management approval. So a sanctions match is a hard stop, while a PEP match is a higher-risk relationship to manage.

8. Transaction monitoring and alerts (Q41 to Q48)

Short answer: These questions test how monitoring systems create alerts, why most alerts are false positives, and how you review an alert step by step.

RBI's KYC Directions describe on-going due diligence as regular monitoring of transactions to make sure they match what the bank knows about the customer, their business, risk profile and source of funds. For the full process, read our guide to transaction monitoring.

Q41. What is transaction monitoring?

Transaction monitoring is the ongoing review of customer transactions to find activity that does not fit the customer's profile and may indicate money laundering, fraud or terrorist financing. Banks use software with rules and models that scan transactions and create alerts. Analysts then review the alerts. The simple flow is: transaction data, rules or models, alert, L1 review, L2 investigation, and finally closure or an STR. It is the main way banks catch layering, mule activity and structuring after onboarding.

Q42. What is an alert, and what is a false positive?

An alert is a flag raised by a monitoring or screening system when a transaction or customer matches a rule or pattern. A false positive is an alert that turns out, after review, to be normal and not suspicious, for example a large credit that is a documented property sale. A true positive is an alert that is genuinely suspicious and needs escalation. Most alerts in many systems are false positives, so analysts must close them quickly but with a clear, documented reason.

Q43. What are common transaction monitoring rules or scenarios?

Common scenarios include large cash deposits or withdrawals, many transactions just below a threshold (structuring), high velocity (many transactions in a short time), sudden activity in a dormant account, rapid movement of funds in and out, round-amount transactions, and transfers to or from high-risk geographies. Others look at many unrelated people paying one account, which may signal a mule, or a business account whose turnover jumps far beyond its declared profile. Each rule targets a known typology.

Q44. How do you review a transaction monitoring alert?

Follow a clear sequence. First, read the alert: what rule fired and which transactions triggered it. Second, review the customer's KYC profile: occupation, expected activity, risk rating and past alerts. Third, analyse the transactions: amounts, frequency, counterparties, channels and locations. Fourth, look for a reasonable explanation, using internal data and, where allowed, open-source research. Fifth, decide: close as a false positive with a rationale, or escalate to L2 with your findings. Finally, document every step so another reviewer can follow your logic.

Q45. What is the difference between L1 and L2 alert review?

L1 review is the first look. The L1 analyst checks whether the alert has an obvious, documented explanation and either closes it or escalates it, usually within a target time. L2 review is a deeper investigation of escalated alerts. The L2 analyst reviews a longer period of activity, links between accounts, counterparties, adverse media and supporting documents, writes a full case narrative, and recommends whether to file an STR. L2 work needs stronger judgement and writing.

Q46. What is scenario tuning and why does it matter?

Scenario tuning means adjusting monitoring rules, thresholds and customer segments so that the system catches real risk without flooding analysts with false positives. If a threshold is too low, the team drowns in useless alerts and real cases get missed. If it is too high, suspicious activity slips through. Tuning uses data such as how many alerts became escalations or STRs. Analysts help by giving clear closure reasons, because those reasons show which rules are working.

Q47. What is the difference between real-time and batch monitoring?

Real-time monitoring checks a transaction as it happens, before or while it is processed. It is common for sanctions screening of payments and for fraud checks, where stopping the payment matters. Batch monitoring runs on transactions after they are processed, often daily, weekly or monthly, and looks for patterns over time, such as structuring across a month. Most AML transaction monitoring alerts that analysts review come from batch runs, while payment screening is usually real time.

Q48. How is a transaction monitoring analyst measured?

Analysts are usually measured on productivity, quality and timeliness. Productivity means the number of alerts or cases closed in a period. Quality means how many of your decisions pass review without errors; one Hyderabad AML listing we read on 24 October 2026 asked for a minimum quality score of 99 percent. Timeliness means meeting turnaround times, often called SLAs (service level agreements). Good analysts balance speed with careful, well-documented decisions, because a fast but wrong closure can become a regulatory problem.

9. Investigations and STR writing (Q49 to Q54)

Short answer: These questions test whether you can investigate a case, decide when suspicion is reasonable, and write a clear, factual narrative that someone else can act on.

Q49. What does an AML investigation involve?

An AML investigation is a deeper review of a customer or activity that looks suspicious. It usually involves reviewing the full KYC file, analysing a longer period of transactions, mapping links to other accounts and counterparties, checking adverse media and public records, and sometimes requesting information from the business or relationship team. The investigator then decides whether there are reasonable grounds for suspicion and recommends an STR or closure, with a written narrative that explains the facts and the reasoning.

Q50. What makes a good STR narrative?

A good STR narrative answers who, what, when, where, why and how in plain, factual language. Start with a short summary of the suspicion. Describe the customer and their expected activity. Explain the suspicious activity with dates, amounts, accounts and counterparties. State why it is suspicious, linking it to red flags or typologies. Mention what checks you did and what explanation, if any, the customer gave. Avoid opinions, emotional words and guesses. Someone at FIU-IND should understand the case without seeing your screens.

Q51. What is tipping off and why must you avoid it?

Tipping off means telling or hinting to a customer, or anyone not authorised, that a suspicious transaction report has been filed or that they are under investigation. It can help criminals hide money or destroy evidence. PMLA requires reporting entities to keep reported information confidential. In practice, never mention STRs, alerts or investigations to the customer, and be careful when asking for documents: frame requests as routine KYC or account review, following your bank's approved scripts.

Q52. What is adverse media screening?

Adverse media, also called negative news, is public information linking a person or company to crime, fraud, corruption, sanctions breaches or similar risks. Analysts search news sources and databases to find it during onboarding, EDD and investigations. The key is to check that the news is about the same person, using details such as age, location and company names, and to judge how credible and recent it is. A single unverified blog post weighs much less than reports from established media or court records.

Q53. How do you decide whether to escalate or close a case?

Escalate when you cannot find a reasonable, documented explanation for activity that does not fit the customer's profile, or when red flags point to a known typology. Close when the activity is explained by reliable information, such as a documented property sale, salary credit or known business payment, and the explanation matches the amounts and timing. When in doubt, escalate with clear notes rather than closing. Either way, write your reasoning so a reviewer can see exactly why you decided as you did.

Q54. What is a quality check (QC) in AML, and how do you respond to QC errors?

A quality check is a review of an analyst's completed work by a senior or a QC team to confirm that the decision, evidence and documentation meet the procedure. Errors may be critical, such as closing a genuinely suspicious alert, or minor, such as a missing screenshot. When you get a QC error, read the feedback carefully, accept it professionally, fix the case if allowed, and change your process so it does not repeat. Interviewers want to hear that you treat feedback as learning, not as criticism.

10. Scenario questions (Q55 to Q61)

Short answer: Scenario questions give you a fictional case and ask what you would check and decide. Use a fixed structure: profile, activity, red flags, checks, decision and documentation.

All cases below are fictional and created for practice. Names and amounts are illustrative.

Q55. A student's savings account receives 40 small UPI credits from different people and sends almost all of it out the same day. What do you do?

This is a classic mule pattern. First, check the KYC profile: a student usually has low expected activity. Second, review the credits: many unrelated senders, small amounts and quick onward transfers suggest pass-through activity. Third, check counterparties for links to fraud complaints or other alerts. Fourth, look at the account age and login or device data if available. Unless there is a strong documented explanation, escalate to L2 with a clear note that the pattern fits mule account typology and may involve fraud proceeds.

Q56. A small grocery shop owner deposits ₹9.5 lakh in cash every week, always just under ₹10 lakh. What is your view?

Repeated deposits just below ₹10 lakh are a structuring red flag, because cash transactions above ₹10 lakh are reported in CTRs. First, compare the deposits with the shop's declared turnover and past pattern. Second, check whether the cash is linked to other accounts or branches. Third, consider that integrally connected cash transactions above ₹10 lakh in a month must be reported anyway. If the volume is far above what a small shop could earn, escalate for investigation and a possible STR, documenting the pattern clearly.

Q57. A dormant account with no activity for three years suddenly receives ₹25 lakh from abroad and the customer wants to withdraw it in cash. What do you check?

Sudden activity in a dormant account, a large foreign credit and an urgent cash withdrawal together are strong red flags. Check who the remitter is and how they relate to the customer, the stated purpose of the remittance, and whether the customer's profile and KYC are up to date. Check for account takeover risk, such as recent contact detail changes. Request supporting documents through approved channels. If the explanation is weak or documents do not match, escalate. Do not tip off the customer while the review is ongoing.

Q58. A new corporate customer's ownership chart shows three layers of companies in different countries and no individual owns more than 10 percent. How do you handle it?

Complex layered ownership is a risk factor, so apply EDD. Ask for the full ownership and control structure up to natural persons, with supporting documents. Under RBI's KYC Directions, if no one crosses the ownership threshold, check who exercises control by other means, such as appointing directors; if still no natural person is identified, record the senior managing official. Screen all owners, directors and controllers for sanctions, PEP status and adverse media. If the structure has no clear business reason, escalate before onboarding.

Q59. During periodic KYC review, you find the customer is now a senior official of a foreign state-owned company. What changes?

The customer may now be a PEP under RBI's description, which includes senior executives of state-owned corporations of a foreign country. Update the risk rating to high and flag the relationship for EDD. That means checking source of funds and wealth, getting senior management approval to continue the relationship as the bank's policy requires, and applying closer monitoring. Also identify family members and close associates linked to the account. Document the change and the date you found it.

Q60. A screening alert shows the customer "Mohammed Rafiq Khan" partially matches a listed name. How do you decide?

Compare the identifiers, not just the name. Check date of birth, nationality, place of birth, address, passport or other ID numbers and any known aliases against the list entry. Common names create many false positives, so a name match alone is not enough. If key identifiers clearly differ, close as a false positive with the reasons written down. If they match or you cannot rule the match out, escalate to the sanctions team immediately, and do not process any pending transaction until it is cleared.

Q61. An importer pays ₹2 crore for "electronic parts" to a company in a country unrelated to its usual suppliers, and the price is far above market. What do you suspect?

This looks like possible trade-based money laundering through over-invoicing. Check the customer's normal trade pattern, suppliers and routes; review the invoice, bill of lading and description of goods; compare unit prices with market rates where possible; and check the supplier for sanctions, adverse media and links to the customer. Note any third-party payments. If the price gap and documents cannot be explained, escalate with a narrative that explains why the trade appears to move value rather than goods.

11. Tools and Excel (Q62 to Q65)

Short answer: You are not expected to know every vendor tool, but you should know what types of tools exist and be comfortable with Excel for reviewing transactions.

AML job listings we read on 24 October 2026 named tools such as World-Check, NICE Actimize, Fircosoft and Mantas, and most asked for MS Excel skills. Some analytics roles also asked for SQL, SAS or Python.

Q62. Which AML tools have you heard of, and what do they do?

Group them by function. Transaction monitoring and case management platforms include NICE Actimize, SAS Anti-Money Laundering and Oracle Financial Crime and Compliance Management. Screening and risk-data tools include LSEG World-Check, Dow Jones Risk and Compliance and LexisNexis Bridger Insight XG, used to check names against sanctions, PEP and adverse media data. Client lifecycle tools such as Fenergo support KYC onboarding. If you have not used one, say so honestly and explain how quickly you learn new systems.

Q63. Which Excel skills does an AML analyst need?

The most useful skills are sorting and filtering transactions, pivot tables to total credits and debits by month or counterparty, lookup functions such as VLOOKUP or XLOOKUP to match accounts across sheets, conditional formatting to highlight round amounts or large values, COUNTIF and SUMIF to count repeated patterns, and removing duplicates. You should also be able to build a simple timeline of transactions. In an interview, describe how you would use a pivot table to spot structuring across a month.

Q64. How would you use Excel to find structuring in a statement?

Export the transactions, filter for cash deposits, and sort by date. Add a column for the month and create a pivot table that totals cash deposits per month and per branch. Use conditional formatting to highlight deposits between, say, ₹9 lakh and ₹10 lakh, and COUNTIF to count how often they occur. If you see repeated deposits just under the reporting threshold that add up to more than ₹10 lakh in a month, that pattern supports escalation. Save the workings as evidence for your case.

Q65. Is SQL needed for AML roles?

SQL is not required for most entry-level KYC and transaction monitoring operations roles, where Excel and the bank's own tools are the main skills. It becomes useful in AML analytics, scenario tuning, quality analytics and data roles, where you query large transaction tables directly. Some listings we read on 24 October 2026 for analytics roles asked for SQL, SAS or Python. If you know basic SELECT, WHERE, GROUP BY and JOIN queries, mention it as a plus, not your main strength.

12. HR and behavioural questions (Q66 to Q70)

Short answer: HR questions check your motivation, honesty, comfort with shifts and targets, and whether you can explain why you want a career in AML.

Q66. Why do you want to work in AML?

Give a genuine, specific answer. For example: you like investigative, detail-oriented work; you want a stable career in banking and compliance; and you value work that protects customers and the financial system from fraud and crime. Link it to your background, such as a B.Com degree, banking operations experience or a course you completed. Avoid saying only that it is easy to get into or that you need any job. Close with what you want to learn in the first year.

Q67. Are you comfortable with night shifts or rotational shifts?

Answer honestly, because many AML roles in India support global clients. Listings we read on 24 October 2026 mentioned night shifts if required, rotational or client-aligned shifts, and shift allowances with transport depending on the shift. If you are comfortable, say so and mention how you will manage health and commute. If you have limits, state them politely and early. A clear, honest answer is better than agreeing now and leaving after two months.

Q68. How do you handle repetitive work with strict targets?

Show that you understand AML operations involve volume, quality targets and deadlines. Explain your methods: following a checklist for every case, planning your queue, taking short breaks to stay sharp, and asking for help early on complex cases rather than rushing. Give an example from college, an internship or a previous job where you met a target without cutting corners. Stress that you will never trade accuracy for speed, because a wrong closure in AML can become a regulatory issue.

Q69. Tell me about a time you found an error or something unusual.

Use the STAR method: situation, task, action and result. Choose a real example, such as spotting a wrong amount in a reconciliation, a mismatch in customer documents at a bank branch, or an error in a college project's data. Explain what you noticed, how you checked it, whom you informed and what changed because of it. Interviewers want evidence of attention to detail, curiosity and the courage to raise an issue, which are the core traits of a good AML analyst.

Q70. What salary do you expect, and do you have questions for us?

For salary, research typical ranges for your role, city and experience on public salary sites before the interview, give a realistic range, and say you are flexible for the right learning opportunity. Our blog's salary guide explains how pay varies. Then ask one or two thoughtful questions, such as which process or client the team supports, what training new joiners get, how quality is measured, and what growth from L1 to L2 looks like. Good questions show you are serious about the work.

13. Quick revision: 10 questions in one line each

Short answer: Use this table the night before your interview. If you cannot expand any line into a full answer with an example, go back to that question above.

14. How to prepare in 7 days

Short answer: Spend one day each on basics, KYC, Indian law, monitoring, investigations, scenarios and mock interviews, and practise every answer aloud.

Reading answers is not enough. Interviewers quickly spot memorised lines. Follow this 7-day plan.

If you are a fresher, focus on basics, KYC, the stages, a few simple scenarios and honest HR answers. Most "AML fresher" results on Naukri on 24 October 2026 were BPO and recruitment-agency posts, while bank and Big Four AML roles usually asked for 1 to 3 years or more, so read every job description carefully. Our guide to AML jobs for freshers explains entry roles and where to find them. If you are experienced, expect deeper questions on your own queue, typologies you have seen, STR narratives, QC feedback and how you would coach juniors.

Certifications such as CAMS from ACAMS and the IIBF Certificate in AML and KYC can strengthen your profile, but the job listings we read on 24 October 2026 treated certifications such as ACAMS, ICA, CFE and CFCS as "good to have" or "a plus", not mandatory for entry roles. Our CAMS certification guide explains that option in detail.

15. How Brolly Academy helps

Short answer: Brolly Academy's 45-day AML course covers money laundering stages, typologies, regulations, KYC, CDD and EDD, compliance programmes and AML technology, with capstone case studies, weekly mock interviews in the live plans, and a bank of interview questions.

The AML Course in India runs for 45 days, online across India and in classrooms in Hyderabad, with weekday and weekend batches and a self-paced video plan. The roadmap moves from money laundering basics and AML risks (weeks 1 and 2) to industries, rules and laws including RBI, SEBI, FATF, reporting and penalties (weeks 3 and 4), KYC, CDD and EDD (week 5), and AML programmes, technology, a final case study and a certificate assessment (week 6). The seven modules (understanding money laundering, AML risks and typologies, AML in specific sectors, the regulatory framework, CDD and KYC, AML compliance programmes, and AML and technology) match most of the questions above.

The course page lists six capstone projects, including a KYC verification case study, transaction monitoring, compliance reporting, a risk assessment and an end-to-end AML case, which give you real stories for scenario rounds. It introduces tools such as NICE Actimize, SAS AML, Oracle OFSAA, World-Check, Excel and SQL. The page also mentions "100+ AML and KYC interview questions", weekly mock interviews in the online and classroom plans, resume support and placement assistance. Fees on the page are ₹6,999 for video recordings, ₹14,999 for live online and ₹19,999 for classroom training. Any graduate aged 18 or above can join, with no finance or coding background needed. You receive a Brolly Academy course completion certificate; third-party certifications such as CAMS or IIBF are examined by those bodies and their fees are separate.

Frequently asked questions