# AML Document Checks: Seven Fields to Capture From Every Document

> A practical seven-field checklist for AML document checks, what FinCEN rules say about thresholds and beneficial owners, and the record gaps to fix first.

**Canonical URL:** https://docsapi.co/resources/blogs/aml-document-checks
**Author:** Nupura Ughade — Content Marketing Lead, DocsAPI
**Author LinkedIn:** https://www.linkedin.com/in/nupura-ughade/
**Published:** 2026-06-17T00:00:00.000Z
**Updated:** October 29, 2026
**Primary topic:** anti-money laundering
**Site:** https://docsapi.co (DocsAPI — Document AI & OCR API for SMB Lending)

---

AML document checks turn the paperwork behind a transaction into structured records you can monitor, report on and show to an examiner. FinCEN's rules say what you must detect and keep, but they do not list the fields to capture from each document. The checklist below is our practical suggestion, not a regulatory list: seven fields that make a document usable for monitoring and for audit.

This guide covers the seven fields, what the rules do say, the document types that need extra care, and the record gaps that show up first. It is not legal advice, so confirm requirements for your institution with your compliance team.

## What do AML document checks cover?

AML (anti-money laundering) rules require financial institutions to detect and report suspicious activity. Document checks are the part where you pull structured data out of wire instructions, source-of-funds statements, beneficial ownership forms and similar records, and keep that data for monitoring, reporting and audit. The work splits in two:

- At onboarding: verify identity (KYC) and collect source-of-funds documents.
- Ongoing: monitor transactions and patterns, and file reports when the rules say to.

The extraction layer feeds both. The identity side is covered in [KYC document verification](/resources/blogs/kyc-document-verification).

## What do the rules actually say?

These are the points worth knowing before you design fields. Secondary sources confirm each one, but check the current rule text before you build logic on a number.

- Suspicious activity reports. For banks, the usual trigger is a transaction of $5,000 or more involving activity you know, suspect or have reason to suspect is illicit. The report is generally due within 30 days of detection, and the SAR is kept for 5 years (see the Willkie compliance guide to SARs). Money services businesses use a lower figure.
- Beneficial owners. FinCEN's customer due diligence rule asks for each person who owns 25 percent or more of the equity of a legal entity customer, plus one person who controls it (see Crowell's summary of the final rule). An institution may choose a lower ownership line on a risk basis.

Neither rule tells you which fields to keep on each page. That part is a design choice, and the checklist below is one way to make it.

## What is the seven-field minimum?

For each AML-relevant document, capture these seven fields. Skip one and you create either an audit gap or a blind spot in monitoring.

### 1. Document type

Is this a wire instruction, a source-of-funds statement, a beneficial ownership form or a tax document? The type decides which rules apply next. See [document classification](/resources/blogs/document-classification-software).

### 2. Dates

Keep both the date on the document and the date you received it. Examiners compare these with transaction timestamps.

### 3. Customer identifier

Your internal customer ID, linked to the KYC record. This ties each document to the right customer.

### 4. Counterparty details

For sender, receiver or beneficiary: name, address and an identifier such as an account number or tax ID. The counterparty is half of the picture in any transfer.

### 5. Transaction amount and currency

Store the amount as a number and the currency as a separate code, never as a formatted string such as "$1,000.00". See [data normalization for extracted documents](/resources/blogs/data-normalization-extracted-documents).

### 6. Stated source of funds

For large or unusual transactions: what does the customer say the money came from, such as salary, sale proceeds, a gift or business income? This field often decides whether an alert becomes a report.

### 7. Risk indicators

Record any flag that triggered extra review: a cross-border transfer, a high-risk jurisdiction, a politically exposed person match or an amount over your threshold. The audit trail should show why a document got special handling.

## Which record gaps show up first?

These are the gaps a mock audit of your own files is most likely to turn up. Treat them as a self-check list, not as a report of what any regulator found.

| Gap | What it looks like | Fix |
| --- | --- | --- |
| Missing counterparty | Wire on file with no receiving party details | Make field 4 required for any transfer document |
| Amount stored as text | "$1,000.00" sits in a text column, so monitoring cannot read it | Store a number and a currency code |
| No source of funds | A $50,000 transfer with documents but no stated source | Require field 6 above a threshold you set |
| Risk flag not recorded | A high-risk jurisdiction was reviewed, but no flag was saved | Write every indicator to field 7 |
| Broken audit trail | A SAR cites a document, but steps in between are missing | Log every step with input, output, time and operator |

## Which document types need extra care?

- Wire transfer instructions. SWIFT messages, ACH files and internal transfer forms. Capture sender, receiver, amount, currency, purpose and any intermediaries. Stripped or hidden party details are themselves a flag.
- Beneficial ownership forms. Capture each owner's name, date of birth, address and ownership percentage, and check them against the source ID.
- Source-of-funds statements. Capture the customer's statement word for word, with the signature and date.
- Cross-border tax forms. W-8BEN, W-9, FATCA and CRS forms each have fixed fields, so extraction has to follow the form's layout.
- Screening records. Record who was screened, against which list, on what date and with what result. See real-time sanctions screening for how list freshness differs from speed.

## What does a pipeline for AML documents look like?

1. Ingest. Take the document in by portal, email or API and store the original unchanged.
2. Classify. Find the document type and route it to the right extraction template.
3. Extract. Run layout-aware OCR and pull the seven fields plus any type-specific fields.
4. Validate. Check that required fields are filled, amounts are numeric and dates parse. Send failures to review. See real-time document validation.
5. Screen. Check counterparties against sanctions and politically exposed person lists, and record the result.
6. Tag. Add risk indicators such as cross-border or high-risk jurisdiction.
7. Log. Keep every step's input, output, time and operator in a record that cannot be edited afterwards.
8. Hand off. Send the data to your monitoring system and start the SAR workflow when your rules call for it.

## How do AML document checks differ from KYC?

KYC establishes who the customer is, at onboarding and on a periodic refresh. AML watches what the customer does, continuously. KYC documents are mostly photo IDs and proof of address. AML documents include those plus transaction records, attestations, source-of-funds papers and ownership forms. AML therefore tends to produce more documents per customer, because each flagged transaction can add its own.

## How accurate does the OCR need to be?

AML documents mix structured forms, where field extraction matters, with free text such as attestations, where meaning matters. A wrong amount or a missed counterparty can turn into a missed report, so validate every extracted value and send low-confidence fields to a person. Accuracy depends heavily on document type, which is why we publish per-type numbers in the [OCR accuracy benchmark](/resources/blogs/ocr-accuracy-benchmark-2026). For the general limits of OCR, see the [honest guide to OCR](/resources/blogs/ocr-pdf-honest-guide), and for the identity side, [OCR for KYC verification](/resources/blogs/ocr-for-kyc-verification).

## Where should you start?

If you are building from scratch, get the seven-field extraction right first. Monitoring rules, SAR workflows and dashboards all sit on top of that data. If you already have a system, pull 100 documents at random and check whether all seven fields were captured cleanly. The gaps are most often in field 4 (counterparty) or field 6 (source of funds), so fix those first. If you are preparing for an exam, run a mock audit on a sample of files and rebuild each decision from the audit trail. Any gap you cannot explain from the file is one an examiner may also find.

## Frequently Asked Questions

### What is AML document verification?

The process of extracting structured data from AML-relevant documents (transactions, wire instructions, source-of-funds attestations, beneficial ownership forms) and using that data for monitoring, reporting, and audit.

### How does AML differ from KYC?

KYC is one-time-plus-periodic identity verification. AML is continuous transaction monitoring. KYC documents are mostly IDs; AML includes transactions, attestations, ownership forms. AML feeds on KYC data plus ongoing activity.

### What documents are most commonly checked in AML?

Wire transfer instructions, source-of-funds statements, beneficial ownership forms, cross-border tax documentation (W-8BEN, W-9, FATCA), and sanctions/PEP screening records.

### How often should AML documents be reviewed?

Triggered by transaction patterns (large amounts, unusual frequencies, high-risk jurisdictions) and periodic schedules for high-risk customers. Exact triggers depend on your AML program design.

### Can I automate AML document extraction with OCR?

Yes, for the extraction step. Decision-making (does this trigger a SAR?) still requires human judgment plus documented rules. Use OCR and rules for extraction and first-pass checks, and keep a person on every decision that can lead to a report.

### What happens if AML documents are missing fields?

For automated processing: route to manual review. For audit: it depends on which field. Missing date or amount fields are findings. Missing risk-indicator flags are findings. Examiners want every decision supported by the file.


---

**Source URL (cite this):** https://docsapi.co/resources/blogs/aml-document-checks
**Author profile:** https://docsapi.co/author/nupura-ughade
**Published by:** DocsAPI (https://docsapi.co)