AML for Non-Bank Lenders: Questions from the SIFTA Workshop on Digitalizing Microfinance Operations, Answered

We heard this one more than once, so let’s start with a clarification: Natech isn’t a list provider. The main international sanctions lists, such as UN and OFAC, come pre-integrated in Natech AML. Any other sanctions or PEP list you need, including commercial lists you license from a provider, follows the same process: an initial full load, then daily delta updates. Once the update files are placed in the agreed location on the server, Natech AML loads them automatically.

Why not rely on a live connection to a third-party provider instead? Because screening is mandatory. If an external service goes down, screening still has to happen. Keeping the lists inside the solution means every customer and transaction is always screened against the latest data you’ve loaded, whatever happens outside it.

New customers and transactions are then screened against the latest version in real time. Fuzzy matching with configurable thresholds catches spelling variations and transliterations, without burying your team in false positives.

Then there are the customers you already have. A name that was clean at onboarding can show up on a list next month. To cover this, we run scheduled automated daily or weekly re-screening of your whole customer base. If someone matches, their profile and risk score update and your compliance team gets an alert.

Every match, decision and threshold change is logged, so you can trace exactly what happened when the auditor or regulator asks.

Yes. PEP lists work exactly like the other sanctions lists. They’re held inside Natech AML, and customers are screened against them in real time at onboarding and on transactions, with your existing customers re-screened on a schedule. When there’s a PEP hit, the system flags it clearly as a PEP match, and it feeds straight into the customer’s risk profile and score.

As for providing the lists ourselves, today we supply PEP lists for Greece and Cyprus, and we’re adding the free international PEP lists. Romania and Moldova are on our roadmap, and the conversations in Iași made that priority even clearer to us. In the meantime, you can load the commercial PEP list of your choice (licensed directly from the provider), or your own internal list, and Natech AML takes care of screening, matching and the audit trail.

Here’s something we said in the room that got a few knowing nods: most MFIs don’t have one core system. They have a loan system, a separate customer database, some Excel files and an email inbox. That’s completely normal, and it’s exactly the setup we designed Natech AML for. It works standalone or embedded in Natech Core, and it connects to your existing customer database, KYC tools and data providers without asking you to replace them.

A typical project follows five steps:

1. Scope fit. We run a demo and review your use cases, data sources and regulatory obligations together.
2. Configuration. We set up your data model, risk attributes, thresholds and rules, starting from our pre-configured, regulator-aligned library.
3. Integration. We support you in integrating your systems with our standard integration layer.
4. Two-week user acceptance testing (UAT). You test on your own data, standalone or integrated with your core.
5. Go live. Real alerts and real cases from day one.

You can choose SaaS, hosted and managed by us, or self-host on-premises or in a private cloud. You can also activate modules one at a time.

In our experience, the main challenges are rarely technical. They’re data quality (duplicate customers, missing fields), knowing exactly which systems feed which data, and agreeing internally on rules and thresholds. Cleaning up customer data in your source systems before go-live helps with the first. Good scoping handles the other two.

That’s why we spend real time on scoping. When every data source, interface and rule is mapped before configuration starts, implementation rarely runs into trouble. The tough projects we’ve seen weren’t the ones with the oldest systems. They were the ones where something important came up late.

Our most demanding case so far is the Hellenic Postal Service in Greece. There, Natech AML serves more than 12 million customers a year, integrates with more than 10 systems and processes over 8,000 transactions per minute. With that many systems feeding customer and transaction data, mapping every interface in detail is what made the project work.

Dynamic. A customer’s risk score isn’t set once at onboarding and then forgotten. It follows the customer through three stages:

1. Onboarding. KYC checks and watchlist and PEP screening give the customer an initial risk classification from the very first interaction.
2. Profiling. The customer joins one or more risk groups based on pre-configured or custom attributes, such as customer type, product, geography, profession or PEP status.
3. Scoring. The score updates in real time as the customer transacts. Unusual amounts, patterns or counterparties raise it, while consistent, expected behavior keeps it steady.

The calculation is multi-factor and rule-based. It weighs transactions, the customer, counterparties and groups, using thresholds and weights your compliance team can configure without needing developers. Scoring can run in real time, near real time or in batch, depending on the flow.

Your analysts can also adjust a score by hand when they know something the system doesn’t. The change is recorded along with the reason, and every score change stays visible in the customer’s history. So when a regulator asks why a customer is rated the way they are, you always have the answer.

The day didn’t end when the session did. Afterward, we were all invited to visit the offices of MK Kredit Romania, an international lender and one of the leading MFIs in Romania, which is celebrating 10 years in the market. A big thank you to their team for having us.

We came home from Iași with a full notebook and a clear picture of what matters most to lenders in the region, starting with PEP list coverage for Romania and Moldova.

What should AML for microfinance institutions cover?
AML for microfinance institutions should cover sanctions and PEP screening at onboarding and on transactions, scheduled re-screening of existing customers, and dynamic risk scoring, with every decision logged for auditors and regulators.

Does Natech provide sanctions lists?
We’re not a list provider. UN and OFAC sanctions lists come pre-integrated in Natech AML. Any other list, including licensed commercial lists, is loaded into the solution with an initial full load followed by daily delta updates.

Can Natech AML re-screen existing customers?
Yes. Natech AML can re-screen your full customer base on a daily or weekly schedule and alert your compliance team when a match appears.

Does Natech AML support PEP screening for Romania and Moldova?
Yes. PEP lists are held in Natech AML and screened in real time, just like sanctions lists. We supply PEP lists for Greece and Cyprus today, with Romania and Moldova on our roadmap.

How does a Natech AML implementation work?
A typical project follows five steps: scope fit, configuration, integration, a two-week UAT and go live. Natech AML runs standalone or embedded in Natech Core, as SaaS or self-hosted.

Is risk scoring in Natech AML static or dynamic?
Dynamic. Scores start at onboarding and update in real time as customers transact. Analysts can adjust them manually, and every change is logged with a reason.

Which institutions use Natech for AML?
Our clients include the Hellenic Postal Service in Greece, where Natech AML serves more than 12 million customers a year and processes over 8,000 transactions per minute.

Rethinking AML for microfinance institutions in your market? If you run compliance at an MFI or IFN, we’d be glad to show you how Natech AML would fit your current setup. Reach our team at info@natechbanking.com or contact us here.