30–40%Less compliance review time
CashDirector reports that clustered profiles and fewer false positives help its compliance officers review cases faster.
Solutions / Audit Trail & Evidence
AML Audit Trail and Decision Evidence Software
Connect screening proof, case activity, reviewer rationale, attachments, and outcomes so compliance teams can answer what happened, when, and why.
Audit timelineImmutable
Case.Update
06/16/26, 10:23 · marcos pla
review outcome: empty → YELLOWScreening.Case.Updated
06/16/26, 10:00 · system_monitoring
case status and source evidence linkedHit.Review
06/14/26, 11:09 · marcos pla
potential match decision recordedRecent eventsTimestamped
WhenActionTarget
10:23CRA config updatedCRA profile
10:23Hit reviewhit_7050
10:22Case openedcase_18f9
Decision proofWho, what, when, and why
TimelineActor, time, action, target
ProofCustomer, profile, sources, outcome
ChangesField-level case updates
ArtifactsAttachments and report artifacts
Audit readiness
Keep proof close to the decision
Audit evidence is strongest when it is created as the work happens. Checklynx links screening runs, case updates, hit reviews, notes, attachments, and report artifacts into a history that compliance, QA, and audit teams can inspect later without rebuilding the story from screenshots.
Prove screening happened
Retain durable screening evidence showing the customer, run, time, screening profile, executed sources, trigger origin, review status, and outcome category.
Track who changed what
Capture critical actions with actor, timestamp, action type, target, changed fields, version, and lightweight references back to the case, hit, report, or document record.
Keep evidence usable
Attach case proof, notes, rationale, and report artifacts to the operational record so audit review starts from connected evidence instead of scattered exports.
Evidence journey
From event to audit record
Each important screening or case event keeps the business record readable while pointing back to the richer evidence needed for review. The audit trail shows the action; the underlying case, hit, screening, or document record carries the full operational context.
| Stage | Evidence captured | Review outcome |
|---|---|---|
| Screening run | Customer ID, run ID, occurred time, screening profile, executed sources, review status, trigger origin | The team can prove the check happened and which control set ran. |
| Outcome event | Case target, actor, timestamp, action, field changes, version, and status movement | Reviewers can see who changed the case and what changed. |
| Hit decision | Case reference, hit status, review mode, rationale, reviewer, and timestamps | Potential matches are tied to clear analyst decisions. |
| Evidence attachment | Case attachment, note attachment, action proof, file metadata, hash, uploader, and status | Supporting documents stay linked to the review record. |
| Report artifact | Report ID, report type, case summary, reviewed hits, rationale, evidence, and timeline | Governance teams can export or inspect the case package. |
| Downstream handoff | Webhook events | Other systems can stay aligned with the compliance record. |
Audit operations
Answer audit questions faster
Keep the audit trail readable: show what happened and link each action to its supporting evidence.
Readable timeline
Recent events and case timelines show action names, actors, timestamps, targets, changed fields, and status movement in a format teams can review quickly.
Compact audit details
Audit entries keep references and counters lightweight, while review attempts, source runs, case hits, cases, attachments, and reports retain the richer payloads.
Evidence retention by value
Zero-hit and suppressed-only screening runs can keep compact proof, while actionable hits, adverse outcomes, and compliance-required cases retain deeper evidence.
Case-ready artifacts
Attachments and report artifacts collect the notes, rationale, source context, and timeline needed for QA, management review, or regulator questions.
| Trigger | Handoff | Business outcome |
|---|---|---|
| Auditor asks what changed | Timeline and recent-events view | Show actor, time, action, target, and field movement. |
| Auditor asks what was checked | Screening report record | Show customer, profile, sources, trigger, status, and outcome. |
| Auditor asks why it was closed | Case, hit review, rationale, attachments | Show the decision packet instead of reconstructing it. |
| System needs the outcome | Webhook handoff | Keep operational records synchronized with compliance events. |
Build evidence into the AML operating model
Use these guides to connect audit evidence to programme governance, screening decisions, case review, and documented control ownership.
Decision evidence record
See the evidence behind every recorded AML decision
Open the screening record, reviewer rationale, case activity, attachments, and final outcome from one connected history—without rebuilding the decision from screenshots or separate systems.
ChecklynxEvidence attached
SCREENING RECORD
CompleteSCR-48219 · Customer review
CustomerNorthbridge Holdings
ProfileCustomer screening
SourcesSanctions · PEP
TriggeredOngoing monitoring
REVIEWER OUTCOMEFalse positive
Name similarity reviewed against identifiers and source context. Candidate does not match the customer record.
ReviewerCompliance Operations
Attachments2 supporting records
CaseCASE-1048 · Resolved
Create evidence through the workflow instead of reconstructing it later
Keep screening proof, case activity, reviewer decisions, attachments, and outcome history connected from the initial check through later monitoring and governance review.
01Screening portal
Retain the subject, profile, sources, result context, and reviewer outcome from direct investigations.
Explore 02Real-time screening APIKeep event-driven request, response, routing, and downstream decision context traceable.
Explore 03Case managementPreserve assignments, status changes, reviewed hits, notes, attachments, rationale, and final outcomes.
Explore 04Ongoing monitoringRecord the monitored population, configured process, relevant changes, suppressions, and review history.
ExploreSee how operational activity becomes reviewable evidence
01Configured check
Record the subject, trigger, screening profile, executed sources, run time, and result category.
02Reviewer action
03Outcome and chronologyConnect hit decisions, rationale, notes, attachments, checklist activity, and status changes.
Keep actor, timestamp, action, target, version, and links to the supporting domain records.
04Governance reviewPrepare report artifacts and inspect the retained history without rebuilding it from screenshots.
Measured impact from review-ready AML evidence
30–40%Read the CashDirector case study →
20%Less time spent on monthly reviews
Shopware connects retained false-positive decisions, customer screening and ongoing monitoring.
What is AML audit-trail and evidence software?
AML audit-trail and evidence software records the important actions, actors, timestamps, changes, and outcomes created during screening and case review, while linking those events to the deeper source, decision, attachment, and report records needed to explain what happened.
What makes the evidence audit-ready?
Evidence is captured as part of the workflow, not assembled after the fact. Screening runs, source context, case activity, hit decisions, reviewer rationale, attachments, timestamps, profile versions, and report artifacts stay linked to the operational record that produced the decision.
Why not store every raw payload in the audit log?
A useful audit trail should be readable. Checklynx keeps audit events focused on who did what, when, and to which record, while the deeper operational context remains in linked screening, case, hit, document, or report records. That keeps the trail searchable without losing the evidence behind it.
How does this help during audits or partner reviews?
Teams can answer the questions reviewers usually ask: what was checked, which sources were used, who reviewed the result, what changed, why the case was closed, and which evidence supported the outcome. The goal is to reduce last-minute evidence gathering and make decisions easier to explain.
What is the difference between an audit trail and a case timeline?
An audit trail provides a cross-workflow record of important actions such as who changed a status, reviewed a hit, or updated a case. A case timeline presents the investigation history for one case. They complement each other: the audit event establishes the action, while the linked case or screening record holds the richer operational context.
Can screening evidence show which sources and profile were used?
Yes. A screening evidence record can retain the subject or customer reference, run and occurrence time, screening profile, executed sources, trigger origin, review status, and outcome category so the team can show which configured check took place.
Are reviewer rationale and attachments part of the evidence record?
They can be retained with the relevant case or decision record alongside reviewed hits, source context, checklist activity, outcome, actor, and timestamps. The audit trail links important actions to that evidence rather than attempting to place every document or narrative inside one event table.
Can evidence be exported for audit or governance review?
Report artifacts can assemble relevant case summaries, reviewed hits, rationale, attachments, outcomes, and timeline context for internal QA, management, partner, or audit review. The customer remains responsible for deciding what to disclose and for meeting its retention and reporting obligations.
Does an audit trail prove that an AML decision was legally correct?
No. It helps show which information, configured controls, actions, and rationale formed the recorded decision. Legal interpretation, regulatory reporting, retention requirements, and the final compliance judgement remain the responsibility of the organisation and its authorised reviewers.