Many financial institutions, fintechs and payment companies in Canada and the US say their anti-money laundering programs are risk-based. Walk the floor and you often find something else. The tools were bought first, the workflows were built around them, and risk was added afterward to explain the choices.
That is a design problem, but it is also a hiring problem. The people you put in a compliance function, and where they sit, decide whether risk drives the work or only appears in the documentation.
The symptom: a team that is busy and not effective
You can spot a program built in the wrong order from the way the team spends its week.
- Analysts clear a long queue of alerts, and most of them close with no action.
- Your best investigators are doing triage because nobody else can.
- Risk ratings get set at onboarding and are rarely touched again.
- Turnover is highest in the entry-level analyst seats, where the work is most repetitive.
- Compliance hears about new products after they launch.
If three or more of these sound familiar, adding headcount to the queue will not fix it. You will pay more to process the same noise.
Hire for judgment at the top of the funnel
A common mistake is to staff alert review with the most junior people and save senior judgment for escalations. That sounds efficient. In practice it means the decisions that shape the whole queue, such as what gets flagged, what gets deprioritized and why, are made by people with the least context.
A risk-first team puts experienced judgment earlier. That usually means:
- A senior risk lead who owns the risk assessment as a working document. This person can explain how a score changes what the team does, not just what the score is.
- Analysts who can tell a pattern from a coincidence. Look for people who ask what a customer is likely to do, not only whether a rule fired.
- Investigators with written-reasoning skills. If a regulator asks why an alert was set aside, someone has to be able to put the logic on paper clearly.
These are not exotic profiles. They are harder to find than queue processors, which is why many employers default to the cheaper hire and then wonder why the backlog never shrinks.
Add the data and AI capability you probably lack
Tuning detection models, testing thresholds and feeding investigation outcomes back into the rules is real analytical work. In many mid-sized institutions it falls to a compliance manager who is also running the team and answering audit requests.
That is a gap. Consider a dedicated seat for someone who sits between compliance and technology:
- A data analyst or scientist who can measure which rules produce action and which produce only volume.
- A model validation or governance specialist who can document how automated decisions are made and reviewed.
- A business analyst who can translate between investigators and the engineers who maintain the monitoring system.
For smaller teams, a contract hire is often the right first step. A six to twelve month engagement to retune rules and document the logic can pay off without committing to a permanent seat before you know the shape of the work.
Fix the reporting line, not only the org chart
Risk stays on paper when compliance operates downstream of product and sales. Staffing can help here in a practical way.
- Place a compliance or risk partner inside the product or operations group, even part-time.
- Give operations leaders a clear view of how risk ratings change onboarding steps and review frequency.
- Make one person responsible for connecting detection, investigation and rule changes, so those three do not become separate functions that rarely talk.
This role is often a strong operations manager with compliance exposure, not a career compliance officer. The skill is running a loop, not interpreting a statute.
Questions to ask before you open a requisition
- What share of our alerts lead to action, and who is responsible for changing that number?
- If a high-risk customer is flagged today, what changes in how we handle them?
- Who can explain, in plain language, why a given alert was deprioritized?
- Which of our analysts are doing work that a better rule or a small amount of automation would remove?
- Where would a data or AI specialist save the most investigator hours?
The answers tell you which role you actually need. Often the first hire is not another analyst but a person who reduces the work the analysts do.
Protect the people doing the repetitive work
Alert-heavy roles burn people out. If your entry-level analysts are leaving inside a year, you are paying to retrain constantly and losing the knowledge that makes triage quicker. A clearer path from analyst to investigator, along with a real say in how rules get tuned, keeps good people longer than a modest raise on its own.
What to do next
Start with the queue. Pull a month of alerts, count how many led to action, and note which roles handled them. Then decide whether the gap is judgment, analytical capacity or ownership, and hire for that gap rather than for volume.
If you are building or reshaping a compliance, operations or data team in Canada or the US, a Traverse recruiter can help you define the roles and find the people for them.