AML Screening via MCP Server — Run Sanctions, PEP, and Adverse Media Checks from Any AI Agent

Key takeaways

• Run AML (Anti-Money Laundering) screening against 1,300+ sanctions, PEP, and adverse-media lists from any MCP-compatible AI client.
• One tool call: didit_verify_aml with full_name (required) plus optional entity type, date of birth, nationality, document number, adverse media flag, and ongoing monitoring enrollment.
• $0.20 per AML screen, $0.07/user/year for ongoing monitoring. 500 free verifications per month included.
• False positives can be cleared with an audit note via didit_session_add_review or a didit_case_manage comment.
• The Didit MCP server exposes 115 tools (hosted, OAuth-authenticated) across 19 domains — no API key required, no npm package to install.
• Used by 2,000+ companies in production. Y Combinator W26, $7.5M raised.

What is AML screening and why run it through MCP?

AML screening — checking a person or company against sanctions lists, Politically Exposed Person (PEP) databases, and adverse-media sources — is a regulatory requirement for fintechs, crypto platforms, payment companies, and any business that onboards users or processes cross-border transactions. It is typically the second check in a KYC flow, after identity verification and before the customer is approved.

The Didit Model Context Protocol (MCP) server exposes AML screening as a single tool call that an AI agent can invoke directly. There is no UI to navigate, no API key to paste into a config file, and no intermediate service to wrap. An agent equipped with the Didit connector can screen a name against live global watchlists and return a structured hit report in under two seconds.

The tool: didit_verify_aml

The didit_verify_aml tool is part of the verify domain of the Didit MCP server. It accepts the following parameters:

• full_name (required) — the name to screen.
• entity_type — person or company (defaults to person).
• date_of_birth — YYYY-MM-DD format. Improves match accuracy for persons.
• nationality — ISO country code. Further improves match precision.
• document_number — optional document ID for exact matching.
• include_adverse_media — boolean. When true, returns adverse-media findings alongside sanctions and PEP hits.
• include_ongoing_monitoring — boolean. When true, enrolls the screened entity for continuous monitoring at $0.07/user/year.
• vendor_data — optional string for vendor-specific configuration.
• metadata — optional object for custom key-value pairs.

The tool screens against 1,300+ watchlists spanning global sanctions regimes (UN, OFAC, EU, UK), PEP databases covering 220+ countries, and adverse-media sources. Every hit is returned with match details, list name, category, and confidence indicators.

How to run an AML screen from an MCP client

First, connect your MCP client to the Didit server. The hosted endpoint is https://mcp.didit.me/mcp and uses OAuth 2.1 + PKCE — no static API key is involved. In Claude, use the custom connector dialog:

Add Didit as a Claude connector

Once connected, you can prompt the agent to run an AML check. A typical prompt looks like this:

Screen the following name against global AML watchlists: John Michael Smith. Include adverse media and enroll for ongoing monitoring.

The agent calls didit_verify_aml with the parameters and returns a structured result listing every match, its category, the watchlist name, and confidence score.

Interpreting AML hits

An AML screening result includes a list of matches, each with:

• Match category — sanctions, PEP, or adverse media.
• List name — the specific watchlist that triggered the hit (e.g., OFAC SDN, EU Consolidated, UK Sanctions List).
• Match confidence — a score indicating how closely the screened entity matches the list entry.
• Entity details — name, date of birth, nationality as recorded on the list.

A hit does not automatically mean the subject is a sanctioned individual. Many matches are false positives caused by common names, partial name matches, or out-of-date list entries. The typical operator workflow is:

1. Review the match confidence and list category.
2. If the match is low-confidence or clearly a different person, add a review note to the session clearing the hit.
3. If the match is high-confidence and the entity is on a sanctions list with matching identifiers, escalate for manual compliance review.

Clearing a false positive

To document a false-positive clearance, use the didit_session_add_review tool to attach an audit comment to the original verification session:

# Agent calls didit_session_add_review with:
# session_id: the UUID from the AML screen
# comment: "False positive — John Michael Smith is a common name.
#          OFAC match is a different individual born 1975 in Iraq;
#          our subject was born 1990 in Canada."
# new_status: "Approved"

Alternatively, if a case was created from the AML hit, use didit_case_manage with the comment action to add the explanation to the case timeline. The six available actions are assign, resolve, reopen, escalate, comment, and update — all accessible from the same MCP client without switching to the console.

Pricing and free tier

AML screening is priced at $0.20 per screen. If you also need identity verification alongside it, the full KYC bundle (ID verification + passive liveness + face match + IP analysis) is $0.33. Ongoing AML monitoring costs $0.07 per user per year and is activated by setting include_ongoing_monitoring: true on the didit_verify_aml call.

Every feature includes 500 free verifications per month. The MCP server itself is free — there is no additional cost for using the MCP protocol versus the REST API. All pricing is public on didit.me/pricing with no minimums or contracts.

Beyond one-shot screening: ongoing monitoring

AML is not a one-time event. Regulated entities are required to monitor their customer base against updated watchlists on an ongoing basis. The Didit platform handles this through ongoing AML monitoring, which re-screens enrolled entities whenever watchlists are updated. Enrollment is a parameter on the didit_verify_aml call — no separate API or workflow needed.

When ongoing monitoring produces a new hit, it appears in the Business Console as a case. The MCP server exposes the full case lifecycle through six dedicated tools (didit_case_search, didit_case_list, didit_case_get, didit_case_create, didit_case_manage, didit_case_statistics), so an agent can triage new hits, add comments, escalate, or resolve cases without leaving the chat interface.

High-severity activities like SAR (Suspicious Activity Report) filing and rule-bundle management remain in the Business Console — they require human-level judgement and audit controls that are outside the MCP tool surface. The MCP handles ingest, screening, triage, and case lifecycle; the console handles governance and reporting.

When the console takes over

The MCP server is designed for triage and operational actions, not for compliance governance. The Business Console at business.didit.me is the place for:

• Configuring AML rule bundles and screening parameters.
• Reviewing and filing SARs with full audit trails.
• Managing user roles and permissions for AML workflows.
• Exporting compliance reports and audit logs.

The MCP complements the console by letting agents handle the fast loop — screen a name, check for hits, clear false positives, and escalate genuine matches — while the console remains the source of truth for compliance records and regulatory filings.

Getting started

The Didit MCP server is open source (MIT) and available on GitHub. The hosted server at https://mcp.didit.me/mcp uses OAuth 2.1 + PKCE and requires no API key, no local installation, and no npm package. Sign in with your Didit account and your agent inherits your workspace permissions.

Add the Didit connector to Claude to run your first AML screen from an AI agent.

For more detail, see the MCP overview docs, the full tool reference, and the OAuth authentication guide.

Related reading: How Didit built the identity and fraud MCP server and Didit MCP tools reference.