No stitching together a screening tool, a spreadsheet of clients, and a folder of PDFs. Kartula runs the whole anti-money-laundering loop as one connected workbench.
Add the companies you're responsible for and Kartula keeps them under watch. A new sanctions designation becomes a typed event the night it is published, attributed to its list and severity-ranked so the critical ones surface first; new annual accounts update the company's financial-health grade and trend. Register publications — a change of status, a moved seat, an insolvency — are read the same way, and switch on for Luxembourg as LBR access is put in place.
Companies and the parties on file are matched against the EU consolidated, UN Security Council, US, UK, Swiss and Canadian sanctions lists, refreshed every night. Politically-exposed-person screening runs on a PEP source you are licensed for. Matching is tuned for the languages you work in — accents and diacritics folded, name variants and legal-form suffixes handled — so real hits aren't missed and noise is kept down. Nothing is auto-decided: candidates land in a review queue where a person confirms or dismisses, with the reason recorded.
Instead of a calendar reminder every few years, a file reopens the moment something material happens — a critical change event, a new sanctions match — and otherwise on a cadence set by the client's risk tier. The review queue is a live worklist: it tells you who needs attention today and why, and each completed review is written to the audit trail. It's the shape of due diligence AMLR is pushing everyone toward.
Look up any company and Kartula assembles a sourced report: the ownership links, an A–F financial-health grade from the filed annual accounts, how the record compares with what the client declared, the screening result, and the risk signals it found — from sanctions exposure and high-risk jurisdictions to shell-company indicators. Export it as a PDF for the client file, with every figure attributed to where it came from.
Open a customer-due-diligence case with the standard measures, and an enhanced-diligence block that appears when the risk rating is high. Record your decision, and — when a case warrants it — Kartula assembles a suspicious-activity report in goAML format as a draft. It maps your risk signals to the report's indicators and lays the XML out in the goAML structure; you write the narrative, complete the report and file it. Kartula never files on its own.
Everything Kartula surfaces is attributed to where it came from, so a finding can always be traced back to a source you can stand behind.
Beneficial ownership stays with your own lawful access to the register (RBE): Kartula holds what you record from it and the client's declarations, compares them with the published records, and never scrapes a gated register on your behalf. It's the defensible model, and it keeps your obligation where it belongs.
Every vendor in this market now says “AI-powered”. Ask them which part. In an AML tool the answer matters, because a supervisor will eventually ask you the same question about the file you signed.
Today nothing in Kartula is written by a model: the narrative of a suspicious-activity report is yours, from a structured template. Where a model is added, it drafts at the edges only — a first narrative from the signals already on file — and the draft arrives labelled, worthless until a named person signs it off, with the sign-off in the audit trail under their name.
The parts that decide anything are deterministic and unit-tested: the diff that produces a change event, the fuzzy matcher that raises a sanctions candidate, the risk logic behind a rating. No model is in that path. A screening hit is reproducible, explainable and identical every time you run it — which is the only kind of hit you can defend.
Why draw the line there. A model that drafts a paragraph from facts already on file is doing something it is good at, and the worst case is a clumsy sentence a reviewer rewrites. A model that decides whether a person is on a sanctions list is doing something it is bad at, and the worst case is a missed hit you cannot explain to the CSSF. The line is not caution for its own sake — it is drawn where the failure modes change.
We'd rather you trust the tool than be surprised by it. So plainly:
Book a 30-minute demo — we'll show the full loop on real Luxembourg companies.