Custos is Latin for “guardian, keeper”. Tom literally stands guard over your compliance.
AML Operations. Automated. Local. Human-supervised.
Tom Custos performs first-line AML/KYC/KYB screening, collects evidence, prepares case files and hands ready-to-review investigations to your MLRO / Head of Compliance.
Checks clients, counterparties, employees, suppliers, UBOs, directors, websites, domains, banks and transactions — locally on your PC/Mac, 24/7.
* Estimated: depends on screening depth, number of sources and share of cases requiring escalation.
The routine workload of an L1 AML Analyst — not the final responsibility of the MLRO.
Unlike monthly-subscription AML SaaS tools, Tom Custos works locally on the client device: sees the screen, controls the browser and performs the check step by step, saves evidence and prepares documents the way an employee would.
| Process | AML Analyst | Tom Custos |
|---|---|---|
| Input from tables, CRM or case queue | ✓ | ✓ |
| Browser checks in approved sources | ✓ | ✓ |
| Official sanctions databases / open-source screening | ✓ | ✓ |
| Commercial AML database workflow, if the client has a subscription | ✓ | ✓ |
| PEP, adverse media and public search review | ✓ | ✓ |
| Company, UBO, domain, IP and trade checks | ✓ | ✓ |
| Evidence Collection / PDF / Screenshots | ✓ | ✓ |
| Case Preparation + Escalation Draft | ✓ | ✓ |
| Final Regulatory Decision | → MLRO | → MLRO |
Ready handover for every cycle — without building a backlog.
At the end of every cycle, Tom shows what cleared, what needs attention, where evidence is stored and which cases are ready for MLRO review. Every result is tied to a Case ID and saved for internal audit.
- 01Checks all parties
Individuals, companies, UBOs, directors, counterparties, banks, employees, websites, domains and goods.
- 02Saves evidence
PDFs with screening date, screenshots, source URLs, Case ID and folder structure.
- 03Prepares the case file
Collects evidence, classifies the result and prepares an escalation draft.
- 04Hands over to the MLRO
Ambiguous matches, red flags and EDD cases go to the MLRO or compliance team for decision.
For every Case ID, Tom saves the screening date and source, PDFs and screenshots of key steps, final classification, escalation reason and the agent action history. The MLRO receives not just a status, but a reproducible evidence pack.
Not just onboarding. The full first-line AML/KYC/KYB review scope.
The logic is built around AML tasks: clients, beneficiaries, directors, employees, counterparties, banks, websites, IP/domain footprint and sanctioned goods.
Individuals
- Sanctions / PEP
- Adverse Media
- DOB matching
- Citizenship / country risk
- Identity data correlation
Companies
- Registration data
- Directors / UBOs
- Counterparties
- Banking partners
- Jurisdiction analysis
Websites
- Russia / Belarus mentions
- Phone numbers
- Addresses
- Branches
- Business relationships
Goods
- HS / commodity codes
- TARIC
- eCFR
- UK Legislation
- Export restrictions
Tom does not work only from a list of websites.
Inside the local node, Tom keeps an AML knowledge base: the client’s checklists, typical red flags, CDD / EDD rules, sanctions screening, PEP screening, adverse media review, jurisdiction risk, UBO review, trade compliance, export restrictions and internal client policies.
Screening rules
Client checklists, criteria for standard and enhanced due diligence, file naming rules and evidence storage procedure.
Red flags and deviations
Sanctions, PEP, adverse media, jurisdiction risk, UBO review, address links and atypical matches.
Goods and restrictions
Trade compliance, export restrictions, product risk, unusual corporate structure and internal client policies.
The Tom Custos AML Wiki is the public knowledge layer of the project — an open practical reference for AML workflows, red flags, evidence collection and MLRO escalation logic. Universal AML knowledge is published openly, while each local client node applies internal policies and evidence procedures on top of this open base.
When a check deviates from the typical scenario — for example, an ambiguous match, unusual jurisdiction, address link, product risk or non-standard corporate structure is found — Tom refers to the local knowledge base, records the reason for deviation and escalates the case to the MLRO or compliance team. Tom does not make the final compliance decision. He identifies deviations, explains what looks atypical, saves the evidence and hands the case to the MLRO for decision.
Tom works like a hired employee, not like a subscription AML service.
Open AML Knowledge Base
Explore the Tom Custos AML Wiki — a practical knowledge base for AML workflows, checks, red flags, evidence collection and MLRO escalation.
Open-source AML Skills
Tom Custos AML Skills Pack defines operational workflows for local AML agents: onboarding, screening, adverse media, EDD and MLRO escalation.
Local Agent Orchestration
Tom Custos turns checklists, AML skills and local LLM instructions into coordinated on-device operations: intake reading, source checks, evidence capture, PDF/screenshots, task queues, messenger heartbeats and MLRO handover.
Tom does not forget periodic reviews.
He builds a queue of periodic AML reviews by risk category and runs re-checks on schedule.
Every 6 months
Automatic queueing and an evidence package after the new cycle.
Every 12 months
Periodic review without manual reminders or Excel calendars.
Every 18 months
Deadline control and result storage in a unified structure.
Scaling by device.
Each Tom Custos node works autonomously: with its own access, local data storage and separate task queue. If you need to check more clients, a new Tom Custos node is added on a separate device.
2 devices ≈ 2× more checks
10 devices ≈ 10× more checks
| Fintech client base | Recommended Tom nodes | Capacity benchmark |
|---|---|---|
| 10,000 clients | 1 node | up to 10,000+ checks / month |
| 100,000 clients | 2–3 nodes | 20,000–30,000+ checks / month |
| 1,000,000 clients | 10–20 nodes | 100,000–200,000+ checks / month |
When there are multiple devices, a separate control agent is added to distribute tasks between Tom nodes, track the queue, monitor statuses and collect a consolidated summary across all nodes.
The model depends not only on the client base, but also on incoming onboarding volume, share of legal entities, risk level and EDD depth.
Send a name or company in chat — Tom will check it out of queue.
Send a request through WhatsApp, Telegram, Zalo, Signal, Slack, Teams, Discord or email. Tom runs a priority check, returns a short conclusion and tells you where the full report and evidence are stored.
The team writes to Tom where it already works every day.
Result from the selected source and anything that requires review.
PDFs, screenshots, URLs, Case ID and the MLRO report are saved automatically.
Tom also sends regular status updates: whether the node is running, how many checks are completed, how many cases were escalated and whether there are errors. If the report does not arrive on time, the team immediately knows to check the device or the agent.
For regulated businesses where AML routine grows faster than the team.
Onboarding, periodic review, sanctions screening.
Clients, merchants, counterparties and payment chains.
Mass onboarding and regular reviews.
Clients, companies, high-risk jurisdictions and red flags.
KYC, counterparties, providers and payment partners.
Client due diligence and risk-profile review.
Suppliers, banks, counterparties and trade restrictions.
International payments, correspondents and beneficiaries.
Local architecture reduces the risk of leakage of client data.
Tom Custos runs on the client device: LLM, vision models, browser control and evidence storage all operate locally. Case materials are not sent to external AI providers. Screening queries go only to licensed screening databases, sanctions sources, domain intelligence tools and approved search engines configured by the client.
│
├─ Local Agent ····· workflow orchestration · TCAML Framework
├─ Local LLM ······· LM Studio · Ollama · vLLM
├─ Vision Model ···· Moondream2 · SmolVLM2 · Qwen-GUI-3B
├─ Browser Control · screen recognition · local browser actions
├─ Evidence Storage · local · client NAS
│
└─ outbound HTTPS · ALLOWLISTED SOURCES ONLY
├─ Commercial AML Databases · World-Check · Dow Jones · LexisNexis · client subscription
├─ Official sanctions DB · OFAC · UN · EU · Local lists
├─ Domain / IP Intelligence ·· DomainTools · MaxMind
└─ Adverse Media ·· Google · Bing · Yahoo · news databases
→ Data is not sent to external AI APIs for processing
The language model is run through LM Studio, Ollama, vLLM or equivalent — on the client CPU/GPU.
Computer-vision models (Moondream2, SmolVLM2, Qwen-GUI-3B) read the client screen and do not send screenshots to external APIs.
PDFs, screenshots, logs and case files are stored locally or in the client’s storage: NAS, corporate drive, S3-compatible on-prem.
The local architecture excludes transferring materials to external AI APIs, but it does not remove normal requests to databases and search engines. This is not “zero risk”: the final security level depends on the client device, encryption, access controls, OS updates and network configuration.
Stack and instructions can be reviewed independently.
Agent configuration files, checklists and working instructions are available to the client for security review. They can be kept under internal version control, checked for hidden endpoints and provided to an independent auditor.
Traffic review
The security team can review the allowlist, outbound connections and absence of hidden data exfiltration channels.
Readable instructions
Checklists, red flags, sources and escalation rules are stored in readable form and available for review.
Change control
Configuration can also be version-controlled inside the client environment, with every change and approval recorded.
From your checklist to a working AML node — up to 7 days.
Tom is configured for your process, sources, naming rules, folder structure and escalation rules.
We turn your AML checklist, list of databases, red flags, file naming rules and escalation order into Tom’s job duties — clear working instructions the agent uses to perform checks.
We deploy the local node and configure the local LLM, vision model and TCAML Framework. Approved source workflows, S010 stagegates and the evidence/case-folder structure are connected and tested.
The MLRO reviews results, rules are calibrated and Tom takes over the routine.
Build the Tom Custos configuration you need. Quoted on request.
Tom is priced as a local AML operations setup, not as a bundled database subscription. Select the operations, sources, inputs, outputs and escalation channels you want Tom to perform and send the configuration for a price calculation.
Base local agentiA first working local node with the minimum AML cycle: public-source check, evidence capture, result classification and MLRO-ready reporting.included in every setup+
Operation workflowswhat Tom performs+
Source workflowswhere Tom checks+
Official sanctions databasesofficial lists
Commercial AML databasesclient subscription
PEP, media and public searchscreening depth
KYB, UBO and regulator registerscompany evidence
Domain, DNS and IP intelligencedigital presence
Trade, export controltrade restrictions
Blockchain intelligencecrypto risk
Inputs, outputs and evidenceinputs and outputs+
Scaling and deploymentdevices and OS+
What people ask first.
Does Tom replace the AML officer?+
Does Tom file reports to the regulator himself?+
How are privacy and security ensured?+
Can we get a full audit trail of the agent’s actions?+
What are the risks of false positives and false negatives?+
What happens to data during a failure, update or powered-off device?+
Additionally, Tom can send a regular status notification: once a day or at another configured interval. The notification shows that the agent is running, how many checks were completed, how many cases were escalated and whether there are errors.
If the notification does not arrive at the scheduled time, it is a signal to check the device, internet, agent status or involve the setup specialist. If the computer is simply turned off, Tom does not work until the device is started again.
How is Tom Custos calibrated to our checklist and sources?+
How many checks can one device perform?+
How does pricing scale?+
What is included in the Base local agent?+
Can we deploy Tom Custos on more devices later?+
How can we pay for Tom Custos setup?+
Why does it matter that Tom controls the browser?+
Put Tom Custos on AML duty 24/7.
Launch in up to 7 days: Tom runs first-line screening on your PC/Mac, prepares evidence packs and hands decision-ready cases to the MLRO.