User roles at a glance
Every FlowSentry role in one place, what each can do, and who approves what under maker-checker.
tocOn this page
FlowSentry gives each person a role, and each role a set of permissions. Your permissions decide which pages you see, which buttons work and which items you can approve. This page lists every role an institution can assign, explains who checks whose work, and points you to the detailed article for each role.
Institution roles
| Role | Purpose | Key permissions | Typical pages |
|---|---|---|---|
| Analyst | AML analyst and investigator | Work alerts and cases, record suspicion, review screening hits, author rules, run file analysis, read customers | /alerts, /screening, /monitoring/rules, /analysis/files |
| Senior analyst | Team lead and first checker | Everything an analyst has, plus supervise cases, QA review, confirm screening hits, bulk-close alerts, propose KYC changes | /alerts, /qa, /screening, /customers/kyc-changes |
| MLRO | Money Laundering Reporting Officer or head of compliance | Everything a senior analyst has, plus decide and view STRs, approve rules, manage and approve lists, review and approve onboarding, approve risk models, approve KYC changes | /approvals, /reporting, /risk/models, /approvals/inbox |
| Deputy MLRO | The MLRO's checker counterpart | Identical to the MLRO; decides what the MLRO recorded and approves what the MLRO made | Same as the MLRO |
| Risk manager | Customer risk models, EDD and risk reporting | Draft risk model versions and run the simulator, propose risk overrides, work EDD checklists, read rules and customers | /risk, /risk/models, /risk/edd, /risk/ewra |
| Administrator | Tenant administrator | Propose and approve tenant settings, manage and approve data sources and mappings, upload files, approve rules, manage lists, read the audit trail | /admin/settings, /integration/sources, /audit, /ops/health |
| Integration engineer | The institution's IT team | Connect data sources, build mappings, upload files | /integration/sources, /ingestion/mapping-studio, /integration/files |
| Executive | Board and senior management | Aggregate dashboards only, with no case-level content | /dashboards/executive, /dashboards |
| Auditor | Internal audit or regulator, read-only | Read the audit trail, cases (including STR material), rules and customers; dashboards; acts on nothing | /audit, /regulator/reviews, /alerts, /reporting |
| QA reviewer | Second-line quality assurance | Read cases, review sampled alert closures, dashboards | /qa, /alerts |
| Relationship manager | Front office and onboarding officer | Capture onboarding applications, answer information requests, upload documents, read customers, propose KYC changes | /requests, /onboarding, /customers |
| KYC reviewer | Second line on onboarding and CDD | Review onboarding, work EDD checklists, upload documents, read customers, propose KYC changes | /onboarding/reviews, /risk/edd, /customers/kyc-changes |
| Senior approver | Senior management sign-off | Approve onboarding (including high-risk), approve KYC changes and EDD, read customers | /customers/kyc-changes, /risk/edd, /onboarding |
| List manager | Maintains internal and domestic watchlists | Propose list changes and exclusions; dashboards | /screening/lists, /screening/exclusions |
| Screening checker | Four-eyes on screening | Confirm true matches and proposed clears, approve lists and exclusions; dashboards | /screening, /screening/exclusions |
Note: Onboarding pages appear only when your institution has client onboarding switched on.
Vendor-side roles
Two roles belong to the FlowSentry service team, not to your institution. You will not hold them and they cannot be assigned to your staff:
- Platform operator runs the shared platform: provisioning institutions, platform-wide scheduled jobs and reference data.
- List desk officer keeps the platform lists up to date, such as the UN Security Council list, Kenya domestic designations, OFAC and the PEP list.
Neither role can see your cases, customers or reports.
Who approves what
Every regulated outcome needs two people: one makes the change, a different person checks it. The table shows who can act as the checker and whether a fresh second factor (step-up) is needed.
| What is made | Checked by | Step-up |
|---|---|---|
| Suspicion recorded on a case | MLRO, Deputy MLRO (File, Return or Do not file) | Yes, to file |
| Alert closure (sampled) | Senior analyst, MLRO, Deputy MLRO, QA reviewer | No |
| Proposed true match or proposed clear | Senior analyst, MLRO, Deputy MLRO, Screening checker | Yes |
| Watchlist version or internal list change | MLRO, Deputy MLRO, Screening checker | Yes |
| Good-guy exclusion | MLRO, Deputy MLRO, Screening checker | Yes |
| Screening four-eyes policy | MLRO, Deputy MLRO, Screening checker | Yes |
| Rule version | MLRO, Deputy MLRO, Administrator | Yes |
| Onboarding application | Senior approver, MLRO, Deputy MLRO | High-risk applications only |
| KYC change on a live customer | Senior approver, MLRO, Deputy MLRO | Yes |
| EDD checklist sign-off | Senior approver, MLRO, Deputy MLRO | No |
| Risk override or risk model activation | MLRO, Deputy MLRO | Yes |
| Alert-work policy | Senior analyst, MLRO, Deputy MLRO | Yes |
| Tenant settings | A second Administrator | Yes |
| Data source go-live | Administrator | Yes |
| Mapping template | Administrator | Yes |
Step-up asks for your authenticator code or passkey again if your last check is more than five minutes old. See Sign in and MFA.
Several roles, never your own work
A person can hold more than one role, for example Senior analyst and KYC reviewer. Your permissions are the combination of all your roles.
Holding two roles never lets you check your own work. The server compares the maker and the checker on every item, and refuses with the message "The approver must be a different person from the author (segregation of duties)." The same applies to an MLRO deciding a suspicion they recorded: the Deputy MLRO decides it instead.
Navigation follows your roles
The icon rail, the flyouts and the command palette show only the pages your roles allow. A page you cannot open never appears, and every action is checked again on the server when you take it. If you expect to see a page and cannot, your role probably does not include it.
Tip: Your roles are listed as badges in the user menu. Select your name in the app bar to see them.
Changing your role
FlowSentry does not yet have a self-service user-management screen. Accounts and role assignments are set up for your institution during provisioning. To add a role, remove one or set up a new colleague, ask your administrator.