Skip to main content

AML Basics

Prerequisites

Before diving into AML, understand:

TL;DR
  • Bank Secrecy Act (BSA) is the foundation of US AML, enforced by FinCEN
  • CIP requires verifying identity at account opening: name, DOB, address, ID number
  • CDD involves understanding relationship nature/purpose and ongoing monitoring
  • SARs within 30 days of detecting suspicious activity: $5K+ with suspect, $25K+ without
  • CTRs required for cash transactions over $10,000
  • Card networks require full AML programs

What Is AML?​

Anti-Money Laundering (AML) refers to the laws, regulations, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income. In the US, this framework is commonly called BSA/AML or AML/CFT (Combating the Financing of Terrorism).

Key Regulatory Bodies​

AgencyRole
FinCENPrimary BSA enforcement (Treasury Department)
OCC, FDIC, Federal ReserveBank regulators with BSA examination authority
CFPBConsumer-facing enforcement
DOJCriminal prosecution

The Bank Secrecy Act Framework​

The Bank Secrecy Act (1970) and its amendments establish requirements for:

  • Recordkeeping of certain transactions
  • Reporting suspicious and large cash transactions
  • Compliance programs at financial institutions
  • Customer identification and due diligence

Key BSA Amendments​

LegislationYearKey Additions
Money Laundering Control Act1986Made money laundering a federal crime
USA PATRIOT Act2001Enhanced CIP/KYC, expanded covered entities
CDD Final Rule2016/2018Beneficial ownership for legal entities
Anti-Money Laundering Act2020Modernization, beneficial ownership to FinCEN
Corporate Transparency Act2024Beneficial ownership reporting to FinCEN

Know Your Customer (KYC)​

KYC is the process of verifying customer identity and understanding the nature of their business relationship. This is your first defense against synthetic identity fraud and application fraud. See identity verification for implementation approaches.

Customer Identification Program (CIP)​

Required information at account opening:

IndividualLegal Entity
Full legal nameLegal name
Date of birthFormation date/jurisdiction
Residential addressPrincipal place of business
ID number (SSN for US persons)EIN or equivalent
Government-issued IDFormation documents

Verification methods:

  • Documentary: Government-issued ID, passport, articles of incorporation
  • Non-documentary: Third-party databases, credit bureaus, public records
Timing

CIP must be completed at or before account opening. Some institutions allow risk-based temporary access while verification completes, but this requires additional controls.

Customer Due Diligence (CDD)​

Beyond basic identification:

  • Understand the nature and purpose of the relationship
  • Assign a risk rating based on customer profile
  • Collect beneficial ownership information (25%+ ownership or control)
  • Conduct ongoing monitoring of transactions

Beneficial Ownership Requirements​

For legal entity customers, identify and verify:

  • Beneficial owners: Individuals with 25%+ ownership
  • Control person: CEO, CFO, managing member, general partner, or equivalent

Required information for each:

  • Full legal name
  • Date of birth
  • Address
  • ID number (SSN or passport)

Exemptions:

  • Regulated financial institutions
  • SEC-registered investment companies
  • Public companies (US exchanges)
  • Government entities
  • Certain pooled investment vehicles

Corporate Transparency Act Impact​

The CTA (effective 2024) requires companies to report beneficial ownership directly to FinCEN. However, financial institutions still have independent CDD obligations and cannot solely rely on the FinCEN database.

Enhanced Due Diligence (EDD)​

Higher-risk customers require additional scrutiny:

  • More thorough background research
  • Senior management approval for relationship
  • More frequent review and monitoring
  • Source of funds/wealth documentation

Higher-risk categories:

  • Politically Exposed Persons (PEPs)
  • High-risk jurisdictions (FATF grey/black lists)
  • Cash-intensive businesses
  • Non-resident accounts
  • Correspondent banking relationships
  • Private banking
  • Virtual currency businesses

Transaction Monitoring​

What to Monitor​

CategoryExamples
Amounts/frequencyUnusual transaction sizes, sudden volume changes
Geographic patternsHigh-risk countries, unexpected jurisdictions
Behavior changesDeviation from established patterns
StructuringMultiple transactions avoiding $10K threshold
Round-dollar transactions$9,999, $9,900 repeatedly
Rapid fund movementMoney in and out quickly

Network-Specific Requirements​

Mastercard monitoring (Rules Section 1.2.1.1):

  • Cross-border activity
  • Cardholder and merchant monitoring based on risk
  • High-risk MCCs
  • Products facilitating fund movement (crypto, transfers, cash-out)
  • Activity changes over time

Mastercard ATM monitoring:

  • Out-of-pattern withdrawal volume
  • Sequential high-volume withdrawals
  • Excessive at-limit transactions
  • Out-of-pattern deposits

Card-Specific Red Flags​

PatternWhat It May Indicate
Bust-outRapid credit build-up → max out → disappear
Card testingMultiple small transactions → large purchases
Cash-advance concentrationUnusual reliance on cash advances
Geographic anomaliesTransactions in unlikely locations
Velocity anomaliesToo many transactions in short time

Building Effective Monitoring Rules​

Rule design principles:

  • Start with baseline behavior per customer segment
  • Use statistical thresholds, not arbitrary numbers
  • Combine velocity and volume triggers
  • Factor combinations (multiple red flags together)
  • Regular tuning based on outcomes

Rule categories:

TypeExample
Threshold-basedCash out >$5K in 24 hours
Pattern-basedRound-dollar transactions repeatedly
BehavioralDeviation from 6-month average
Peer-basedActivity unusual vs. similar customers
List-basedMatch against known bad actors

Alert Investigation Process​

Alert generated
    ↓
L1 review (triage)
    ↓
L2 review (detailed)
    ↓
Case escalation
    ↓
SAR decision

Suspicious Activity Reports (SARs)​

When to File​

For banks (thresholds vary by institution type):

SituationThreshold
Suspected violation with identifiable suspect$5,000+
Suspected violation without identifiable suspect$25,000+
Insider abuseAny amount
Money laundering or BSA violation$5,000+

Note: Money Services Businesses (MSBs) may have $2,000 threshold.

SAR Filing Timeline​

EventDeadline
DetectionStart 30-day clock
Initial SAR30 calendar days from detection
Extension (if investigating)Up to 60 days total
Continuing activityRisk-based follow-up

Continuing Activity SARs: Historically ~90 days, but current FinCEN guidance emphasizes risk-based timing rather than fixed cadence. Many institutions still use ~90 days as a default.

SAR Confidentiality​

  • Cannot disclose SAR filing to the subject
  • No tipping off the subject of investigation
  • Safe harbor for good-faith filings

What Goes in a SAR​

  • Subject information (name, address, DOB, SSN, account numbers)
  • Suspicious activity description
  • Dates and amounts involved
  • Account information
  • Narrative explaining why activity is suspicious
  • Documentation references

Currency Transaction Reports (CTRs)​

Requirement​

File a CTR for cash transactions exceeding $10,000 in a single business day.

Key Points​

  • Aggregate multiple transactions by same person
  • Structuring (breaking up transactions to avoid reporting) is illegal
  • 15-day filing deadline
  • Applies to deposits, withdrawals, exchanges

Exemptions​

Certain customers may be exempt from CTR filing:

  • Domestic banks
  • Government entities
  • Listed public companies
  • Eligible non-listed businesses (requires risk assessment and documentation)

AML Program Requirements​

Five Pillars​

Every covered financial institution must maintain an AML program with:

  1. Written policies and procedures
  2. Designated compliance officer (BSA Officer with authority and resources)
  3. Ongoing training for relevant personnel
  4. Independent testing (regular audits)
  5. Risk assessment (periodic evaluation)

Mastercard Requirements (Rules Section 1.2)​

  • Client identification and due diligence
  • Controls, resources, and monitoring systems
  • Regulatory recordkeeping and reporting
  • Risk assessment incorporating all products
  • Training for AML personnel
  • Independent audit processes

Visa Requirements​

Visa's rules focus on data protection and risk, requiring members to:

  • Investigate suspected compromise, fraud, or money laundering
  • Report to Visa
  • Maintain security
  • Cooperate with investigations

Sanctions Compliance​

Key Lists​

ListMaintained By
SDN ListOFAC (US Treasury)
Restrictive MeasuresEuropean Union
Consolidated ListUN Security Council

Mastercard Requirements (Rules Section 1.2.2)​

  • Issuers: Screen cardholders, service providers, agents
  • Acquirers: Screen merchants, service providers, agents
  • Screening at onboarding and ongoing
  • No activity with sanctioned persons, entities, or jurisdictions

Recordkeeping Requirements​

Record TypeRetention Period
Customer identification records5 years after account closure
Transaction records5 years from transaction
SAR filings and documentation5 years from filing
CTR filings5 years from filing
AML training records5 years

Consequences of Non-Compliance​

ViolationPotential Consequence
Failure to file SARsUp to $1M civil penalty, criminal penalties
Failure to maintain AML programEnforcement actions, consent orders
Willful BSA violationsCriminal prosecution, $500K fines, 10 years
Repeat violationsLicense revocation, processing restrictions
Network non-complianceLicense suspension, termination

Recent Enforcement Examples​

InstitutionYearPenaltyIssue
TD Bank2024$3BBSA/AML failures
Wells Fargo2023$97.8MAML compliance failures
Bittrex2022$29MCrypto SAR filing failures
HSBC2012$1.9BInsufficient AML controls

Issuer-Specific Considerations​

Prepaid Card Programs (Visa Rules 10.5.1.1)​

  • Report approved/pending/declined enrollments
  • Report loads, reloads, unauthorized requests
  • Report fraud (prepaid, transaction load, enrollment)
  • Participate in Prepaid Clearinghouse Service

Credit Card Applications (Visa Rules 10.5.1.2)​

  • Report approved/declined applications
  • Report unauthorized requests and fraudulent applications
  • Within 48 hours of approval/decline/fraud determination
  • Submit per CCA requirements

First-Party Fraud Considerations​

First-party fraud may indicate:

  • Synthetic identity fraud
  • Bust-out schemes
  • Potential money laundering
  • Account takeover for laundering purposes

Coordinate fraud and AML functions to identify overlapping patterns.

Practical Implementation Guidance​

Building an AML Program from Scratch​

Phase 1 (Foundation):

  • Appoint BSA Officer
  • Draft policies and procedures
  • Implement basic CIP/KYC
  • Establish CTR filing process

Phase 2 (Monitoring):

  • Deploy transaction monitoring
  • Define initial rules based on product risk
  • Establish alert investigation workflows
  • Implement SAR process

Phase 3 (Optimization):

  • Tune rules based on outcomes
  • Conduct first independent audit
  • Formalize training program
  • Establish ongoing risk assessment

Common Implementation Mistakes​

  • Over-reliance on automated systems without human review
  • Insufficient investigator training
  • Static rule sets that don't evolve
  • Siloed fraud and AML teams
  • Inadequate documentation of decisions

Coordinating AML with Fraud Prevention​

Overlap: Both functions monitor patterns, investigate behavior, may terminate accounts, and deal with suspicious activity.

Integration opportunities:

  • Shared case management systems
  • Combined alerts for cross-functional review
  • Joint training on overlapping typologies
  • Coordinated customer communication

Next Steps​

Building an AML program?

  1. Start with CIP/KYC - Foundation requirements
  2. Define risk ratings - Segment customers
  3. Set up transaction monitoring - Build initial rules

Improving existing program?

  1. Tune monitoring rules - Reduce false positives
  2. Coordinate with fraud team - Share insights
  3. Prepare for independent testing - Audit readiness

Handling a suspicious activity case?

  1. Review SAR requirements - Know thresholds
  2. Follow investigation process - Document thoroughly
  3. Maintain confidentiality - No tipping off

See Also​