This guide covers how AML, the Bank Secrecy Act (BSA), OFAC sanctions, KYC, transaction monitoring and reporting relate, with a UK and cross-border lens. Your obligations depend on your activities, customers, jurisdictions and any US nexus. Check current official guidance before acting on anything here.
Key Takeaways
- AML targets money laundering and related crime; OFAC compliance targets US sanctions restrictions.
- BSA duties, KYC, screening and monitoring support each other but never replace each other.
- A risk-based programme covers customers, products, geographies, channels and ownership structures.
- Governance, escalation records and independent testing matter as much as technology.
What AML, BSA and OFAC Compliance Cover
AML and money laundering
Money laundering is the processing of criminal proceeds to disguise their illegal origin. The UNODC overview describes the commonly cited stages: placement, layering and integration. Real schemes don't always follow that neat sequence, so treat it as a teaching model.
AML controls aim to prevent, detect and report the movement of illicit funds.
OFAC and sanctions compliance
The US Treasury's Office of Foreign Assets Control (OFAC) administers and enforces US economic and trade sanctions. Programmes differ. Measures can include:
- Blocking property of designated persons
- Prohibiting specified transactions
- Sectoral or country-wide restrictions
- Secondary sanctions
Blocked property is frozen. Under some non-blocking prohibitions, the transaction must be rejected instead.
OFAC's 50 Percent Rule also treats an entity owned 50% or more in aggregate by blocked persons as blocked, even if it isn't listed. That makes ownership analysis a core control.
BSA versus AML
The Bank Secrecy Act, established in 1970, is a US statute authorising Treasury reporting and record-keeping requirements. AML is the broader concept covering laws, controls and programmes across jurisdictions. The BSA is one part of that picture, not a synonym for it.
Core programme elements include:
- Internal controls
- Independent testing
- A designated compliance officer
- Training
Ongoing customer due diligence (CDD) is a separate rule, sometimes informally called a fifth pillar.
Who may be in scope
Not every fintech is automatically caught by every BSA or OFAC requirement. Scope turns on licensing, activities, counterparties and jurisdictions. Banks, money services businesses, payment firms and crypto businesses can face quite different duties.
OFAC generally covers US persons, including US-incorporated entities and, under some programmes, foreign subsidiaries they own or control. Some prohibitions also reach non-US persons who cause a US person to breach sanctions.
UK and cross-border considerations
UK sanctions, EU sanctions and OFAC are separate legal regimes with their own lists, licensing and reporting. In the UK, the relevant framework includes the Sanctions and Anti-Money Laundering Act 2018 and the Money Laundering Regulations 2017, with HM Treasury's OFSI handling financial sanctions.
Map obligations by entity, activity and customer location rather than relying on one list. The EU's AML Regulation (2024/1624) generally applies from 10 July 2027.
How AML and OFAC Compliance Differ and Work Together
Different objectives and risk questions
A domestic payment can raise AML concerns with no OFAC match. A sanctions issue can arise with no sign of laundering. Different questions, different decisions.
KYC and CDD versus sanctions screening
KYC and CDD establish who the customer is, the purpose of the relationship and expected activity, then assess risk. Screening checks customers, beneficial owners, counterparties and transactions against applicable sanctions lists.
Neither substitutes for the other. OFAC advises checking the complete list entry and comparing multiple identifiers, because a name match alone may be a false positive.
Transaction monitoring, reporting and sanctions reports
The reporting rules differ in trigger, timing and recipient:
| Report | Trigger and timing | Recipient |
|---|---|---|
| US bank SAR | Generally $5,000 threshold; within 30 calendar days of detection | FinCEN |
| US MSB SAR | $2,000 or more; within 30 calendar days | FinCEN |
| OFAC blocked-property report | Within 10 business days of blocking | OFAC |
| OFAC rejected-transaction report | Within 10 business days | OFAC |
| UK SAR | As soon as practicable after suspicion forms | UKFIU (NCA) |
| UK OFSI report | Where there is knowledge or reasonable cause to suspect dealings with a designated person | OFSI |
OFSI states that sanctions reporting is additional to other reporting, so a SAR doesn't satisfy it. Verify current thresholds and deadlines for each jurisdiction before relying on this table.
Blocking, rejecting and escalating
A potential sanctions match may call for a hold, block, rejection, licence review or escalation. Suspected laundering may call for investigation, enhanced due diligence, account restrictions or a SAR.
Staff shouldn't assume a match is real without evidence. They also must not tell customers about confidential reporting decisions. UK law restricts tipping-off.
One workflow, separate decisions
A practical lifecycle looks like this:
- Onboard the customer and review beneficial ownership
- Screen against applicable lists
- Screen payments
- Monitor transactions
- Adjudicate alerts
- Escalate cases
- Report and keep records
AML and sanctions teams can share data and governance. Keep separate decision criteria and audit trails.
How to Build an Integrated AML and OFAC Compliance Programme
Run an enterprise-wide risk assessment
Assess inherent and residual risk across customers, products, geographies, channels, counterparties, ownership structures and third-party providers. FFIEC guidance describes updating the assessment for material changes. New products, markets, acquisitions or payment rails should trigger a refresh.
MLR-supervised firms need a current business risk assessment and proportionate controls.
Set governance and accountability
You need board and senior-management oversight, a named compliance owner, a documented risk appetite and clear escalation routes. Compliance, operations, legal, product, technology and support teams must coordinate. A director or senior manager holds overall responsibility, with an appointed MLRO.
Apply risk-based CDD and EDD
Onboarding should establish identity, beneficial ownership, expected activity and relationship purpose. Apply enhanced due diligence to higher-risk customers, products, jurisdictions or structures.
Relevant factors include politically exposed persons (PEPs), opaque ownership, adverse information and unclear source of funds. FATF stresses that PEP status doesn't mean criminality. None of these is an automatic trigger on its own.
Design sanctions-screening controls
- Screen at onboarding, at payment and on list updates
- Capture accurate, complete data
- Handle name variations and transliteration
- Check beneficial owners, applying the 50 Percent Rule
- Map applicable OFAC, OFSI and EU lists
- Document every alert disposition
- Know your licence and exemption process
Confirm current OFAC ownership guidance before finalising rules.
Build monitoring, investigation and reporting
Scenarios should reflect your risk assessment. Typical typologies include unusual velocity, unexplained cross-border activity, structuring, rapid movement of funds and activity inconsistent with the customer profile.
Prioritise alerts, set investigation standards, retain evidence and document SAR decisions.
Support it with the five pillars and independent assurance
Policies and controls, a designated officer, training, independent testing and CDD must show up in daily operations. Exact requirements depend on your legal framework. Testing should assess whether controls work in practice, not merely whether documents exist.
Common Risk Areas and Red Flags
Digital assets, instant payments and emerging products
Crypto, wallets, decentralised services, instant payments, prepaid products and API-based payments raise issues of speed, traceability and customer identification. FATF guidance applies financial-institution measures to virtual asset service providers, including the Travel Rule.
Don't label a whole category unlawful. In the Tornado Cash case, the US Fifth Circuit held in 2024 that the immutable smart contracts at issue weren't sanctionable property, and the US Treasury delisted the service in March 2025. That ruling shouldn't be generalised to all mixers.
Cross-border activity and complex structures
Watch for:
- High-risk or sanctioned jurisdictions
- Nested or correspondent relationships
- Shell companies, trusts and layered ownership
- Unusual routing across currencies or jurisdictions
Identify the underlying parties and the commercial purpose. FinCEN's May 2026 alert on Iranian networks describes front companies and layered structures, and notes that no single indicator is determinative.
Practical red flags
- Inconsistent customer information
- Unexplained changes in transaction behaviour
- Rapid pass-through activity
- Repeated name-screening alerts
- Opaque beneficial ownership
- Payments without a credible business reason
A red flag prompts investigation. It isn't proof of crime or a sanctions breach.
How to Keep the Programme Effective
Test, tune and document
Independent testing, quality assurance, list-update checks, alert sampling, rule validation and data-quality reviews all feed remediation tracking. Regulators, banking partners and investors expect evidence such as:
- Test reports with findings and owners
- Alert samples and dispositions
- Rule-tuning rationale
- Remediation logs
- Board and committee minutes
Failures here are costly. The FCA fined Starling Bank £28,959,426 after its automated screening covered only a fraction of the relevant sanctions lists. In the US, CoinList settled with OFAC for $1,207,830 after screening missed users in Crimea.
Training, reporting and regulatory change
Give onboarding, operations, investigators, leadership and the board role-specific training. Track management information on themes, overdue reviews, control gaps and remediation.
Feed regulatory updates, enforcement actions, new products and emerging typologies back into policies and training. FinCEN's 2026 AML/CFT programme proposal, for instance, is a proposal, not a final rule, so monitor it.
When to bring in additional compliance leadership
Growing or cross-border firms often need interim or fractional support for a CCO, BSA Officer, CAMLO or MLRO. Typical moments include:
- Product launches
- Sponsor-bank reviews
- Fundraising and expansion
- Remediation
Fraxtional offers Director-led fractional compliance leadership for fintech, banking and crypto businesses that want embedded expertise without a full-time executive hire. Its Directors have acted as named BSA Officer, CAMLO or MLRO.
The FCA says external advisers can support compliance, but the accountable person needs sufficient knowledge, experience and time. Outsourcing doesn't transfer responsibility, and external support as the sole compliance resource isn't considered sufficient.
Frequently Asked Questions
What is OFAC and AML?
OFAC is the US Treasury office that administers and enforces US sanctions. AML means the measures used to prevent, detect and report money laundering and related financial crime.
Is BSA the same as AML?
No. The BSA is a US statute with reporting and programme requirements. AML is broader and covers laws, controls and programmes in any jurisdiction.
What is money laundering in AML?
It is the concealment, movement or use of proceeds connected to unlawful activity. UNODC describes placement, layering and integration as its common stages.
What is the purpose of the Anti-Money Laundering Act (AMLA)?
In the US, the Anti-Money Laundering Act of 2020 took effect on 1 January 2021 and modernised the AML regime. "AMLA" has no single universal meaning, so confirm which jurisdiction a question refers to.
What are the 5 pillars of a BSA AML programme?
The four statutory elements are internal controls, independent testing, a designated compliance officer and training. Ongoing CDD is the commonly cited fifth. Confirm requirements for your regulatory status.
What are the four types of sanctions?
Sources vary, but measures are often grouped as country-wide, entity or individual-based, sectoral and activity-based. Terminology differs by programme and jurisdiction, so check the applicable regime.
