Introduction
Money laundering moves an estimated 2% to 5% of global GDP through the financial system every year — up to $4 trillion annually, per IMF estimates. Regulators are paying attention.
In 2023 alone, global AML, KYC, and sanctions penalties reached $6.6 billion — a 57% jump year-over-year. Transaction monitoring failures alone accounted for $3.3 billion of 2024's enforcement total.
Yet many financial institutions still treat AML compliance as a documentation exercise : policies filed away, training boxes ticked, monitoring systems running unchecked.
This guide is for compliance officers, founders, and risk leaders at fintechs, crypto firms, banks, and embedded finance companies who need to build or strengthen an AML program that holds up under scrutiny. It covers the 7 steps regulators actually examine, what each requires in practice, and where most programs break down.
TL;DR
- An AML compliance program is the structured set of policies, controls, and procedures financial institutions use to detect, prevent, and report money laundering.
- The BSA (US), FCA rules (UK), AMLD (EU), and FINTRAC (Canada) all mandate these programs; non-compliance carries civil penalties, enforcement actions, and charter risk.
- Effective programs cover 7 areas: tone at the top, a designated compliance officer, risk assessment, written policies, KYC/CDD, transaction monitoring, and independent audits.
- One-size-fits-all programs consistently fail regulatory scrutiny — yours must reflect your actual risk profile.
- Most enforcement actions stem from weak implementation, not missing documentation.
What Is an AML Compliance Program?
An AML compliance program is a structured framework of written policies, internal controls, staff training, and oversight mechanisms that financial institutions implement to detect and prevent money laundering, terrorist financing, and related financial crimes.
The program's purpose goes beyond avoiding fines. It enables an institution to:
- Know who its customers are and understand the nature of their activity
- Monitor transactions for red flags and investigate suspicious patterns
- File Suspicious Activity Reports (SARs) when required
- Demonstrate to regulators that controls actually work in practice
An AML policy document is not a program. A functional program requires four components working together as a system:
- People — a designated compliance officer with real authority
- Processes — KYC onboarding, transaction monitoring, SAR workflows
- Technology — screening tools calibrated to your actual customer risk
- Governance — independent audits and board-level oversight
A policy sitting in a shared folder, unread and untested, won't survive an exam — and regulators know the difference.
Why AML Compliance Matters
The Regulatory Mandate
AML programs are legally required across all major jurisdictions:
| Jurisdiction | Primary Framework | Key Requirement |
|---|---|---|
| United States | BSA / USA PATRIOT Act (31 U.S.C. 5318(h)) | Written program with 4 minimum elements: internal controls, compliance officer, training, independent testing |
| United Kingdom | Proceeds of Crime Act / MLR 2017 | Business-wide risk assessment, proportionate controls, MLRO appointment, staff training |
| European Union | 6AMLD / EU AML Package | Obliged entity program requirements; new EU AML Authority (AMLA) establishing a single rulebook |
| Canada | PCMLTFA / FINTRAC | Compliance officer, written policies, risk assessment, training, two-year effectiveness review |
Requirements differ across jurisdictions. Beneficial ownership thresholds alone vary — the US FinCEN CDD Rule sets a 25% ownership threshold, while EU AMLD uses more than 25%. Cross-border operators must map their program against every applicable regime, not just their home jurisdiction.
The Cost of Getting It Wrong
Enforcement actions are not hypothetical. Recent penalties illustrate what regulators are willing to do:
- Capital One (2021): FinCEN levied a $390 million penalty for willful AML failures, including roughly 50,000 unreported cash transactions totaling over $16 billion
- Binance (2023): $3.4 billion civil penalty — the largest in US Treasury history for a virtual asset entity
- Santander UK (2022): FCA fined the bank £107.7 million for persistent AML control gaps
- TD Bank (2024): Pleaded guilty to BSA violations, resulting in a $1.8 billion DOJ resolution; investigators found 92% of total transaction volume had gone unmonitored for years
The Business Case Beyond Compliance
A strong AML program also has real commercial value, particularly for fintechs and crypto firms:
- It supports sponsor bank relationships and accelerates onboarding approvals
- It satisfies investor due diligence during funding rounds
- It reduces fraud losses and improves customer data quality
- It demonstrates institutional credibility to banking partners and regulators
Fraxtional has seen this play out directly with clients: one Series A neobank reported that rebuilding its AML stack before a funding round left investors "impressed with how ready we were."
7 Steps to Build an Effective AML Compliance Program
Regulators don't prescribe a single template, but effective programs consistently follow these seven building blocks. Skipping or underinvesting in any one of them creates vulnerabilities that examiners will find.
Step 1: Set the Tone at the Top
AML compliance cannot live only in the compliance department. Senior leadership and the board must visibly sponsor the program, allocate budget, and model a culture where suspicious activity is always escalated — never suppressed for business reasons.
In practice, this means:
- Board-level AML training, documented and dated
- Explicit senior management sign-off on the AML risk appetite and program framework
- Written accountability for AML outcomes at the executive level
Regulators examine this during examinations. A program with strong written policies but no visible leadership commitment is a program that fails under scrutiny.
Step 2: Appoint a Qualified Compliance Officer
Every jurisdiction requires a named, accountable compliance lead: a BSA Officer in the US, MLRO in the UK, or CAMLO in Canada. This individual owns the AML program — overseeing controls, managing SAR escalations, and communicating with regulators.
For early-stage fintechs, crypto firms, and growth-stage companies that can't yet justify a full-time executive hire, a fractional BSA Officer or MLRO fulfills this regulatory requirement. Fraxtional, for example, places named compliance officers who appear on regulatory filings and sponsor bank documentation — the same accountability standard examiners require, without the cost of a permanent C-suite hire.
Step 3: Conduct a Comprehensive Risk Assessment
The risk assessment is the foundation everything else rests on. It identifies the specific money laundering and terrorist financing risks your institution faces — based on customers, products, geographies, and delivery channels — and determines where controls must be strongest.
Key requirements:
- Document it thoroughly — a verbal understanding of your risks isn't enough
- Update it regularly — at minimum when the business materially changes (new products, geographies, customer segments, mergers)
- Use it to calibrate everything else — monitoring rules, EDD triggers, training priorities, and audit scope should all flow from the risk assessment
A static, generic risk assessment is one of the most consistent triggers for regulatory criticism. The FCA warned firms in 2024 about financial crime controls that hadn't kept pace with business growth.
Step 4: Develop Written Policies and Procedures
Written policies translate risk assessment findings into operational instructions. They must be specific to how your institution actually operates — not adapted from a generic template.
Policies must cover:
- Customer identification and KYC/CDD standards
- Enhanced due diligence (EDD) triggers and procedures
- Transaction monitoring criteria and escalation paths
- SAR filing procedures and recordkeeping requirements
- Sanctions screening obligations
- Employee reporting and whistleblower procedures
Two common failures: policies stored only in a compliance folder nobody reads, and policies that assign no clear ownership for each procedure. Every process in the policy should have a named role responsible for it, with review cycles tied to regulatory changes, new products, and updated risk profiles.
Step 5: Implement KYC, CDD, and EDD Processes
Customer due diligence operates across three tiers:
- Customer Identification Program (CIP) — identity verification for all customers at onboarding
- Standard CDD — understanding the nature and purpose of the customer relationship to develop a risk profile
- Enhanced Due Diligence (EDD) — deeper scrutiny for high-risk customers, including PEPs, high-risk jurisdictions, and cash-intensive businesses
Under FinCEN's CDD Rule, legal entity customers also require beneficial ownership identification — covering individuals who own 25% or more of equity interests plus one person with significant management control.
KYC is not a one-time onboarding event. Customer risk profiles must be reviewed on a risk-based schedule — typically annually for high-risk customers — and trigger events like unusual transaction spikes, adverse media hits, or significant changes in business activity should prompt immediate reassessment.
Step 6: Deploy Ongoing Transaction Monitoring and SAR Reporting
Transaction monitoring is where AML programs most visibly fail enforcement scrutiny. HSBC was fined £63.9 million by the FCA for failing to test and update monitoring parameters and check data accuracy. TD Bank's program excluded major transaction categories from monitoring entirely — leaving $18.3 trillion in transactions unmonitored over six years.
An effective monitoring program requires:
- Rules and scenarios calibrated to your specific customer base and product risk
- Documented alert management workflows and investigation processes
- Regular threshold testing and tuning to avoid alert fatigue
- Clear escalation paths from alert to SAR decision
SAR filing deadlines vary by jurisdiction:
| Jurisdiction | Filing Standard | Deadline |
|---|---|---|
| US | Detection-based | 30 calendar days (60 to identify a suspect) |
| UK | Suspicion-based (POCA S.330) | 7 working days for DAML requests |
| Canada | Reasonable grounds to suspect | As soon as practicable |
Document your decision-making process even for cases where a SAR is not filed. Regulators examine both filing decisions and non-filing rationales.
Step 7: Conduct Independent Audits and Continuous Testing
Independent audits — conducted by a party not involved in building or running the AML program — are a regulatory requirement under 31 CFR 1020.210 in the US, and equivalent frameworks in the UK and Canada. The FFIEC recommends an audit cycle of every 12–18 months, though frequency should increase when risk profiles, systems, or products change materially.
Audit scope should cover:
- BSA/AML risk assessment accuracy and currency
- KYC and CDD process effectiveness
- Transaction monitoring calibration and alert investigation quality
- SAR filing accuracy and completeness
- Training program coverage and adequacy
- Whether management has corrected prior deficiencies
Between audits, compliance teams should track program health metrics continuously: alert-to-SAR conversion rates, false positive rates, training completion, and policy review cycles. These metrics demonstrate a proactive compliance posture — and surface weaknesses before an examiner does.
Key Factors That Shape Your AML Program's Effectiveness
Customer and Product Risk Profile
Every control decision flows from who you serve and what you offer. A crypto exchange faces fundamentally different risks than a community bank or an embedded finance provider — different customer anonymity risks, transaction velocity, geographic exposure, and typologies. Regulators examine whether controls are proportionate to actual risk, not just technically present.
Jurisdictional Scope
Institutions operating across the US, UK, EU, and Canada must reconcile requirements that differ in meaningful ways. Key variables include:
- Beneficial ownership thresholds — the percentage at which disclosure is required
- MLRO reporting obligations — role-specific duties that differ between UK and US regimes
- SAR timing rules — filing windows that vary from 30 to 60 days depending on jurisdiction
- EDD standards — what triggers enhanced diligence and how it must be documented
Your program must demonstrate compliance with each applicable framework, not just the home jurisdiction's rules.
Technology and Data Quality
Monitoring systems and sanctions screening tools are only as effective as the data feeding them. Poor data quality, legacy systems, and disconnected tools create coverage gaps that auditors and examiners will identify. Model validation should be treated as an ongoing discipline: thresholds need regular testing to confirm they're capturing the risk typologies they were designed to catch — not just the ones that were relevant at implementation.
Common AML Compliance Mistakes to Avoid
Most AML program failures aren't caused by missing policies — they're caused by programs that don't hold up under operational scrutiny. Three patterns appear repeatedly in enforcement actions:
Treating compliance as a documentation exercise. Policies that say one thing while staff do another are a recurring theme. The FCA's 2025 Barclays final notice found CDD and EDD measures weren't applied as required in a high-risk customer context. Regulators test whether programs work in practice, not just on paper.
Limiting training to the compliance team. Customer-facing staff, product teams, and senior management all play roles in identifying and escalating suspicious activity. Untrained front-line employees are among the most commonly cited gaps in enforcement actions. Role-specific, scenario-based training builds a real detection culture — annual e-learning modules don't.
Failing to update the program as the business grows. A program built for a seed-stage startup with 500 customers won't hold up at Series B scale. New products, geographies, and customer segments each introduce risks that require proactive updates to the risk assessment, policies, and monitoring rules — before a regulator or sponsor bank finds the gap.
Frequently Asked Questions
What is an AML program?
An AML (Anti-Money Laundering) program is a structured set of policies, controls, and procedures that financial institutions implement to detect, prevent, and report money laundering and related financial crimes. It is required by law in the US (BSA), UK (FCA/MLR 2017), EU (AMLD), and Canada (FINTRAC).
What should an AML program include?
Core components include a designated compliance officer, a written risk assessment, documented KYC/CDD policies, ongoing transaction monitoring, a SAR filing process, employee training, and independent auditing. Programs must be tailored to the institution's specific risk profile — generic templates consistently fail regulatory review.
Who is responsible for an organization's AML compliance?
A named compliance officer holds formal accountability — the BSA Officer in the US, MLRO in the UK, and CAMLO in Canada. AML is still a shared responsibility: senior management sets the risk culture, front-line staff flag suspicious activity, and the board controls resource allocation.
What are the penalties for AML non-compliance?
Penalties range from multi-million dollar fines to license revocation and criminal prosecution of executives. Recent cases include Capital One ($390M FinCEN), Binance ($3.4B settlement), TD Bank ($1.8B DOJ resolution), and BitMEX co-founders (each $10M in criminal fines for BSA violations).
How often should an AML compliance program be reviewed?
Independent audits should occur at minimum every 12–18 months. Risk assessments should be updated at least annually or after material business changes. Policies should be reviewed whenever regulations change or new products and geographies are added.
Do fintechs and crypto firms need an AML compliance program?
Yes. Fintechs, crypto exchanges, payment processors, and money transmitters are subject to AML obligations in most major jurisdictions. Even companies not yet directly regulated may face AML requirements through their sponsor bank relationships — banks routinely require evidence of a functioning program before and during the partnership.
