The message is consistent across jurisdictions: any company moving money must operate a defensible AML program, regardless of size or funding stage.
This guide covers what AML means for fintechs, the regulatory framework across the US, UK, EU, and Canada, the five pillars of a compliant program, and the operational best practices that separate audit-ready fintechs from those facing enforcement.
TLDR
- Every fintech moving money — including BaaS-dependent fintechs — carries direct AML compliance responsibility
- US, UK, EU, and Canadian frameworks differ but converge on the same core requirements: risk assessment, KYC, transaction monitoring, SAR filing, and independent audit — covered in detail below
- Five pillars define a defensible AML program: compliance officer, written policies, transaction monitoring, employee training, and independent testing
- Templated AML policies and sponsor bank reliance are the two most common paths to enforcement action
- Fractional compliance leadership is a regulator-accepted alternative for fintechs that cannot justify a full-time hire
What Is AML in Fintech — and Which Companies Are Affected?
Anti-money laundering (AML) refers to the laws, regulations, and internal controls designed to detect and prevent criminals from disguising illegally obtained funds as legitimate income. Banks have operated under these frameworks for decades. Fintechs are now squarely within scope.
Which Fintech Business Models Trigger AML Obligations
FinCEN classifies Money Services Businesses (MSBs) by activity, not by label. If your fintech performs any of the following, you are an MSB and must register with FinCEN within 180 days of establishment:
- Payment processors and money transmitters
- Foreign exchange dealers
- Prepaid access providers and sellers
- Issuers or sellers of money orders and traveler's checks
- Neobanks and stored-value card issuers
- Crypto and digital asset platforms (exchanges, wallets, and custodians)
- Lending platforms that facilitate fund transfers
Some categories apply a more than $1,000 per person per day activity threshold. Prepaid access carries separate conditions. The key point: MSB status is determined by what you do, not what you call yourself.
The BaaS Misconception
Many fintechs operating under a sponsor bank's charter assume the bank's AML program covers them. It does not.
OCC orders against Blue Ridge Bank (January 2024) and FDIC orders against Lineage Bank and Thread Bank (both 2024) explicitly required those sponsor banks to remediate BSA/AML failures tied to their fintech partnerships. The remediation items named by regulators included:
- Third-party risk management controls
- Customer due diligence (CDD) procedures
- Suspicious activity monitoring
- BSA staffing adequacy
Regulators made clear that sponsor banks bear responsibility for fintech partner oversight.
The practical implication: if your sponsor bank receives examination findings tied to your program, the partnership itself is at risk. Regulators have terminated BaaS arrangements over program deficiencies — which means your AML program needs to stand up to the same scrutiny as the bank's own.
The AML Regulatory Framework Fintechs Must Know
United States: BSA, FinCEN, and OFAC
The Bank Secrecy Act (BSA) is the foundational US AML statute. FinCEN administers it, and the core MSB obligations are:
| Requirement | Rule |
|---|---|
| SAR filing deadline | Within 30 calendar days of initial detection |
| SAR threshold (MSBs) | $2,000 (or $5,000 for certain issuers reviewing clearance records) |
| CTR filing threshold | Currency transactions exceeding $10,000 |
| Record retention | 5 years for BSA-required records |
| Beneficial ownership (CDD Rule) | Identify individuals owning 25% or more of a legal entity customer, plus one control person |
The Anti-Money Laundering Act of 2020 (AMLA) modernized the BSA framework, adding FinCEN's AML/CFT Priorities, an expanded whistleblower program, and Corporate Transparency Act provisions on beneficial ownership.
OFAC compliance operates separately from BSA obligations. Fintechs must screen customers and transactions against US sanctions lists — and the penalties are entirely separate from any FinCEN action.
Bittrex settled an OFAC action for $24.28 million in 2022 alongside its FinCEN penalty. Kraken settled an Iran sanctions violation for $362,158 that same year. Two regulators, two enforcement tracks, two sets of consequences.
United Kingdom: FCA and MLRs 2017
The Money Laundering Regulations 2017 (MLRs 2017) govern UK-regulated fintechs. Key obligations include:
- Appointing a Money Laundering Reporting Officer (MLRO) with sufficient seniority and authority
- Filing Suspicious Activity Reports (SARs) with the National Crime Agency (NCA) — the UK Financial Intelligence Unit sits within the NCA and has sole national responsibility for receiving and analyzing SARs
- Conducting annual ML/TF risk assessments
- Implementing systems and controls to identify, assess, monitor, and manage money laundering risk
The FCA's enforcement record makes its expectations concrete. CB Payments received a £3.5 million fine in 2024 for enabling cryptoasset trading while repeatedly breaching restrictions on high-risk customer services.
European Union: 6AMLD and AMLA
The 6th Anti-Money Laundering Directive (6AMLD), adopted October 23, 2018 and transposed by December 3, 2020, expanded the EU's criminal AML framework with:
- Maximum imprisonment of at least 4 years for money laundering offences
- Expanded predicate offence categories
- Corporate criminal liability for legal persons
Preventive obligations — CDD, ongoing monitoring, and beneficial ownership transparency — derive from the 4th and 5th AMLDs (Directive 2015/849). These directives set the baseline requirements every EU-operating fintech must meet.
The EU AML Authority (AMLA) is a new decentralized EU agency being established to coordinate national authorities and strengthen FIU cooperation. It will hold direct rule-making authority over CDD standards and supervisory practices across member states — meaning requirements fintechs meet today may shift as AMLA issues binding technical standards.
Canada: FINTRAC and PCMLTFA
FINTRAC oversees Canadian AML compliance under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). MSB obligations include registration, client identification, record-keeping, and suspicious transaction reporting.
FINTRAC's enforcement posture has sharpened. It assessed CAD 6,002,000 against Binance Holdings Limited in May 2024 for two violations under Part 1 of the PCMLTFA — a significant penalty that confirms foreign MSBs operating in Canada face real consequences.
Many fintechs operate across two or more of these jurisdictions simultaneously. Where obligations overlap, the stricter standard generally applies — and gaps between them are precisely where regulatory exposure tends to surface.
The 5 Pillars of a Defensible Fintech AML Program
Under 31 CFR 1022.210, an MSB AML program must include four elements: a designated compliance officer, employee training, internal controls, and independent review. In practice, compliance professionals break this into five distinct pillars.
Pillar 1 — Designated Compliance Officer
Every fintech must appoint a qualified compliance officer with sufficient authority, board-level access, and independence from business lines:
- US: BSA Officer (required under 31 CFR 1022.210)
- UK: Money Laundering Reporting Officer (MLRO) under MLRs 2017
- Canada: Chief AML Officer (CAMLO) under FINTRAC requirements
For early-stage fintechs that cannot justify a full-time hire, fractional compliance leadership is a recognized and regulator-accepted alternative. Fraxtional places named Directors in BSA Officer, MLRO, and CAMLO roles, with full title use, board-level reporting, and direct accountability for regulatory filings and sponsor bank correspondence.
Sponsor banks have explicitly required fintech clients to appoint a BSA Officer, and Fraxtional's fractional placements have satisfied that requirement.
FINTRAC's guidance notes that while compliance officer duties may be delegated, the appointed officer remains ultimately responsible. The FCA similarly states that accountability cannot be delegated in outsourcing arrangements, which is why Fraxtional's Directors function as genuine compliance executives rather than arms-length advisors.
Pillar 2 — Written Policies, Procedures, and Controls
The AML program must be documented, board-approved, and tailored to the firm's actual risk profile. A complete program covers:
- Customer Identification Program (CIP)
- Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) procedures
- Transaction monitoring methodology and rule rationale
- SAR and CTR filing workflows
- OFAC and sanctions screening protocols
- Record retention policies (minimum five years)
Generic templates fail examination. Regulators expect policies that reflect your specific products, customer types, and delivery channels. Fraxtional's policy development work is built around each client's actual business model — not plug-and-play language — and is structured to withstand sponsor bank review and regulatory examination from day one.
Pillar 3 — Risk-Based Transaction Monitoring
Monitoring rules must derive from a documented risk assessment. Without that foundation, threshold choices are indefensible in examination.
Key alert typologies for fintech transaction monitoring include:
- Structuring: Repeated transactions just under $10,000 designed to avoid CTR reporting
- Rapid fund movement: Funds received and withdrawn or transferred out within hours, with no apparent business purpose
- Velocity anomalies: Transaction frequency or volume that spikes sharply beyond the customer's established profile
- Geographic red flags: Activity routed through high-risk jurisdictions, FATF grey-listed countries, or sanctioned regions
Regulators expect documented rationale for each rule's thresholds — not just alert generation. Deploying monitoring tools without ongoing tuning and documented parameter justification leaves the program indefensible under examination.
Pillar 4 — Ongoing Employee Training
All relevant staff must receive AML training at onboarding and at least annually thereafter. Effective training programs include:
- Role-specific content (front-line staff, compliance team, and senior leadership each need different material)
- Documented attendance records
- Comprehension testing
- Updates reflecting regulatory changes and new typologies
Regulators treat absent or stale training as a program deficiency. It is one of the most commonly cited examination findings precisely because documentation either exists or it doesn't.
Pillar 5 — Independent Testing and Audit
Per FFIEC guidance, independent testing may be performed by internal audit, outside auditors, consultants, or other qualified independent parties. The testing party must report directly to the board or a board committee to maintain independence.
Critical points:
- Testing must occur at least every 12–18 months
- Self-assessments by the compliance function do not satisfy this requirement
- Findings must be reported to the board, not just retained internally
Fraxtional's independent audit service is structured to satisfy this requirement — covering BSA/AML policies, transaction monitoring effectiveness, control gaps, and documentation completeness, with board-ready findings reports.
AML Best Practices for Fintech Companies
Start With a Documented Risk Assessment
The risk assessment is more than a compliance formality. Per FFIEC examination standards, if a firm lacks an adequate risk assessment, examiners develop one themselves to serve as the examination foundation — which means you lose control of how your risks are characterized.
A defensible risk assessment documents exposure across:
- Products and services offered
- Customer types and risk tiers
- Geographic exposure (markets served, customer origin)
- Transaction channels and delivery methods
- Third-party relationships and technology dependencies
This document drives every downstream compliance decision and is the first thing regulators request.
Build a Robust KYC and KYB Program
CIP minimum data elements under 31 CFR 1020.220:
- Individuals: Name, date of birth, address, identification number
- Entities (corporations, partnerships): Name, principal place of business, taxpayer identification number or equivalent
Risk-tiered onboarding works in practice: low-risk customers move through streamlined verification; high-risk customers trigger enhanced steps before account opening. Biometric and digital verification tools enable compliance without adding friction to onboarding.
Apply CDD and EDD Consistently
Standard CDD applies at onboarding for all customers. Enhanced Due Diligence (EDD) is triggered for higher-risk relationships, including:
- Politically Exposed Persons (PEPs)
- Customers in high-risk jurisdictions
- Complex or layered ownership structures
- Customers whose activity patterns are inconsistent with stated purpose
EDD typically involves source-of-funds verification, senior management sign-off, and more frequent review cycles.
Real-time sanctions screening against OFAC, UN, and relevant local lists runs alongside these workflows — but treat it as a separate compliance obligation. OFAC violations are their own enforcement track, distinct from your AML program.
Establish Clear SAR Filing Procedures
SAR narratives are the element regulators scrutinize most carefully. Each narrative should address who, what, when, where, and how in plain language — demonstrating that the institution understood the suspicious activity, not just detected it.
A complete SAR workflow covers:
- Alert triage and initial review
- Analyst investigation and evidence documentation
- SAR/no-SAR determination with written rationale
- Quality review before filing
- E-filing within 30 calendar days of initial detection (US)
Late or missing SARs are among the most cited BSA violations in enforcement actions. Bittrex failed to file any SARs between February 2014 and May 2017 — a gap that contributed directly to its $29.28 million FinCEN penalty.
Treat AML as a Continuous Process
A well-functioning AML program operates on a defined monitoring cadence:
- Daily: Alert review and SAR/STR workflow management
- Monthly: Metric analysis — alert volume, SAR rates, false positive rates
- Quarterly: Rule tuning and threshold review
- Annually: Full risk assessment refresh
Trigger off-cycle updates when launching new products, entering new markets, or identifying new risk typologies. The risk assessment should evolve with your business — a static document is a liability, not a safeguard.
Common AML Compliance Mistakes Fintechs Make
Assuming the Sponsor Bank or a Template Covers You
Assuming your sponsor bank's program covers you — or that a downloaded policy template is enough — is the most consequential mistake fintechs make, and enforcement actions have made the consequences concrete. The OCC's January 2024 consent order against Blue Ridge Bank explicitly required remediation of BSA/AML program failures tied to fintech partner management — including CDD controls, suspicious activity monitoring, BSA staffing, and third-party risk oversight. Similar orders hit Lineage Bank and Thread Bank the same year.
The pattern is consistent: sponsor banks are ordered to fix their fintech oversight programs, and fintechs without their own defensible programs face losing the banking relationship entirely. A delegated responsibility clause in a BaaS contract does not satisfy regulatory expectations. A generic policy template does not satisfy regulatory expectations.
Both parties must have compliant programs — and both face scrutiny when they don't.
Missing SARs, Skipping the Risk Assessment, or Treating Compliance as a Cost Center
Three specific failures show up repeatedly in enforcement:
- Bittrex went three years without filing SARs — a core driver of its $29.28 million penalty. The obligation is not discretionary.
- Without a documented risk assessment, the entire program is indefensible in examination. Regulators will build their own picture, using your worst-case risk profile.
- A well-structured AML program has a measurable cost. Enforcement — penalties, monitorship, license revocation, lost banking relationships — does not. Binance's $3.4 billion FinCEN settlement marks the upper range.
Frequently Asked Questions
What is AML in fintech?
AML (Anti-Money Laundering) in fintech refers to the laws, regulations, and internal controls that fintech companies must implement to detect, prevent, and report money laundering on their platforms. Core obligations include KYC, transaction monitoring, SAR filing, sanctions screening, and record-keeping. These apply to any fintech moving money, regardless of size.
What are the compliance standards fintechs must follow?
In the US, the Bank Secrecy Act and FinCEN regulations; in the UK, the FCA's Money Laundering Regulations 2017; in the EU, the AMLD framework; in Canada, FINTRAC under the PCMLTFA. Globally, FATF's 40 Recommendations serve as the baseline. Specific obligations depend on the fintech's business model and operating jurisdictions.
What happens if a fintech fails to comply with AML regulations?
Consequences range from civil monetary penalties and criminal prosecution of responsible individuals, to loss of banking relationships, revocation of money transmitter licenses, and reputational damage. In severe cases, regulators issue cease-and-desist orders that halt operations entirely.
Can a fintech outsource its AML compliance program?
Fintechs can outsource compliance activities such as transaction monitoring, SAR filing, independent audits, and even the compliance officer role. Accountability cannot follow. The fintech's board and management remain ultimately responsible, and regulators expect meaningful internal oversight of any outsourced functions.
What is the difference between KYC and AML in fintech?
KYC (Know Your Customer) is one component within the broader AML framework, focused specifically on verifying customer identity and assessing risk at onboarding. AML covers the full program: transaction monitoring, SAR filing, sanctions screening, record-keeping, and ongoing customer due diligence.
How often should a fintech update its AML risk assessment?
At minimum annually, and whenever material changes occur: new products, new markets, new risk typologies, or regulatory updates. Treat the risk assessment as a living document, not a one-time filing.
