An AML program (anti-money laundering program, often written AML/CFT program to include countering the financing of terrorism) is the documented framework of controls that a regulated financial business must maintain to prevent itself from being used for money laundering and terrorist financing. It sets out how the firm identifies customers, monitors activity, reports suspicions, trains staff and checks that all of this actually works.
In the United States the requirement is framed as a set of minimum elements, commonly called the pillars. Other jurisdictions describe similar components in their own terms, but the underlying expectation is the same: controls must be written down, owned by an accountable person, proportionate to the firm's risks, and tested.
Legal basis
In the US, the duty derives from the Bank Secrecy Act (BSA), as amended by the USA PATRIOT Act of 2001, which required every financial institution to establish an anti-money laundering program. FinCEN implements the requirement through regulations specific to each industry, including banks, broker-dealers, casinos and money services businesses. The Anti-Money Laundering Act of 2020 directed that programs be effective, risk-based and reasonably designed, and FinCEN has since proposed rules to update program requirements accordingly.
Internationally, the standards of the Financial Action Task Force (FATF) require countries to oblige financial institutions to have internal programs against money laundering. The European Union, the United Kingdom, Canada and other jurisdictions translate this into national law, for example the UK's Money Laundering Regulations 2017.
The pillars of an AML program
- Internal policies, procedures and controls. Written rules covering customer identification, customer due diligence, enhanced due diligence, sanctions screening, transaction monitoring, record keeping and reporting.
- A designated compliance officer. A qualified individual with sufficient authority, independence and resources to run the program, such as a BSA officer in the US or a money laundering reporting officer (MLRO) in the UK.
- Ongoing training. Staff, and in some sectors agents, must be trained to recognize and escalate suspicious activity in ways relevant to their roles.
- Independent testing. A periodic independent AML review by internal audit or an outside party, checking both design and effectiveness.
For banks and certain other institutions in the US, FinCEN's 2016 customer due diligence rule added risk-based ongoing customer due diligence, including identifying the beneficial owners of legal entity customers. This is often called the fifth pillar.
Risk assessment as the foundation
A program is expected to start from a documented risk assessment covering the firm's customers, products, delivery channels and geographies. This risk-based approach determines where enhanced controls are applied. A remittance company serving high-risk corridors through agents will need different controls from a bank lending to domestic businesses. Regulators increasingly look for evidence that controls are calibrated to the assessed risks rather than copied from a template.
Reporting obligations
An AML program also governs how the firm meets reporting duties. In the US these include filing a suspicious activity report (SAR) and a currency transaction report (CTR) for cash transactions above USD 10,000. Similar suspicious transaction reporting exists in nearly every jurisdiction. Detecting attempts at structuring deposits to avoid reporting thresholds is a classic program requirement.
Common weaknesses
Enforcement actions repeatedly identify the same failures: a compliance officer without authority or resources, monitoring rules that do not reflect the actual business, unmanageable alert backlogs, failure to oversee agents or nested relationships, and independent testing that is too narrow or not independent. A program that exists on paper but is not followed in practice is treated as a failure of the program itself. Banks and partners therefore usually ask for the full program, risk assessment and latest independent review as part of onboarding, and for a principal MSB the program must extend to its agents.