Anti-Money Laundering (AML): What It Is
Anti-money laundering, commonly known as AML, refers to the laws, regulations, controls, and processes designed to prevent criminals from disguising illegally obtained funds as legitimate money. AML programs help organizations identify who they are doing business with, understand financial crime risks, detect suspicious behavior, investigate unusual activity, and report certain transactions or activity to authorities when required.
AML is particularly important for banks, credit unions, payment companies, money services businesses, investment firms, cryptocurrency businesses, insurers, and other organizations that move or manage money. Requirements vary significantly by country, industry, entity type, and risk profile, so there is no single AML checklist that applies identically to every organization.
In the United States, much of the AML regulatory framework is built around the Bank Secrecy Act and administered by the Financial Crimes Enforcement Network, or FinCEN. Internationally, the Financial Action Task Force’s AML/CFT Recommendations provide the global standards that countries use to develop laws and supervisory regimes for combating money laundering, terrorist financing, and proliferation financing.
For compliance teams, AML is therefore much more than screening a customer during onboarding. A strong program connects customer risk, due diligence, transactions, alerts, investigations, regulatory reports, policies, controls, training, and evidence into one continuous compliance process.
What Is Money Laundering?
Money laundering is the process of concealing the criminal origin of money or other assets so they appear to come from legitimate sources.
The underlying funds can originate from many types of criminal activity, including fraud, corruption, drug trafficking, organized crime, cybercrime, tax crimes, human trafficking, theft, and other illegal activity. The objective is often to make the proceeds difficult to trace back to the original crime so they can be stored, transferred, invested, or spent without attracting attention.
Money laundering can involve traditional bank accounts, shell companies, cash-intensive businesses, real estate, international transfers, trade transactions, cryptocurrency, payment platforms, luxury assets, and other financial channels.
Modern AML programs therefore need to look beyond individual transactions. A transaction that appears harmless in isolation can become suspicious when combined with information about the customer, beneficial owners, geographic exposure, transaction history, business activity, counterparties, or previous alerts.
What Are the Three Stages of Money Laundering?
Money laundering is commonly explained through three stages: placement, layering, and integration. Real-world laundering schemes do not always follow these steps neatly, but the model helps explain how illicit funds can move through the financial system.
Placement
Placement involves introducing criminal proceeds into the financial system or another legitimate economic channel.
For example, large amounts of illicit cash may be divided into smaller deposits, moved through cash-intensive businesses, converted into financial instruments, or used to purchase assets.
The objective is to move money away from its direct connection with the underlying crime.
Layering
Layering involves creating transactions or ownership structures that make the source of funds harder to trace.
Money may move between several accounts, companies, countries, assets, payment methods, or intermediaries. Transactions can be intentionally complex and may have little obvious business purpose.
This stage creates distance between the criminal activity and the funds.
Integration
Integration occurs when the money re-enters the legitimate economy appearing to have a lawful source.
Funds may be invested in businesses, property, securities, luxury goods, or other assets. At this point, separating legitimate wealth from criminal proceeds may become considerably more difficult.
AML controls attempt to identify suspicious activity throughout this lifecycle rather than waiting until funds have been fully integrated.
Why Is Anti-Money Laundering Important?
Money laundering allows criminal organizations to benefit from illegal activity and continue funding future crimes. It can also expose legitimate businesses to regulatory, operational, legal, and reputational consequences.
A financial institution may unknowingly process transactions for fraud networks, corruption schemes, sanctioned actors, trafficking organizations, or other criminal operations. Without effective customer due diligence and transaction monitoring, suspicious behavior can remain hidden within otherwise normal financial activity.
AML programs create mechanisms for identifying those risks earlier.
They also help organizations demonstrate that financial crime risk is being actively managed. Regulators increasingly look beyond whether an organization has written policies. They want evidence that controls are operating, alerts are reviewed, cases are investigated, decisions are documented, issues are escalated, and weaknesses are corrected.
VComply explores this operational gap in more detail in Why “AML on Paper” No Longer Satisfies Regulators.
What Is AML Compliance?
AML compliance is the process of establishing and operating the controls required to identify, assess, monitor, and respond to money laundering and related financial crime risks.
The exact requirements depend on the organization. A global bank, cryptocurrency exchange, investment adviser, money services business, and small financial institution can have very different regulatory obligations.
In the United States, the Bank Secrecy Act requires covered financial institutions and businesses to maintain certain records and reports designed to help authorities detect and investigate financial crime. FinCEN explains that BSA requirements can include recordkeeping, currency transaction reporting, suspicious activity reporting, and AML program requirements depending on the type of institution.
Internationally, FATF maintains 40 Recommendations covering areas such as preventive measures, beneficial ownership transparency, money laundering offenses, terrorist financing, regulatory supervision, international cooperation, and the powers of authorities.
A practical AML compliance lifecycle often looks like:
Risk Assessment → Customer Due Diligence → Screening → Monitoring → Alert → Investigation → Regulatory Reporting → Corrective Action → Ongoing Review
Effective AML compliance depends on maintaining traceability across that entire process.
The Core Elements of an AML Program
Although requirements differ between jurisdictions and regulated entities, effective AML programs generally rely on several connected components.
AML Risk Assessment
A strong AML program begins with understanding the organization’s exposure to financial crime.
Risk assessments can consider factors such as customer type, products and services, transaction volumes, delivery channels, geographic exposure, counterparties, industries, ownership structures, and emerging financial crime threats.
A local retail bank serving mostly domestic consumers will have a different risk profile from a global payments business processing cross-border transactions.
The risk assessment should influence the rest of the AML program. Higher-risk products, customers, or relationships usually require stronger controls and greater scrutiny than lower-risk activity.
The objective is a risk-based approach, rather than treating every customer and transaction identically.
Customer Due Diligence and Know Your Customer
Customer Due Diligence, or CDD, is central to AML compliance.
Organizations need to understand who their customers are and, where applicable, who ultimately owns or controls legal entities. This commonly involves obtaining and verifying identifying information, understanding the nature and purpose of the customer relationship, assessing risk, and keeping relevant information current.
Know Your Customer, commonly called KYC, is often used to describe the identity-verification and customer-understanding processes that support CDD.
A strong process should answer more than:
“Is this a real person or company?”
It should help the institution understand whether the customer’s activity makes sense based on who they are.
For example, a company representing itself as a small domestic consulting business may warrant further review if it suddenly begins receiving large international transfers from unrelated entities in high-risk locations.
Identity verification establishes who the customer is. Effective AML compliance also considers whether their financial activity is consistent with what the organization knows about them.
Enhanced Due Diligence
Not every customer presents the same level of risk.
Higher-risk customers or relationships may require Enhanced Due Diligence (EDD). The exact circumstances and requirements vary, but enhanced reviews may involve obtaining additional information about ownership, source of funds, source of wealth, expected transaction activity, business relationships, geographic exposure, or other relevant risk factors.
Higher risk does not automatically mean the customer is engaged in illegal activity.
It means the organization’s exposure justifies additional scrutiny.
Documenting why a customer received a particular risk rating and what enhanced controls were applied is important because regulators and auditors may later ask how the organization reached its decision.
Beneficial Ownership
Complex legal entities can be used to conceal the individuals who ultimately own or control assets.
This makes beneficial ownership an important part of AML frameworks.
FATF’s Recommendations include transparency and beneficial ownership of legal persons and arrangements as one of the core areas within the global AML/CFT standards.
The U.S. beneficial ownership reporting environment has changed significantly. As of the current FinCEN rules, entities created in the United States and U.S. persons are exempt from Corporate Transparency Act BOI reporting to FinCEN, while certain foreign entities registered to do business in the United States remain within the reporting regime. Organizations should therefore avoid relying on older guidance stating that all U.S. companies must file BOI reports.
This is a good example of why AML compliance programs need an active regulatory-change process rather than static policy documents.
AML Screening
AML screening helps organizations determine whether customers, beneficial owners, counterparties, or other parties present known financial crime risks.
Depending on the organization’s obligations and risk profile, screening can involve sanctions lists, politically exposed persons, adverse media, watchlists, and other risk sources.
A potential match does not automatically establish wrongdoing.
The compliance team needs a process for determining whether a match is genuine, whether additional due diligence is necessary, and what action should follow.
The quality of that process matters because poorly configured screening systems can produce enormous numbers of false positives, creating unnecessary workloads and making genuinely important alerts harder to identify.
For a deeper breakdown of the process, see VComply’s guide to AML screening, screening types, and compliance workflows.
Transaction Monitoring
Transaction monitoring analyzes customer activity to identify patterns that could indicate money laundering or other financial crime.
The objective is not simply to identify large transactions.
Suspicious behavior depends on context.
A $100,000 transaction might be perfectly normal for one business and highly unusual for another. Effective monitoring therefore considers customer risk, expected activity, transaction history, counterparties, products, geographic exposure, velocity, frequency, and other relevant information.
Monitoring scenarios may look for activity such as unusual transaction volumes, sudden changes in behavior, rapid movement of funds, repeated transactions designed to avoid thresholds, unexplained transfers between unrelated parties, unusually complex transaction chains, or activity inconsistent with the customer’s known business.
An alert should then move into an investigation process rather than automatically being treated as evidence of money laundering.
VComply’s guide to AML transaction monitoring explains how alerts, investigations, data quality, and governance connect across that process.
Suspicious Activity Reports
When suspicious activity meets applicable regulatory criteria, certain covered institutions may be required to file a Suspicious Activity Report, commonly known as a SAR.
In the United States, FinCEN receives SARs under the Bank Secrecy Act framework. FinCEN notes that covered institutions are required to report suspicious activity that may indicate money laundering, tax evasion, or other criminal activity under applicable rules.
A transaction monitoring alert and a SAR are not the same thing.
An alert identifies activity that warrants review. Compliance investigators evaluate the available information and determine whether the activity can reasonably be explained or whether regulatory reporting may be appropriate.
That decision should be documented.
If an examiner later asks why a SAR was filed or why the organization decided not to file one, the institution should be able to demonstrate the information reviewed, the reasoning behind the decision, approvals where required, and related evidence.
AML Investigations and Case Management
Transaction monitoring is only as effective as the investigation process that follows it.
An alert may require investigators to review customer information, transaction histories, counterparties, previous alerts, screening results, account activity, supporting documents, and external information.
Several investigators or departments may become involved.
A defensible AML case should maintain a clear history of what was reviewed, who reviewed it, what conclusions were reached, what evidence supported the decision, and whether further action occurred.
A useful investigation workflow looks like:
Alert → Triage → Investigation → Evidence → Decision → Escalation → SAR Decision → Closure → Ongoing Monitoring
If investigations live across inboxes, spreadsheets, transaction systems, and shared folders, maintaining that audit trail becomes difficult.
This is where case management and compliance governance become important even when specialist transaction-monitoring technology is already in place.
Common AML Red Flags
AML red flags are behaviors or circumstances that may justify additional review. A red flag is not proof that money laundering has occurred.
Context matters.
For example, an organization’s monitoring process may pay attention to transactions that appear inconsistent with the customer’s business, unexplained movement of funds through several accounts, sudden changes in transaction behavior, unusual cross-border transactions, reluctance to provide ownership information, payments involving apparently unrelated companies, transactions that appear deliberately structured, or activity involving jurisdictions associated with heightened financial crime risk.
The Financial Action Task Force maintains information on high-risk and other monitored jurisdictions as part of its global AML/CFT work.
Organizations should avoid treating country lists or isolated red flags as automatic evidence of criminality. They should form part of a broader risk assessment and investigation.
The Role of the AML Compliance Officer
AML programs need clear accountability.
Depending on the regulated entity and applicable rules, an organization may need a designated person responsible for coordinating and monitoring AML compliance.
The AML compliance officer typically helps oversee the risk assessment, policies, controls, training, regulatory reporting, monitoring processes, investigations, governance, and responses to audits or examinations.
The role also involves communicating with senior management and ensuring identified weaknesses are addressed.
An AML officer should not become the sole owner of every AML task. Effective programs distribute responsibilities across customer onboarding, operations, compliance, investigations, legal, technology, management, and other relevant functions while maintaining central oversight.
VComply’s AML Compliance Officer guide explains these responsibilities in more detail.
AML Policies, Procedures, and Controls
AML policies establish the organization’s expectations, but policies alone do not create compliance.
Each important requirement needs an operational control.
For example, a policy might state that high-risk customers require enhanced review. The actual compliance process needs to determine who identifies high-risk customers, what additional information must be collected, who approves the relationship, how often the customer is reviewed, what evidence is retained, and how overdue reviews are escalated.
The chain becomes:
AML Requirement → Policy → Control → Owner → Activity → Evidence → Review
That is the difference between having an AML policy and operating an AML program.
Employee AML Training
Employees can play a significant role in detecting financial crime.
Training should therefore reflect the employee’s responsibilities rather than relying only on generic annual awareness material.
Frontline employees may need to recognize unusual customer behavior. Onboarding teams need to understand customer identification and due diligence procedures. Investigators need deeper knowledge of transaction patterns and regulatory reporting. Managers need to understand escalation and accountability.
Training should also evolve as risks, products, regulations, and financial crime techniques change.
An organization should be able to demonstrate not only that training material exists, but also who was required to complete it, whether completion occurred, and when training was updated.
Independent Testing and AML Program Reviews
AML programs need periodic review to determine whether controls are actually working.
Independent testing may evaluate areas such as the AML risk assessment, customer due diligence, transaction monitoring, screening, SAR processes, training, governance, data quality, recordkeeping, case management, and corrective actions.
The objective should not be to produce a report that gets stored until the next review.
Weaknesses need owners, remediation plans, deadlines, supporting evidence, and verification before closure.
The process should look like:
Finding → Root Cause → Corrective Action → Owner → Due Date → Evidence → Validation → Closure
This is where compliance management becomes particularly important.
U.S. AML Regulation: The Bank Secrecy Act and FinCEN
The Bank Secrecy Act remains the foundation of the U.S. anti-money laundering framework.
The BSA established recordkeeping and reporting requirements intended to help U.S. authorities identify and investigate financial crime. FinCEN administers and enforces many of the rules implementing the BSA.
The framework has evolved significantly through later legislation, including the USA PATRIOT Act and the Anti-Money Laundering Act of 2020.
Organizations should also watch current rulemaking.
In April 2026, FinCEN proposed a significant update to financial institution AML/CFT program requirements intended to implement provisions of the Anti-Money Laundering Act of 2020. FinCEN said the proposal would revise its regulations and supersede an earlier 2024 proposal.
Because this remains regulatory rulemaking rather than a blanket final requirement, compliance teams should distinguish carefully between current obligations and proposed future changes.
FATF and the Global AML Framework
Financial crime frequently crosses borders, making international coordination essential.
The Financial Action Task Force develops the internationally recognized AML/CFT standards used as the foundation for national frameworks around the world.
Its 40 Recommendations cover seven broad areas, including national AML/CFT coordination, criminalization and confiscation, terrorist and proliferation financing, preventive measures, beneficial ownership transparency, supervisory and institutional powers, and international cooperation.
FATF does not function as the financial regulator for every individual business.
Instead, countries incorporate FATF standards into their own legal and regulatory frameworks.
This means a global organization may need to manage similar AML principles across multiple jurisdictions while still accounting for significant differences in local requirements.
AML Regulation in the European Union
The European Union has also significantly changed its AML/CFT supervisory architecture.
The new Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) is intended to coordinate national authorities and strengthen consistency in how EU AML/CFT requirements are applied. From January 1, 2026, EU-level AML/CFT responsibilities previously held by the European Banking Authority transitioned to AMLA.
AMLA is building a more harmonized approach to supervision and enforcement, with direct supervision of selected significant cross-border financial institutions scheduled to begin from 2028.
In July 2026, AMLA also announced common standards intended to make AML/CFT enforcement approaches more consistent across EU supervisors.
For organizations operating across Europe, this makes regulatory-change monitoring particularly important.
AML vs. KYC: What Is the Difference?
AML and KYC are closely related but not interchangeable.
AML describes the broader framework for preventing and detecting money laundering and related financial crime.
KYC focuses more specifically on identifying and understanding the customer.
KYC is therefore one component of AML.
An organization might successfully verify a customer’s identity during onboarding but still have a weak AML program if it does not monitor subsequent activity, reassess customer risk, investigate suspicious patterns, maintain appropriate records, or report relevant activity when required.
AML continues throughout the customer relationship.
AML vs. CFT
AML is also frequently paired with CFT, meaning Countering the Financing of Terrorism.
Money laundering generally involves disguising the source of criminal proceeds.
Terrorist financing can involve money from either illegal or legitimate sources that is ultimately used to support terrorism.
Because the financial controls used to identify these risks overlap, regulations and international standards frequently refer to AML/CFT together.
FATF’s standards address money laundering, terrorist financing, and proliferation financing as connected areas of financial crime risk.
Common AML Compliance Challenges
One of the biggest AML problems is fragmentation.
Customer information may live in an onboarding platform. Screening happens in another tool. Transaction alerts exist in a monitoring system. Investigations are maintained somewhere else. SAR decisions may sit in restricted files, while AML policies, risk assessments, training records, audit findings, and corrective actions are managed separately.
Each system may perform its individual function well.
The problem appears when compliance leadership needs to answer a broader question:
Can we demonstrate that our AML program works from beginning to end?
That requires traceability across requirements, controls, systems, people, decisions, evidence, and remediation.
Another challenge is alert volume. Poorly calibrated monitoring can overwhelm investigators with false positives. Weak customer data can reduce the quality of both screening and monitoring. Outdated risk assessments can cause resources to be focused on the wrong areas.
AML effectiveness therefore depends on more than buying a transaction monitoring tool.
It requires governance around the entire program.
How to Build a Strong AML Compliance Program
A strong AML program starts with applicability and risk.
Organizations should first understand which regulations apply and assess the money laundering risks presented by their customers, products, services, geographies, transactions, and delivery channels.
The risk assessment should then inform customer due diligence, monitoring, screening, approval processes, and escalation.
Responsibilities should be clearly assigned. Policies should be translated into controls. Controls should produce evidence. Alerts should move through documented investigation workflows. Regulatory reporting decisions should be recorded. Training should reflect actual roles. Independent reviews should result in trackable remediation.
That creates an operational chain:
Regulation → Risk → Policy → Control → Owner → Monitoring → Alert → Investigation → Decision → Evidence → Remediation
Organizations looking for a step-by-step implementation framework can use VComply’s AML/CTF compliance program guide.
How Compliance Technology Supports AML Programs
AML technology covers several different functions.
KYC and identity tools support customer onboarding. Screening platforms check customers against relevant risk lists. Transaction monitoring systems identify unusual financial activity. Case management systems support investigations.
A GRC or compliance management platform serves a different purpose.
It can connect the AML regulatory program around those specialist technologies.
For example, an organization can map BSA/AML obligations to internal controls, assign control owners, schedule recurring reviews, maintain AML policies, collect assessment evidence, track audit findings, manage corrective actions, and give management visibility into program weaknesses.
VComply does not replace specialist transaction monitoring, KYC, or sanctions screening technology. Its role is to help organizations manage the governance, controls, accountability, evidence, policies, risks, and remediation surrounding AML compliance.
That distinction matters.
AML compliance is not one technology implementation. It is an organizational system.
Anti-Money Laundering Compliance Checklist
An effective AML program should be able to demonstrate that its applicable AML requirements are identified and current, its financial crime risks are assessed, customer due diligence is risk-based, higher-risk relationships receive appropriate scrutiny, screening and transaction-monitoring processes are governed, alerts are investigated consistently, suspicious activity decisions are documented, policies remain current, employees receive appropriate training, independent reviews occur, and identified weaknesses are remediated.
For every important control, compliance teams should also be able to answer four questions:
Who owns it?
When was it last performed?
What evidence proves it happened?
What happens if the control fails?
Those questions turn AML from a collection of policies into an operating compliance program.
Frequently Asked Questions About Anti-Money Laundering
What does AML stand for?
AML stands for Anti-Money Laundering. It refers to laws, regulations, controls, and processes intended to prevent criminals from disguising illegally obtained funds as legitimate money.
What is an AML program?
An AML program is the set of policies, controls, risk assessments, due diligence processes, monitoring activities, investigations, reporting procedures, training, and governance an organization uses to identify and manage money laundering risk.
What are the three stages of money laundering?
Money laundering is commonly described through three stages: placement, layering, and integration. The model explains how illegal proceeds can enter the financial system, move through transactions designed to obscure their origin, and eventually appear to be legitimate funds.
Is KYC the same as AML?
No. KYC focuses primarily on verifying and understanding customers. AML is the broader financial crime compliance framework and includes KYC as well as risk assessment, screening, transaction monitoring, investigations, reporting, training, and governance.
Who regulates AML in the United States?
Several agencies play roles depending on the institution, but FinCEN administers key requirements under the Bank Secrecy Act and serves as the U.S. Financial Intelligence Unit.
What is a suspicious activity report?
A Suspicious Activity Report, or SAR, is a regulatory report that certain covered financial institutions must file when activity meets applicable suspicious-activity reporting requirements. An internal monitoring alert does not automatically mean a SAR must be filed.
What is an AML red flag?
An AML red flag is activity or information that may indicate elevated money laundering or financial crime risk and warrants further review. A red flag alone is not proof that criminal activity occurred.
Is AML compliance required for every business?
No. AML obligations depend on jurisdiction, industry, regulated entity type, products, and activities. Banks and many other financial institutions have significant AML obligations, while requirements for other industries can differ considerably.
What is FATF?
The Financial Action Task Force is an intergovernmental body that develops international standards for combating money laundering, terrorist financing, and proliferation financing. Its 40 Recommendations form the foundation for many national AML/CFT regimes.
Why is AML compliance important?
AML compliance helps organizations prevent their systems from being used for financial crime, meet applicable regulatory obligations, improve detection of suspicious activity, maintain defensible records, and reduce legal, financial, operational, and reputational risk.
Making AML Compliance Work in Practice
The effectiveness of an AML program cannot be measured only by the number of policies an organization has written or the number of transaction alerts its systems generate.
What matters is what happens when risk appears.
Does the organization understand the customer? Can it explain why a relationship received its risk rating? Are alerts reviewed on time? Can investigators reconstruct how a decision was made? Are regulatory reporting decisions supported by evidence? When an audit identifies a weakness, does someone own the remediation until it is actually closed?
Strong AML programs connect those activities rather than treating them as separate compliance exercises.
The result is a continuous process in which customer risk informs monitoring, monitoring creates investigations, investigations produce decisions, decisions remain supported by evidence, and weaknesses lead to measurable improvement.
That is the difference between having an AML policy and having an AML program that can stand up to real regulatory scrutiny.