AML
Anti-Money Laundering — a framework of laws, regulations, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income.
Anti-Money Laundering (AML) refers to the laws, regulations, policies, and procedures designed to prevent criminals from using financial systems to disguise the proceeds of illegal activity as legitimate funds. AML compliance is a fundamental obligation for financial institutions, fintech companies, money service businesses, and increasingly for any company operating in regulated financial services.
Money laundering typically occurs in three stages: Placement (introducing illegal cash into the financial system — buying prepaid cards, making cash deposits), Layering (obscuring the trail through complex transactions — wire transfers through multiple accounts, currency exchanges, shell company transactions), and Integration (the laundered money re-enters the economy as legitimate funds — real estate purchases, business investments).
In the US, AML is primarily governed by the Bank Secrecy Act (BSA), which requires financial institutions to maintain AML programs with four pillars: (1) written policies and procedures; (2) a designated AML compliance officer; (3) ongoing employee training; and (4) independent testing of the program. The Financial Crimes Enforcement Network (FinCEN) is the primary AML regulator.
Key AML compliance requirements include: Currency Transaction Reports (CTRs) for cash transactions over $10,000; Suspicious Activity Reports (SARs) for transactions exhibiting suspicious patterns; Customer Due Diligence (CDD) and Know Your Customer (KYC) procedures; and OFAC screening against the Specially Designated Nationals (SDN) list of sanctioned individuals and entities.
For fintech companies, AML compliance is increasingly complex — the speed and volume of digital transactions create challenges for traditional rule-based monitoring. AI-powered AML solutions analyze transaction patterns, network relationships, and behavioral signals to identify suspicious activity with greater accuracy and fewer false positives than legacy systems.
FAQs
What is the difference between AML and KYC?
KYC (Know Your Customer) is a component of AML — the customer identification and due diligence process at account opening that establishes who the customer is and their risk profile. AML encompasses the broader framework: KYC at onboarding, ongoing transaction monitoring, SAR filing, OFAC screening, record-keeping, and employee training. KYC is the 'who' of AML; AML is the full compliance system.
What triggers a Suspicious Activity Report (SAR)?
SARs are filed when a transaction involves funds from illegal activity, is designed to evade BSA requirements (structuring), has no lawful purpose, or involves a known or suspected money laundering pattern. Common triggers include: transactions just below reporting thresholds (structuring), unusual cash activity, transactions inconsistent with customer profile, and rapid movement of funds through accounts.
What AML obligations do fintech startups have?
It depends on the business model and regulatory classification. Money service businesses (MSBs), money transmitters, and companies that issue prepaid cards or handle customer funds are subject to full BSA/AML requirements. SaaS companies that are purely software providers without touching customer funds typically aren't directly regulated under BSA, though their financial institution partners' AML programs cover customer transactions.
Related Terms
KYC
Know Your Customer — the process of verifying the identity of customers and assessing their risk profile to prevent fraud, money laundering, and terrorist financing.
GDPR Compliance
Adherence to the EU's General Data Protection Regulation, governing how organizations collect, store, process, and transfer personal data of EU residents.
SOC 2
A security audit standard developed by the AICPA assessing a service company's data security, availability, processing integrity, confidentiality, and privacy controls.
Audit Trail
A chronological record of all user actions, system events, and data changes in a financial system, providing a traceable history for auditing and investigation.
