Money laundering — the process of making illegally obtained funds appear legitimate — is a serious global problem. Governments worldwide have enacted comprehensive Anti-Money Laundering (AML) laws that impose significant obligations on businesses. Whether you run a bank, a law firm, a real estate agency, or a cryptocurrency exchange, AML compliance is likely a legal requirement. Understanding these obligations is critical for avoiding severe penalties.
The Scale of the Problem
The United Nations estimates that between 2% and 5% of global GDP — roughly $800 billion to $2 trillion annually — is laundered each year. This money funds organized crime, terrorism, corruption, and trafficking. AML laws exist to cut off criminals' access to the financial system, making it harder to profit from illegal activities.
Governments take AML violations seriously. Penalties can include massive fines, criminal prosecution of individuals, loss of business licenses, and reputational damage that can destroy a company's customer relationships and market position.
The Bank Secrecy Act and FinCEN
In the United States, the primary AML framework is the Bank Secrecy Act (BSA), administered by the Financial Crimes Enforcement Network (FinCEN). The BSA requires financial institutions to assist government agencies in detecting and preventing money laundering by maintaining records and filing reports of suspicious activity.
BSA obligations include filing Currency Transaction Reports (CTRs) for cash transactions over $10,000, filing Suspicious Activity Reports (SARs) for transactions involving $5,000 or more that involve funds from illegal activity or lack a lawful purpose, maintaining a comprehensive AML compliance program, and designating a compliance officer responsible for the program.
Who Is Subject to AML Laws
AML laws don't apply only to banks. A wide range of businesses are covered, including banks and credit unions, securities broker-dealers, insurance companies, money services businesses (including cryptocurrency exchanges and money transmitters), casinos and gambling businesses, real estate professionals, attorneys and law firms, accountants and accounting firms, and dealers in precious metals, gems, or jewels.
If your business falls into one of these categories, you likely have AML compliance obligations. Many small businesses are surprised to learn they qualify. A law firm handling client funds, a real estate agent closing transactions, or a dealer in high-value goods may all be subject to BSA requirements.
Know Your Customer (KYC)
Customer identification and verification — often called KYC — is the foundation of AML compliance. Before opening an account or establishing a business relationship, covered institutions must identify the customer and verify their identity using documents, data, or other information sources.
KYC goes beyond simple identification. Institutions must also understand the nature and purpose of the customer relationship. For higher-risk customers, enhanced due diligence is required, which may include deeper background checks, ongoing monitoring, and senior management approval. Politically exposed persons (PEPs) — individuals holding prominent public positions and their family members and close associates — require particular scrutiny due to their elevated risk profile.
Suspicious Activity Reporting
The most important AML obligation for many businesses is the SAR requirement. Financial institutions must file a SAR when they know, suspect, or have reason to suspect that a transaction involves funds from illegal activity, is designed to evade BSA requirements, lacks a lawful purpose, or involves use of the institution to facilitate criminal activity.
SARs must be filed within 30 days of initial detection, unless a suspect cannot be identified, in which case an additional 30 days is permitted. The information in SARs is extremely sensitive — disclosure of a SAR filing to the subject of the report is a federal crime. This creates practical challenges for compliance teams who want to investigate without alerting potential wrongdoers.
Building an AML Program
A compliant AML program must include written policies and procedures, a designated compliance officer, ongoing employee training, an independent testing function, and a risk assessment that considers the institution's products, services, customers, and geographic footprint.
The risk assessment is particularly important. It should identify and evaluate the money laundering risks associated with your business, considering factors like customer types, transaction volumes, geographic exposure, and product features. Your policies and procedures should be calibrated to the risks you face — a small community bank doesn't need the same program as a major international bank.
Red Flags
AML compliance requires recognizing suspicious patterns. Common red flags include transactions just below reporting thresholds, rapid movement of funds through an account, structuring (breaking transactions into smaller amounts to avoid reporting), customers who are reluctant to provide identification or use of third parties to conduct transactions, and transactions inconsistent with the customer's known business or financial situation.
Transactions involving high-risk jurisdictions, shell companies, or unusual corporate structures also warrant additional scrutiny. When in doubt, the safest approach is to file a SAR — regulators strongly prefer over-reporting over under-reporting.