Anti-money laundering (AML) compliance sounds like something only large banks need to worry about. In reality, a growing range of businesses, including fintechs, money services businesses, casinos, dealers in precious metals, and certain real estate and investment businesses, are legally required to maintain one. Others adopt a compliance program voluntarily to manage risk and reassure banking partners and investors.

What an AML Compliance Program Actually Is

At its core, an AML compliance program is a set of policies, procedures, and controls designed to detect and prevent the use of a business for money laundering or terrorist financing. In the United States, the framework traces back to the Bank Secrecy Act (BSA) and is generally built around four pillars: written policies and procedures, a designated compliance officer, ongoing employee training, and independent testing of the program.

Who Is Legally Required to Have One

"Financial institutions" under the BSA is a broad legal term. It includes banks and credit unions, but also money services businesses, broker-dealers, casinos, and certain fintech and payment companies. Whether your specific business falls under this definition depends on the services you offer, not just how you describe yourself, so this is worth confirming rather than assuming.

Why Some Businesses Adopt a Program Voluntarily

Even businesses without a strict legal mandate often build an AML program because banking partners, payment processors, or investors require it as a condition of doing business. A documented program can also reduce the business's own exposure if it is unknowingly used to move illicit funds.

What a Program Typically Includes

  • A written risk assessment identifying where the business is most exposed to money laundering or sanctions risk.
  • Customer due diligence (CDD) procedures for onboarding and monitoring customers.
  • Transaction monitoring to flag unusual or suspicious activity.
  • Sanctions screening against OFAC and other relevant lists.
  • A process for filing Suspicious Activity Reports (SARs) when required.
  • Regular training for staff and periodic independent testing of the program.

Getting Started

The right starting point is usually a risk assessment: understanding your customer base, products, geography, and transaction types before building policies around them. A program built without that step often ends up either overbuilt for a low-risk business or missing controls a regulator would expect to see.