What Is Anti-Money Laundering (AML)? Meaning and Key Processes

Search Fintrev

Search our guides, reviews and glossary.

Anti-money laundering (AML) is the set of laws, regulations and internal procedures meant to stop criminals from passing off illegally obtained money as legitimate income. In banking and finance, AML has two sides. Governments write the rules and define the crimes. Banks, brokers, money transmitters, payment apps and crypto exchanges carry out the day-to-day work: identifying customers, watching transactions and reporting activity that looks suspicious.

When a bank, payment app or job posting refers to “AML,” it usually means one of three things: the legal framework, an institution’s compliance program, or a specific check run on a customer or transaction.

What AML covers

AML is broader than a single law. It includes criminal statutes that make laundering a crime, regulations that tell financial institutions what they must do, and the compliance programs built to meet those rules. Authorities use the same framework against tax evasion, public corruption, fraud and sanctions evasion, because each depends on moving money without revealing where it came from.

The obligations fall mainly on institutions that handle other people’s money:

• Banks and credit unions
• Broker-dealers and other securities firms
• Money transmitters and payment services, including digital wallet providers
• Cryptocurrency exchanges and certain other virtual asset businesses
• In some cases, non-financial businesses such as dealers in high-value goods

Individuals have a smaller set of direct duties. In the U.S., a person engaged in a trade or business who receives more than $10,000 in cash in one transaction or in related transactions must report it to the IRS on Form 8300.

The three stages of money laundering

1. Placement. Illicit cash or funds first enter the financial system, for example through deposits, purchases of money orders or loading payment accounts. This is where the money is closest to its criminal source and easiest to spot.
2. Layering. The launderer moves the money through a series of transactions, often repetitive and high in volume: transfers between accounts, jurisdictions, shell companies or assets. The goal is to make the trail too complex to follow back to the source.
3. Integration (or extraction). The now-obscured funds come back out as apparently legitimate wealth, used to buy real estate, stocks, businesses or luxury goods, or simply withdrawn.

KYC is aimed mainly at the first stage, because stopping a criminal from opening an account or making the initial deposit is the cleanest intervention. Ongoing monitoring targets layering. Reporting and record-keeping make integration traceable after the fact.

How AML works inside a financial institution

Know Your Customer (KYC)

Compliance starts when a customer opens an account. KYC (sometimes “Know Your Client”) establishes who the customer is and whether their money plausibly comes from a legitimate source. The institution collects name, date of birth, address and an identification number, then verifies them against documents or independent data sources.

At the same stage, institutions screen new customers against lists of higher-risk parties:

• Sanctions lists, covering individuals, companies and countries under economic sanctions
• Criminal watchlists, covering suspects and people convicted of financial crimes
• Politically exposed persons (PEPs), meaning foreign public officials, their family members and close associates, whose positions create a higher risk of corruption-related funds

A match does not automatically mean rejection, but it triggers closer review.

Customer due diligence (CDD)

KYC is a component of customer due diligence, which continues for the life of the account. Customers can be added to sanctions lists or watchlists after onboarding, and their activity can change, so institutions recheck them and keep records for regulators and investigators.

In the U.S., FinCEN’s CDD rule has four core requirements:

• Identify and verify the customer.
• Identify and verify the beneficial owners of legal entity customers, meaning individuals who own 25% or more of a company opening an account (plus a person who controls it).
• Understand the nature and purpose of the customer relationship so the institution can build a risk profile.
• Monitor transactions on an ongoing basis to identify and report suspicious activity, and keep customer information current.

The beneficial ownership requirement exists because shell companies are a common layering tool: an account in a company’s name reveals little unless someone records who owns or controls it. FinCEN has since eased the rule, so institutions can verify a legal entity’s beneficial owners when it first opens an account rather than each time it opens another.

Higher-risk customers, such as PEPs or businesses with large cross-border flows, typically receive enhanced due diligence: more documentation about source of funds and closer monitoring. Matching scrutiny to risk is the basis of the “risk-based approach” that U.S. and international standards favor.

Transaction monitoring

Monitoring looks for patterns that match known laundering methods. Two of the best known:

• Structuring (smurfing): breaking a large sum into smaller transactions, often spread across people, accounts or branches, to stay below reporting thresholds. Structuring to evade reporting is itself a crime in the U.S., even if the underlying money is legal.
• Layering patterns: rapid movement of funds in and out of an account, round-trip transfers, or activity that has no clear business purpose for that customer.

Banks may also hold certain deposits longer under exceptions in federal funds availability rules, giving them time to review a deposit before the money can be moved on.

Reporting

Two U.S. reports sit at the center of AML reporting:

• Currency Transaction Report (CTR): filed for cash transactions over $10,000. This requirement goes back to the original Bank Secrecy Act. A CTR is routine and does not imply wrongdoing.
• Suspicious Activity Report (SAR): filed when activity suggests possible money laundering or other financial crime. SARs go to FinCEN, which makes them available to law enforcement and other agencies for investigation. Institutions are generally barred from telling the customer that a SAR has been filed.

The compliance program

Banks, brokers and dealers must maintain a written AML program, approved in writing by a member of senior management and overseen by a designated AML compliance officer. It also includes internal controls, employee training, independent testing and the CDD procedures described above. Compliance and operations teams run these processes day to day: reviewing alerts, investigating cases and preparing reports.

Worked example: how a structuring pattern gets flagged

Hypothetical example for illustration. A small retail business opens a checking account. At onboarding, the bank verifies the owner’s identity, records the business’s expected activity (card sales with occasional cash deposits of a few hundred dollars), and screens the owner against sanctions and PEP lists. Nothing is flagged.

Two months later, the account begins receiving cash deposits of $9,500, $9,800 and $9,700 on consecutive days at different branches. Then a wire transfer sends almost the entire balance to an account in another country.

Each deposit is below the $10,000 CTR threshold, so none triggers a currency report on its own. The pattern is what matters:

• Several cash deposits just under the threshold suggest structuring.
• The use of different branches suggests an effort to avoid notice.
• Cash volume far above the profile recorded at onboarding conflicts with the customer’s stated business.
• A rapid outbound wire after the deposits is consistent with layering.

The monitoring system raises an alert, and an analyst reviews the account history against the customer’s profile. If the explanation does not hold up, the bank files a SAR and, depending on its policies and the risk involved, may restrict or close the account. The customer would not be told that a report was filed.

How U.S. AML law developed

The Bank Secrecy Act (BSA) of 1970 created the modern U.S. framework. It required financial institutions to report cash transactions over $10,000, collect information on account owners and keep transaction records.

Later laws built on it. The Money Laundering Control Act of 1986, aimed at drug trafficking, made money laundering a federal crime, and 1990s measures improved surveillance and reporting. After the September 11, 2001, attacks, the USA PATRIOT Act expanded due diligence duties and focused the framework on terrorist financing.

The Anti-Money Laundering Act of 2020, the broadest overhaul since the PATRIOT Act, strengthened the BSA framework, extended AML attention to areas such as the antiquities trade and added measures to improve coordination and enforcement. FinCEN, a bureau of the Treasury, writes and interprets the rules, and its more recent proposals emphasize risk-based, effective programs that reflect national AML/CFT priorities.

Many states have their own AML statutes. They often mirror federal requirements but can add provisions of their own.

AML around the world

The European Union and other jurisdictions adopted measures similar to U.S. law. AML became a coordinated global effort in 1989, when a group of countries formed the Financial Action Task Force (FATF), an intergovernmental body that sets international standards. After 2001, it extended its mandate to terrorist financing.

The FATF’s 40 Recommendations form the template for AML/CFT rules in many countries. They cover customer due diligence, transaction monitoring, suspicious activity reporting and international cooperation. Countries are assessed against these standards, which gives governments a reason to align their laws.

Other bodies contribute: the United Nations through the 1988 Vienna Convention (drug trafficking), the 2000 Palermo Convention (organized crime) and the 2003 Mérida Convention (corruption); the International Monetary Fund, which presses members to comply with AML/CFT norms; the European Union, whose Anti-Money Laundering Directive (AMLD) sets requirements for all member states and has been amended several times; and the Basel Committee on Banking Supervision, whose Customer Due Diligence for Banks paper guides customer identification and verification.

AML in cryptocurrency

Crypto draws regulatory attention because pseudonymous wallets can move value across borders without a bank in the middle, and frameworks built for centralized institutions do not map neatly onto peer-to-peer networks. Regulators have since closed many of the earlier gaps.

In the U.S., FinCEN has treated qualifying administrators and exchangers of convertible virtual currency as money transmitters under the BSA since 2013, so they must register with FinCEN and meet AML, record-keeping and reporting requirements. The GENIUS Act created a federal framework for payment stablecoins and directs that permitted issuers be treated as financial institutions under the BSA, with AML, sanctions and customer identification obligations being written into rules.

Outside the U.S., jurisdictions have added licensing or registration, due diligence, monitoring and reporting requirements for virtual asset service providers. The FATF’s Travel Rule requires certain information about the sender and recipient of crypto transfers to be collected and passed along between providers, mirroring a long-standing rule for bank wire transfers. Adoption has spread, though implementation and enforcement remain uneven.

Blockchain analytics firms such as Chainalysis, Elliptic and TRM Labs help exchanges and law enforcement trace funds on-chain, flagging wallets and transactions linked to sanctioned parties, terrorist groups, ransomware, scams, hacks and darknet markets. Because public blockchains keep a permanent ledger, a transfer flagged later can still be traced backward. In practice, an exchange checks who you are and whether the coins you send or receive touch known illicit addresses.

What AML means for ordinary customers

For most account holders, AML shows up as routine friction:

• ID and address verification when opening a bank, brokerage or crypto account
• Questions about the source of funds or the purpose of a large or unusual transfer
• Holds on certain deposits before funds become available
• A transfer marked as “under review” or showing a pending “AML status” in a money transfer or fintech app while compliance checks are completed
• Account restrictions or closures, sometimes without a detailed explanation, because institutions cannot disclose SARs

Limitations of AML

AML frameworks have well-known weaknesses:

• False positives. Many flagged transactions turn out to be legitimate, yet each alert needs human review, which costs money and can delay payments.
• Compliance cost. Programs are expensive to build and staff, and the burden weighs relatively more on smaller institutions.
• De-risking. Some institutions refuse whole categories of customers, such as certain countries or cash-heavy businesses, instead of assessing each one, which can push legitimate users toward less regulated channels.
• Adaptation by criminals. Launderers shift to methods the rules cover less well, such as trade-based schemes, complex corporate structures or poorly supervised jurisdictions.
• Uneven global enforcement. A country’s laws are only as effective as its supervision, so funds can move through weaker links.
• Ownership opacity. Beneficial ownership checks rely partly on customer-supplied information, and layered structures can still hide who is in control.

AML vs. KYC, CDD, CFT and sanctions compliance

These terms overlap and are often used together (as in “KYC/AML”), but they are not interchangeable:

• AML is the whole framework: laws, regulations and institutional programs against laundering.
• CDD is the set of practices institutions use within AML to understand customers and detect suspicious activity across the relationship.
• KYC is the identification and verification step inside CDD, done mainly at onboarding.
• CFT targets terrorist financing. It is often paired with AML (AML/CFT) because the tools overlap, but the money involved can be legitimately earned and still be illegal in use.
• Sanctions compliance means not dealing with listed parties at all, regardless of whether their funds are criminal. Sanctions screening runs inside AML programs but enforces a separate legal regime.

FAQs

The Bottom Line

AML affects anyone who opens a bank, brokerage or crypto account, sends large transfers or runs a cash-heavy business. Expect ID checks, source-of-funds questions and occasional holds or reviews as normal parts of compliance. Because institutions cannot disclose Suspicious Activity Reports, a restricted or closed account may come without a detailed explanation, so keeping activity consistent with your stated profile helps avoid alerts.