Anti-Money Laundering
What is anti-money laundering (AML)?
Anti-money laundering (AML) is the framework of laws, regulations, and internal controls that financial institutions and payment businesses use to detect, prevent, and report the movement of criminally obtained funds through the financial system. Money laundering disguises the origin of illegal proceeds so they appear to come from a legitimate source.
AML applies at two points: when a business takes on a customer, and whenever money moves afterwards. Regulated firms are legally obliged to verify who they are dealing with, watch transaction behavior over the life of the relationship, and report activity that looks suspicious to a national authority. The global baseline comes from the Financial Action Task Force (FATF), an intergovernmental body whose recommendations national regulators write into local law, which is why AML programs look similar in structure across markets even though the statutes differ.
Money laundering vs anti-money laundering
Money laundering is the crime. Anti-money laundering is the regulatory and operational response built to catch it.
| Money laundering | Anti-money laundering |
| A criminal process that moves illicit funds through placement, layering, and integration until their origin is obscured | A compliance discipline that identifies customers, monitors transactions, and escalates suspicion to authorities |
| Carried out by criminals and the intermediaries who knowingly assist them | Carried out by obliged entities: banks, payment firms, acquirers, and other regulated businesses |
| Prosecuted under criminal law | Enforced by financial supervisors through fines, license conditions, and business restrictions |
Enforcement lands on the control failure. Supervisors penalize firms that couldn't demonstrate working detection, whether or not laundered money actually passed through the business.
Key requirements
An AML program is built from a standard set of controls:
- Customer due diligence. Identity is verified before the relationship goes live, using checks for individuals and checks for companies. Corporate onboarding also identifies the behind the legal entity.
- A risk-based approach. Checks scale with risk. Straightforward relationships get standard ; a , a politically exposed person, or a counterparty in a jurisdiction on the FATF monitoring lists gets enhanced due diligence and senior sign-off.
- Transaction monitoring. Rules and models run against payment flows to surface structuring, rapid pass-through of funds, mismatches between declared business model and actual volume, and links to sanctioned parties.
- Suspicious activity reporting. Alerts that survive investigation are filed with the national financial intelligence unit. Filing obligations are confidential, so the customer is not told.
- Sanctions and terrorist financing screening. Customers and counterparties are screened against sanctions and watchlists, which is where AML overlaps with .
- Governance and records. A named compliance officer owns the program, staff are trained, and identification and transaction records are retained for a period set by local law.
Who it applies to
AML obligations bind "obliged entities" rather than the general public. The category covers banks, e-money and payment institutions, acquirers, , investment firms, and, in a growing number of markets, crypto-asset service providers. Non-financial businesses that handle large value transfers, such as real estate agents, casinos, and some dealers in high-value goods, are also captured in many jurisdictions.
The legal source depends on the market. In the United States the core obligations sit under the Bank Secrecy Act and its subsequent amendments. In the EU, the 2024 AML package replaces national transpositions with a directly applicable regulation and creates a central supervisor, the Anti-Money Laundering Authority (AMLA) in Frankfurt.
Merchants that are not themselves regulated still feel AML through their provider. An or PSP passes its own obligations down the chain, which is why onboarding asks for incorporation documents, ownership structure, and evidence of the business model before an account is approved.
Penalties for non-compliance
Supervisory penalties for AML failures are set as a percentage of turnover or a fixed maximum, depending on the regime, and are applied to the firm rather than to individual transactions. Beyond the fine itself, enforcement typically brings a remediation order with deadlines, a skilled-person review paid for by the firm, and restrictions on onboarding new customers until the controls are fixed.
Individual accountability is a feature of most modern regimes: named compliance officers and directors can face personal fines, prohibition from holding regulated roles, and in serious cases criminal liability. A firm that loses supervisory confidence can also lose its license, and banking partners frequently exit the relationship before a regulator acts, which removes access to settlement accounts and card scheme processing.
