AML Compliance: How to Build a Risk-Based Program

AML compliance is the set of policies, controls, and people a regulated business uses to stop criminals from laundering money through it, and to report suspicious activity when it happens. A working program rests on a risk assessment, a named compliance officer, customer due diligence, screening, transaction monitoring, reporting, record-keeping, training, and independent testing.

What AML Compliance Means

Anti-money laundering (AML) compliance means meeting the legal duty to prevent, detect, and report money laundering and terrorist financing. The law sets the outcome. Then each firm designs a program that fits its own risks. So two banks can run very different programs, and yet both still comply.

Above all, regulators judge the program on whether it works, not on how thick the policy binder is. In practice, examiners test whether staff follow the procedures, whether analysts review alerts, and whether reports reach the authorities on time. Since the first step in any program is knowing the customer, it helps to see how KYC and AML differ before going further.

Who Needs an AML Compliance Program

Any business that the law defines as an obliged or reporting entity needs one. The list starts with financial institutions. However, it has grown well beyond banks.

• Banks and credit providers, including digital banks and lenders.
• Payment and money transfer firms, such as e-wallets and remittance services.
• Crypto asset service providers, which FATF brought into scope in 2019.
• Securities firms, insurers, and fund managers.
• Designated non-financial businesses and professions, for example casinos, real estate agents, dealers in precious metals, lawyers, accountants, and trust and company service providers.

Coverage differs from one country to the next. Australia, for instance, is extending its AML law to lawyers, accountants, and real estate agents from July 2026, so firms in those sectors there now face program duties for the first time.

Why AML Compliance Matters Beyond Avoiding Fines

Penalties get the headlines. However, they are only part of the cost. A weak program also hurts the business in quieter ways, for example:

• Banking access. That is because partner banks and payment networks review their clients’ controls. Firms with weak programs often lose correspondent or sponsor bank relationships, which can shut down payments overnight.
• Licenses and growth. Regulators can cap growth, block new products, or refuse license renewals until gaps close.
• Fraud losses. The same identity gaps that let launderers in also let in fraudsters, so poor onboarding costs money directly.
• Reputation and personal liability. Customers and investors notice enforcement actions. In some countries, senior managers can even face personal fines or bans.

Seen this way, then, a working program protects revenue as much as it satisfies the law.

AML Compliance by Industry

The pillars stay the same across sectors. Even so, the main risks differ. So each industry puts its weight on different controls.

Industry	Typical laundering risk	Control that matters most
Banks	Cash deposits, mule accounts, trade finance abuse	CDD, transaction monitoring, beneficial owner checks
Payment and e-wallet firms	Fast transfers, many small accounts, cross-border flows	Remote identity proofing, velocity rules, screening
Crypto asset providers	Pseudonymous wallets, mixers, quick cross-chain swaps	Strong onboarding, wallet screening, travel rule data
Lenders and BNPL	Loan-back schemes, fake identities, fast repayment with dirty cash	Identity and income checks, repayment monitoring
Insurers	Early policy surrender, overpayment refunds	Source of funds checks on large premiums
Real estate and luxury goods	Integration of laundered wealth through high-value purchases	Buyer due diligence, source of wealth checks
Online gaming and casinos	Deposit and withdraw with little play, chip dumping	Player verification, play-pattern monitoring

For example, a crypto exchange and a life insurer both need a risk assessment. Still, the exchange spends most effort at onboarding and on wallets, while the insurer focuses on how premiums are paid and refunded.

The Pillars of an AML Compliance Program

FATF Recommendation 18 asks firms to run internal controls, and most national rules turn that into a short list of pillars. For example, the US Bank Secrecy Act names five. Likewise, most other regimes expect the same building blocks.

Pillar	What it requires	What examiners check
Compliance officer	A named person with authority, independence, and resources	Seniority, reporting line to the board, budget
Policies and internal controls	Written procedures that match the firm’s risk assessment	Whether staff actually follow them
Risk-based customer due diligence	Identify and verify customers and beneficial owners, then risk-rate them	File quality, beneficial owner records, risk scores
Training	Regular, role-specific training for staff	Attendance records and content relevance
Independent testing	Periodic review by internal audit or an outside party	Scope, findings, and whether gaps were fixed

FATF also lists screening of new employees as part of internal controls. That point is easy to miss. Still, insiders who help criminals remain a common way programs fail.

Governance: The Board, the Officer, and Three Lines of Defense

In practice, regulators look first at who owns the program. A policy without clear ownership rarely survives contact with growth targets.

Most firms organize AML around three lines of defense. The first line is the business itself, for example onboarding teams and relationship managers, who apply checks every day. The second line is the compliance function, led by the compliance officer, which sets policy, reviews alerts, and challenges the business. The third line is internal audit, which tests whether the first two lines actually work.

Finally, above all three sits the board. In particular, it approves the risk appetite, receives regular reports from the compliance officer, and funds the program. Examiners often ask board members directly what the firm’s top money laundering risks are, so the reporting needs to be clear enough for non-specialists to follow.

The Risk-Based Approach: FATF’s Baseline

FATF Recommendation 1 tells firms to identify and assess their own money laundering risks, then put more effort where risk is higher. In other words, firms spend effort in proportion rather than applying the same checks to everyone.

Specifically, a firm-wide risk assessment usually scores four areas.

1. Customers. Who they are, for instance individuals, companies, politically exposed persons, or non-residents.
2. Products and services. Cash-heavy, anonymous, or fast cross-border products carry more risk.
3. Delivery channels. Remote onboarding without face-to-face contact needs stronger identity checks.
4. Geographies. Countries with weak AML controls or high corruption raise the score.

After that, the scores drive everything else. High-risk customers get enhanced due diligence and closer monitoring, while low-risk ones may qualify for simplified checks. For that reason, an outdated risk assessment quietly weakens the whole program.

AML Rules by Region

FATF sets the global standard, and about 200 jurisdictions have committed to it. Even so, each region still writes its own law and runs its own supervisor.

Region	Main framework	Supervisor or FIU	Notable feature
Global	FATF 40 Recommendations	FATF mutual evaluations	Grey and black lists put pressure on weak countries
United States	Bank Secrecy Act, AML Act of 2020	FinCEN plus banking regulators	Five program pillars; large criminal penalties
European Union	AML Regulation (EU) 2024/1624	National supervisors, new EU authority AMLA	Single rulebook applies from July 2027
United Kingdom	The Money Laundering Regulations 2017	FCA and professional body supervisors	Detailed guidance on a risk-based approach
Australia	AML/CTF Act 2006, amended 2024	AUSTRAC	Scope widening to lawyers, accountants, and real estate
Canada	PCMLTFA	FINTRAC	Public naming of penalized firms

Because of these differences, a firm serving several markets usually builds one core program, then adds local annexes for reporting formats, thresholds, and record periods.

KYC, CDD, and Screening Inside the Program

In practice, customer due diligence is where the program meets the customer. Under FATF Recommendation 10, firms must identify the customer, verify that identity with reliable sources, identify beneficial owners, and establish why the customer wants the relationship. After that, they screen each customer against sanctions and politically exposed person lists.

This layer is also where manual work breaks down first, because volume peaks here. The table compares the two ways of running it.

Task	Manual approach	Automated approach
Read ID documents	Staff type data from photos	OCR extracts fields in seconds
Confirm the person is real	Video call or branch visit	Face match plus liveness check
Spot deepfakes	Rarely possible by eye	Deepfake detection on the selfie
Screen names	Search lists one by one	Real-time match with similarity scores
Re-screen the customer base	Periodic spreadsheet exercise	Bulk search and ongoing monitoring

Here, Verihubs covers this identity and screening layer. Its OCR, face match, liveness detection, and deepfake detection confirm who the customer is. Then Verihubs watchlist screening checks names with an adjustable similarity threshold, bulk search handles up to 1,000 rows at a time for back-book reviews, and Monitor flags changes after onboarding. For business customers, however, KYB checks cover Indonesian entities only. Transaction monitoring, suspicious activity reporting, and case management sit in other systems, so Verihubs plugs into a program rather than replacing it.

Choosing AML Technology

Today, most programs rely on several tools instead of one platform. So when you compare options, test them against your own risks, not a vendor demo.

1. Coverage of your risks. Check that the tool handles your customer types, documents, and markets.
2. Accuracy and tuning. Ask how the tool scores matches, whether you can set thresholds, and how it handles spelling variants.
3. Resistance to spoofing. For remote onboarding, confirm the identity layer detects printed photos, replayed video, and deepfakes.
4. Audit trail. Every decision, automated or manual, needs a log entry an examiner can follow.
5. Integration. Look for clean APIs, so identity checks, screening, monitoring, and case management share data.
6. Scale and cost. Price the tool at your expected volume, including bulk re-screening of existing customers.

Then run a pilot on real, anonymized data before you sign. After all, even a short test shows false-positive rates and gaps that slide decks never reveal.

Monitoring, Reporting, and Record-Keeping

However, onboarding checks only capture a moment in time. From then on, firms must watch how accounts behave and act on anything unusual.

• Transaction monitoring. Rules and models flag behavior that breaks from the customer profile, for example sudden large transfers or many small cash deposits.
• Suspicious transaction reports. FATF Recommendation 20 requires a prompt report to the national financial intelligence unit when a firm suspects criminal proceeds.
• Threshold reports. Many countries also require reports on cash transactions above a set amount.
• Record-keeping. FATF Recommendation 11 sets a minimum of five years for transaction and identity records.

Meanwhile, tipping off is the trap here. Staff must never tell a customer that a report has gone in, because that can wreck an investigation and is itself an offense in most countries.

What Non-Compliance Costs: Recent Enforcement Actions

These days, weak programs draw penalties in the billions. In fact, regulators often punish the program failure even without proof that the firm meant to help criminals.

TD Bank (2024). TD Bank admitted guilt in a US court in October 2024 to Bank Secrecy Act program failures and conspiracy to launder money, with penalties of about $3 billion. Prosecutors said the bank left about 92% of its transactions unmonitored between January 2018 and April 2024, which let laundering networks move hundreds of millions of dollars.

Binance (2023). In November 2023, the crypto exchange pleaded guilty to charges that included conspiracy to violate the Bank Secrecy Act, and agreed to $4.3 billion in penalties and forfeiture. Its founder also pleaded guilty and then stepped down as CEO.

In short, both cases show the same pattern. The firms grew fast, compliance staff and systems lagged behind, and known gaps stayed open for years. On top of the fines, each faced independent monitors and limits on growth.

How to Build an AML Compliance Program, Step by Step

In most cases, a new program, or a rebuild after an exam finding, follows the same sequence.

1. Map your obligations. First, list every law and regulator that applies in each market you serve.
2. Run the firm-wide risk assessment. Next, score customers, products, channels, and geographies.
3. Appoint the compliance officer. Make sure they report straight to the board and control a real budget.
4. Write policies that match the risks. Also keep them specific, so staff know what to do.
5. Set up CDD and screening. Define standard, simplified, and enhanced checks, and fit them into your KYC workflow.
6. Deploy monitoring and reporting. Set alert rules, review queues, and escalation paths to the reporting officer.
7. Train staff. Then tailor content to each role, from front-line agents to the board.
8. Test independently. Finally, schedule audits, track findings, and close them on a deadline.

In general, automation fits best at steps five and six, where volume is highest. For example, weak identity checks at remote signup invite synthetic identity fraud, which no amount of later monitoring fully fixes.

Measuring Whether Your Program Works

Regulators increasingly ask firms to prove effectiveness, not just existence. Fortunately, a handful of metrics, reported to the board each quarter, makes that possible.

Metric	What it shows	Warning sign
Alert backlog and age	Whether reviewers keep up	Alerts older than your policy allows
False-positive rate	How well screening and monitoring are tuned	Analysts closing almost every alert unread
Report timeliness	How fast suspicions reach the authorities	Reports filed after the legal deadline
Periodic review completion	Whether high-risk files stay current	Overdue reviews on high-risk customers
Onboarding fraud rate	How strong identity checks are	Rising mule or fake-identity accounts
Training completion	Whether staff know the rules	Teams below target, or no role-specific content
Audit findings closed on time	Whether the firm fixes what it finds	Repeat findings across audits

Also, trends matter more than single numbers. For instance, a falling false-positive rate is good news only if true matches are not falling too.

Audit Your Program: Checklist and Common Gaps

Before an exam or internal audit, run through this checklist. Then treat any “no” as a gap worth fixing first.

• Is the firm-wide risk assessment less than 12 months old, and does it reflect new products?
• Also, does the compliance officer report to the board at least once a year?
• Do customer files show verified identity, beneficial owners, and a risk rating?
• Do you screen every customer at onboarding and again when lists or profiles change?
• Do analysts review alerts within a set time and record a reason for each closure?
• Do suspicious transaction reports go out on time, with a quality review?
• Do you hold records for five years or more, in a form that is easy to retrieve?
• Similarly, has every employee completed role-specific training this year?
• Has the team closed past audit findings, with evidence?

Above all, the most common gaps are stale risk assessments, backlogs of unreviewed alerts, missing beneficial owner data, and customers never re-screened after onboarding. Each of these also appeared in recent enforcement actions, so they make a sensible starting point.

Frequently Asked Questions

What is AML compliance?

AML compliance is the program of policies, controls, and staff that a regulated business uses to prevent money laundering and terrorist financing. It covers customer due diligence, screening, monitoring, reporting, record-keeping, training, and independent testing.

What are the five pillars of AML compliance?

Under US rules, the five pillars are a designated compliance officer, internal policies and controls, risk-based customer due diligence, ongoing training, and independent testing. Similarly, most other regimes expect the same elements.

Who regulates AML compliance?

FATF sets global standards, while national authorities then enforce them. Examples include FinCEN in the US, the FCA in the UK, AUSTRAC in Australia, and FINTRAC in Canada.

How long should firms keep AML records?

FATF sets a minimum of five years after a transaction or the end of a customer relationship. However, some countries require longer periods.

What is a risk-based approach in AML?

A risk-based approach means a firm assesses its own money laundering risks and applies stronger controls where risk is higher, instead of the same checks for everyone. FATF Recommendation 1 sets it as the global standard.

What happens if a company fails AML compliance?

Consequences range from warnings and fines to growth limits, license loss, independent monitors, and criminal charges. Partner banks may also end the relationship.

Who is responsible for AML compliance in a company?

The board holds ultimate responsibility, while a named compliance officer runs the program day to day. Front-line staff, compliance, and internal audit each play a defined role.

Can AML compliance be automated?

Partly, yes. Identity verification, name screening, re-screening, and transaction monitoring are commonly automated, while risk decisions, investigations, and report filing still need trained staff.

AML Compliance Is a Program That Has to Run Every Day

A strong AML program links a current risk assessment to clear policies, verified customers, screened names, monitored accounts, timely reports, trained staff, and honest testing. When one link fails, criminals find the gap first, and regulators find it next. So the firms that avoid billion-dollar penalties are not the ones with the longest policies, but the ones whose controls keep running as they grow.

Planning the identity and screening layer of your program? Book a call with our team and map where verification and watchlist checks belong.