KYC AML Compliance Requirements 2026

Anti-Money Laundering (AML) refers to the laws, regulations, and programs designed to detect and prevent the conversion of illegally-obtained funds ("dirty money") into seemingly legitimate assets ("clean money"). The three stages of money laundering are placement (introducing illicit cash into the financial system), layering (concealing the trail), and integration (making funds appear legitimate). (FinCEN BSA Overview)

Know Your Customer (KYC) is the due diligence process by which financial institutions verify customer identity, assess customer risk, and monitor ongoing account activity. KYC is the customer-facing component of a broader AML compliance program. (FinCEN CDD Final Rule)

The primary US law governing AML is the Bank Secrecy Act (BSA) of 1970 (31 U.S.C. 5311–5336), as amended by the USA PATRIOT Act (2001), the Anti-Money Laundering Act of 2020 (AMLA), and the Corporate Transparency Act (2021). Enforcement is led by FinCEN (US Treasury), with examination by federal banking regulators (OCC, FDIC, Fed, NCUA). (31 U.S.C. 5311)

FinCEN requires covered financial institutions to maintain a written AML compliance program with at minimum five elements. (FinCEN CDD Final Rule, May 2018) as of March 2026

Currency Transaction Reports (CTRs)

Financial institutions must file a CTR for any single or aggregated cash transaction(s) of more than $10,000 by or for the same person in a business day. CTRs must be filed within 15 days of the transaction. (31 CFR § 1010.311)

Suspicious Activity Reports (SARs)

Financial institutions must file a SAR when they know, suspect, or have reason to suspect that a transaction involves funds from illegal activity, is designed to evade BSA requirements, lacks a lawful purpose, or involves potential insider fraud exceeding $5,000. (31 CFR § 1020.320)

The FinCEN CDD Final Rule (effective May 11, 2018) requires covered financial institutions to identify and verify the beneficial owners of legal entity customers — individuals who own 25%+ or exercise significant control. (FinCEN CDD Final Rule)

CDD Four Core Elements

• Customer Identification (CIP): Collect and verify customer name, date of birth, address, and identification number (SSN or EIN)
• Beneficial Ownership Identification: Identify individuals owning 25%+ of legal entities; identify one control prong individual
• Customer Risk Assessment: Understand the nature and purpose of customer relationships to develop a risk profile
• Ongoing Monitoring: Monitor for suspicious activity and maintain current customer information

Corporate Transparency Act (CTA) — Beneficial Ownership Information (BOI)

Effective January 1, 2024, the Corporate Transparency Act requires most US companies (LLCs, corporations, etc.) to report beneficial ownership information directly to FinCEN. Note: In early 2025, BOI reporting was subject to court injunctions; consult FinCEN.gov for current status. (FinCEN BOI Rule)

Source: FinCEN enforcement actions, DOJ press releases, and FinCEN/CFTC published settlement documents.

• Designate a BSA Compliance Officer with adequate authority and resources
• Conduct an enterprise-wide BSA/AML risk assessment (at minimum annually)
• Document written BSA/AML policies, procedures, and internal controls
• Implement a Customer Identification Program (CIP) for all new accounts
• Collect and verify beneficial ownership information for legal entity customers
• Screen customers against OFAC SDN List and PEP databases at onboarding and ongoing
• Establish risk-based customer due diligence tiers (standard, enhanced, simplified)
• Implement transaction monitoring system for unusual activity detection
• File SARs within 30 days (60 if no suspect identified) — never tip off the subject
• File CTRs for cash transactions exceeding $10,000; monitor for structuring
• Conduct annual BSA/AML training for all applicable employees
• Perform independent annual audit of BSA/AML program effectiveness
• Maintain SAR/CTR records for 5 years
• Implement enhanced due diligence (EDD) for high-risk customers (PEPs, correspondent banks, MSBs)

How to Build an AML Compliance Program — Step by Step

Whether you're building an AML program from scratch or strengthening an existing one, these are the seven required elements under FinCEN guidance and the BSA examination manual. (FFIEC BSA/AML Manual)

1. Conduct an Enterprise-Wide BSA/AML Risk Assessment. Assess money laundering risks across your products, customers, services, and geographies. Document it. Review at minimum annually. This drives everything downstream — the intensity of your monitoring, your CDD thresholds, your training focus.
2. Appoint a Designated BSA Compliance Officer. Must have sufficient authority, resources, and independence. Cannot be a perfunctory title — examiners will test whether this person actually manages the program. Board approval or acknowledgment is standard practice.
3. Write Board-Approved BSA/AML Policies and Internal Controls. Cover CIP, CDD, transaction monitoring, SAR/CTR procedures, record retention (5 years), and escalation paths. Must be reviewed and approved by the board or a senior committee at least annually.
4. Implement Customer Identification Program (CIP) and CDD. Verify customer identity at onboarding using documents (passport, driver's license) or non-documentary methods. Collect beneficial ownership for legal entity customers (any individual with ≥25% ownership, plus one control person). Assign risk ratings. Conduct ongoing monitoring.
5. Deploy Risk-Based Transaction Monitoring. Implement automated monitoring calibrated to your risk assessment. Document alert thresholds and the rationale for them. Investigate alerts in a timely manner and document outcomes. Retention: 5 years minimum.
6. Conduct Annual AML Employee Training. Train all applicable staff on red flags, tipping-off prohibition, and institution-specific procedures. Document completion. New employee training should occur within 30 days of hire.
7. Perform Independent Annual Testing of the BSA/AML Program. Must be conducted by qualified internal audit or an external firm. Must cover policy adequacy, training completion, CDD quality, monitoring calibration, and SAR/CTR accuracy. Address all findings. Testing independence from BSA function is required.

Ask our AI: "What should be in a BSA/AML risk assessment?" or "How do I set transaction monitoring thresholds?"

Frequently Asked Questions

Related Compliance Topics