AML Laws and Regulations in the US

The United States runs one of the oldest, deepest, and most aggressively enforced anti-money-laundering regimes in the world. It’s also one of the most confusing to newcomers, because it isn’t a single law but a stack of them, built up over more than fifty years, with each new layer added after criminals found a way around the last. The result is a web of statutes, rules, and regulators that even seasoned compliance professionals have to work to keep straight.

This guide untangles that web. We’ll trace the US AML framework from its foundation outward, through its history, the main regulations in force today, who they apply to, how crypto fits in, how to actually comply, and the penalties for getting it wrong. A couple of corners of this picture have been unusually turbulent lately, especially around beneficial-ownership reporting, so we’ll flag where the ground has shifted and is still shifting. The thread running through all of it is the same question US law has circled for half a century: who is really moving this money?

The foundation: the Bank Secrecy Act (1970)

Everything in US AML starts with the Bank Secrecy Act of 1970, which is why the whole field is still called “BSA/AML” in American usage. The BSA’s core idea was simple but powerful: require financial institutions to keep records and file reports that give the government a paper trail to follow criminal money. Its best-known requirement, the Currency Transaction Report for cash transactions above $10,000, dates from here and is still in force today.

The BSA didn’t criminalize money laundering itself, it created the reporting and recordkeeping backbone that everything later would build on. Administered today by the Financial Crimes Enforcement Network (FinCEN), a bureau of the Treasury, it remains the cornerstone statute, and every subsequent law is, in effect, an amendment or an extension of it.

The history of US anti-money-laundering laws

US anti-money-laundering law wasn’t designed in one piece; it accreted, one statute at a time, usually in reaction to the last scandal or the next emerging threat. FinCEN itself maintains a history of anti-money-laundering laws that traces the arc, and it’s a useful reminder that the framework is a living thing rather than a finished monument. The milestones that matter most:

• The Money Laundering Control Act of 1986. This is the law that actually made money laundering a federal crime, turning it from a regulatory concern into a prosecutable offense and giving the government real teeth.
• The Annunzio-Wylie Anti-Money Laundering Act of 1992. Strengthened penalties and paved the way for the Suspicious Activity Report (SAR), the mechanism by which institutions flag suspicious transactions to the authorities.
• The USA PATRIOT Act of 2001. Passed after 9/11, its Title III massively expanded AML law: it introduced the Customer Identification Program (CIP) requirement, enhanced due diligence for correspondent and private banking, special measures against high-risk jurisdictions (Section 311), and information-sharing mechanisms between the government and institutions (Section 314).
• The Anti-Money Laundering Act of 2020. The biggest overhaul in a generation, it modernized the BSA, expanded its scope, created a whistleblower program to reward those who report violations, and, through the Corporate Transparency Act, established a beneficial-ownership reporting regime, which has since become the most contested corner of US AML.

Read together, these show the direction of travel: from a recordkeeping rule, to a criminal offense, to a sprawling framework reaching ever deeper into who owns and controls the money. The pattern is reactive, each law closing a gap the previous generation of criminals had exploited, which is also why the framework keeps growing rather than settling into a final form.

What are the main AML regulations in the US?

If the history explains how the framework came to be, it helps to have a clear picture of the main regulations as they stand today, because this is the rulebook a compliance team actually works from day to day:

• The Bank Secrecy Act and its implementing regulations. The foundation, imposing the core reporting (CTRs and SARs) and recordkeeping obligations.
• The USA PATRIOT Act requirements. Most importantly the Customer Identification Program (CIP) rule and enhanced due diligence for higher-risk relationships.
• The FinCEN Customer Due Diligence (CDD) rule. Requiring institutions to identify and verify the beneficial owners of their legal-entity customers, the so-called fifth pillar.
• SAR and CTR reporting rules. The suspicious-activity and large-cash-transaction reporting obligations at the heart of the regime.
• OFAC sanctions regulations. Screening and blocking requirements for sanctioned parties, enforced on a strict-liability basis that leaves little room for error.
• The Corporate Transparency Act and beneficial-ownership rules. The direct company-reporting regime, now significantly scaled back for US companies, covered in detail below.
• The Anti-Money Laundering Act of 2020 and its implementing rules. The modernization layer, still being rolled out through subsequent FinCEN rulemaking.

These aren’t separate silos. A single institution has to satisfy all of them at once, which is exactly why US AML programs are as comprehensive, and as demanding, as they are.

The Corporate Transparency Act and beneficial ownership

Beneficial ownership, knowing the real humans who ultimately own or control a company, has become the central preoccupation of modern AML, because shell companies are the classic tool for hiding dirty money. US law approaches it from two directions, and it’s important not to confuse them.

The first is the FinCEN Customer Due Diligence (CDD) rule, in effect since 2018, which requires financial institutions to identify and verify the beneficial owners of their legal-entity customers at onboarding. This remains firmly in force. The second is the Corporate Transparency Act, which would have required companies themselves to report their beneficial owners directly to FinCEN. That regime has been through extraordinary upheaval. After a wave of litigation, FinCEN issued an interim rule in 2025 that exempted US companies and US persons from the reporting requirement, and that exemption has since been treated as effectively permanent. As of late 2026, domestic US companies and US persons are not required to file beneficial-ownership reports, and the requirement falls essentially on foreign reporting companies registered to do business in the US. This area has moved repeatedly and may move again, so the current position should always be checked directly with FinCEN before relying on it.

Who enforces US AML law?

One reason US AML feels complicated is that no single agency owns it. Enforcement is spread across a crowded field, and a regulated business can answer to several at once:

• FinCEN. The Treasury bureau that administers the BSA, issues AML regulations, and collects the reports. The central AML authority.
• OFAC. The Office of Foreign Assets Control, also within Treasury, administers and enforces economic sanctions, a closely related obligation that sits alongside AML.
• Federal banking regulators. The OCC, Federal Reserve, FDIC, and NCUA examine the institutions they supervise for BSA/AML compliance, guided by the FFIEC examination manual.
• The Department of Justice. Brings criminal prosecutions for money laundering and willful BSA violations.
• The SEC and CFTC. Oversee AML obligations for the securities and derivatives firms within their remit.
• State regulators. Some states impose their own requirements; New York’s Department of Financial Services, through its Part 504 rule, is the most prominent.

The practical consequence is that US AML compliance means satisfying overlapping expectations from multiple supervisors, with the FFIEC BSA/AML examination manual serving as the shared reference for what examiners look for.

The core requirements for institutions

At the heart of US AML is the obligation for covered institutions to maintain an effective, risk-based AML program. That program is conventionally described in terms of five pillars, the elements an examiner expects to find:

• Internal controls. Written policies, procedures, and controls designed to ensure ongoing compliance.
• A designated BSA/AML officer. A specific, accountable individual responsible for the program.
• Ongoing training. Regular, relevant training for staff so they can meet their obligations.
• Independent testing. Periodic independent audit of the program to confirm it actually works.
• Customer due diligence. The fifth pillar, added by the 2016 CDD rule, requiring institutions to understand their customers, including beneficial ownership, and to conduct ongoing monitoring.

Those pillars produce a set of concrete obligations: the Customer Identification Program (CIP) to verify who customers are, filing SARs when activity is suspicious and CTRs for large cash transactions, screening against OFAC sanctions lists, keeping records, and sharing information under Section 314. Together they add up to a demanding, continuous compliance operation rather than a one-time setup.

How to comply with US AML regulations

Knowing the rules is one thing; building a program that satisfies them is another. For a business in scope, compliance comes down to a sequence of concrete steps, each building on the one before:

1. Conduct a risk assessment. Understand your specific money-laundering and terrorist-financing risks across customers, products, geographies, and channels. Everything else is calibrated to this.
2. Build a written AML program. Structure it around the five pillars, document it, and have senior management approve it.
3. Appoint a BSA/AML compliance officer. A qualified, accountable individual with genuine authority and the resources to do the job.
4. Implement CIP and CDD. Verify customer identity at onboarding, and identify and verify the beneficial owners of legal-entity customers.
5. Screen against sanctions and watchlists. Check customers and counterparties against OFAC and other lists, and ideally adverse media, at onboarding and on an ongoing basis.
6. Monitor and report. Watch transactions and relationships for suspicious activity, file SARs and CTRs as required, and keep the necessary records.
7. Train and test. Train staff regularly, and have the program independently tested to confirm it works in practice, not just on paper.

The theme is that compliance is a continuous operation, not a one-time build. A program that was adequate at launch can drift out of compliance as the business, its customers, and the rules all change, which is why ongoing monitoring and periodic testing matter as much as the initial setup.

Who do AML regulations in the US apply to?

US AML obligations apply to a broad and growing list of “financial institutions” as the BSA defines them, a term far wider than just banks. The main categories in scope today include:

• Banks and credit unions, the original and still the archetypal covered institutions.
• Money services businesses, including money transmitters, currency exchangers, check cashers, and prepaid-access providers.
• Broker-dealers in securities and mutual funds.
• Casinos and card clubs above certain thresholds.
• Futures commission merchants and introducing brokers in commodities.
• Many cryptocurrency businesses, treated as money transmitters under the BSA.

The perimeter keeps widening as regulators pull new sectors in. Investment advisers are the clearest current example: FinCEN finalized a rule to bring them under AML program and SAR requirements, but then delayed its effective date, now pushed to 2028, while it reviews and tailors the rule. The lesson is that US AML scope is a moving line, and businesses in adjacent sectors should assume it’s more likely to widen than narrow. If your business handles money or financial transactions in any meaningful way, the safe assumption is that some form of AML obligation applies, or soon will.

AML and cryptocurrency in the US

Crypto deserves its own treatment, because it’s where US AML has expanded most dramatically and where enforcement has been most active. The core principle is that crypto isn’t a regulatory blank space. FinCEN has long treated businesses that exchange or transmit convertible virtual currency, exchanges, administrators, and many wallet providers, as money services businesses under the BSA, a position set out in its virtual currency guidance.

In practice that means those businesses must register with FinCEN, build and maintain AML programs, verify customer identity, monitor transactions, file SARs and CTRs, and comply with the Travel Rule by collecting and passing on required information about the parties to a transfer. OFAC sanctions apply too, and specific crypto addresses have been designated, though this is a fast-moving and legally contested area; notably, the sanctions on the Tornado Cash mixer were withdrawn in 2025 following a court ruling. Enforcement has been substantial, with major crypto businesses hit by very large settlements for AML and sanctions failures. And the legislative picture continues to evolve, with ongoing debate over dedicated federal frameworks for crypto and stablecoins. The clear direction is that US regulators increasingly treat crypto businesses like other financial institutions for AML purposes, and expect them to comply accordingly.

Penalties for non-compliance

What makes US AML genuinely feared, globally, is the scale of its enforcement. The penalties are among the most severe anywhere, and they come in both civil and criminal flavors. Civil money penalties for BSA violations can be substantial, and in serious cases the Department of Justice brings criminal charges that can reach not just institutions but the individuals responsible, including compliance officers.

The headline numbers tell the story: US regulators and prosecutors have repeatedly imposed AML-related penalties running into the hundreds of millions, and in the largest cases into the billions, of dollars, often combining fines from several agencies at once. Beyond the money, consequences include deferred-prosecution agreements, mandated monitors installed inside the business, business restrictions, and reputational damage that can outlast any settlement. For a financial institution, a serious AML failure is a genuinely existential risk, which is precisely why US firms invest so heavily in compliance.

Recent developments and what’s changing

The US AML landscape is in motion on several fronts, and anyone operating in it should track the direction of travel:

• AML Act of 2020 implementation. FinCEN continues to roll out the many rules and priorities mandated by the Act, reshaping expectations around risk-based, effective programs.
• The beneficial-ownership saga. The Corporate Transparency Act’s reporting regime was dramatically scaled back in 2025 and 2026, exempting US companies and persons, a reversal few predicted and one still capable of further change.
• Investment advisers. The AML rule for advisers was finalized and then delayed to 2028, leaving the sector in a holding pattern.
• Crypto enforcement. Digital-asset businesses face growing scrutiny under the existing BSA framework, with significant enforcement actions already on the record.

Because several of these are unsettled, treat any specific status, above all on beneficial ownership, as a snapshot to verify against FinCEN rather than a fixed fact.

Where Beady fits

US AML compliance is broad, spanning programs, transaction monitoring, SAR operations, training, and independent testing. Beady doesn’t do all of that, and it’s worth being precise about the slice it owns: the entity-and-people layer, which happens to be exactly where US AML has pushed hardest. It handles the “who are you really dealing with” question that CIP, customer due diligence, and beneficial ownership all turn on.

In practice that means KYB automation that verifies business customers and resolves the beneficial ownership behind them, the same ownership the CDD rule requires institutions to identify, across more than 200 million legal entities and officers worldwide. It means screening those entities and the people who control them against OFAC and other sanctions lists and adverse media, with every finding linked back to its source so a decision can be evidenced to an examiner. And it means ongoing monitoring, the continuous element the fifth pillar demands, so a customer who becomes risky after onboarding is caught. Beady is the identity and entity intelligence layer of a US AML program; it complements the transaction-monitoring and SAR systems that sit alongside it, rather than replacing them.

Fifty years, one question

US AML law can look like an intimidating thicket, and in some ways it is: five decades of statutes, a crowd of regulators, and rules that are still visibly shifting under foot. But step back from the detail and the whole edifice is organized around a single, consistent purpose. Every report, every pillar, every beneficial-ownership rule, settled or contested, exists to answer one question that financial crime has always turned on: who is really behind this money, and can they be trusted?

That’s the question Beady is built to answer, on the entity-and-people side where it’s hardest and where US regulators look closest. If you’d like to see how it verifies who really sits behind a customer or counterparty and keeps watch after onboarding, book a Beady demo and we’ll walk through it on a company of your choosing.