Every regulated business is eventually told that it needs AML compliance. Far fewer are ever told what that actually looks like in reality and it’s that gap which sees so many good intentions just peter out. What actually turns “we have to comply with the AML rules” into something that a business actually does on a day to day basis is the AML policy. That’s the policy that turns the legal requirement into a working reality.
This guide has two purposes. It explains what an AML policy is, what it should contain and how it differs from the broader compliance programme. It then takes you through the process of building that programme and looks at the global regulatory regime it has to conform to. It’s all jurisdiction neutral, based on the global standard set out by the FATF with appropriate reference to any national variations. By the end of it you won’t just have a better understanding of what AML compliance is, you’ll have a clear idea of how to actually put it in place.
What is an AML policy?
An AML policy is the formal document that sets out how a specific business meets its anti-money-laundering and counter-terrorist-financing obligations. It’s part internal playbook, telling the organisation’s own people how to do their jobs compliantly, and part external evidence, because it’s usually the first thing a regulator asks to see when it comes knocking.
It describes, in one place, how the business assesses its risks, verifies its customers, screens and monitors them, reports suspicion, keeps records, trains its people, and governs the whole effort. In other words, it’s the written answer to the question “how do you make sure you’re not being used to launder money?”
AML policy vs AML programme
These two terms are often used interchangeably but they are in fact not the same thing and it’s worth making the distinction. The AML policy is the document, the written statement of how the business intends to meet its obligations. The AML programme (or programme in US usage) is everything the business actually does to comply with those obligations: the people, the systems, the procedures and the actual day to day work. The policy sets out what is intended; the programme is what actually gets done.
Think of the policy as the blueprint and the programme as the building. A blueprint with no building is just paper, and a building thrown up without a blueprint tends to fall down. Regulators care about both: they’ll ask to see the policy, but they’ll judge you on whether the programme behind it actually works. A common and costly failure is having an impressive policy and a hollow programme, a document that promises controls the business doesn’t really operate. The two have to match, which is the thread running through everything that follows.
What does AML compliance mean in practice?
Strip away the jargon and AML compliance in practice is simply a business doing four things continuously: knowing who its customers are, understanding the risk they present, watching what they do and acting (by reporting) when something looks suspicious. All the rest of it (the policies, the officers, the training etc) is there to ensure those four things actually happen in a reliable and verifiable manner.
In practical terms that’s about verifying the identity of a new customer prior to onboarding them, checking them against sanctions and watchlists, forming a risk assessment of them, monitoring their activity over time and escalating anything that’s suspicious to the appropriate people and where necessary to the authorities. It’s about keeping records of all of that so you can demonstrate your work. AML compliance isn’t something you achieve once and then go and have a certificate. It’s an ongoing operational discipline. It’s part of the way the business operates.
Why do you need an AML policy?
There are two honest reasons, and both are real. The first is that it’s a legal requirement. Regulated businesses, financial institutions and a growing list of others, are obliged to have documented AML controls, and failing to maintain them carries serious penalties. For a regulated firm, there’s no lawful way to operate without one.
The second is that it’s a real risk control rather than just a piece of paper. It’s a genuine AML policy which protects the business from being used as a vehicle for money laundering, from the fraud and damage to reputation that would result and from the regulatory penalties that would follow. There’s a very practical third point to make too: the written and actually followed policy is what enables you to demonstrate compliance. If a regulator comes to you and asks you how you manage the money laundering risk, “we just know” is not a valid answer. You need the policy and the records to show that the policy has in fact been applied.
Who needs an AML policy? Industries subject to AML compliance
AML obligations fall on what regulators broadly call regulated or obliged entities, and the list is wider than most people assume, and still growing. The sectors typically in scope include:
- Banks, credit unions, and other deposit-taking institutions.
- Money services businesses, payment firms, and money transmitters.
- Investment firms, broker-dealers, and asset managers.
- Insurance companies, particularly life and investment-linked products.
- Cryptocurrency and digital-asset businesses.
- Casinos and other gambling operators.
- Designated non-financial businesses and professions: lawyers, accountants, real estate agents, and dealers in high-value goods.
That final group is important because the global trend (driven by FATF) is to extend AML obligations beyond the traditional financial sector to the professions that criminals use to move and launder money. Australia’s Tranche 2 reforms (discussed below) are a good recent example of this. The practical implication is that if your business is dealing with significant value or assisting others in moving value then you can assume AML obligations either currently apply or will very soon.
What should an AML policy include?
While the exact shape varies by business and jurisdiction, a complete AML policy covers a consistent set of components. If any of these is missing, the policy has a hole in it:
- A risk assessment. The business’s assessment of its own money-laundering and terrorist-financing risks, by customer, product, geography, and channel. This drives everything else.
- Customer due diligence (CDD) procedures. How the business verifies who its customers are, including KYC and, for business customers, beneficial ownership.
- Sanctions and screening. How customers and counterparties are screened against sanctions lists, politically exposed person data, and adverse media.
- Transaction monitoring. How the business watches activity for suspicious patterns over the life of a relationship.
- Suspicious activity reporting. The process of identifying, escalating and reporting suspicious activity to the appropriate authority.
- Record keeping. What records are kept and for how long to provide evidence of compliance.
- Training. How and how frequently staff are trained in their AML obligations.
- Governance. Who is the accountable person? Typically a designated compliance officer or MLRO (money laundering reporting officer) with clear authority.
These components aren’t a loose list; they’re an interlocking system, which is why building the programme behind them follows a logical order.
Key components of an AML compliance programme
If the policy lists what must be covered, the programme is where those components come to life as working parts. Six of them do the heavy lifting, and they support one another:
- Know Your Customer (KYC) and Customer Due Diligence (CDD). Verifying who customers are and assessing their risk, including identifying the beneficial owners behind business customers. The foundation the whole programme rests on.
- Sanctions screening. Checking customers and counterparties against sanctions lists, PEP data, and watchlists, at onboarding and continuously, to avoid dealing with prohibited parties.
- Transaction monitoring. Watching customer activity for patterns that suggest laundering, such as structuring, unusual flows, or activity inconsistent with the customer’s profile.
- Suspicious Activity Reporting (SAR). The identification, escalation and reporting of suspicious activity to the relevant Financial Intelligence Unit (FIU) which is a legal requirement in most jurisdictions.
- Record keeping and reporting. Documenting the due diligence, screening and monitoring and holding the records for the requisite period so that compliance can be demonstrated and reports can be filed.
- Employee training and awareness. Equipping staff to recognise red flags and meet their obligations, because a programme is only as strong as the people running it.
Each component supports the others. Weak KYC undermines monitoring; poor training undermines everything. A strong programme runs all of them together, not a favoured few in isolation.
AML risk assessment and the risk-based approach
If there’s one idea at the centre of modern AML, it’s the risk-based approach, and it starts with the risk assessment. Rather than applying identical controls to every customer and transaction, the risk-based approach, promoted globally by FATF, directs a business to identify its specific money-laundering and terrorist-financing risks and then concentrate its effort where those risks are highest.
A proper AML risk assessment is a multi-dimensional exercise. You look at the customers (who they are, where they’re from, whether any are higher risk e.g. PEPs), the products and services (some are more easily abused than others), the geographies (some jurisdictions are inherently higher risk) and the channels (remote, non-face to face onboarding is quite different to in person). The result is a set of risk ratings which then underpin everything else: the level of due diligence you apply to a customer, the level of monitoring you apply and where you focus your resources. That’s why the risk assessment comes first in any sensible AML build. If you don’t do it you’re either going to be over controlling your low risk customers (wasting effort and creating friction) or under controlling your high risk customers (which is how the real problems get through). The risk based approach is what enables you to have an effective and proportionate compliance regime.
The step-by-step guide to AML compliance
Here’s the practical sequence for building the programme your policy describes. The order is important as each stage is dependent on the ones that go before it:
- Carry out an AML risk assessment. Begin by assessing your specific risks across customers, products, geographies and delivery channels. That’s the basis on which everything else is then calibrated and a programme that doesn’t have that is just guesswork in the form of controls.
- Appoint an AML compliance officer. Designate a qualified, accountable individual, often called the MLRO, with real authority and the resources to do the job. Compliance without a clear owner tends to become nobody’s job.
- Build customer due diligence procedures. Establish how you verify customer identity (KYC) at onboarding and, for business customers, how you identify the beneficial owners who ultimately control them. Apply enhanced due diligence to higher-risk cases.
- Implement sanctions, PEP, and adverse-media screening. Screen customers and counterparties against sanctions and watchlists, politically exposed person data, and negative news, both at onboarding and on an ongoing basis.
- Set up transaction monitoring. Put in place the means to watch activity for suspicious patterns, calibrated to the risks your assessment identified, rather than generic rules that bury you in noise.
- Establish suspicious activity reporting. Define how staff identify, escalate, and report suspicious activity to the relevant financial intelligence unit, and make sure everyone knows the process.
- Keep thorough records. Document your due diligence, screening, monitoring, and reporting, and retain the records for the required period. If it isn’t recorded, as far as a regulator is concerned it didn’t happen.
- Train your staff. Give everyone relevant, regular training so they can recognise red flags and meet their obligations. A policy only works if the people applying it understand it.
- Independently test and audit the programme. Have the programme reviewed independently, by someone not responsible for running it, to confirm it actually works rather than merely exists.
- Review and update continuously. Revisit the risk assessment and the policy as your business, your customers, and the rules change. AML compliance is a living process, not a one-time project.
Followed in order, these turn a policy document into a functioning programme. Skip or shortcut one, and the weakness tends to surface at the worst possible moment.
The pillars behind a strong AML programme
Underneath those steps sits a recognised structure, often described as the pillars of an AML programme, and set out in detail in references such as the FFIEC BSA/AML examination manual. They are internal controls (the policies and procedures themselves), a designated compliance officer, ongoing staff training, independent testing, and, added more recently, customer due diligence including ongoing monitoring.
The value of knowing the pillars is that they’re exactly what an examiner looks for. If you can point to each one and show it working, policies on the shelf, an accountable officer in post, training delivered, testing done, and due diligence applied, you’ve demonstrated the structure of an effective programme. The step-by-step above is really just these pillars, put into the order you’d build them.
The international AML regulatory landscape
AML is a global exercise, loosely but effectively coordinated by the Financial Action Task Force (FATF) whose 40 Recommendations form the international benchmark that the laws of most countries are designed to meet. There is no single global AML law though; each jurisdiction implements the FATF standards in its own way via its own legislation and regulators. A business operating internationally therefore has to comply with a number of regimes. Here’s a quick run through of the principal ones.
The United States
The US regime is of course the Bank Secrecy Act (extended by the USA PATRIOT Act and updated by the Anti-Money Laundering Act 2020) administered by FinCEN with OFAC dealing with sanctions. It’s one of the oldest and most aggressively applied regimes in the world, notorious for the fines that can run into the billions and the five pillar programme is its defining feature. The beneficial ownership reporting rules have been particularly volatile of late so the current state of those rules is worth checking directly.
The European Union
The EU has traditionally dealt with AML via a series of Directives (the AMLDs, now to the 6th), which the Member States have then implemented into their own national law. The current move is to a much more harmonised model with a single AMLR (Anti-Money Laundering Regulation) which will apply directly across the EU from 2027 and a new EU-wide AMLA (Anti-Money Laundering Authority) to supervise and co-ordinate. That’s the direction they’re clearly heading in.
The United Kingdom
Post-Brexit the UK has its own regime (the Proceeds of Crime Act 2002 and the Money Laundering Regulations 2017 with the FCA as the principal regulator of financial firms (along with other regulators in their respective areas). It is very much in line with the FATF standards and broadly with the EU approach which it was part of in shaping that.
Australia
Australia’s regime is underpinned by the AML/CTF Act 2006 and is administered by AUSTRAC. The most significant recent development has been the Tranche 2 reforms which extend AML/CTF obligations to a range of professions beyond the traditional financial sector (i.e. lawyers, accountants and real estate agents) with those new obligations coming into effect in 2026. That’s a significant expansion of the scope of the regime.
India
India’s framework centres on the Prevention of Money Laundering Act, 2002 (PMLA), with the Financial Intelligence Unit (FIU-IND) receiving reports and the Enforcement Directorate handling enforcement, while the Reserve Bank of India sets KYC and AML requirements for banks and financial institutions. As one of the world’s fastest-growing financial markets, India’s regime has been tightening steadily in line with FATF expectations.
The common thread is FATF. The details will vary of course but they are all implementing the same international standards so the fundamentals of an AML policy (risk assessment, due diligence, screening, monitoring and reporting) are the same across the board even if the specifics are different. For a business operating in a number of these jurisdictions that shared core is what makes a single good policy so much more viable than having to build a new one from scratch in each country.
Common AML policy mistakes to avoid
Knowing what good looks like is easier when you also know the ways it commonly goes wrong. These are the recurring failures:
- A policy that’s written but not followed. The single most common and most dangerous mistake, because the document then sets a standard the business can be shown to have missed.
- Treating compliance as one-and-done. Standing up a programme and then leaving it untouched as the business, its customers, and the rules all move on.
- Weak beneficial-ownership checks. Verifying a company exists but never establishing who really controls it, which is exactly what shell structures exploit.
- Over-reliance on manual processes. Trying to screen and monitor by hand at a scale where it simply doesn’t work, so things slip through.
- Drowning in false positives. Poorly calibrated screening and monitoring that generates so much noise the real risks get lost in it.
Most of these share a root cause: treating the policy as a document to produce rather than a programme to operate. The fix is to build for the practice, not the audit.
How often should an AML policy be updated?
An AML policy is a living document, not a one-time deliverable, and letting it go stale is a classic compliance failure. As a baseline, it should be reviewed at least annually. But the calendar isn’t the only trigger: the policy should be revisited whenever something material changes. That includes launching a new product or service, entering a new market or geography, a shift in the business’s customer base or risk profile, a change in the applicable laws or regulations, and in response to the findings of an independent audit or a regulatory examination.
The underlying principle is that the policy should reflect the business as it actually is, not as it was when the policy was written. A fast-growing company can outgrow its AML policy in months. Treating each review as a genuine reassessment, rather than a rubber stamp, is what keeps the policy, and the programme behind it, fit for purpose.
AML penalties and regulatory fines
The reason AML compliance gets the attention and budget it does is that the penalties for failure are severe, and getting more so. They come in several forms, often combined:
- Financial penalties. Regulators impose fines for AML failings that regularly reach into the hundreds of millions, and in the most serious cases billions, of dollars, euros, or pounds, among the largest regulatory penalties in any field.
- Criminal liability. In serious cases, both companies and the individuals responsible, including compliance officers and senior managers, can face criminal prosecution.
- Loss of licence or registration. A regulated business can lose the authorisation it needs to operate, which for many is an existential outcome.
- Business restrictions and monitors. Regulators can impose operating restrictions or put in place an independent monitor within the business to oversee the remediation.
- Reputational damage. Enforcement is public and the loss of customer, partner and investor trust can outlive any fine.
The pattern across the jurisdictions is the same: AML enforcement has become steadily tougher and the cost of non-compliance is now very comfortably greater than the cost of doing it properly. For a serious business that’s the entire case for getting AML right.
Best practices for AML compliance
Do it well rather than just do it and it comes down to a few principles. Take a risk based approach and focus your effort where the risk is actually highest rather than just spread it out. Do your checks continuously rather than as a one off as a customer that’s cleared at onboarding can turn into a problem months down the line. Automate the heavy lifting (the IDV, the screening, the monitoring) so your people can focus their judgement where it matters. Document everything so that compliance can be demonstrated rather than just claimed. And keep the policy alive, review it and update it as the business and the rules change.
The common denominator is that effective AML compliance is operational rather than cosmetic. It’s embedded in the day to day running of the business in terms of who you bring on board and how you monitor them. The best AML programmes are the ones you’d keep going regardless of whether or not anyone was looking.
It’s also important to remember that compliance is proportionate. A small firm with a fairly straightforward, low risk customer base doesn’t need the same level of compliance infrastructure as a global bank. A risk based approach is exactly what enables you to scale the effort to the level of exposure rather than just replicating some other person’s programme. The structure remains the same (a documented policy, an accountable owner, due diligence, screening, monitoring, reporting and review) the depth of that structure can vary. The real skill of AML compliance is in getting that balance right, having sufficient rigour to control the risk without it being so onerous that the business is effectively brought to its knees.
Where Beady fits
An AML policy covers far more ground than any single tool can possibly do (transaction monitoring, SARs, training etc). Beady is focused on one element of that policy and it’s one that underpins a number of the steps above: the identity and entity layer, the ‘who the hell are you actually dealing with’ question that CD, beneficial ownership and screening all revolve around.
In practice that means KYC and KYB automation that verifies customers and resolves the beneficial ownership behind business ones, across more than 200 million legal entities and officers worldwide. It means screening those customers, counterparties, and the people who control them against sanctions and watchlists and adverse media, with every finding linked back to its source so the decisions in your policy can actually be evidenced. And it means ongoing monitoring, so the “continuous” part of your policy is real rather than aspirational. Beady is the due-diligence and screening engine behind an AML policy; it complements the transaction-monitoring, reporting, and training elements that sit alongside it, rather than replacing them.
A policy you actually live by
An AML policy on the shelf protects nobody. It’s the policy that’s actually in operation that protects the business. It’s the policy that’s embedded in the way you onboard a customer, the way you check the people behind a company, the way you monitor a relationship over time and the way you react when something looks amiss. The policy is important, but only in so far as it’s the operating policy for a real programme that’s actually run and that’s kept up to date as the business and the rules evolve.
Much of that programme comes down to knowing who you’re dealing with and staying sure of it, which is the hardest and most consequential part to get right. If you’d like to see how Beady handles that due-diligence and screening layer, verifying who really sits behind a customer or counterparty and keeping watch after onboarding, book a Beady demo and we’ll walk through it on a company of your choosing.
