AML in banking covers the legal obligations, internal controls, and reporting requirements that financial institutions must maintain to detect and prevent illicit funds from moving through their accounts, products, and correspondent networks.
Having controls on paper is no longer enough to satisfy regulators. In December 2024, the OCC issued a cease and desist order against Bank of America for Bank Secrecy Act (BSA) deficiencies spanning internal controls, governance, independent testing, training, and customer due diligence, citing execution failures at a bank with a documented AML program. FinCEN and bank regulators followed with proposed rules in April 2026 requiring banks to show their programs are risk-based and effective in practice, with controls calibrated to actual institutional risk.
This guide covers what bank AML programs must include and what separates a program that passes examination from one that doesn’t.
Key takeaways:
- A documented AML program isn’t the same as a compliant one
Regulators assess whether controls are working in practice, not just whether they exist on paper. Execution failures are the most common source of exam findings and formal enforcement actions.
- AML risk in banking concentrates in specific product lines and customer segments
Correspondent banking, private banking, wire transfers, and trade finance each carry distinct typologies that require tailored controls beyond standard CDD.
- The regulatory bar for bank AML programs is changing in 2026
New proposed rules from FinCEN and the federal banking agencies require banks to demonstrate that their programs are risk-proportionate and calibrated to their actual customer and product mix.
- Examiners assess whether controls keep pace with the institution
Monitoring thresholds, CDD records, independent testing, and SAR quality are assessed against the bank’s actual risk profile. Independent testing is evaluated based on whether the bank acted on its findings in writing.
- Sigma360 brings sanctions screening, adverse media, perpetual KYC, and AML investigations into one platform
Sigma 360’s AI agents handle high-volume review work without removing analyst judgment from the decisions that require it.
What AML in banking requires
Anti-money laundering obligations for banks in the United States trace back to the Bank Secrecy Act of 1970 and have expanded through the USA PATRIOT Act, the Anti-Money Laundering Act of 2020, and successive FinCEN rulemakings.
The FATF 40 Recommendations set the international baseline that most national frameworks, including the EU’s AMLR and the UK’s Money Laundering Regulations, are built from. Across jurisdictions, each framework requires banks to know who their customers are, monitor how funds move through accounts, and report suspicious activity to the relevant authorities.
In practice, BSA/AML compliance for banks is structured around five program pillars codified in the FFIEC BSA/AML Examination Manual, which regulators use to assess how well a bank’s program functions and how proportionate its controls are to institutional risk.
The table below covers what each pillar requires and how examiners test it:
| Pillar | What it requires | What examiners assess |
| Internal policies, procedures, and controls | Written CDD, EDD, transaction monitoring, and SAR procedures | Whether written procedures match what analysts actually do |
| Designated BSA/AML compliance officer | A named individual with authority to enforce the program (April 2026 proposed rule would require U.S.-based) | Whether the officer has real organizational authority and regulator access |
| Ongoing employee training | Current, documented training specific to the bank’s risk profile | Whether training addresses the bank’s actual typologies and is updated as risks evolve |
| Independent testing | Periodic review by a party outside the AML function | Whether testing is rigorous, documented, and acted upon |
| Customer due diligence (CDD) | Identity verification, beneficial ownership, and risk profiling at onboarding and throughout the relationship | Whether CDD records are complete, current, and calibrated to customer risk |
The OCC issued updated BSA/AML examination procedures for community banks in November 2025, giving examiners explicit discretion to rely on a bank’s independent testing where it meets a high standard. Banks with rigorous, well-documented testing programs are well-positioned to benefit from the flexibility this creates.
Bank-specific AML risks
AML risk in banking isn’t evenly distributed across product lines and customer segments. Regulators expect banks to assess exposure at the product line and customer segment level, and a single program standard applied across the institution leaves the highest-risk areas under-controlled.
The following product lines carry the highest inherent AML risk for banks and require tailored controls beyond standard CDD:
- Correspondent banking: Nested accounts, payable-through structures, and multi-jurisdictional fund flows make it difficult to identify the ultimate originators of transactions. Banks must assess the AML controls of respondent institutions as part of their own program obligations.
- Private banking: High-net-worth clients, complex ownership structures, and cross-border asset movements create elevated exposure to bribery, corruption, and tax evasion. Source of wealth and source of funds documentation are mandatory at onboarding and must be kept current.
- Wire transfers: High volume, short settlement windows, and cross-border routing add another layer of complexity to tracing fund flows. Structuring, layering through rapid fund movement, and third-party payment arrangements are the typologies most often cited in enforcement findings.
- Trade finance: Over- and under-invoicing, phantom shipments, and multiple financing against the same goods are trade-based money laundering techniques that standard transaction monitoring rarely catches. Closing that exposure requires product-specific detection rules and trade document review.
Beyond product lines, customer segments carry their own risk concentrations. PEPs, cash-intensive businesses, non-resident aliens, and customers in FATF gray-listed jurisdictions each require enhanced scrutiny and monitoring intervals calibrated to their actual risk profile.
AML red flags banks must monitor
Examiners look for evidence that a bank’s monitoring system is tuned to the typologies its customer base and product mix produce. The red flags below represent the patterns most commonly cited in BSA examination findings and supervisory actions.
Transaction patterns:
- Cash deposits structured just below the $10,000 Currency Transaction Report threshold to evade CTR filing requirements
- Rapid round-trip movements through accounts with no clear business purpose
- High-volume mismatches between a customer’s stated business and actual transaction activity
Customer behavior:
- Reluctance to provide beneficial ownership documentation or inconsistent responses across interactions
- Requests to keep transaction details off written records
- Use of third parties with no disclosed relationship or business rationale
Account activity:
- Dormant accounts suddenly receiving and disbursing large balances
- Frequent cash deposits followed by immediate wire transfers offshore
- Account activity inconsistent with the customer’s occupation, industry, or stated risk profile
Cross-border and sanctions exposure:
- Transactions involving counterparties in FATF gray-listed or black-listed jurisdictions
- Shell company or nominee ownership structures with no identifiable beneficial owner
- Payments routed through multiple intermediaries with no apparent commercial purpose
Read more: How to Reduce False Positives in AML Screening
What BSA examinations most commonly find
In many BSA examinations, the program in place was built once and never revisited. This approach often leads to specific failure patterns.
Three failure patterns drive most exam findings and formal enforcement actions:
- Monitoring thresholds set at deployment and never updated: As the customer base grows, thresholds calibrated at program setup no longer reflect actual risk. Alert volumes accumulate and detection logic lags, leaving analysts to clear a queue that never produces actionable intelligence.
- Beneficial ownership records left on a flat review cycle regardless of risk: The FinCEN CDD Rule requires banks to maintain and update customer information on a risk basis, but high-risk customers often end up on the same review cycle as low-risk ones. Periodic review processes that exist on paper aren’t consistently executed.
- Independent testing conducted by staff too close to the AML function: When the testing function is too close to the AML team, findings reflect what the program intends to do, not what the program produces. Examiners look for evidence that independent testing identified weaknesses and that management responded to them in writing. A clean test report from a function that has never found a material issue is itself a finding.
Read more: AML Solutions: What They Cover & How to Choose the Right One
What effective AML in banking looks like today
The proposed rules from April 2026 require banks to demonstrate that their controls are proportionate to their actual risk profile, with thresholds calibrated to documented risk assessments and compliance resources directed toward the customers, products, and markets that carry the highest exposure.
FinCEN’s national AML/CFT priorities must also be built into each bank’s risk assessment process. The eight priorities are corruption, cybercrime, domestic and foreign terrorist financing, fraud, transnational criminal organization activity, drug trafficking organization activity, human trafficking and smuggling, and proliferation financing.
The banks with the most defensible programs in 2026 share several characteristics:
- Monitoring rules carry a stated rationale, run on a defined review schedule, and are updated when the customer risk profile changes.
- CDD records are tiered by risk, so high-risk customers receive more frequent and deeper review.
- Independent testing produces findings that management responds to in writing.
- SAR narratives provide enough context to be useful to FinCEN and law enforcement.
Technology has changed what banks can do with the analyst headcount they already have. AI-driven entity resolution and adverse media review reduce the volume of false alerts that reach a reviewer, keeping analysts focused on cases that require judgment instead of processing volume.
The shift from periodic to perpetual monitoring means risk changes are caught between scheduled reviews, closing a window that rule-based programs leave open.
Read more: AML Implementation Timeline: Expectation from Signing to Go-Live
Where Sigma360 fits in a bank AML program
Sigma360 is used by Tier 1 banks, global financial institutions, fintechs, payments firms, asset managers, and regulated corporates to run their full AML program on one platform. Within the platform, AI agents handle high-volume review without removing analyst judgment from the decisions that require it.
The platform covers capabilities essential for successful AML programs, including:
- Sanctions and watchlist screening against global lists, with configurable alert decisioning
- Adverse media monitoring across millions of sources, with AI-driven relevance and materiality scoring
- Perpetual KYC for continuous portfolio monitoring between scheduled review cycles
- AML investigations with structured case management and a defensible audit trail
Sigma360’s Match Agent clears easily identifiable false positives before they reach an analyst’s queue, reducing manual match reviews by 90%. Meanwhile, the Adverse Media Summary consolidates related news coverage into a single contextualized account so analysts can assess the full risk picture across an entity rather than individual article alerts. At the investigation stage, the Entity Summary pulls together global KYC data, watchlist results, corporate registry information, and adverse media into a single risk profile, giving analysts the full picture before they open a case.
To see how Sigma360 supports bank AML programs ahead of the 2026 regulatory changes, speak to a compliance expert.
FAQ
What is the role of the BSA compliance officer in a bank?
The BSA compliance officer is the named individual responsible for the bank’s AML program, including policies, controls, training, and regulatory reporting. FinCEN’s Advisory FIN-2014-A007 requires this person to have sufficient authority, independence, and resources to implement and enforce the program effectively. The April 2026 proposed rule would further require that the officer be U.S.-based.
Does AML apply the same way to community banks and large institutions?
The five-pillar framework applies to all banks, but the OCC’s November 2025 procedures give community bank examiners discretion to rely on independent testing and carry forward prior-cycle findings where the bank’s risk profile is stable. Large institutions face more prescriptive oversight and higher expectations around monitoring calibration and alert disposition.
What is the difference between AML screening and transaction monitoring?
AML screening runs customers and counterparties against sanctions lists, PEP databases, and adverse media sources at onboarding and throughout the relationship. Transaction monitoring watches account activity for patterns that deviate from an established customer profile, and it operates continuously.
How should banks scope their AML risk assessment?
Banks must assess risk at the level of their specific customer segments, products, and geographies. Treating the institution as a single risk unit doesn’t satisfy examiner expectations or the April 2026 proposed rulemaking, which requires controls proportionate to assessed risk and formal incorporation of FinCEN’s eight national priorities.
What is the difference between a Matter Requiring Attention and a formal enforcement action?
A Matter Requiring Attention identifies a program weakness that requires corrective action but doesn’t rise to formal enforcement. Failure to remediate in a timely manner, or a serious or systemic weakness, escalates to formal agreements, consent orders, or civil money penalties.
