Who Is Required to Have an AML Program? (2026 US Guide)

Quick answer: In the United States, the businesses required to have an anti-money laundering (AML) program are the "financial institutions" named in FinCEN's Bank Secrecy Act rules: banks and credit unions, money services businesses, broker-dealers, mutual funds, casinos and card clubs, insurers that issue covered products, futures commission merchants and introducing brokers, dealers in precious metals, stones, or jewels, operators of credit card systems, non-bank residential mortgage lenders and originators, and housing government-sponsored enterprises. Other businesses aren't required to run a full AML program, though they may still have reporting duties, such as reporting cash payments over $10,000.

The United Nations Office on Drugs and Crime has estimated that money laundered globally each year equals 2% to 5% of world GDP, which is why regulators require the institutions that money passes through to have controls in place. A written AML policy sets out how the institution meets those requirements.

What Is an AML Compliance Program?

An AML compliance program comprises a set of rules and procedures which are required to be strictly followed by organisations.

Why? To avoid financial crimes/money scams.

An AML compliance program helps companies, including traditional banking organisations and such entities as defined in the regulations–like money changers and insurance providers—in uncovering suspicious transactions linked to criminal activities, such as money laundering and terrorist financing (ML/TF).

Though financial institutions fall under a common sector, yet every financial institution has a different landscape and different kinds of challenges when it comes to preventing money laundering.

When establishing an AML compliance program, an organisation should take into account few considerations such as nature of its clients, international, national, and local rules, and geographical characteristics.

Hence, financial institutions need to implement and maintain a detailed AML Compliance Program according to their specific risks. Policies, practices, and internal controls should all form a part of this program to identify and stop money laundering and funding of terrorism.

Therefore, an AML compliance program is not a one-size-fits-all approach.

It needs to be specifically designed to meet the requirements of the organisation and the area in which it works. The program must provide a procedure for detailed reporting and due diligence while customer verification is ongoing. The compliance officer is typically in charge of creating the AML compliance program and is also in charge of testing and updating it on regular basis.

What an AML Program Must Include

Under FinCEN's rules, and as examiners assess it using the FFIEC BSA/AML Examination Manual, an AML program has these core elements, often called pillars:

• Internal policies, procedures, and controls: a risk-based system for complying with the Bank Secrecy Act, including customer identification, recordkeeping, and suspicious activity reporting
• A designated BSA/AML compliance officer: responsible for day-to-day compliance
• Ongoing employee training: so staff can recognize and escalate suspicious activity
• Independent testing: periodic audits by internal staff not involved in the program or by an outside party
• Customer due diligence: for banks, broker-dealers, mutual funds, futures firms, and other institutions covered by the CDD Rule, risk-based ongoing due diligence, including identifying the beneficial owners of legal entity customers

Banks and other institutions subject to the Customer Identification Program rule must also verify customers' identities when accounts are opened. Our guide to the 5 pillars of an AML program covers each element in detail.

In practice, a workable program needs a compliance team with clear ownership and tools that automate identity checks, screening, and transaction monitoring. Document the risk assessment and the procedures that follow from it, and review both regularly.

What Makes an Effective AML Compliance Program?

AML process usually involves various steps as mentioned below –

1. Know Your Customer (KYC): Organisations are required to verify the identity of their clients and the supporting documents provided by them.

Why? To make sure that the client or business is who they say they are and is not engaged in any criminal activities.

KYC policies must be regularly updated to take into consideration any amendments in the regulations and alterations in client info to help with AML efforts.

2. Risk-Based AML Policies: Organisations must implement and follow AML policies according to exposed risks.

This includes: CDD, transaction monitoring, and unusual activity reporting.

Why are these important? These policies assist the organisation in identifying suspicious activities and taking suitable measures.

3. Risk Assessment and Ongoing Monitoring: Organisations must continuously monitor their clients and dealings to find any clues for any unusual behaviour.

Why? To assist organisations in real-time identification of any possible money laundering activity and take the necessary action in due time.

Without Transaction monitoring software solutions, organisations leave themselves open to financial crimes and their adverse outcomes.

4. AML Compliance Training: Organisations need to make sure that their employees are informed and well-trained on AML compliance.

How? By updating training materials on a regular basis to reflect the amendments in rules, guidelines, and best practices concerning money laundering operations.

By appointing an internal compliance officer in senior management who will enforce these policies.

5. Internal Controls and Audits: AML compliance should be routinely checked and inspected to make sure that all AML regulations are being followed.

Why?To assist in identifying any suspicious behaviour or any abnormalities that could have gone unnoticed throughout the monitoring procedure.

Organisations need to keep their AML compliance standards up to date.

💡 Related Blog:

What are the 5 pillars of an AML program

Who Is Required to Have an AML Program in the US?

Not every company. The requirement applies to the categories of financial institution that FinCEN has written AML program rules for:

Fintechs aren't a separate category. A fintech needs its own AML program if it falls into one of these categories, for example as a money transmitter. If it offers accounts through a partner bank, the bank's AML program applies and the bank will usually require the fintech to follow it. Our guide on who is subject to AML regulations in the US covers the wider set of rules.

What Changed in 2025 and 2026

• Investment advisers: FinCEN's final rule bringing many registered investment advisers and exempt reporting advisers under AML program requirements was postponed in December 2025 and now takes effect January 1, 2028.
• Residential real estate: FinCEN's reporting rule for certain non-financed residential property transfers, delayed to March 1, 2026, was vacated by a federal court in Texas on March 19, 2026. While the vacatur stands, filings aren't required. FinCEN and the Justice Department have appealed. This is a reporting rule, not an AML program requirement.
• Payment stablecoin issuers: in April 2026, FinCEN and OFAC proposed rules under the GENIUS Act that would require permitted payment stablecoin issuers to run AML/CFT and sanctions compliance programs.
• AML program reform: FinCEN's April 2026 proposal would rewrite program requirements around four pillars, with risk assessment built into internal controls and a requirement that the compliance officer be based in the US. It is still a proposal with no effective date.

Related Solutions

Identity VerificationPep ScreeningBank Account Verification

How Signzy can help your business with AML screening?

Signzy provides APIs that support the customer-facing parts of an AML program: identity verification, business verification, and AML screening against sanctions, PEP, and adverse media data, with ongoing monitoring. Each check is logged, which helps when independent testers or examiners review your program.

For building the program itself, see our guides to an AML policy for fintechs, customer due diligence, and AML red flags.