In December 2025, FinCEN fined the crypto exchanger Paxful $3.5 million. Its consent order describes a compliance seat held by someone with no AML training, at a firm whose wallet addresses dealt directly with more than 26 ransomware strains. Paxful facilitated transactions involving over $500 million in suspicious activity. Through 2018 its listed chief compliance officer was the then chief executive, who had never received training specific to BSA and AML work.
FinCEN faulted the missing training and the unqualified seat. A certificate is one way a person shows that training, and the right one depends on the job.
Which AML certification fits which job?
The credential follows the seat. Table 1 compares eight credentials, each read on the issuer's own page on the date shown.
| Credential | Issuer | Level | Format and exam | Price as read (date) | Renewal | Best for |
|---|---|---|---|---|---|---|
| CAMS | ACAMS | Specialist; 40 eligibility credits | 120 multiple choice questions in 3.5 hours | $2,095 package, private sector; $1,595 public (11 Sep 2026) | Every 3 years: 60 credits, fee $200 to $300 | General AML analysts and officers |
| CGSS | ACAMS | Specialist; 40 eligibility credits | Four online courses, then the exam | $1,995 package, private sector (24 Jun 2026) | Every 3 years: 30 credits, fee $200 to $300 | Sanctions and screening roles |
| CKYCA | ACAMS | Associate; no eligibility rule | Test center or online proctored exam; 4 months to sit it | $1,045 package (9 Mar 2026) | Yearly: free for members with 2 credits a year | KYC and onboarding staff |
| CAFCA | ACAMS, built with FINTRAIL | Associate | Eight hour digital course, 90 minute proctored exam | $1,045 package (28 May 2026) | Yearly: free for members with 2 credits a year | Fintech compliance staff, hybrid roles included |
| ICA Certificate in AML | International Compliance Association | Level 2, introductory (Advanced Certificate Level 4, £2,250; Diploma Level 6, £4,500) | Online course, one hour multiple choice exam | £765 or $1,030, plus £195 membership for non members (12 Nov 2026) | None listed on the course page; 20 ICA CPD hours | First AML roles and general AML work |
| CFCS | ACFCS | Specialist | Self study (12 months to certify) or accelerator classes (6 months) | $1,215 to $2,220 by program (12 Nov 2026) | 60 credits over 3 years, active membership | Financial crime roles wider than AML |
| CAFP | American Bankers Association | Professional; ABA certificates give some candidates eligibility | Exam window (July 2026) at a test site or by live remote proctoring | Not shown in the May 2026 copy | Continuing education credits and a renewal fee | AML and fraud work in one remit |
| CAMI | RT Academy (Regtech Times) | Video course with exam | 100 questions in 2 hours, 75% to pass | $300 with the exam (2024 edition of the page) | Not stated | A low cost introduction |
Table 1. AML certifications compared, as listed by each issuer. ACAMS figures come from archived copies of acams.org, dated in each cell, and the ABA row from a 10 May 2026 copy; the ICA, ACFCS and RT Academy pages were read on 12 November 2026.
Read the table by seat. A generalist in an AML compliance officer seat, or an analyst working toward one, usually starts with CAMS or the ICA Certificate. CAMS needs 40 eligibility credits from education, experience and training, and ACAMS aims it at people with 18 to 24 months in anti financial crime work. The ICA Certificate, a Level 2 course with a one hour exam, suits the first year.
Specialists take the credential of their queue. Sanctions and screening staff take CGSS. KYC and onboarding teams take CKYCA, which has no eligibility rule, so an AML analyst in the first months of the job can sit it. Fintech staff whose day mixes onboarding, alerts and payments take CAFCA.
Four names answer other questions. CFCS spans financial crime beyond AML, and the CFE is a fraud examiner's credential. CAMLS, from the Conference of State Bank Supervisors, needs two years of on the job service as an examiner, so it is closed to industry staff. ABA's CAFP, from the American Bankers Association, tests AML and fraud knowledge in one exam.
Does any law require an AML certification?
No. No US, UK or EU rule names a certificate that a compliance employee must hold. Each puts a training duty on the firm, and the UK and EU texts also ask for a record of it. Under the Bank Secrecy Act, an ongoing employee training program is one of four program minimums, next to a designated compliance officer, and the bank and money services business rules repeat the duty in their own words.
| Rule and citation | Who it binds | What it requires |
|---|---|---|
| 31 U.S.C. 5318(h)(1)(C) | Every US financial institution under the BSA | "an ongoing employee training program", one of four program minimums |
| 31 CFR 1020.210(a)(2)(iv) | Banks | "Training for appropriate personnel" |
| 31 CFR 1022.210(d)(3) | Money services businesses, crypto exchangers included | Training of appropriate personnel, including in detecting the suspicious transactions the business must report |
| UK MLR 2017, regulation 24 | Firms under the UK regulations | Relevant employees aware of the law and "regularly given training"; a written record of the training; measures sized to the business and its risks |
| AMLR Article 12, from 10 July 2027 | EU obliged entities, agents and distributors included | Specific, ongoing training fit to the role and the risks, "duly documented" |
Table 2. What the training rules require, none of them naming a certificate, read 12 November 2026 (US Code; eCFR, Title 31 last amended 6 November 2026; legislation.gov.uk text up to date to 11 November 2026; Regulation (EU) 2024/1624 as published).
The seat matters as much as the training. A US program needs a designated compliance officer, and a UK firm must appoint a nominated officer, a seat its money laundering reporting officer can hold.
From July 2027, AMLR Article 13 adds an assessment of every employee who takes a direct part in compliance work, with content the compliance officer approves. That is a test of the person, close to know your employee screening.
Paxful failed both lines. FinCEN found the firm "operated without appropriate compliance personnel, training, and policies and procedures in place for at least four years", and that its compliance chief lacked the training and experience the obligations called for.
Is there an AML certification for fintech?
Yes. ACAMS runs a fintech track that ends in an exam based credential, CAFCA, the Certified AML FinTech Compliance Associate. Picture an analyst at an electronic money institution who onboards merchants in the morning and reviews payment alerts in the afternoon, with no separate KYC or monitoring team behind them. CAMS asks for 40 eligibility credits. This analyst may have one year in the job and needs every step of the work in one course.
- AML Foundations for FinTech. Four hours online, a short assessment, a certificate and 4 ACAMS credits, at $595 for members and $795 for non members (March 2026 copy).
- AML Intermediate for FinTech. Four more hours and a 20 question final assessment, also 4 credits.
- CAFCA. An eight hour digital course and a proctored 90 minute exam, built with FINTRAIL for fintech teams, early stage firms with hybrid roles among them, at $1,045 (May 2026 copy).
ACAMS sets the path out as the two certificates plus a proctored exam, which together make the associate level certification.
And for crypto compliance?
ACAMS also lists CCAS, a specialist credential for cryptoasset crime work, for analysts whose whole job is crypto. A generalist at a crypto startup is better served by CAFCA first. In the US the duty does not change with the asset: crypto exchangers are money services businesses, so the training line of 31 CFR 1022.210 applies, as it did to Paxful.
What does an AML certification cost over three years, and who pays?
The package price is only part of a three year bill, because ACAMS requires an active membership to obtain and keep any of its certifications. Take three illustrative candidates who buy at the prices last read.
A private sector CAMS candidate pays $2,095 for the package, three years of ACAMS membership and, at the three year mark, a recertification fee of $200 to $300 with 60 credits earned. That makes $2,295 to $2,395 plus membership. A CKYCA candidate pays $1,045 plus three years of membership, because yearly renewal is free for members who earn two credits a year. An ICA Certificate candidate who is not yet a member pays £765 for the course and £195 for 12 months of membership, so £960 up front.
ACAMS lists its membership fee on its own membership page, so add three years of it to the first two totals. Even before that, the CAMS route costs about twice the CKYCA route.
Who pays follows from Table 2. The training duty belongs to the firm, so a firm that funds a certificate is buying part of the record its supervisor will ask to see. That record still has to cover every relevant employee, and one analyst's credential does not train the rest of the team.
How do you choose an AML certification before you pay?
Run these five checks before money moves.
- The seat and the jurisdiction. A sanctions analyst in London and a KYC lead at a US money transmitter need different syllabi, and Table 2 shows the training rule differs by country. A remit in privacy, ethics or US bank regulation calls for a credential outside AML.
- What the job ads ask for. Ads for the seat you want next show which credential employers in your market name, and that counts for more than any ranking.
- Membership and renewal. ACAMS and ACFCS both require active membership to keep the credential. CAMS and CGSS recertify every three years, while CKYCA and CAFCA renew every year.
- Time to the exam window. CAMS and CAFCA give six months from approval to sit the exam and CKYCA gives four, so buy when the calendar has room to study.
- The employer's training plan. If the firm's yearly training already covers sanctions or KYC, pick a credential that fills a gap the plan leaves.
What did FinCEN, the UK and the EU change on training in 2026?
- 10 April 2026, US. FinCEN proposed new program rules (91 FR 18704). They would put the BSA's "ongoing employee training program" wording into every institution type's rule, a change FinCEN calls "clarifying, not substantive", and treat the 2024 program proposal as withdrawn. Comments closed on 9 June 2026. As of 12 November 2026, no final rule has appeared in the Federal Register.
- 2026, UK. Regulation 24 took no amendment in 2026. The legislation.gov.uk text is up to date to 11 November 2026.
- 10 July 2027, EU. AMLR Article 12, with its "duly documented" training, starts to apply to most obliged entities.
Back to Paxful. Its gap was the seat and the training record. A crypto exchanger filling that seat today would look for CAMS or CFCS level knowledge, and could start its first analysts on the CAFCA track. The record to check this quarter is who was trained, on what, and when, written down as UK regulation 24(1)(b) and AMLR Article 12 ask.
