Three dates set the wording of a policy written today.
10 April 2026. FinCEN proposed that a bank's AML/CFT program "must be written" and approved by its board, an equivalent governing body or appropriate senior management.
30 June 2026. S.I. 2026/621 reworded the UK monitoring clause in regulation 19(4)(a) and made a "FATF call for action country" the enhanced due diligence trigger in regulation 33.
10 July 2027. Article 9 of AML Regulation 2024/1624 applies across the EU: written policies approved by the management body, procedures approved at least by the compliance manager.
All three reach the wording of an AML policy, and the template below follows the texts as of November 2026.
What sections does an AML policy template need?
Table 1. Policy sections mapped to EU, UK and US rules, November 2026
| Section | The clause must say | EU (AMLR, applies 10 July 2027) | UK (MLR 2017) | US (Bank Secrecy Act) |
|---|---|---|---|---|
| Document control | Owner, approver, version, review date, change log | Art 9(2): in writing; policy approved by the management body | reg 19(1)(c) written record of policies, changes and how they reached staff; 19(2)(b) senior management approval | 31 CFR 1020.210(b)(3) board approval for banks without a federal functional regulator; proposed: written and approved for every bank |
| 1. Scope and policy statement | Activities, branches, agents; customers not taken | Art 9(1): all activities, proportionate, sanctions evasion risk | reg 19(1)(a), 19(2)(a): proportionate to size and nature | 31 U.S.C. 5318(h)(1)(A): internal policies, procedures and controls |
| 2. Risk assessment | Risk factors, owner, update triggers | Art 10(2): documented, kept current, approved by the management body | reg 18: customers, countries, products, transactions, channels | Proposed: updated promptly after a significant change |
| 3. Roles | Compliance manager, compliance officer, nominated officer | Art 11(1), 11(2) | reg 21(1)(a), (3), (4): officers named, supervisor told within 14 days | 5318(h)(1)(B): a compliance officer; proposed: located in the United States |
| 4. Due diligence and identification | Verification, purpose, risk rating | Art 9(2)(a)(iii) | reg 19(3)(c), regs 27 to 38 | 31 CFR 1020.220(a)(1): written CIP inside the program |
| 5. EDD, PEPs, high risk countries | Triggers, measures, approver | Art 9(2)(a)(iii): PEP checks | reg 33(1)(b): EDD trigger: a FATF call for action country | 1020.210(a)(2)(v): risk based ongoing due diligence |
| 6. Sanctions | Lists, timing, who clears a match | Art 9(1)(b): evasion risk; Art 11(2) | UK Sanctions List: sole source of UK designations from 28 January 2026 | 31 CFR 501.601: records kept at least 10 years |
| 7. Monitoring | Scenarios, thresholds, review | Through due diligence and reporting, Art 9(2)(a)(iii), (iv) | reg 19(4)(a), worded as from 30 June 2026 | 1020.210(a)(2)(v)(B): ongoing monitoring |
| 8. Internal reports and SARs | Route to the MLRO, decision, timing | Art 9(2)(a)(iv); Art 11(2) | reg 19(4)(d); reg 21(3) | 31 CFR 1020.320(b)(3): 30 days; 60 if no suspect was identified on detection |
| 9. Reliance and outsourcing | Who, under what agreement | Art 9(2)(a)(v) | reg 19(3)(d) | 31 CFR 1022.210(d)(1)(iii): MSB stays responsible |
| 10. Records | What is kept, how long | Art 77(3): five years after the relationship ends | reg 40(3): five years | 31 CFR 1010.430(d): five years; 501.601: 10 for sanctions |
| 11. Staff screening and training | Before and during employment, recorded | Art 9(2)(a)(viii), (x); Art 12 | reg 21(1)(b); reg 24 | 5318(h)(1)(C): ongoing training |
| 12. New products and technology | Risk assessed before launch | Art 10(1) | reg 19(4)(c) | Proposed: risk assessment updated after a significant change |
| 13. Communication | Staff, agents, branches abroad | Art 9(2)(a)(ix) | reg 19(1)(c)(iii), 19(6) | 1022.210(d)(1)(iii): agent agreements for MSBs |
| 14. Compliance monitoring and testing | Tests, findings, fixes | Art 9(2)(a)(vii), 9(2)(b): audit function or external expert | reg 21(1)(c): independent audit function | 5318(h)(1)(D): independent audit |
Read the EU column as the target. Until 10 July 2027, EU firms work under national laws that transpose Article 8 of Directive 2015/849, which already asks for policies, controls and procedures approved by senior management. The US column reads as one program. Section 5318(h)(1) of Title 31 puts internal policies, procedures and controls first among four program elements, ahead of a designated compliance officer, ongoing training and independent testing. In other markets, FATF Recommendation 18 and its Interpretive Note set the same core. Cells marked "proposed" come from FinCEN's April 2026 text, which is not law yet.
How do you fill in this AML policy template?
Six steps take it from blank to signed.
- Start from the risk assessment. UK regulation 19(1)(a) ties the policies to the risks found under regulation 18. Write Section 2 first.
- Fill every bracket. A signed policy that still says [Firm name] or [12 months] shows that nobody read it against the business.
- Cut a section only with a written reason. Proportionality scales a duty to the firm's size and nature (AMLR Article 9(1), regulation 19(2)(a)) and leaves the duty in place. A line such as "No agents: Section 13 covers staff only" keeps the gap visible.
- Keep the how in the procedures. The policy says what and who. Article 9(2) lets the compliance manager approve procedures, so a monthly change does not need the board. None of the rule texts cited here asks for a single manual.
- Send it for sign off at the level the next section sets for each market.
- Record how it reached staff. Regulation 19(1)(c)(iii) asks for a written record of how the policy and each change were communicated.
Document control: who signs the policy, and what record do you keep?
The control block sits on the first page. It also holds the change log, so picture [Firm name], an illustrative payment firm, at its second review.
Document control
- Title: AML and counter terrorist financing policy, version 2.1, effective [14 July 2026].
- Owner and approver: [Name], compliance officer and MLRO; [board of directors], [date], minute [reference].
- Next review: [July 2027].
- Review triggers: a new product, market or channel; a changed risk assessment; an audit or supervisory finding; customer growth above [30] percent in a year.
- Change log: 2.1, [14 July 2026]: Sections 5 and 7 follow the UK wording of 30 June 2026. Sent to all staff on [21 July 2026] with a read receipt; [96] percent confirmed by [28 July 2026].
Rule: UK regulation 19(1)(c); AMLR Article 9(2).
Who approves an AML policy?
Under the AMLR, from 10 July 2027, the policies go to the management body in its management function for approval. Procedures and controls are signed off at compliance manager level or higher (Article 9(2)). UK senior management approves policies, controls and procedures alike (regulation 19(2)(b)). In the US, a bank without a federal functional regulator has its board, or an equivalent governing body, approve its written program (31 CFR 1020.210(b)(3)). FinCEN's proposal would make a written, approved program the rule for every bank.
How often should an AML policy be reviewed?
The texts of the three markets fix no cycle, and UK regulation 19(1)(b) asks only that firms "regularly review and update" the policies. AMLR Article 9(3) asks that they stay current and improve where weaknesses show. Two yearly reports come close to a cycle: the EU compliance manager's report to the management body (Article 11(6)) and the information a UK payment or electronic money firm's appointed individual gives senior management at least annually (regulation 21(7)(d)). Events are the other trigger. A new product, market or channel, a changed risk assessment, an audit finding and fast growth all belong on the trigger list.
Growth belongs on that list. On 5 November 2026 FINRA fined Webull Financial $4.2 million for failing to implement reasonably designed programs for anti money laundering, identity theft prevention and best execution. From January 2020 to September 2023 Webull opened millions of new accounts each year, and in that period it approved more than 120,000 without forming a reasonable belief that it knew each customer's true identity.
A review that moves a monitoring threshold changes a rule as well, so the policy's change log and the rule record should agree. complead, formerly Sanction Scanner, versions every rule and change on its AI native platform, with a record of who changed what, when and why.
Sections 1 to 3: what do scope, risk assessment and roles say?
Each section gives the model clause, with [placeholders] to fill, then the rule it answers.
Section 1: Scope, risk appetite and policy statement
[Firm name] does not accept money laundering, terrorist financing or the evasion of financial sanctions in any part of its business. This policy covers every activity, branch, subsidiary and agent of the firm in [countries]. The firm does not open or keep relationships with [excluded customers, for example customers who will not name their beneficial owners]. The [board of directors] owns this policy and approves every change to it.
Rule: AMLR Article 9(1) asks for policies that cover all activities, fit the firm's size and risks and manage sanctions evasion risk; UK regulation 19(1)(a) and 19(2); US 31 U.S.C. 5318(h)(1)(A).
Section 2: Business wide risk assessment
The firm assesses its money laundering and terrorist financing risk by customer, country or geographic area, product or service, transaction and delivery channel. The compliance officer drafts the assessment. The [board of directors] approves it. It is updated every [12 months] and at each review trigger in the document control block, and each control in Sections 4 to 14 is set against the risks it records.
Rule: AMLR Article 10(2) wants the business wide risk assessment documented and kept current, with the compliance officer as author and the management body as approver; UK regulation 18(2) and 18(4); FinCEN's proposal adds a prompt update after a significant change.
Section 3: Roles and responsibilities
[Name], a member of the [board of directors], is the compliance manager and answers for compliance with this policy. [Name] is the compliance officer and nominated officer (MLRO), who receives internal reports and decides on reports to [the FIU]. The firm tells [the supervisor] of each appointment within 14 days. The designated US AML/CFT officer is [Name].
Rule: AMLR Article 11(1) for the compliance manager and 11(2) for the AML compliance officer; UK regulation 21(1)(a), (3) and (4); US 5318(h)(1)(B); FinCEN's proposal wants that officer located in the United States.
Sections 4 to 8: what must due diligence, sanctions, monitoring and reporting cover?
These five sections carry the daily checks, so each names the procedure that holds the detail.
Section 4: Customer due diligence and identification
Before a relationship starts, the firm identifies and verifies each customer and beneficial owner, records the purpose of the relationship and gives the customer a risk rating. [KYC procedure] sets the documents and data sources for each customer type. No account opens before verification ends. The exceptions are [permitted cases].
Rule: AMLR Article 9(2)(a)(iii); UK regulations 27 to 38; a US bank's written customer identification program must be part of its AML program (31 CFR 1020.220(a)(1)).
Section 5: Enhanced due diligence, PEPs and high risk countries
The firm applies enhanced measures to politically exposed persons, their family members and close associates, to anyone based in a FATF call for action country and to every customer rated high risk. [Senior manager] approves each such relationship first. [EDD procedure] lists the extra checks.
Rule: AMLR Article 9(2)(a)(iii) asks for procedures that find out whether a customer or owner is a PEP; UK regulation 33(1)(b) requires enhanced due diligence for a person established in such a country.
Section 6: Sanctions screening
The firm screens customers, beneficial owners and [payments] against [the UN, EU, UK and OFAC lists that apply] at onboarding, whenever a list changes and before [payments are released]. A possible match is held until [role] clears or confirms it; a confirmed match is frozen and reported to [authority] within [timeframe].
Rule: the EU text puts sanctions inside the policy. AMLR Article 9(1)(b) asks firms to manage the risk that targeted financial sanctions are not applied or are evaded, the risk a sanctions risk assessment measures, and Article 11(2) makes the compliance officer responsible for implementing them. OFAC wants its records kept for at least 10 years (31 CFR 501.601).
Section 7: Transaction monitoring
The firm monitors transactions against each customer's expected profile. [Monitoring procedure] sets the scenarios and thresholds. They are reviewed every [12 months]. Staff examine any transaction that, given its nature, is unusually complex or unusually large, any unusual pattern and any transaction with no apparent economic or legal purpose.
Rule: UK regulation 19(4)(a) as worded from 30 June 2026; US 31 CFR 1020.210(a)(2)(v)(B).
Section 8: Internal reports and suspicious activity reports
Any employee who knows or suspects money laundering or terrorist financing reports it at once to the MLRO through [channel]. The MLRO decides whether to report to [the FIU] and records the reason either way. For US business, a SAR is filed within 30 calendar days of initial detection. Where no suspect has been identified, the firm may hold the filing for up to 30 more days to name one. Day 60 is the outer limit.
Rule: AMLR Article 9(2)(a)(iv) and 11(2); UK regulation 19(4)(d) and regulation 21(3), which requires a nominated officer, usually called the money laundering reporting officer; US 31 CFR 1020.320(b)(3).
Sections 9 to 14: which controls keep the policy working?
Section 9: Reliance and outsourcing
The firm relies on [named regulated third parties] for customer due diligence only under a written agreement, and keeps responsibility for the result. [Register] lists each outsourced task and its owner.
Rule: AMLR Article 9(2)(a)(v); UK regulation 19(3)(d); 31 CFR 1022.210(d)(1)(iii) lets an MSB and an agent acting for it agree who develops the policies, while each MSB stays solely responsible for implementation.
Section 10: Record keeping
Due diligence and transaction records stay on file for five years, counted from when the relationship ends or from the occasional transaction. Sanctions records stay for [10] years.
Rule: AMLR Article 77(3); UK regulation 40(3); US 31 CFR 1010.430(d) for five years and 501.601 for at least 10 years on OFAC records.
Section 11: Staff screening and training
The firm screens relevant staff before appointment and during employment, and trains them on joining and every [12 months]. Each session, its content and who attended are recorded.
Rule: AMLR Article 9(2)(a)(viii) and (x) and Article 12; UK regulation 21(1)(b) and regulation 24(1), which asks for a written record of training; US 5318(h)(1)(C).
Section 12: New products, services and technology
No product, service, delivery channel, technology or new market goes live before the compliance officer has assessed its money laundering and terrorist financing risk and [approver] has signed that assessment.
Rule: AMLR Article 10(1); UK regulation 19(4)(c).
Section 13: Communication
Each new version of this policy reaches staff, agents, distributors and branches outside [home country] within [10 working days]. The change log records how.
Rule: AMLR Article 9(2)(a)(ix); UK regulation 19(1)(c)(iii) and 19(6).
Section 14: Compliance monitoring and independent testing
[Internal audit or an external expert] tests this policy and its procedures every [12 months] and reports to the [board of directors]. Each finding gets an owner and a date, and the fix is recorded.
Rule: AMLR Article 9(2)(a)(vii) and 9(2)(b), which accepts an external expert where there is no audit function; UK regulation 21(1)(c); US 5318(h)(1)(D).
How do you adapt the template to your firm?
Keep all 14 headings and change what your firm type calls for.
- UK payment and electronic money firms. Name the individual regulation 21(7) requires and plan the yearly report to senior management.
- Money services businesses with agents. Add the UK fit and proper check on agents (regulation 19(4)(e)) and the US agent agreement 1022.210(d)(1)(iii) allows.
- Crypto firms. Add wallet screening to Section 6 among the AML controls for crypto firms. From 1 February 2027, UK regulation 34A adds enhanced due diligence when a cryptoasset exchange or custodian wallet provider has a correspondent relationship with a similar provider in a third country.
- Small firms such as estate agents and accountants. Scale each section and keep it. UK regulation 21(1) applies the officer, staff screening and audit duties where the size and nature of the business make them appropriate, and an individual who neither employs nor acts with anyone else needs no nominated officer (regulation 21(6)). In the EU one person may be both compliance manager and compliance officer where the firm's nature, risks and size justify it (Article 11(7)).
- US investment advisers. FinCEN delayed the adviser rule to 1 January 2028, so an adviser can draft now against the US AML program rules that banks and money services businesses already follow.
- Broker dealers. FINRA Rule 3310 applies, and FINRA's AML template for small firms gives text examples, last updated 8 September 2020.
- US creditors and financial institutions with covered accounts. Add a written Identity Theft Prevention Program, which the Red Flags Rule requires (16 CFR 681.1(d)(1)).
What has 2026 changed in AML policy rules?
FinCEN opened the year on 2 January by moving the investment adviser AML rule back to 1 January 2028. AMLA consulted from 16 April to 15 July. Its draft guidelines cover the business wide risk assessment behind Section 2. UK regulations 19(4)(a) and 33 changed on 30 June.
The AMLR dates for AMLA guidelines under Articles 9(4) and 10(4) passed on 10 July. AMLA's regulatory instruments page, updated 10 November, lists the 10(4) draft with its consultation closed and no 9(4) item. On 12 November the Federal Register still held no final FinCEN program rule; the proposal would take effect 12 months after one is issued.
Two dates come next: 1 February 2027 for UK regulation 34A and 10 July 2027 for the AMLR.
Settle the signatures first. From 10 July 2027 the EU text puts the policy with the management body and the procedures with the compliance manager at least, so keep the two documents apart and decide now which changes go to the board.
