The question an examiner or supervisor brings to an AML policy fits in one line: where does it say who may approve a high risk customer, and which file shows that person did? The policy is the top layer of the policies, procedures and controls that anti money laundering laws require, so the files have to carry the names it gives.
Which rules require a written AML policy?
The FATF sets the standard. Recommendation 18 says firms "should be required to implement programmes against money laundering and terrorist financing", and its Interpretive Note starts that program with "the development of internal policies, procedures and controls", scaled to the risk and "the size of the business" (FATF Recommendations, June 2026). Senior management approves them (INR 1, paragraph 13).
The EU applies it today through Directive (EU) 2015/849, Article 8, with senior management approval. From 10 July 2027, Regulation (EU) 2024/1624 Article 9 says policies, procedures and controls "shall be recorded in writing", kept up to date and enhanced where weaknesses show, and splits who signs them (Table 1).
In the UK, regulation 19 of the Money Laundering Regulations 2017 asks for policies that answer the risks found in the firm's risk assessment, reviewed and updated, with a written record of the policies, every change and how each was communicated to staff. Neither text sets a fixed review cycle.
In the US, section 352 of the PATRIOT Act put internal policies, procedures and controls first among the AML program elements of the Bank Secrecy Act (BSA), in 31 U.S.C. 5318(h), beside a compliance officer, training and an independent audit.
Paper alone is not enough
The FCA's Final Notice to Starling Bank of 27 September 2024 records that Starling accepted a requirement in September 2021 not to open accounts for high or higher risk customers, then opened 54,359 accounts for 49,183 of them in breach of it. A review the bank commissioned found that senior managers "had different understandings of whom at Starling had responsibility", leaving "no single person with sufficient authority and oversight", and that the engineering teams making the changes "were not informed of the existence" of the requirement. The FCA fined Starling £28,959,426.
Policy, procedures, controls, program: what does each layer do?
Table 1. Policy, procedures, controls, testing and program: what each does and who signs it (as of October 2026).
| Layer | What it says | Who writes it | Who approves it | What an examiner checks |
|---|---|---|---|---|
| Policy | What the firm commits to, and who owns each duty | Compliance officer or MLRO | EU: the management body (AMLR Art 9(2)); UK: senior management (reg 19(2)(b)) | That it matches the risk assessment and the files |
| Procedures | How each duty is carried out, step by step | The teams that run them, with compliance | EU: at least the compliance manager (AMLR Art 9(2)) | That staff follow them |
| Controls | The checks that catch a failure: four eyes, system rules, limits | Compliance and operations | EU: at least the compliance manager | That they run and are tested |
| Independent testing | Whether the whole set works | Internal audit or an outside party | Reported to the board or senior management | Findings and their fixes |
| Program | All of the above, plus the officer and training | The firm | US proposal: the board, an equivalent governing body or senior management | That it is written, approved and followed |
The EU split is the clearest line: the management body signs the policy, while procedures and controls need sign off "at least at the level of the compliance manager". In the US, "program" carries the legal meaning of the whole set, and FinCEN's proposal of 10 April 2026 would require that it "must be written" and approved at board or senior management level.
What should be included in an AML policy?
Twelve items, each with its one line of why:
- Scope and risk appetite, to define which business, products and customers it covers and which the firm will not take.
- The risk assessment it rests on. UK regulation 19 ties the policies to the risks the firm's own AML risk assessment found, under its risk based approach.
- Owners and approvals. Who may accept a high risk customer, close an alert or sign a SAR, with the designated AML compliance officer named. complead, formerly Sanction Scanner, keeps that record for compliance officers: owner, reason, decision and timestamp on every case.
- Customer due diligence and identity verification. The customer due diligence and, in the US, CIP steps by customer type.
- Enhanced due diligence (EDD) triggers: which risks move a customer into deeper checks, a politically exposed person (PEP) among them.
- Screening: which sanction lists are checked and who clears a match.
- Monitoring and escalation. Which alerts go to whom, and how fast.
- Reporting. When staff raise an internal report, who is responsible for filing suspicious activity reports and, in the US, currency transaction reports (CTRs) for cash over $10,000.
- Information sharing. In the US, the 314(b) notice before sharing AML data with other financial institutions, and the limits on sharing SAR information.
- Records. What is kept and for how long.
- Training. Who is trained, on what, how often.
- Testing, review and change log. Independent testing, a review date, and the written record of each change and how it reached staff.
The duty to report stays with each firm. Under 31 CFR 1020.320, every bank files its own reports and keeps a SAR confidential, while the rule still lets it share the underlying facts, for example with another institution preparing a joint SAR.
How do you create an AML policy in practice?
The old eight step outline (objective, compliance officer, data sharing, screening, identity, CDD, SAR and CTR filing) is a fair start. The twelve items above add what it leaves out: the risk assessment underneath, named owners, records, training and testing.
Write the policy from the firm's own risk assessment, give each duty one owner and send it for approval at the level Table 1 shows for the market. After that, keep the written record of each change and of how it reached staff that UK regulation 19 asks for, so the next review starts from the last one. That record, more than the wording, is one of the advantages of a strong AML policy when an examiner opens the files.
Which policy texts moved in 2026?
- 10 April. FinCEN proposed that a bank's program must be written and approved at board or senior management level, with an AML/CFT officer located in the United States (91 FR 18704). Comments ended on 9 June; still a proposal on 29 October 2026.
- 16 April to 15 July. AMLA consulted on draft guidelines for the business wide risk assessment, the document a policy rests on; the results are not out yet.
- 10 July. The date by which AMLR Article 9(4) asked AMLA to issue guidelines on the extent of policies and controls; they are not on AMLA's regulatory instruments list as of its last update of 7 October 2026.
Three checks to run on a policy before its next review:
- Pull three recent high risk files and match each approval to the name the policy gives.
- Put the policy's date beside the risk assessment's; a policy older than the assessment it rests on needs a review.
- Give each duty one named owner, the gap Starling showed.
Related terms
- AML compliance officer. The person who owns the program day to day.
- MLRO. The officer who receives internal suspicion reports and decides what goes out.
- Customer due diligence (CDD). The checks the policy sets for each customer.
- Compliance. The wider function an AML policy sits in.
- AML risk assessment. The firm wide view of risk the policy answers.
- Risk based approach. Matching the depth of controls to the risk.
How this entry was checked. The twelve item list sums up the rules below; it is not a template. The author, Minhac Celik (Marketing Advisor, complead), read FATF Recommendation 18 and its Interpretive Note (June 2026 edition), Article 8 of Directive (EU) 2015/849 as consolidated on 9 July 2024, Articles 9 and 90 of Regulation (EU) 2024/1624, the UK Money Laundering Regulations 2017 (regulations 19 and 21), 31 U.S.C. 5318(h), 31 CFR 1020.210 and 1020.320, FinCEN's proposal of 10 April 2026 and the FCA's Final Notice to Starling Bank of 27 September 2024. Before publication Fatih Coşkun, Founder and CEO of complead, rereads them. Last reviewed: 30 October 2026.
