AML is often read as one law or one compliance task, when it works in three layers. At the top sits a standard: FATF Recommendation 3 says countries "should criminalise money laundering on the basis of the Vienna Convention and the Palermo Convention" (p. 12). In the middle, national laws turn the 40 FATF Recommendations into duties for banks and other firms, most of them against terrorist financing too (AML/CFT).
At the bottom sit each firm's own controls. AML compliance, a firm's work to meet the law that covers it, is only this last layer.
What does anti money laundering (AML) mean?
AML stands for anti money laundering: the rules and controls aimed at laundering itself. The Vienna Convention of 1988, in the wording UNODC quotes, describes laundering as "the conversion or transfer of property, knowing that such property is derived from any offense(s), for the purpose of concealing or disguising the illicit origin of the property". The crime that produced the money is the predicate offense, such as drug trafficking, fraud or corruption. Picture a dealer who pays 30,000 dollars in cash for a car, cancels the order and takes the refund by bank transfer: the money now looks like a refund.
The G7 set up the Financial Action Task Force (FATF) in 1989, and it issued its Forty Recommendations in April 1990 (FATF history). The EU's first AML directive followed on 10 June 1991. In October 2001 the FATF added special recommendations on terrorist financing, the CFT in AML/CFT.
The global scale is an estimate. The most widely quoted figure, 2 to 5 percent of world GDP, is the IMF's "consensus range", made public in 1998; UNODC's own best estimate, for 2009, was 2.7 percent, about US$1.6 trillion.
Who has to apply anti money laundering rules?
AML laws name the businesses that must apply them, the required entities, and the list has grown with each FATF update:
- Banks. AML in banking and finance began with cash: under the Bank Secrecy Act of 1970, US banks report cash transactions over $10,000.
- Other financial institutions. Lenders, money transmitters, currency exchanges, life insurers and investment firms all fall inside FATF's definition.
- DNFBPs. Lawyers, accountants and notaries, real estate agents, casinos, trust and company service providers and dealers in precious metals and stones, when they do the work FATF Recommendation 22 lists.
- Virtual asset service providers. Since June 2019 the FATF standards have set binding rules for the firms of the cryptocurrency industry.
Supervisors check these firms; financial intelligence units (FIUs) analyze what they report.
Which laws make up AML in the US, the UK, the EU and India?
Table 1. Key AML acts, authorities and penalties by jurisdiction (as of October 2026).
| Jurisdiction | Main texts | Supervisors and FIU | Penalties | Status |
|---|---|---|---|---|
| United States | Bank Secrecy Act of 1970, amended by the USA PATRIOT Act 2001 and the AML Act of 2020; the laundering offense in 18 U.S.C. 1956 | FinCEN, the administrator of the BSA, with the federal banking agencies | Laundering: a fine of up to $500,000 or twice the value involved, whichever is greater, up to 20 years in prison, or both | Program rule proposed 10 April 2026, not final |
| United Kingdom | Money Laundering Regulations 2017, amended in 2026; offenses in the Proceeds of Crime Act 2002 (POCA) | FCA, HMRC, the Gambling Commission and 22 professional body supervisors; UKFIU inside the NCA | Laundering (POCA ss327 to 329), on indictment: up to 14 years in prison, a fine, or both | FCA to take over legal and accountancy supervision |
| European Union | AML Regulation 2024/1624 and Directive 2024/1640 | National supervisors and FIUs; AMLA for 40 selected firms from 2028 | Firms in serious, repeated or systematic breach: for credit and financial institutions, a maximum fine of at least EUR 10 million or 10% of annual turnover, whichever is higher | Applies 10 July 2027; national laws until then |
| India | PMLA 2002, in force since 1 July 2005 | India's Financial Intelligence Unit, whose Director can fine reporting entities | Laundering (s4, basic offense): 3 to 7 years of rigorous imprisonment and a fine | In force |
All four rows rest on the same FATF base, so the duties look alike. The penalties do not compare directly: the EU cell is a fine on a firm that fails to comply, and the other three are prison terms for laundering itself. The EU text is a regulation, so it applies directly in every member state; the directive beside it must be transposed by 10 July 2027, the day the current Directive 2015/849 is repealed. AMLA, the EU's AML authority in Frankfurt, selects 40 obliged entities for direct supervision during 2027 and starts supervising them during 2028.
When someone asks "are we AML compliant?", the first answer is the name of a law and its supervisor, because a firm complies with the text that covers it: the Bank Secrecy Act and FinCEN, the Money Laundering Regulations 2017 and the FCA, HMRC or a professional body, the AML Regulation and a national supervisor from 10 July 2027, or the PMLA and India's Financial Intelligence Unit.
What changed in 2026.
- 10 April: FinCEN proposed a rule to reform AML/CFT programs under the AML Act of 2020; comments closed on 9 June, and no final rule had been published by late October.
- 9 June: the UK made S.I. 2026/621. In force from 30 June, it converts most of the regulations' euro thresholds to sterling one for one (10,000 euros becomes £10,000), with lower sterling figures where the FATF standard needs them; a new regulation 34A on cryptoasset correspondent relationships follows on 1 February 2027.
- June: the FATF published an updated text of its Recommendations.
- 18 June: HM Treasury set out the FCA's duties, powers and accountability as future supervisor of legal, accountancy and trust and company service providers, a move it announced on 21 October 2025.
How does a firm put anti money laundering into practice?
Inside a firm, AML sits in the compliance function. The four laws above ask for much the same process, written as policies, procedures and controls:
- Risk assessment. The firm works out where its laundering risk sits, by customer, country, product and channel, and scales its controls to match, FATF's risk based approach (Recommendation 1).
- Customer due diligence (CDD). It identifies each customer and beneficial owner before doing business, the know your customer (KYC) step, and applies enhanced due diligence where the risk is higher.
- Sanctions and PEP screening. Names are checked against sanctions lists and for politically exposed persons. Sanctions are a separate legal regime, which AML programs screen for with the same customer data.
- Monitoring. Transaction monitoring compares what a customer does with what the firm expected when it opened the account.
- Reporting and records. Suspicion goes to the FIU in a suspicious activity report, and FATF asks for records to be kept for at least five years (Recommendation 11).
AML software keeps the record of each step. In complead, formerly Sanction Scanner, regulatory compliance records alerts, dispositions, reason codes and approvals as soon as they occur, and drafts the SAR or STR from the case trail. An analyst still decides whether to file.
What does AML look like in a regulator's own example?
The UK's National Risk Assessment of July 2025 gives this case (Box 5.K, p. 121). The senior partner of a London law firm was also its MLRO. In 2018, Serious Fraud Office investigators made covert enquiries about a client who had paid £4 million toward a property in Mayfair. The partner told the client about the inquiry. They met over the next five months, and he later sent the SFO a fake letter of engagement. In 2023 he was sentenced to nine months in prison, suspended for 18 months, for tipping off. The Solicitors Regulation Authority found that more than £28 million had passed through the firm's client account "without any underlying legal transaction", and on 25 February 2025 the Solicitors Disciplinary Tribunal suspended him from practice for 12 months.
Two points make the case important. The duty reaches gatekeepers such as solicitors as well as banks, and it binds the very person meant to report. Telling a customer about a report or an investigation is also an offense of its own: FATF Recommendation 21 asks countries to ban disclosing that a suspicious transaction report is being filed, and here the consequences fell on the partner himself.
The next question is the crime itself: what is money laundering, and what are its three stages?
Related terms
- AML compliance officer. The person a firm names to run its AML program day to day.
- Suspicious activity report. A firm's report to its FIU about a transaction or customer it suspects.
- Enhanced due diligence. Deeper checks for customers and transactions that carry more risk.
- Fraud vs money laundering. How the crime that makes the money differs from hiding it.
- Money laundering. Making criminal proceeds look legitimate, usually in three stages.
- MLRO. The UK officer who receives staff reports of suspicion and decides what goes to the UKFIU.
How this entry was checked. Melis Alparslan, Regional Sales Manager at complead, wrote this entry and Ufuk Gürdaş, Compliance Specialist, reviews it (last reviewed: 28 October 2026). On 27 October 2026 its statements were checked against the FATF Recommendations (June 2026 text) and the FATF's history page, UNODC's money laundering overview and its 2011 study of illicit financial flows, Regulation (EU) 2024/1624, Directive (EU) 2024/1640 and AMLA's timeline, FinCEN's Bank Secrecy Act page and its proposed AML/CFT program rule of 10 April 2026, 18 U.S.C. 1956, the UK Money Laundering Regulations 2017 as amended by S.I. 2026/621, the Proceeds of Crime Act 2002, India's PMLA 2002 and the UK National Risk Assessment 2025; the definition follows how the FATF and these laws use the term.
