On 10 October 2024, FinCEN's release on its "record $1.3 billion penalty" against TD Bank said the bank "failed to timely detect suspicious activity involving its own employees", so a bank's fraud detection and prevention work has to cover its staff too.
FinCEN also imposed, for the first time, an accountability review. It looks at staff conduct.
Why is know your employee important in AML?
Know your employee, also called know your staff or know your personnel, is the staff side of an AML program: it turns the checks of know your customer and know your supplier (KYS) on a firm's own people.
The FATF's Interpretive Note to Recommendation 18 lists "adequate screening procedures to ensure high standards when hiring employees" among what a financial institution's AML program should include, scaled to risk and "the size of the business" (FATF Recommendations, June 2026, p. 90).
The reason is access. Staff who open accounts, release payments or clear alerts can let money laundering through the controls they run, or commit employee fraud against the firm.
Sanctions add a plain case: a salary paid to a designated person makes funds available to that person. The UK's Russia sanctions rules forbid that where the payer knows or has reasonable cause to suspect it, subject to exceptions and licenses (regulation 12).
What goes into a KYE check at hire, and what after?
A State Department, Treasury and FBI advisory of 16 May 2022 on North Korean IT workers gives an example: a developer asks for the work laptop to go to "an address not listed on the developer's identification documentation" (p. 9). For firms hiring developers on freelance platforms, its checks include video interviews and "Verify employment and higher education history directly with the listed companies", using contacts the employer finds itself (p. 11, advisory).
So a KYE file has two halves:
- At hire. Establish identity, screen for sanctions and PEP status, check criminal records where the law allows, and verify employment history, references and skills.
- During employment. Rescreen when lists change, review conduct and the accounts and payments the person handles, and record close ties to customers, which compliance staff will have to disclose from 10 July 2027 under Article 13(2) of the EU's AML Regulation.
A KYE file that stops at the hiring check tests a person's past, while the insider in FinCEN's TD Bank consent order acted while employed. From early 2021, a branch employee took bribes to help launder money and, during that employee's tenure, opened over 2,000 accounts, many for shell companies with nominee owners, often without the customer present (p. 56). UK regulation 21 asks for screening "both before the appointment is made and during the course of the appointment", and only the second half can read the accounts a member of staff opens.
In what order do the KYE steps run?
Table 1. KYE steps and the owner a policy might name.
| Step | What is checked | Result | Owner |
|---|---|---|---|
| 1. Role scoping | The job's access to accounts, payments, alerts and systems | A screening level | Line manager and compliance |
| 2. Offer | Identity details and document checks, employment history confirmed with past employers, references, a record check at the level the law allows | A cleared or refused candidate | HR, with compliance on refusals |
| 3. Screening | Name, date of birth and nationality against sanctions, PEP and adverse media data | Match or no match, with a reason | Compliance analyst |
| 4. Onboarding and access | The cleared file and the access list | Payroll and system accounts; a payroll record with no KYE file behind it marks a ghost employee | HR and IT |
| 5. Move into a sensitive role | The new access | A deeper check first | Compliance |
| 6. Ongoing | List changes, yearly certification where it applies, accounts the person opens, declared ties to customers | Rescreening results, certificate, review notes | Compliance and line manager |
| 7. Exit | The last day and any open cases | Access off that day, a reference on request, a suspicious activity report where abuse is suspected | HR, IT and the MLRO |
A KYE policy names an owner for each step. In Table 1, HR runs the checks and the line manager owns the role's access. Accountability sits with the officer responsible for compliance a UK firm appoints under regulation 21(1)(a), where appropriate to its size and nature. From 10 July 2027, Article 13 of the EU's AML Regulation has the compliance officer approve what the assessment covers. Employment verification works by confirming past jobs and dates with the employers, and this process sits at the offer stage next to a background check.
The screening step uses the name checks a firm already runs on customers. complead, formerly Sanction Scanner, provides client screening and ongoing monitoring in which a team can add its own blacklists and internal lists, and ongoing monitoring keeps screening active beyond onboarding. Automation in KYE mostly covers step 6: a firm can automate the rescreen when lists change, and each automated match goes to manual review, where the reviewer decides whether it is the employee.
Which laws require staff screening?
Table 2. Rules that call for staff screening (as of October 2026).
| Rule | What it asks | Timing or threshold | Note |
|---|---|---|---|
| FATF Recommendation 18, Interpretive Note paras 1(a) and 2 | Hiring screening that keeps standards high | By risk and the size of the business | June 2026 edition |
| UK Money Laundering Regulations 2017, regulation 21(1)(b) and (2) | Screening of relevant employees: skills, knowledge and expertise, conduct and integrity | Before appointment and during it, where appropriate to the size and nature of the business | Last amended 1 September 2022 |
| FCA certification regime, SYSC 27.2 | Certify certification staff as fit and proper | On appointment and at least once a year (FCA page) | SM&CR firms; updated 24 April 2026 |
| FCA regulatory references, SYSC 22.2 | References from the current employer and those of the past six years | Before the certificate is issued | Updated 24 April 2026 |
| EU, Directive (EU) 2015/849, Article 8(4)(a) | Employee screening among internal controls | Proportionate to the nature and size of the firm | In force through national law |
| Germany, GwG section 6(2) no. 5 | Staff reliability checks, such as personnel control and appraisal systems | Matched to the firm's risk | Under the directive |
| EU, Regulation (EU) 2024/1624, Article 13 | For staff, agents and distributors in compliance tasks: skills and "good repute, honesty and integrity", on content the compliance officer approves | Before the tasks start, then regularly repeated by risk | From 10 July 2027 (2029 for football agents and clubs) |
| Hong Kong, HKMA AML and CFT guideline, paras 3.4(c) and 3.14 | Employee screening for high hiring standards | By the nature, size and complexity of the business | Authorized institutions; revised May 2023 |
| US, 12 U.S.C. 1829 and the FDIC rule | No work at an insured bank after a conviction for dishonesty, breach of trust or money laundering without the FDIC's prior written consent | Not after 7 years from the offense, 5 from release, or 30 months from sentencing if 21 or younger, except listed bank crimes (10 years); expunged and some minor offenses fall outside | Exceptions since 23 December 2022; FDIC rule from 1 October 2024 |
| US, FINRA Rule 3110(e) | Investigate good character, business reputation, qualifications and experience | Required before applying to register the person | Latest Form U5 reviewed if registered before |
Data privacy law sets the limits. Under the EU's GDPR, conviction data may be processed only under official authority or where EU or national law allows it with appropriate safeguards (Article 10). In the US, outside some transport jobs, a firm that orders a background report from a consumer reporting agency must first give a clear and conspicuous disclosure in a document of its own and get written authorization (15 U.S.C. 1681b(b)(2)).
A DBS check comes in four types: basic, standard, enhanced, and enhanced with barred lists; Scotland and Northern Ireland have different rules.
What happened in staff screening in 2026?
- 24 April. The FCA updated its certification regime page: regulatory references are due "within 4 weeks at most", a limit and not a target.
- 13 October. The Justice Department charged 14 people over a North Korean remote IT worker scheme that it says used "stolen or fabricated identity documents" and affected more than 70 US employers (DOJ release); the charges are allegations.
How do banks apply KYE, and what are the risks of non compliance?
A US bank starts from 12 U.S.C. 1829, the hiring bar with a consent route (Table 2). After hire, a bank the FDIC supervises files a suspicious activity report for "Insider abuse involving any amount" (12 CFR 353.3).
The compliance risks of weak KYE show in the TD Bank order. The bank filed a SAR on Individual A's personal account "over a year after" two wires had alerted (p. 56). Individual B, a branch employee fired in February 2023, was reported in March 2023, "almost two years after the conduct began" (pp. 58 and 59). The accountability review reaches current and former staff, with recommendations on discipline for those still employed and on "clawback" of past pay from those who left (pp. 78 and 79).
Which roles need the deeper check?
Regulation 21 covers relevant employees, whose work bears on compliance or on finding and preventing money laundering. Depth follows the role:
- Account opening and payments. TD Bank's branch employee used this route to open the accounts.
- Alert review and reporting. These staff decide which alerts end in a suspicious activity report.
- Finance and trading. The FCA counts deeper vetting here as good practice against insider fraud (FCG 4.2.1).
- Remote technical roles. The North Korean schemes target them.
Checks for this week:
- List every employee with access to account opening, payment release or alert review.
- Check that each of those files holds a screening date after the hire date.
- Name who reviews the accounts those staff open, and how often.
Related terms
- Insider fraud. Fraud through trusted access.
- Employee fraud. Staff defrauding their employer.
- Payroll fraud. Pay taken through fake hours or staff.
- MLRO. The officer who receives internal suspicion reports.
- Know your supplier (KYS). The same checks on suppliers.
- Know your customer (KYC). The identity and due diligence checks a firm runs on its customers.
How this entry was checked. Pages 56 to 59, 78 and 79 of FinCEN's TD Bank consent order were read on 28 October 2026 with FinCEN's release; the FATF Recommendations (June 2026 edition); the UK Money Laundering Regulations 2017, regulation 21; the FCA Handbook (SYSC 22.2, SYSC 27.2, FCG 4.2.1) and certification regime page; Directive (EU) 2015/849 and Regulation (EU) 2024/1624; GwG section 6; the HKMA guideline of May 2023; 12 U.S.C. 1829, the FDIC rule of 7 August 2024 and 12 CFR 353.3; FINRA Rule 3110; the GDPR; 15 U.S.C. 1681b; gov.uk's DBS page; the UK Russia sanctions regulations; the State, Treasury and FBI advisory of 16 May 2022; and the Justice Department release of 13 October 2026. Sinan Tekin, Regional Sales Manager at complead, is the author, and Javid Khasayev, Senior Anti-Fraud Specialist at GoldenPay, the fact checker; last reviewed 29 October 2026. The definition rests on the Interpretive Note to Recommendation 18 and regulation 21. Rule status is October 2026.
