Anti-Money Laundering (AML) in the Banking Industry (2026)

Why do criminals use banks to launder money?

On 13 October 2026, Bank of America, N.A. admitted willfully breaking the Bank Secrecy Act. Under its resolution with FinCEN, which assessed a $1.2 billion penalty, the bank accepted three failures: an AML program below the legal minimum, no due diligence on correspondent accounts for foreign financial institutions, and suspicious activity reports never filed. The OCC added $750 million over the program and OFAC $11.6 million over apparent sanctions violations. Missed risks included Chinese money laundering networks and illicit finance along the southwest border.

Anti money laundering (AML) rules start with banks because almost every scheme ends in an account. The UK's national risk assessment of 2025 rates money laundering risk high in retail banking and in wholesale banking and markets, where investment products are traded. Most money laundering, it says, "will have a touch point with retail banking".

The US 2024 national money laundering risk assessment calls Chinese money laundering organizations key professional launderers and points to money mules and complicit insiders.

Which AML laws apply to banks, and who supervises them?

The EU is mid change: the 2015 directive applies through national law until 9 July 2027, and the AMLR then binds every credit institution directly. In the US, FinCEN writes the rules and the federal banking agencies examine against them; Bank of America faced FinCEN, the OCC and OFAC on one day.

Most of the UK's S.I. 2026/621 took effect on 30 June 2026 and put the Regulations' thresholds in sterling.

Türkiye and the UAE both left the FATF's increased monitoring list in 2024, the UAE in February and Türkiye in June.

What are the AML requirements for banks in 2026?

AML for banks comes down to nine duties, and each rulebook numbers them its own way.

The owner line splits. The UK, Türkiye and the 2015 directive say more than 25 percent; the AMLR, the US and the UAE say 25 percent or more. A group onboarding file should record the exact percentage.

Since 13 February 2026, FinCEN's exceptive relief lets a US bank identify and verify a legal entity customer's owners at its first account, when facts call the earlier information into question, or as its risk procedures require, not at every new account. The program row is the five element minimum of 31 CFR 1020.210(a)(2). FinCEN proposed a new program rule on 10 April 2026 and had issued no final rule by 3 November 2026.

How fast must a bank report a suspicious transaction?

The EU says "promptly" (Directive art. 33); from 10 July 2027, AMLR art. 69 adds five working days to answer an FIU request, which the FIU may shorten or extend. The UK says "as soon as is practicable". A bank that asks the NCA's consent to go ahead is treated as having it when no refusal arrives within seven working days; a refusal starts a 31 day moratorium that a court can extend (POCA s. 335, s. 336A). The US allows 30 calendar days from initial detection, 60 when no suspect is identified, and wants an immediate call to law enforcement for an ongoing scheme. Türkiye allows 10 business days from the day suspicion arose; the UAE wants a report "immediately and without delay". The clocks start at different points, so date the alert, the decision and the filing in every suspicious activity report file.

Which money thresholds trigger due diligence or a report?

Picture a walk in customer at a Turkish bank wiring 20,000 TL. On 6 October 2026 that needed identification: the line was 15,000 TL. Presidential Decision No. 11845 (Official Gazette, 7 October 2026) doubled the line to 30,000 TL (Regulation art. 5(1)(c)). Now it needs none, unless it links to other transfers or raises suspicion (art. 5(1)(d)). The beneficial owner line is 25 percent in all five jurisdictions; table 2 shows where it means "more than".

Which red flags should a bank's monitoring catch?

The first seven are from Appendix F of the FFIEC BSA/AML Examination Manual; the rest from enforcement cases and risk assessments.

• Fast in, fast out. Many small deposits or transfers wired out almost at once, unlike the business (FFIEC).
• Secrecy havens. Wires to or from a secrecy haven or higher risk place without business reason (FFIEC).
• Round amounts. Many wires in large, round amounts (FFIEC).
• Thin payment details. Payments citing only a contract or invoice number, or goods that do not match the profile a respondent bank gave (FFIEC).
• Hidden holders. The bank cannot track the true holder behind correspondent or concentration account activity (FFIEC).
• Reluctant business customers. A company that will not fully state its business, expected activity or prior banks (FFIEC).
• Trade mispricing. Goods obviously over or under priced, or unlike the business (FFIEC).
• Personal accounts used for business. The gap the FCA found at Nationwide (2025).
• Person to person (P2P) patterns. Transfers indicating human trafficking, which TD Bank did not identify and report in time (FinCEN, 2024).
• Mule accounts. Retail accounts that move criminal funds through money mules (UK NRA 2025).
• Complicit insiders. Staff who open accounts for a network for bribes, as a TD Bank employee did in 2021 (US NMLRA 2024; FinCEN).
• No visible purpose. One sign is enough: a transaction that is complex, unusually large, unusually patterned or without an apparent economic or lawful purpose (AMLR art. 34(2)).

What does correspondent banking due diligence require of a bank?

Picture a respondent bank (illustrative) licensed outside the EU that asks a German bank for a euro account to clear its customers' payments. The German bank never meets those customers, so correspondent banking rules make it assess the respondent: its license and supervisor, its AML record, an approval signed before the first payment and a clause saying who screens what.

FATF R.13 adds five steps for cross border correspondent relationships. Understand the respondent's business, reputation and supervision, including any money laundering investigation or regulatory action; assess its AML controls; get senior management approval before opening; clearly understand each side's responsibilities; and for payable-through accounts, be satisfied that the respondent has done due diligence on the customers with direct access and can provide the data on request. Directive art. 19, AMLR art. 36, MLR reg. 34 and Türkiye's art. 23 repeat the steps for respondents abroad and want the responsibilities in writing; the UAE's CR art. 26 follows the FATF. A correspondent banking due diligence questionnaire collects the answers to all five steps in one file per respondent.

In the US, 31 CFR 1010.610 asks instead for a risk based due diligence program for each correspondent account of a foreign financial institution, enhanced for some foreign banks. Every rulebook here bans correspondent relationships with shell banks; the US ban (31 CFR 1010.630) still lets a bank serve a shell bank that is a regulated affiliate.

The list of who may not reach a US bank keeps moving. FinCEN orders published on 30 June 2025 barred transmittals of funds involving CIBanco, Intercam and Vector Casa de Bolsa; after two extensions they took effect on 20 October 2025.

A final rule of 16 October 2025 cut Huione Group off from US correspondent accounts.

Proposals followed for MBaer Merchant Bank AG on 2 March 2026 and Banque Misr UAE on 1 September 2026; neither binds until made final.

What is de-risking, and when does exiting a respondent become a problem?

De-risking means exiting or restricting whole groups of customers or respondents to avoid risk rather than manage it. The CPMI counted about 25 percent fewer correspondent relationships in 2020 than in 2011 (BIS, 13 December 2021).

From 10 July 2027, an EU bank that ends a cross border correspondent relationship with a third country respondent for AML/CFT reasons must document the decision (AMLR art. 36). In the US, the OCC's review of 14 October 2026 found that all nine largest national banks it supervises had policies, between 2020 and September 2025, that could deny or limit access over political or religious beliefs or lawful business.

Which banks were fined for AML failures since 2024?

BaFin fined N26 and J.P. Morgan SE for suspicious transaction reports that went in late. Starling and Monzo grew faster than their controls and kept opening accounts for high risk customers while under FCA requirements not to. At Nationwide, personal accounts carried business money; at ABN AMRO, monitoring of high risk customers fell short. Monzo's control failings ran from 2018 to 2020 and Nationwide's from 2016 to 2021, years before each fine. FinCEN called TD Bank's $1.3 billion the largest penalty against a depository institution in Treasury and FinCEN history. No MASAK release in the period names a fined bank.

What changed for bank AML since 2025, and what is due in 2027?

• 9 January 2025. EU banks offering instant payments must check their customers against EU targeted financial sanctions daily and after every new or amended listing (Regulation (EU) 2024/886, art. 5d).
• 30 June 2025. FinCEN's orders on CIBanco, Intercam and Vector (in effect 20 October 2025).
• 14 December 2025. The UAE's Cabinet Resolution No. 134 of 2025 takes effect, 30 days after publication.
• 13 February 2026. FinCEN's beneficial owner relief.
• 10 April 2026. FinCEN proposes a new AML program rule.
• 7 October 2026. Türkiye doubles its identification lines.
• 13 and 14 October 2026. The Bank of America penalties; the OCC's debanking review.
• 30 October 2026. The FATF plenary takes four countries off increased monitoring (FinCEN note).

Next: the AMLR applies on 10 July 2027, also the transposition date for most of Directive (EU) 2024/1640. AMLA starts its first selection by 1 July 2027 (art. 13(4)). It assesses institutions active in at least six member states, selects those whose residual risk is classified high (arts. 12(1), 13(1)) and supervises them directly from 2028.

What should a bank's AML program checklist hold in 2026?

Each line names the article an examiner or auditor will test it against. Where complead has no part in a line, the cell says so: risk assessments, approvals and contracts stay with the bank.

How does complead fit a bank's AML program?

complead, formerly Sanction Scanner, gives a bank one engine for onboarding, screening, monitoring and investigation, so each customer carries one risk score. Its AML for banks setup runs beside the current tool, with a parallel run on the bank's own names before any switch.

Client screening and ongoing monitoring covers OFAC, EU, UN, UK (HMT), DFAT and SECO lists plus 200+ national regimes. Payment screening checks both parties of each transfer through the API.

In transaction monitoring, agents take the routine cases to a close and attach the evidence, a narrative and the work log. Each alert names the rule that fired and the signals that matched. The MLRO or BSA officer decides the rest and files; the case record names who decided.

One decision is due before 10 July 2027: which correspondent files to redo. Start with every respondent opened without a documented approval, a responsibilities clause or a payable-through check.

What the 2026 PDF adds. Every article cited here was read in its official text on 4 November 2026: EUR-Lex, legislation.gov.uk, the eCFR, mevzuat.gov.tr and the UAE's English texts of the Decree by Law and CR 134. The PDF in the download form beside this page adds four working templates: a correspondent onboarding file (respondent, supervisor, AML record, approval, responsibilities, payable-through access), a report clock card for the six rulebooks, a beneficial owner worksheet at 25 percent and an exit decision log.