On 13 October 2026, three federal agencies acted against one bank. FinCEN assessed $1.2 billion from Bank of America, naming risks the bank had failed to mitigate and report: Chinese money laundering networks and illicit finance along the southwest border. The OCC added $750 million for the bank's BSA program, and OFAC settled apparent sanctions violations for $11.6 million.
Bank of America admitted it willfully violated the BSA in three ways. Its program fell below the minimum, it skipped due diligence on correspondent accounts for foreign financial institutions, and it left suspicious activity reports unfiled. Each failure is a row of the obligations table below, where every duty cites the regulation that sets it.
Who regulates AML compliance in the United States?
| Body | Role in AML | Who it examines |
|---|---|---|
| Financial Crimes Enforcement Network (FinCEN), a Treasury bureau | Administers the BSA, writes the rules in 31 CFR Chapter X, receives SARs and CTRs, assesses civil penalties | Keeps overall authority for enforcement and compliance and delegates examination to the agencies below |
| Office of the Comptroller of the Currency (OCC) | Examines BSA programs, issues orders and civil money penalties | National banks and federal savings associations |
| Federal Reserve | Same powers for the banks it supervises | State member banks |
| Federal Deposit Insurance Corporation (FDIC) | Same powers for the banks it supervises | State nonmember banks |
| National Credit Union Administration (NCUA) | Same powers for credit unions | Federally insured credit unions |
| Securities and Exchange Commission (SEC) | Examines AML programs of securities firms | Brokers or dealers in securities and investment companies, mutual funds among them |
| Commodity Futures Trading Commission (CFTC) | Examines AML programs of futures firms | Futures commission merchants, introducing brokers in commodities and commodity trading advisors |
| Internal Revenue Service (IRS) | Delegated BSA examiner for firms no federal bank supervisor examines | MSBs, casinos, insurers, dealers in precious metals and other firms outside the agencies above |
| Office of Foreign Assets Control (OFAC) | Administers sanctions programs and the SDN List | Enforces against any US person |
| Department of Justice (DOJ) | Prosecutes money laundering and criminal BSA cases | Not an examiner |
| State regulators | License money transmitters and charter state banks | Their own licensees |
Of these AML regulatory bodies in the US, FinCEN writes the BSA rules for every industry, and the federal bank regulators add program rules for their own banks (12 U.S.C. 1818(s)). The others examine. The Financial Crimes Enforcement Network is the US financial intelligence unit, and 31 CFR 1010.810 leaves it overall authority for enforcement while delegating examination to the bank regulators, the SEC, the CFTC and the IRS.
In practice, a national bank meets an OCC examiner, a broker or dealer meets the SEC, and a money transmitter meets the IRS and the state that licensed it. The DOJ comes in only when the conduct is criminal. OFAC stands apart from this chain, because sanctions rules bind every US person, bank or not.
Whichever agency arrives, have three things ready: the written program, the risk assessment behind it, and evidence that both run as written.
Which US laws govern anti money laundering efforts?
US AML regulations rest on five layers:
- Bank Secrecy Act (1970), 31 U.S.C. 5311 onward. Records and reports, including the currency transaction report.
- Money Laundering Control Act (1986). Made laundering a federal crime in 18 U.S.C. 1956 and 1957.
- USA PATRIOT Act (2001), Title III. Section 311 special measures, section 314 information sharing, section 326 customer identification, section 352 programs at every financial institution.
- Anti-Money Laundering Act of 2020, passed inside the National Defense Authorization Act for fiscal year 2021. Whistleblower awards of 10 to 30 percent of what is collected in actions over $1 million (31 U.S.C. 5323), the Corporate Transparency Act and a push toward effective, risk based programs.
- FinCEN's rules in 31 CFR Chapter X. Where the duties are written, one part per industry.
Section 326 shows how the layers connect. Congress told the Treasury to set minimum identity standards for new accounts. The resulting rule, 31 CFR 1020.220, still asks a bank for a name, date of birth, address and identification number before an account opens. An examiner cites the rule. The statute explains why it exists.
Who must comply with AML regulations in the US?
FinCEN's rules name the covered industries by part: banks, savings associations and credit unions (Part 1020), casinos and card clubs (1021), money services businesses (1022), brokers or dealers in securities (1023), mutual funds (1024), insurers of covered products (1025), futures firms (1026), dealers in precious metals, stones or jewels (1027), credit card system operators (1028), nonbank residential mortgage lenders (1029) and housing government sponsored enterprises (1030). Investment advisers join on 1 January 2028.
Lawyers and accountants have no part of their own in Chapter X. Like any trade or business, they report cash of more than $10,000 received in one transaction or in related ones (31 U.S.C. 5331), on the IRS's Form 8300.
Take a crypto exchange serving US customers. Under FinCEN's 2019 guidance on convertible virtual currency, it is a money transmitter, so it registers as a money services business within 180 days of starting and reports suspicious transactions from $2,000.
Which industries are high risk for money laundering in the US?
FinCEN's 2026 orders show where it sees risk. Since 3 September 2026, money services businesses in listed ZIP codes of eight counties in New Mexico and Texas have reported cash transactions of $1,000 to $10,000. The Bank of America action named Chinese money laundering networks and the southwest border. In the UBS action it was high risk customers with ties to Russia and Latin America.
Cash heavy MSBs, foreign correspondent accounts and wealth clients whose money comes from abroad recur across these actions. Each maps to a row below.
What are the AML compliance requirements for US businesses?
These 12 duties are written for banks. Other industries carry parallel rules in their own CFR parts. The right hand column shows how complead, formerly Sanction Scanner, supports each duty.
| Obligation | Legal basis (in force, November 2026) | What a program must do | How complead does it |
|---|---|---|---|
| AML/CFT program | 31 U.S.C. 5318(h); 31 CFR 1020.210 | A written, board approved program with internal controls, independent testing, a designated BSA officer, training and risk based customer due diligence | Each detection rule keeps its version history, showing who changed what, when and why |
| Customer identification program | 31 CFR 1020.220 | Before an account opens, collect the customer's name, date of birth, address and identification number; verify within a reasonable time; check any terrorist list Treasury designates for CIP (none is designated today, so OFAC screening stays a separate duty); a US CIP form template lists the fields | Onboarding, screening, monitoring and fraud run on one engine, which gives each customer one risk score |
| Beneficial owners of legal entity customers | 31 CFR 1010.230 | At account opening, identify and verify each person owning 25 percent or more and one person with significant control; a US beneficial ownership certification collects the data | KYB and UBO verification traces owners upward until it reaches natural persons; a layer it cannot resolve is reported as unresolved |
| Customer due diligence and monitoring | 31 CFR 1020.210(a)(2)(v) | Understand the nature and purpose of each relationship to build a risk profile (customer due diligence); monitor to find and report suspicious transactions; update customer information on a risk basis | Ongoing monitoring starts and stops per name through API triggers |
| Suspicious activity reports | 31 CFR 1020.320 | File through BSA E-Filing within 30 calendar days of initial detection, 60 if no suspect is named, for transactions of $5,000 or more; keep the filing confidential | Reporting support within case management; agents put the evidence, a narrative written in the examiner's format and the work log into each case |
| Currency transaction reports | 31 CFR 1010.311; 1010.313 | Report each cash transaction over $10,000, adding up one person's cash in a business day | A daily cash aggregation rule, built without code and backtested in 30, 60 or 90 day windows |
| Funds transfers and the travel rule | 31 CFR 1010.410 | Record and pass on originator and beneficiary data for transmittals of $3,000 or more | Through the API, transaction screening checks both parties to a transfer during processing |
| Sanctions | IEEPA (50 U.S.C. 1702); 31 CFR 501.603; 501.601 | Screen against the SDN List and other OFAC lists, block or reject, report blocked property within 10 business days, keep records for at least 10 years | 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes; matching thresholds set per list type and per list |
| Correspondent and private banking | 31 CFR 1010.610; 1010.620 | Due diligence on foreign correspondent accounts, enhanced due diligence for certain foreign banks, added scrutiny of senior foreign political figures in private banking | From a customer, the connections graph follows links toward sanctioned, PEP or adverse media entities, six hops deep by default; each hop keeps its source as case evidence |
| Information sharing | 31 CFR 1010.520; 1010.540 | Search records for names in a FinCEN 314(a) request and report matches in the time frame the request sets; share under 314(b) after notice to FinCEN | Each screening search is logged with the user, the search terms, the time and the result, no match results included |
| Record keeping | 31 CFR 1010.430 | Keep required records for five years | Each agent output carries the evidence, the narrative and the work log |
| Independent testing and training | 31 CFR 1020.210 | Test the program independently and train staff on it | An alert lists the rule behind it and the signals that matched, so a tester can follow each one |
If you are preparing for an exam, read the table from the right: for each row, find the written procedure and the evidence that it ran. FinCEN's April 2026 proposal would call a program effective when it is "established and maintained in accordance with applicable requirements" (91 FR 18704, 10 April 2026). For any alert or closed case an examiner could sample, keep who decided it and on what evidence.
What are the US AML thresholds and deadlines?
| Rule | Trigger | Threshold or deadline | Basis (in force, November 2026) |
|---|---|---|---|
| Currency transaction report | Cash in or out by or for one person in one business day | More than $10,000 | 31 CFR 1010.311, 1010.313 |
| Form 8300 | Cash received by any trade or business | More than $10,000 | 31 U.S.C. 5331 |
| Suspicious activity report, banks | Suspicious transaction | $5,000; file in 30 days, 60 with no suspect | 31 CFR 1020.320 |
| Suspicious activity report, MSBs | Suspicious transaction | $2,000 | 31 CFR 1022.320 |
| Travel rule | Funds transfer | $3,000 or more | 31 CFR 1010.410 |
| Beneficial owner | Equity in a legal entity customer | 25% or more, plus one control person | 31 CFR 1010.230 |
| Blocked property report | Property blocked under OFAC rules | 10 business days | 31 CFR 501.603 |
| Record retention | BSA records; OFAC records | 5 years; at least 10 years | 31 CFR 1010.430; 501.601 |
| MSB registration | A new money services business | Within 180 days; renew every two calendar years | 31 CFR 1022.380 |
| Cross border currency report | Cash or monetary instruments carried into or out of the US | More than $10,000 | 31 CFR 1010.340 |
Picture a customer who deposits $9,000 in cash on Monday and $9,000 on Tuesday. Neither day crosses the CTR line. Deposits shaped to evade a report are one of the cases the bank SAR rule lists, though, and a bank weighs a suspicious activity report from $5,000.
What are the penalties for failing to comply with US AML laws?
| Offense or violation | Basis | Maximum (in force, November 2026) |
|---|---|---|
| Laundering through a transaction or an international transfer | 18 U.S.C. 1956 | 20 years; a fine of $500,000 or twice the value involved, whichever is greater |
| Dealing in criminally derived property worth more than $10,000 through a monetary transaction | 18 U.S.C. 1957 | 10 years |
| Unlicensed money transmitting business | 18 U.S.C. 1960 | 5 years and a fine |
| Willful BSA violation | 31 U.S.C. 5322(a) | 5 years and $250,000 |
| Willful BSA violation alongside another federal crime or in a pattern over $100,000 in 12 months | 31 U.S.C. 5322(b) | 10 years and $500,000 |
| Willful civil BSA violation | 31 U.S.C. 5321(a)(1) | The amount involved up to $286,184, or $71,545 if greater, as adjusted for inflation in 31 CFR 1010.821 (statute: $100,000 and $25,000); program failures count per day and per office |
The civil cap per violation looks small until it multiplies by day and by office. The impact of non compliance also stacks across agencies: FinCEN, the OCC and OFAC each acted against Bank of America on the same day. Criminal cases go to the DOJ, and under 31 U.S.C. 5321(d) a civil penalty can stand beside a criminal one for the same failures.
Major money laundering cases in the US, 2024 to 2026
Three FinCEN actions set today's scale; the biggest AML fines list carries the older ones.
TD Bank, 10 October 2024. FinCEN assessed $1.3 billion, a sum no depository institution had paid Treasury or FinCEN before, and put the bank under an independent monitor for four years. By its own admission, TD Bank willfully failed to keep a program that met the BSA minimum. FinCEN found it knew the program was neither designed nor resourced for the risks it faced.
UBS Financial Services, 3 August 2026. FinCEN assessed $125 million, the largest BSA penalty ever imposed on a broker or dealer in securities. A 2018 consent order had already found weak monitoring of foreign currency wires. UBS told FinCEN it would fix the problem, and more than 50,000 such wires worth over $10 billion then went unmonitored.
Bank of America, 13 October 2026. The case at the top of this page: $1.2 billion to FinCEN.
How does the US cooperate with FATF and global AML initiatives?
The United States has been a FATF member since 1990. Its last mutual evaluation dates from 2016; after the US reported back in 2020, the FATF rerated Recommendation 10 on customer due diligence. As of March 2024, the US is compliant on 9 of the 40 Recommendations, largely compliant on 23, partially compliant on 5 and non compliant on 3. It reports its next progress in the FATF's fifth round of mutual evaluations.
Cooperation also runs outward. Section 311 of the PATRIOT Act lets FinCEN cut a foreign bank off from US correspondent accounts. In 2026 it proposed that step against MBaer Merchant Bank of Switzerland on 2 March and against the five UAE branches of Banque Misr on 1 September. Once final, each measure would bar US financial institutions from opening or keeping a correspondent account for the named bank.
How can US businesses improve their AML programs with screening and monitoring?
Five steps answer the gaps these cases exposed:
- Map every control to a row of the obligations table. The 2026 proposal asks whether each one is established and maintained.
- Screen at onboarding and again when lists change. A blocked property report is due within 10 business days.
- Set matching per list. A threshold tuned for the SDN List can flood a watchlist queue.
- Write thresholds as tested rules. Structuring patterns belong in backtested rules, not in an analyst's memory.
- Keep the evidence with the decision. At UBS, FinCEN learned of the wire gap through an investigation that followed an examination; the firm had not disclosed it.
complead, formerly Sanction Scanner, has an office in New York and is an AI native platform for AML, KYC and fraud. Steps 2 and 3 run in client screening and ongoing monitoring. Step 4 runs in transaction monitoring, where rules are built without code, backtested over 30, 60 or 90 days and kept in versions with a one click rollback. Sanction Scanner, the screening product, is part of complead. Agents close routine cases with the evidence, narrative and work log attached, while a reviewer makes the call and the record names that reviewer.
Which red flags do US examiners expect a program to catch?
FinCEN's actions from 2024 to 2026 point to six patterns:
- Cash kept just under $10,000. Deposits or purchases sized to avoid a CTR.
- Foreign currency wires nobody monitors. They were the gap in the UBS case.
- Negative news about corruption or fraud. UBS kept such customers without weighing the news.
- Shell company accounts and funnel activity. At TD Bank, an employee opened accounts for shell companies that ran millions of dollars through funnel accounts.
- Correspondent chains to high risk banks. Funds routed through banks named in section 311 proposals.
- Payments linked to Chinese money laundering networks. A priority risk named in the Bank of America action.
What are the current US AML trends, and which 2026 rules drive them?
Dated 2026 items (Federal Register dates unless noted):
- 1 April. Whistleblower program proposed (91 FR 16328).
- 10 April. Program reform proposed (91 FR 18704), superseding the 2024 proposal; stablecoin issuer AML and sanctions rules proposed with OFAC (91 FR 18582); issuer CIP followed on 22 June (91 FR 37234).
- 11 August. Minnesota order: banks and money transmitters in Hennepin and Ramsey counties report certain payments of $3,000 or more (91 FR 51588).
- 14 August. Final beneficial ownership rule under the Corporate Transparency Act: reporting companies stay exempt from reporting their US person beneficial owners, as under the March 2025 interim rule (91 FR 52508).
- 3 September. Southwest border geographic targeting order in force (91 FR 56776).
- 8 September. CIP FAQs on mobile driver's licenses and other verifiable digital credentials (release date).
- 6 October. Unhosted wallet and CVC mixing proposals withdrawn (91 FR 63514; 91 FR 63513).
Read together, the items point one way: few new duties, and more weight on whether existing ones work. FinCEN proposes that a final program rule take effect 12 months after it issues; none had issued by 3 November 2026. Investment advisers follow on 1 January 2028 (91 FR 36).
Before that 12 month clock starts, sort the rows of the obligations table into two piles: the controls you could prove today were established and maintained, and the ones you could not.
How this guide was checked. Sinan Tekin wrote it and Ufuk Gürdaş reviewed it; every rule was read in its primary text on 3 November 2026, with amounts and dates taken from FinCEN releases and the Federal Register.
Get the US AML checklist (PDF, 2026 edition)
This page carries the whole guide. The 16 page PDF holds the working files: a 14 point program checklist, a risk factor template for US customers and a SAR decision record with the fields to fill in.
