US AML/CFT Framework
United States AML/CFT obligations are institution-specific. The controlling rule depends on the institution type, activity, regulator and applicable part of 31 CFR Chapter X.
Core instruments and authorities#
| Instrument or authority | Function | Operational relevance |
|---|---|---|
| Bank Secrecy Act (BSA) | Federal statutory basis for AML-related reporting, recordkeeping and programme requirements | Defines the legal architecture that is implemented through institution-specific regulations |
| 31 CFR Chapter X | FinCEN regulations organised by general provisions and financial-institution type | AML programmes, CDD, SAR/CTR and other reports, recordkeeping, information sharing and sector rules |
| Anti-Money Laundering Act of 2020 | Modernisation and reform of the US AML/CFT framework | National priorities, beneficial-ownership reforms, information sharing, innovation and continuing rulemaking |
| FinCEN | US financial intelligence unit and principal BSA administrator | Rules, guidance, advisories, reporting systems, enforcement and financial-intelligence priorities |
| Federal functional regulators and FFIEC | Supervision and examination for relevant regulated institutions | Risk-focused examination, governance, programme effectiveness and control testing |
| OFAC | Administration and enforcement of US economic and trade sanctions | Screening, ownership/control analysis, blocking or rejection, reporting, licensing and sanctions governance |
Scope by institution and activity#
The term “financial institution” does not create one identical control framework for every US business. Banks, money services businesses, broker-dealers, mutual funds, casinos, dealers in precious metals and other covered categories can be subject to different programme, reporting and recordkeeping provisions.
Before applying a US control, record:
- the institution type and activity;
- the applicable section of 31 CFR Chapter X and any regulator-specific rule;
- the federal and state supervisory perimeter;
- exclusions, exemptions and exceptive relief;
- the effective date and current rulemaking status.
Process mapping#
| Universal AML process | US overlay questions |
|---|---|
| Customer classification | Which BSA category, regulator and institution-specific part of Chapter X applies? |
| CDD / KYC | Which customer-identification, customer-risk-profile, monitoring and legal-entity CDD rules apply? |
| Beneficial ownership | Is the customer and institution within the current CDD Rule, and do exclusions, exemptions or 2026 exceptive relief affect collection or verification? |
| Transaction monitoring | Which risks, products, geographies, customer activity and regulatory reporting duties must the monitoring design address? |
| SAR and other reporting | Which report type, filing authority, confidentiality rule, timing rule and recordkeeping duty applies? |
| AML/CFT programme | Which sector-specific programme elements, board or senior-management responsibilities, testing and training requirements apply? |
| Sanctions | Which OFAC programme, list, ownership/control rule, licence, blocking or reporting obligation applies? |
| Examination and QA | Which regulator examines the institution, and which FFIEC or regulator materials are guidance rather than independent legal requirements? |
CDD and beneficial ownership: current status#
The FinCEN CDD Rule establishes explicit CDD requirements for specified covered financial institutions. It must be read together with current exclusions, exemptions, guidance and later actions. FinCEN issued exceptive relief in February 2026 affecting when covered institutions must identify and verify beneficial owners of legal-entity customers.
SAR, CTR and confidentiality boundaries#
US reporting is not one generic “SAR process”. The workflow must distinguish suspicious activity reporting from currency and other regulatory reports, and must preserve the confidentiality restrictions that apply to SARs and information revealing their existence.
This page deliberately does not reproduce filing thresholds or deadlines. Those values are institution-specific operational parameters that must be taken from the current regulation and FinCEN instructions.
AML/CFT programme controls#
Programme requirements vary by institution type. Common control themes include internal controls, designated responsibility, independent testing, training and risk-based governance. The FFIEC BSA/AML Examination Manual is highly useful for banks and examination practice, but the manual itself does not create new legal requirements.
Current rules versus proposed reform#
FinCEN published a proposed AML/CFT programme reform in April 2026. It must be labelled as a proposal until a final rule is issued and becomes effective. A source register, control library or reviewer must not silently convert a notice of proposed rulemaking into a production obligation.
OFAC is a separate sanctions layer#
US AML and OFAC sanctions controls interact operationally but arise from different legal authorities. A suspicious-activity decision does not replace a blocking, rejection, reporting or licensing analysis, and an OFAC match is not automatically a money-laundering conclusion.
Evidence requirements for a US overlay#
- institution type, activity and regulator;
- statute, regulation, section and effective date;
- current FinCEN rule, guidance, relief or proposal status;
- applicable federal and state layer;
- OFAC programme, list version, ownership/control analysis and licence status where relevant;
- internal-policy mapping and accountable approver;
- unresolved legal interpretation requiring specialist review.
Relationship to FATF#
The US framework implements AML/CFT controls within a national legal and supervisory system. FATF remains the global standard-setting baseline, but FATF language cannot be used as a substitute for the applicable US statute, regulation or regulator instruction.
Source basis#
- SRC-US-BSA-001: Bank Secrecy Act overview.
- SRC-US-CFRX-001: 31 CFR Chapter X.
- SRC-US-AMLA-001: AML Act of 2020 implementation.
- SRC-US-CDD-001 and SRC-US-CDD-RELIEF-001: CDD framework and current relief.
- SRC-US-AMLPROG-NPRM-001: proposed 2026 programme reform.
- SRC-FFIEC-001: BSA/AML Examination Manual.
- SRC-FINCEN-001 and SRC-FINCEN-ADVISORIES-001: SAR quality and typology guidance.
- SRC-OFAC-001 and SRC-OFAC-002: sanctions data and compliance framework.
- SRC-FATF-001: global baseline.
Boundary#
Boundary: institution classification, regulator selection, filing thresholds, SAR decisions, OFAC action and legal conclusions require the current controlling source and accountable US review.