AML Policies and Procedures: A Complete Compliance Guide
Banks aren't the only ones who need to worry about money laundering. Crypto exchanges, payment processors, online merchants — if your business moves money, a regulator somewhere will eventually ask how you stop illicit funds from passing through it. Your answer needs to exist in writing. That's your AML policy, and get aml policies and procedures wrong and you're looking at fines, frozen accounts, and a reputational mess that outlasts whatever violation caused it.
So what actually goes into one of these documents? This guide walks through what an AML policy contains, why regulators demand one, and how to put together a framework that survives an audit. Doesn't matter if you're running a bank, a fintech startup, or a crypto payment business — the logic underneath is the same.
What Are AML Policies and Procedures?
An AML policy is your organization's written rulebook for spotting, stopping, and reporting money laundering and terrorist financing. Think of it as the "what" and "why" — risk appetite, which customer types get rejected outright, who on staff is responsible for what. This whole discipline goes by the name anti-money laundering, or AML, and regulators use that term as shorthand for basically any control aimed at keeping dirty money out of the financial system.
Procedures cover the "how." A transaction gets flagged somehow. Someone reviews it. A suspicious activity report gets filed, following a specific process. Policy and procedures together make up a chunk of what's usually called an AML compliance program, which also folds in training, technology, and independent audits.
People mix these terms up constantly, but regulators don't. A policy with no procedures behind it is basically unenforceable. Procedures with no policy backing them have nothing to stand on legally.
Here's why the distinction actually matters day to day: an examiner won't just check that a policy document exists somewhere in a drawer. They'll pull real transactions and trace them through your procedures, checking whether the paperwork matches what actually happened. Plenty of policies read beautifully on paper and collapse the moment someone tests them against real files — it's one of the most common gaps auditors find at small and mid-sized firms.
Why Every Business Needs an AML Policy
This isn't some marginal crime we're talking about. The UN puts the number at 2–5% of global GDP laundered every single year, and 2023 alone saw over $3 trillion in illicit funds move through the world economy. Every business that fails to control that flow through its own doors, knowingly or not, becomes part of the pipeline.
Regulators know this, which is why financial institutions, money service businesses, and now crypto companies all face mandatory AML compliance obligations. Penalties run from fines up to losing your operating license entirely. And the legal risk is honestly the smaller half of the problem — a laundering scandal sticks in customers' and partners' memories for years.
Auditors and regulators ask for the documented policy first, before anything else. No policy means no way to prove good faith, even if what you're actually doing day to day is perfectly reasonable.
Just look at enforcement history. Regulators around the world keep handing out multi-million-dollar fines for AML program failures, and often laundering itself was never even proven — the fine came from gaps in policy, training, or monitoring that made prevention impossible to show. A well-built policy costs far less than that kind of exposure.
Key AML Laws and Regulations You Must Know
AML requirements vary by jurisdiction, but a handful of frameworks shape nearly every policy written today. Understanding them is the fastest way to know what your document must cover.
| Regulation | Region | Core requirement |
|---|---|---|
| Bank Secrecy Act (BSA) | United States | Requires recordkeeping, reporting of suspicious transactions, and a written AML program |
| USA PATRIOT Act, Section 352 | United States | Mandates four pillars: compliance officer, training, testing, and internal controls |
| EU Anti-Money Laundering Directives (AMLD) | European Union | Harmonizes customer due diligence, beneficial ownership, and reporting rules across member states |
| FATF Recommendations | Global | Sets the international standard that national AML laws are built around |
None of these frameworks are optional add-ons. They're the baseline, and a policy that ignores the one relevant to your operating region will fail its first regulatory review. The Financial Action Task Force, in particular, sets the benchmark that most national anti-money laundering and terrorist financing laws are modeled on. That's why FATF language shows up in policies written oceans apart.
Core Components Every AML Policy Must Include
Section 352 of the USA PATRIOT Act lays out four mandatory pillars for a written AML compliance program, and most global frameworks mirror them closely. Any policy missing one of these is incomplete by regulatory standards:
- A designated compliance officer responsible for day-to-day AML oversight and regulatory reporting
- Ongoing employee training covering red flags, reporting duties, and updates to regulations
- Independent testing or audit to confirm the program works as written, not just as designed
- Written policies, procedures, and internal controls covering customer onboarding through transaction monitoring
Modern AML policies typically add two more components on top of the four pillars: a documented AML risk assessment and a sanctions screening process. Regulators increasingly treat both as expected, even where the law doesn't spell them out explicitly.
A frequent mistake is treating these components as a checklist to satisfy once, rather than a living system. The compliance officer role, for instance, needs real authority and budget. A title without either won't hold up if regulators ask who actually has the power to freeze a suspicious account. Training that happens once at onboarding and never again quickly falls out of step with new typologies and updated regulations too.
Customer Due Diligence and Risk-Based Procedures
Customer due diligence, or CDD, just means figuring out who you're actually doing business with, both at signup and afterward. That means confirming identity, understanding what the customer actually does, and watching for anything that looks off. An AML risk assessment is what tells you where to spend the extra effort — which accounts need a two-minute check and which ones deserve real scrutiny.
Risk isn't evenly distributed across customers, and that's the whole point of a risk-based approach. Politically exposed persons, customers based in high-risk jurisdictions, accounts moving money in odd patterns — all of these need enhanced due diligence. Deeper background checks. More frequent monitoring. A sign-off from someone senior before the account moves forward. Miss a politically exposed person and you'll draw regulatory attention fast, so don't fold that screening into generic onboarding — give it its own dedicated step.
Then there's sanctions screening, checking new customers (and honestly, transactions too) against government lists like OFAC before money moves anywhere. Skip this and you've made one of the costliest mistakes an AML policy can contain.
None of this stops after onboarding. A customer who looked perfectly safe on day one might not stay that way — bigger transaction volumes, new counterparties in risky places, activity that stops matching what they told you their business was. Good risk-based policies revisit customer ratings on a schedule instead of treating that first check as a one-time gate.
Step-by-Step: Building Your AML Policy Framework
Writing an AML policy from a blank page is easier when you follow a fixed sequence. Here's the order that produces a defensible, audit-ready document:
- Conduct a risk assessment — map out which products, customers, and geographies expose you to the highest laundering risk.
- Appoint a compliance officer or MLRO — someone with the authority and resources to run the program day-to-day.
- Define the policy's scope and risk appetite — state clearly what customer types and activities are acceptable, restricted, or prohibited.
- Set CDD and enhanced due diligence triggers — specify exactly when standard checks escalate to deeper review.
- Build transaction monitoring rules — define thresholds and patterns that trigger internal alerts.
- Establish a suspicious activity reporting (SAR) process — document who reviews alerts and how filings get submitted to regulators.
- Train all relevant staff — not just compliance teams, but anyone customer-facing or transaction-facing.
- Schedule independent audits — put a recurring review on the calendar before the policy goes live, not after a regulator asks for one.
Following this order avoids a common mistake: writing detailed procedures before the underlying risk assessment is done. Skip that step and you usually end up rewriting half the document later.
Most businesses can complete a working draft of this framework in four to six weeks, though the timeline depends heavily on how many product lines and jurisdictions the policy needs to cover. Firms that try to compress this into a few days typically end up with generic language borrowed from templates. That language looks complete, but it doesn't reflect their actual risk profile, and that's exactly what an auditor will notice first.
Monitoring, Auditing, and Updating AML Procedures
Your policy is only as good as whatever's monitoring transactions behind it. Whether that system is manual or automated, it needs to catch structuring, funds moving unusually fast, or activity that just doesn't fit a customer's normal profile.
Timing matters once something looks suspicious. Businesses generally get 30 days under the Bank Secrecy Act to file a suspicious activity report before delay penalties kick in. And don't throw the paperwork away afterward — identity documents, transaction logs, SARs, all of it needs to stick around for five years under both the Bank Secrecy Act and EU AMLD4.
The policy itself needs revisiting too, not just the transactions running through it. Regulations shift, business models change, new laundering tactics show up. Most compliance teams review their AML policy at least once a year, plus extra updates whenever regulations or risk exposure move enough to matter.
International AML Compliance Considerations
Stay in one country and you've got one regulatory framework to satisfy. Cross borders, and suddenly your policy needs to hold up under several frameworks at once, without any of them contradicting each other.
What most compliance teams actually do: write one core global policy, then bolt on local addenda per jurisdiction. The core handles universal stuff, risk-based approach, CDD, sanctions screening. The addenda deal with local reporting formats, who to call at the regulator, and thresholds that shift country to country.
Fintech and crypto businesses feel this pressure hardest, since plenty of them serve customers in dozens of jurisdictions before they've even hit their first anniversary. Keep the policy as one global document, reviewed centrally, applied locally. That's how you dodge the gaps that show up when regional policies get bolted together after the fact instead of designed that way from the start.
There's more to this than paperwork, too. A transaction that raises zero flags under one country's thresholds might trigger a mandatory report somewhere else. So who makes the call when two frameworks disagree? Usually that falls to one person, the compliance officer or MLRO, who needs to actually understand where the thresholds diverge.
AML Compliance for Crypto and Digital Payment Businesses
Crypto gets more AML scrutiny than most of traditional fintech, and honestly, it's not hard to see why. Pseudonymous wallets, transfers that cross borders in seconds, blockchain settlement moving faster than a bank wire ever could — all of that raises the stakes for regulators trying to keep money laundering and terrorist financing out of digital assets. And that scrutiny lands squarely on whoever's processing the crypto payments.
A crypto-ready AML policy needs a few things a standard financial-services template just doesn't cover:
- Wallet address screening against known illicit-activity and sanctions databases before accepting funds
- On-chain transaction monitoring that tracks fund flows across multiple hops, not just the immediate sender
- Clear escalation paths for transactions involving mixers, high-risk exchanges, or blacklisted addresses
If you're running e-commerce and accepting crypto, building all of that infrastructure yourself is overkill. Easier route: work with a payment processor that already has AML and KYC controls baked in. Plisio handles wallet and transaction screening as part of its infrastructure, so merchants can accept crypto without shouldering the entire compliance burden alone.
That gap is bigger than it looks at first. A merchant who builds crypto checkout on top of a processor with zero AML controls inherits that risk quietly — nobody notices until a regulator or banking partner starts asking hard questions about illicit-fund exposure. Pick infrastructure that already handles the screening, and you've got an answer ready before anyone even asks.
Final Thoughts
A strong AML policy isn't a document you write once and file away. It's a living framework that needs monitoring, auditing, and regular updates as regulations and risks evolve. Get the fundamentals right, a clear risk assessment, defined due diligence procedures, a designated compliance officer, and any business, from a traditional bank to a crypto payment platform, ends up ahead of most regulatory reviews.
The businesses that struggle with AML compliance are rarely the ones facing genuinely novel risks — they're the ones that treated their policy as a one-time paperwork exercise instead of an operational system. Building solid aml policies and procedures from the start, with real ownership and regular review baked in, is far cheaper than rebuilding them after a violation forces the issue.
