AML
Anti-money laundering (AML) is the body of law and the set of controls that require financial institutions to prevent, detect and report the movement of criminal proceeds through their services: identifying customers and their beneficial owners, assessing their risk, monitoring transactions, screening against sanctions, reporting suspicious activity and keeping records. Its rules come from FATF's standards, transposed into EU, UK and US law; for a fintech they are a licensing condition and the most common subject of enforcement.
- Also known as
- Anti-money laundering, AML compliance, AML/CFT, Anti-money laundering controls, AML/KYC
- Used at
- every licensed financial institution — banks, payment and e-money institutions, crypto-asset service providers, lenders, investment firms — and, through them, every fintech that holds or moves money; also lawyers, accountants and estate agents under the same rules
- Binding
- FATF's 40 Recommendations (the global standard); in the EU, the 4th–6th Anti-Money Laundering Directives and the 2024 AML Regulation with a new EU authority (AMLA) from 2025; in the UK, the Money Laundering Regulations 2017 and the Proceeds of Crime Act; in the US, the Bank Secrecy Act and FinCEN's rules; the criminal offences (laundering, failure to report, tipping off) sit alongside the regulatory duties
- Typical controls
- a risk assessment of the business; customer due diligence at onboarding (identity, beneficial ownership, purpose, risk rating) with enhanced measures for higher risk; ongoing monitoring of transactions and periodic reviews; sanctions and PEP screening; suspicious activity reports (SARs) to the financial intelligence unit; record-keeping for five years or more; training; and an appointed money laundering reporting officer
- Typical cost
- 2–4% of operating cost at a bank; at a fintech, compliance headcount is often the largest team after engineering, and vendor spend on screening, monitoring and identity verification runs to hundreds of thousands a year at scale
- Parties
- the institution and its MLRO, the regulator (FCA, BaFin, the national supervisors, AMLA), the financial intelligence unit that receives SARs, the vendors, the correspondent and sponsor banks that impose their own standards, and the acquirers who price AML findings in diligence
How AML works in practice
A payment institution onboards a merchant. It collects the company's registration, identifies every beneficial owner above 25%, verifies their identities, screens all of them against sanctions and PEP lists, checks the business's activity against prohibited and high-risk categories, and assigns a risk rating that determines what happens next: standard monitoring, or enhanced due diligence with source-of-funds evidence and senior approval. Once live, the merchant's transactions run through monitoring rules and models — velocity, unusual counterparties, structuring below thresholds, mismatches with expected activity — that generate alerts; analysts investigate, close most as benign, and file SARs on the rest. Periodic reviews refresh the picture; a change in ownership or activity triggers a new one. Every step is documented, because the regulator's question is not whether laundering occurred but whether the controls were adequate.
The strains are known. False-positive rates on monitoring alerts commonly exceed 90%, so analyst time is spent clearing noise; the fix is better models, tuned rules and feedback loops, not more analysts. Beneficial-ownership verification depends on registers of uneven quality. Sanctions lists change weekly and screening must keep pace. And the regime is enforced in arrears: a fintech that grew fast on thin controls meets the regulator's review two years later with a remediation programme, a fine and a growth restriction — the pattern of most fintech enforcement cases of 2020–2025. In M&A, AML is the diligence item that reprices or kills deals: a buyer inherits the target's historical failures, and a regulator's open review is a condition precedent nobody can satisfy on schedule.
For a fintech, AML is the control environment the licence rests on; building it to the scale the business will reach, not the scale it has, is the difference between the firms that grew and the firms that were restricted.
Example
A European e-money institution grows from 50,000 to 900,000 customers in two years on an onboarding flow with automated identity checks and a rules-based monitor written for the earlier scale. A regulator's thematic review finds: 30% of high-risk customers without documented enhanced due diligence, monitoring rules that missed structuring across accounts, a SAR backlog of 1,400 alerts older than 30 days, and one MLRO for the whole firm. The outcome: a €4.2 million fine, a restriction on onboarding new customers for eight months, an independent reviewer at the firm's expense, and a remediation programme that costs €11 million — analysts, a new monitoring system, a re-review of 120,000 customer files. A planned Series C is delayed a year and closes at a lower valuation; the acquirer that eventually buys the firm prices the residual risk into an escrow of 15% of the consideration.
Common mistakes
- Controls built for the customer base at launch and never re-scaled as the firm grows. - Treating monitoring alerts as a queue to be cleared rather than a signal to be tuned. - Enhanced due diligence recorded as a checkbox without the evidence behind it. - One MLRO with no deputy, no independence and no authority to stop onboarding. - Buying a fintech without reading its SAR history, alert backlog and regulator correspondence.