How to Build an AML Compliance Program: A Step-by-Step Guide

Most regulated firms can produce an AML compliance program on request. Showing that it runs as written is harder. Examiners read the documents first, then test what sits underneath: whether the risk assessment set the monitoring thresholds, whether each alert reached a recorded decision, and whether the board acted on the audit findings it received.

This guide sets out a build order for an AML compliance program. For each element it names the evidence to keep and the rule behind it under the US Bank Secrecy Act, the UK Money Laundering Regulations 2017 (MLR 2017) and the FATF Recommendations; a short section covers India. It is general guidance rather than legal advice, since the obligations on a given firm depend on its license, its activities and its supervisor.

What an AML compliance program has to contain

An AML compliance program is the written and approved set of risk-based controls a regulated firm uses to prevent money laundering and terrorist financing where it can, and to flag and report the cases it finds. FATF Recommendation 18 and its Interpretive Note set the common baseline: a compliance officer at management level, employee screening at hiring, ongoing training and an independent audit function. National rules restate that baseline in their own terms. Our explainer covers what AML compliance involves; this post deals with assembly.

The order matters because each element leans on another. A policy can only be proportionate once the risk assessment says what it is proportionate to. Customer risk tiers and monitoring thresholds draw on that same assessment. Independent testing goes last, because it needs a working program to test. The steps below follow those dependencies.

Before you build: who must have an AML program and which rules apply

In the US, 31 U.S.C. 5318(h) obliges financial institutions to maintain an AML program. FinCEN's program rules reach 11 types of financial institution, and each type has its own section; for banks it is 31 CFR 1020.210. Investment advisers have a separate rule, whose effective date has been pushed back to 1 January 2028. The UK applies MLR 2017 to "relevant persons", who are supervised by the FCA, HMRC or a professional body. In India, the Prevention of Money Laundering Act (PMLA) calls the firms it covers reporting entities. They work from the PML Rules and from their sector regulator's AML/KYC rules (for RBI-regulated entities, the RBI KYC Direction for their class).

Evidence for the file: an obligations register mapping each regulated activity to the rule and supervisor that govern it.

Step 1: Ownership and sign-off

Ownership comes first, because every later step needs someone accountable for it and a route to approval. US banks must designate one or more individuals to coordinate and oversee day to day compliance (31 CFR 1020.210(a)(2)(iii)). The FFIEC BSA/AML Examination Manual asks examiners to confirm that this officer has the authority, independence and resources the role requires.

In the UK, regulation 21 of MLR 2017 has a firm appoint a board member or senior manager as the officer responsible for compliance where its size and nature make that appropriate, and notify its supervisor of the appointment within 14 days. FCA-regulated firms must also give a director or senior manager overall responsibility for AML systems and controls (SYSC 6.3.8R). They must appoint a money laundering reporting officer (MLRO) with the authority, independence and resources to do the job (SYSC 6.3.9R).

Evidence for the file: the board resolution or minutes, appointment letters with role descriptions, the supervisor notification, a resourcing plan and the officer's reporting line to the board.

Step 2: Run the enterprise-wide risk assessment

FATF Recommendation 1 and its Interpretive Note require financial institutions to identify and assess the money laundering and terrorist financing threats they face across customers, geographies, products, services, transactions and delivery channels. It is documented and kept current, and under Recommendation 15 new products and technologies are assessed before launch. MLR 2017 regulation 18 requires the assessment in writing, kept up to date and available to the supervisor on request. Regulation 18A adds a separate proliferation financing risk assessment. In the US, the FFIEC manual expects US coverage of products, services, customers and geographic locations, updated as they change.

An assessment is useful when the rest of the program can act on what it decides. A payments firm opening a new cross-border payout corridor should be able to show the inherent risk it adds and the controls placed on it, then the residual risk and who accepted it. That one entry feeds the customer risk model in Step 4 and the monitoring scenarios in Step 5.

Evidence for the file: the methodology and inherent-risk scoring, a mapping of controls to risks, the residual-risk conclusion with its approval record, and a log of the events that prompted each update.

Step 3: Policies, procedures and controls that answer the risk assessment

US banks need internal controls that keep them compliant on a continuing basis (31 CFR 1020.210(a)(2)(i)). The OCC goes further for national banks: Their program must be written and board-approved, with that approval reflected in the minutes (12 CFR 21.21). Under MLR 2017 regulation 19, policies, controls and procedures must be proportionate and approved by senior management. They are kept in writing and reviewed regularly, with a record of changes and of how staff were told.

The AML policy is a single document within this step, and the program is the wider set of controls it sits within. Every procedure should point back to the risk it addresses, so a reviewer can trace the line from assessment to control.

Evidence for the file: version-controlled policies and procedures, the approval record and a review log, plus staff attestations.

Step 4: Build customer due diligence into onboarding and the relationship

Under the customer identification program rule (31 CFR 1020.220), a US bank must obtain at least four items before the account opens: the customer's full name and address, a date of birth for individuals, and an identification number. The CDD element of the program rule goes further. The bank must understand the nature and purpose of each relationship and build a customer risk profile, then keep monitoring on an ongoing basis, beneficial ownership included. A beneficial owner is each individual with 25% or more of the equity, plus one individual with significant responsibility to control the entity (31 CFR 1010.230(d)).

Customer risk ratings should be built from the categories in the Step 2 assessment. The high-risk tier triggers enhanced due diligence, and each tier carries its own refresh cycle. Among the first gaps independent testing tends to find is a rating model that cannot be traced to the assessment.

Evidence for the file: the customer risk-rating model with its rationale, sample customer files and beneficial-ownership records, and a refresh register organized by risk tier.

Step 5: Monitoring, screening and the reporting clock

Monitoring thresholds are set tier by tier. Sanctions and PEP screening runs at onboarding and again whenever a list changes, while each alert goes through investigation to a recorded decision. Suspicious activity is reported on a fixed clock.

In the US that clock is precise. A bank has 30 calendar days from first detecting the facts to file a suspicious activity report (SAR) on transactions of $5,000 or more. Where no suspect has been identified, it may take another 30 days, but never more than 60 in total. The SAR and its supporting documents are kept for five years from filing (31 CFR 1020.320), and currency transactions over $10,000 call for a currency transaction report.

Where screening, monitoring and case decisions sit on one platform, such as KYC Hub's AML screening and monitoring, every alert and its disposition goes into a single audit trail. That trail is the record independent testing samples in Step 8.

Evidence for the file: a scenario library with each rule's rationale and threshold, a tuning log, alert dispositions with reasons, and a SAR decision log showing detection date against filing date.

Step 6: Train staff by role, and keep the record

US banks must provide "training for appropriate personnel" (31 CFR 1020.210(a)(2)(iv)). MLR 2017 regulation 24 asks for more. Relevant employees and agents must know the law on money laundering, terrorist financing and proliferation financing, and the related data-protection requirements. They must be regularly trained to recognize and deal with suspicious transactions. The firm keeps a written record and sets frequency by its nature, size and risk. FATF Interpretive Note to Recommendation 18 adds screening of employees at hiring.

Content should vary by role. Onboarding staff need the red flags for their customer segments. Investigators need case and escalation standards. Senior management needs enough grounding to approve the risk assessment knowingly.

Evidence for the file: a training-needs matrix by role, records of completion and testing, and a version history showing the material keeps up with current typologies.

Step 7: Records an examiner can reconstruct

BSA records in the US are kept for five years (31 CFR 1010.430(d)). In the UK, MLR 2017 regulation 40 sets the same period for CDD and transaction records. It runs from the end of the business relationship, or from completion of an occasional transaction. Retention alone is not enough. The records must also be retrievable in a form that lets a reviewer follow a transaction from onboarding to alert to decision.

Evidence for the file: a retention schedule, together with the results of a retrieval test in which the team pulls a closed file and rebuilds its transaction trail.

Step 8: Test the program independently, then close the findings

US banks must have compliance tested independently, either by their own staff or by an outside firm (31 CFR 1020.210(a)(2)(ii)). No frequency is fixed in the rule. The FFIEC manual describes periodic testing, for example every 12 to 18 months or after significant change, matched to the bank's risk profile.

In the UK, MLR 2017 regulation 21 requires an independent audit function where the firm's size and nature make it appropriate. The function examines whether controls are adequate and effective, makes recommendations and monitors compliance with them. FCA guidance at SYSC 6.3.7G expects the MLRO to report to the governing body at least once a year.

Testing is only worth doing if findings close, each with an owner, a due date and evidence of the fix.

Evidence for the file: the audit scope and workpapers; a findings tracker recording owners, dates and closure evidence; the annual MLRO report; and board minutes showing the findings were received.

Step 9: Keeping the program current

A program is designed once, and maintaining it is continuous work. The triggers for an update are predictable. A new product, channel or geography is one (FATF Recommendation 15 requires it to be assessed before launch), and a change in law is another. Findings from Step 8 also count, as does anything monitoring reveals about where risk actually sits.

FinCEN's 2026 proposal draws the same line in law. It separates establishing a program, which means designing one with every required component, from maintaining it, which means implementing it in all material respects. The maintenance failures are familiar: a risk assessment that has not moved since approval while the customer base has, monitoring rules never tuned after go-live, and escalations that overrun the filing clock.

Evidence for the file: a change log linking each program change to its trigger, and dated re-approvals.

FinCEN's 2026 program proposal: status at the time of writing

Proposed, and not yet final. FinCEN issued its proposed AML/CFT program rule on 7 April 2026, and the Federal Register published it on 10 April 2026. It replaces the July 2024 proposal, which FinCEN is withdrawing. The comment period closed on 9 June 2026; At the time of writing no final rule had been published. The proposal rests a program on four core pillars. The first is internal policies, procedures and controls, including risk assessment processes and, where applicable, ongoing CDD. Independent testing comes second, then a designated AML/CFT officer located in the United States, then ongoing employee training. The board, an equivalent governing body or appropriate senior management would approve the written program. Because risk assessment sits inside the first pillar, accounts of a "sixth pillar" misread it. Firms build to the current rule until a final one takes effect, and a risk-assessment process designed now can be made to satisfy either version. Source: Federal Register, 91 FR 18704.

AML compliance program requirements in India: where the rules differ

Indian reporting entities follow the PMLA and the PML Rules. For banks, program detail comes from the RBI (Commercial Banks – Know Your Customer) Directions, 2025; each other RBI-regulated entity class has its own Direction and paragraph numbers. References below are to the Commercial Banks Direction. The build order holds; these are the points where the detail departs from US and UK practice:

Each threshold in a program traces back to the risk assessment, and so does each risk tier and training module. With the minute recording its approval, the assessment is the document an examiner reads the rest of the file against.