AML and sanctions compliance are two separate legal regimes that most financial institutions run through one program: anti-money laundering rules require you to detect and report suspicious activity, while sanctions rules require you to block transactions with prohibited people, entities, and jurisdictions. The laws, the agencies, and the underlying questions are different. AML asks where the money came from. Sanctions ask who the money is going to. In day-to-day operations — customer onboarding, payment screening, monitoring, recordkeeping — the two converge, which is why firms build a single financial-crime program that satisfies both.
What an AML Program Must Include
The Bank Secrecy Act, enacted in 1970 and codified at 31 U.S.C. § 5311 et seq., is the primary U.S. anti-money laundering statute.1FDIC. Bank Secrecy Act/Anti-Money Laundering The USA PATRIOT Act expanded it after September 11, 2001, adding customer identification program requirements, information-sharing provisions under Sections 314(a) and 314(b), and enhanced due diligence obligations.2OCC. BSA and Related Regulations The Financial Crimes Enforcement Network (FinCEN), a Treasury bureau, writes and enforces the implementing regulations.3NCUA. Bank Secrecy Act Resources
Every covered institution has to maintain a written AML program with four required components: internal controls, a designated compliance officer, ongoing employee training tailored to the institution’s risks, and independent testing by a qualified party.4FinCEN. AML/CFT Program NPRM Fact Sheet
Around those pillars sit the operational duties. Institutions must run a customer identification program, perform customer due diligence to build a risk profile for each relationship, and file Suspicious Activity Reports (SARs) when they detect transactions that may involve criminal activity. Currency Transaction Reports (CTRs) are required for cash transactions exceeding $10,000. FinCEN has emphasized that the program only works with a genuine “culture of compliance” — leadership backing, resources, and independence from the revenue-generating side of the house.5FinCEN. Advisory FIN-2014-A007
What Sanctions Compliance Requires
U.S. sanctions are administered by the Office of Foreign Assets Control (OFAC), also part of Treasury. Sanctions law is legally distinct from the BSA. The Commodity Futures Trading Commission has stated that OFAC compliance is “not a required component of an AML Program,” even though every U.S. person is independently obligated to comply with the sanctions regulations at 31 CFR Chapter V.6CFTC. Anti-Money Laundering – Sanctions Programs
OFAC runs country-based programs, which impose comprehensive restrictions on transactions with specific jurisdictions, and list-based programs, which target named individuals, entities, and vessels. The central list is the Specially Designated Nationals and Blocked Persons (SDN) list. U.S. persons must block the assets of anyone on the list and generally cannot transact with them.7OFAC. Sanctions FAQs Several other lists — including the Sectoral Sanctions Identifications List and the Foreign Sanctions Evaders List — are pulled together in a searchable consolidated database.8OFAC. Sanctions List Search Tool
One rule catches firms that screen only against the named lists. Under OFAC’s “50 percent rule,” any entity owned 50 percent or more, individually or in the aggregate, by one or more blocked persons is itself blocked even if it never appears on the SDN list by name. Blocked property must be reported to OFAC within 10 business days. Violations can carry civil or criminal penalties, and OFAC treats voluntary self-disclosure as a mitigating factor.7OFAC. Sanctions FAQs
OFAC’s May 2019 Framework for OFAC Compliance Commitments spells out five elements it expects in an effective sanctions program: management commitment, risk assessment, internal controls, testing and auditing, and training.9OFAC. A Framework for OFAC Compliance Commitments The pillars look similar to the AML ones, but the purpose differs: stopping transactions from reaching prohibited parties in the first place, rather than detecting suspicious patterns after they occur.
How the Two Regimes Differ
AML concerns the source and nature of funds — whether money is derived from crime. Sanctions concerns the destination and identity of the parties — whether a payment reaches a prohibited person, entity, or place. Funds involved in a sanctions breach can be entirely legitimate in origin.10ICAEW. Sanctions
Sanctions can also carry strict liability. An institution can be penalized for dealing with a listed target even without knowledge of the target’s status.10ICAEW. Sanctions That risk profile changes how firms design controls: screening has to be preventive, not merely detective.
Reporting does not cross over. Filing a SAR with FinCEN does not satisfy the separate obligation to report a blocked transaction to OFAC, and reporting to OFAC does not remove the need to file a SAR when suspicious activity is present.10ICAEW. Sanctions FINRA groups “Anti-Money Laundering, Fraud and Sanctions” as a single area in its annual regulatory oversight reports, reflecting the expectation that firms treat these as connected components of one financial-crime program.11FINRA. Anti-Money Laundering
Screening in Practice
Sanctions screening is the operational core where both regimes meet. It runs at three points in a relationship.
- At onboarding, firms collect identifying information and screen it against sanctions lists, Politically Exposed Person (PEP) databases, and adverse media. Matches can trigger enhanced due diligence or rejection.
- Before a payment is processed, firms check whether the sending or receiving parties appear on restricted lists. Confirmed matches result in blocking or rejecting the transaction.
- On an ongoing basis, firms re-screen existing customers as lists change. OFAC updates its programs daily, and the agency has stated that screening only at extended intervals such as every 30 days is insufficient.12OFAC. Civil Penalties and Enforcement Information
The persistent operational problem is false positives — alerts triggered by partial name matches, transliteration differences, or common names that turn out not to be sanctioned parties. Modern screening tools use fuzzy matching, machine learning, and AI-based triage to reduce false-positive volume while keeping coverage. OFAC’s own search tool applies approximate string matching with a user-defined confidence threshold, and the agency has cautioned that its tool is not a substitute for broader due diligence.13OFAC. Sanctions List Search
Who Is Now Covered
The perimeter of covered institutions keeps expanding, and several recent changes affect which firms must build programs at all.
Investment Advisers
In August 2024, FinCEN issued a final rule designating registered investment advisers and exempt reporting advisers as financial institutions under the BSA. Covered advisers must implement AML/CFT programs, file SARs, and meet recordkeeping, information-sharing, and currency reporting obligations. The rule followed a Treasury risk assessment documenting exploitation of the advisory industry by sanctioned persons and foreign adversaries.14FinCEN. Investment Adviser Final Rule Fact Sheet The compliance deadline, originally January 1, 2026, was postponed to January 1, 2028, by a final rule issued December 31, 2025.15FinCEN. FinCEN Issues Final Rule to Postpone Effective Date of Investment Adviser Rule to 2028
Cryptocurrency and Stablecoin Issuers
Crypto exchanges and virtual asset service providers (VASPs) are subject to AML and sanctions rules under both U.S. law and FATF Recommendation 15, which was updated in 2019 to require VASP licensing or registration, customer due diligence, recordkeeping, suspicious transaction reporting, and the “travel rule” for transmitting originator and beneficiary information.16FATF. Virtual Assets
The GENIUS Act, signed into law on July 18, 2025, formally designated permitted payment stablecoin issuers (PPSIs) as financial institutions under the BSA. PPSIs must maintain AML programs, file SARs, hold the technical capability to block and freeze impermissible transactions, and comply with OFAC requirements.17Federal Register. GENIUS Act Implementation In April 2026, FinCEN and OFAC issued a joint proposed rulemaking to detail the specific AML/CFT and sanctions program requirements for these issuers.18U.S. Department of the Treasury. Treasury Press Release on GENIUS Act NPRM
The Corporate Transparency Act Boundary
One area readers often assume falls under current AML obligations no longer does for most companies. The Corporate Transparency Act, enacted as part of the Anti-Money Laundering Act of 2020, originally required most U.S. corporations and LLCs to report beneficial owners to FinCEN starting January 1, 2024.19FinCEN. FinCEN Issues Final Rule Regarding Access to Beneficial Ownership Information Treasury suspended enforcement in March 2025, and an interim final rule effective March 26, 2025, removed the reporting obligation for domestic companies and U.S. persons. Only foreign companies registered to do business in the United States are currently required to file beneficial ownership reports.20FinCEN. FinCEN Removes Beneficial Ownership Reporting Requirements for US Companies and US Persons
What Enforcement Looks Like
Penalties for AML and sanctions failures have reached historic levels, and recent cases show what draws regulatory attention.
TD Bank
On October 10, 2024, federal agencies collectively imposed over $3 billion in penalties on TD Bank for systemic AML failures — the largest BSA enforcement action in U.S. history. FinCEN alone assessed a record $1.3 billion penalty, the Department of Justice added $1.8 billion in criminal fines, the Office of the Comptroller of the Currency imposed $450 million, and the Federal Reserve Board added $123.5 million.21FinCEN. FinCEN Assesses Record $1.3 Billion Penalty Against TD Bank
TD Bank pled guilty to conspiracy to fail to maintain an adequate AML program and to filing inaccurate currency transaction reports. Approximately 80 percent of the bank’s transaction volume — trillions of dollars — went unmonitored, more than five million customer accounts were never assessed for compliance risk, and at least $670 million in suspicious funds moved undetected or unreported. The bank processed over $400 million in transactions for a convicted money launderer between 2017 and 2021 despite obvious red flags, and failed to detect an employee who accepted bribes to launder narcotics proceeds.21FinCEN. FinCEN Assesses Record $1.3 Billion Penalty Against TD Bank The resolution imposed a four-year independent monitorship and an OCC prohibition on opening new branches or growing U.S. assets without regulatory permission.22FinCEN. FinCEN TD Bank Consent Order
Huione Group
In May 2025, FinCEN designated Cambodia-based Huione Group as a financial institution of primary money laundering concern under Section 311 of the USA PATRIOT Act. A final rule issued in October 2025 severed the group from the U.S. financial system. FinCEN found Huione had processed at least $4 billion in illicit proceeds between August 2021 and January 2025, including funds from North Korean cyber heists and “pig butchering” investment scams.23FinCEN. FinCEN Finds Cambodia-Based Huione Group To Be of Primary Money Laundering Concern The agency found the group had “no meaningful AML/KYC program.”24Federal Register. Imposition of Special Measure Regarding Huione Group
Recent OFAC Settlements
OFAC settled with TradeStation Securities in 2026 for $1.1 million over 481 apparent violations involving brokerage services to persons located in Iran, Syria, and Crimea between June 2021 and June 2022. The violations were voluntarily self-disclosed and classified as non-egregious.25OFAC. TradeStation Securities Settlement Other 2026 settlements included a $3.77 million individual settlement and a $1.72 million settlement with IMG Academy.12OFAC. Civil Penalties and Enforcement Information An earlier case in October 2022 saw OFAC settle with a cryptocurrency firm for over $24 million for sanctions violations.26EY. AML Sanctions Compliance for Crypto Firms
What Is Changing Next
On April 10, 2026, FinCEN proposed a rule to modernize AML/CFT program requirements across all covered institutions — banks, broker-dealers, casinos, money services businesses, insurers, and others. The rule would require programs to be “effective, risk-based, and reasonably designed” and would mandate that firms incorporate FinCEN’s national AML/CFT Priorities, first published in June 2021 under the Anti-Money Laundering Act of 2020, into their risk assessments.27Federal Register. Anti-Money Laundering and Countering the Financing of Terrorism Programs The comment period closes June 9, 2026.28FinCEN. AML/CFT Program NPRM Fact Sheet
FinCEN has also been issuing advisories on emerging threats, including Chinese money laundering networks used by Mexican cartels, Iranian oil smuggling and shadow banking, and financing of ISIS affiliates. A February 2026 bulletin announced that FinCEN is accepting whistleblower tips on fraud-related AML and sanctions violations under the expanded whistleblower program established by the Anti-Money Laundering Act of 2020, which can award up to 30 percent of sanctions exceeding $1 million.29FinCEN. Advisories, Bulletins, and Fact Sheets
Firms doing business in Europe face a parallel shift. The EU’s Anti-Money Laundering Authority (AMLA), based in Frankfurt, took over AML and counter-terrorist financing mandates from the European Banking Authority in January 2026 and is building toward direct supervision of 40 high-risk EU financial institutions starting in 2028.30Freshfields. Unveiling AMLA’s Blueprint AMLA can impose fines of up to 10 percent of annual turnover or 10 million euros, whichever is higher. The EU’s Anti-Money Laundering Regulation takes direct effect across all member states on July 10, 2027, and expands covered entities to include crypto-asset service providers, luxury goods traders, professional football clubs, and real estate professionals.31Norton Rose Fulbright. Harmonisation of European Money Laundering Prevention