The anti-money laundering process at a U.S. bank is a layered compliance workflow that runs from the moment you apply for an account through every transaction you make afterward. The AML banking process has five working parts: identifying who you are, screening you against sanctions lists, reporting large cash transactions, monitoring your activity for suspicious patterns, and filing confidential reports to the government when something looks wrong. Most of it happens without your knowledge, and some of it the bank is legally forbidden from discussing with you. Understanding how the process works explains why banks ask the questions they ask, why certain transactions trigger paperwork, and why an account can be closed without a clear reason.
The Framework Every Bank Operates Under
Federal law requires every bank to maintain a formal anti-money laundering program with specific components: internal policies and controls, a designated compliance officer, ongoing employee training, and an independent audit function that tests whether the program actually works.1Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority A fifth requirement was added by regulation in 2018: risk-based procedures for ongoing customer due diligence, including understanding the nature and purpose of each customer relationship and updating that information when circumstances change.2Federal Register. Customer Due Diligence Requirements for Financial Institutions
Everything that follows in the AML process grows out of this framework. The compliance officer is accountable when something goes wrong. The training ensures tellers and loan officers can spot problems in the moment. The audit catches gaps before examiners do. For you as a customer, these pieces are invisible, but they shape how the bank treats your account from the first application forward.
What Happens When You Open an Account
The first checkpoint is the Customer Identification Program, often called “Know Your Customer.” Before a bank can open your account, federal regulations require it to collect your full legal name, date of birth, a residential or business street address, and an identification number. For U.S. persons, that number is a taxpayer identification number such as a Social Security Number. For non-U.S. persons, a passport number, alien identification card number, or another government-issued document number works.3eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
The bank verifies this information through risk-based procedures designed to form a reasonable belief that it knows who you actually are. In practice, that usually means presenting a government-issued photo ID. Some institutions also request secondary documentation, such as a recent utility bill or lease, to confirm your address. These can usually be submitted in person at a branch or through a secure digital portal.
Behind the scenes, the bank screens your name and identifying details against the sanctions lists maintained by the Treasury Department’s Office of Foreign Assets Control. OFAC’s Sanctions List Search tool checks the Specially Designated Nationals list and several other consolidated lists for individuals and entities prohibited from accessing the U.S. financial system.4Office of Foreign Assets Control. Sanctions List Search Tool Federal examiners expect banks to run this check before an account opens or immediately afterward, with procedures to block transactions until screening is complete.5Federal Financial Institutions Examination Council. BSA/AML Manual – Office of Foreign Assets Control A possible match does not automatically mean the account gets denied. It means the bank has to investigate, and if the match is confirmed, freeze the assets and report to OFAC.
If the account is for a corporation, LLC, or other legal entity, the bank also has to identify the beneficial owners: each individual who directly or indirectly holds 25 percent or more of the equity, plus at least one person with significant control over the entity’s management.2Federal Register. Customer Due Diligence Requirements for Financial Institutions That is why business account applications ask for personal information about owners and officers. The requirement exists to keep shell companies from being used to hide who actually controls the money.
Cash Transactions Over $10,000
Any time you conduct a cash transaction over $10,000 at a bank, the bank must file a Currency Transaction Report with FinCEN. This covers deposits, withdrawals, currency exchanges, and any other payment or transfer involving physical currency.6eCFR. 31 CFR 1010.311 – Filing Obligations The report goes on FinCEN Form 112, and the bank has 15 calendar days from the transaction date to file it.
The CTR is automatic and does not mean you are suspected of anything. A contractor depositing $12,000 in cash receipts, someone cashing in savings bonds, or a buyer withdrawing cash for a private vehicle purchase will all trigger one. The bank cannot refuse to process the transaction just because a report is required, and the filing does not affect your account standing.
Where this gets people in real trouble is aggregation. If you make several cash transactions at the same bank in a single business day and they total more than $10,000, the bank must treat them as one reportable transaction. Breaking a $15,000 cash deposit into two $7,500 deposits on the same day to avoid the report does not work, and it is a separate federal crime called structuring. The statute carries penalties of up to five years in prison, or up to ten years when connected to other criminal activity.7Office of the Law Revision Counsel. 31 US Code 5324 – Structuring Transactions to Evade Reporting Requirement Prohibited A common misconception is that structuring is only a crime when the underlying money is dirty. It is not. The crime is the deliberate act of evading the reporting requirement, regardless of where the cash came from.
How Your Transactions Get Monitored
Once your account is active, automated monitoring software tracks every deposit, withdrawal, and transfer against a baseline of normal behavior for your account. When a transaction deviates significantly, the system generates an alert for a human investigator to review. A mid-size bank processes millions of transactions a day, and this is the only practical way to find the handful that warrant a closer look.
The patterns that consistently draw scrutiny include:
- Structuring, meaning cash transactions broken up to stay under the $10,000 CTR threshold.
- Rapid pass-through activity, where large sums enter an account and are immediately wired out, especially if the account has no history of that kind of volume.
- Unusual international wires, particularly a sudden spike in high-value transfers to jurisdictions known for weak anti-money laundering controls when the account holder has no apparent business reason for them.
- Mismatched account behavior, such as a personal checking account that starts receiving deposits from many unrelated parties followed by rapid outflows.
Investigators evaluating these alerts look for a clear economic purpose behind the activity. A small business owner whose deposits spike in December has an obvious explanation. A personal account receiving dozens of cash deposits from different geographic locations in the same week does not. The absence of a plausible explanation is what turns an alert into an investigation.
Higher-Risk Customers and Ongoing Review
Some customers get a more intensive review from the start because the nature of their finances or their professional status creates elevated risk. Politically exposed persons, meaning individuals who hold or have recently held prominent government positions, draw this scrutiny because their roles may expose them to bribery and corruption. Cash-intensive businesses like laundromats, restaurants, and convenience stores also fall into the high-risk category because cash revenue is harder to trace than electronic payments.
Enhanced due diligence goes beyond confirming identity. The bank looks at the customer’s source of wealth and source of funds, seeking documentation that the money came from lawful activity. That might mean tax returns, financial statements, or contracts that explain how the customer accumulated their capital.
This is not a one-time check. The 2018 Customer Due Diligence Rule requires banks to monitor on an ongoing basis and update customer information on a risk basis. The regulation does not impose a fixed schedule. Instead, the updating requirement is event-driven, triggered when monitoring reveals information inconsistent with the customer’s existing risk profile.2Federal Register. Customer Due Diligence Requirements for Financial Institutions Many banks still run periodic reviews on a set calendar for their highest-risk accounts, but the regulation itself only demands an update when circumstances change.
When the Bank Files a Suspicious Activity Report
When a bank’s investigation concludes that a transaction or pattern of activity has no apparent lawful purpose, the bank must file a Suspicious Activity Report with FinCEN. The deadline is 30 calendar days from the date the bank first detects the suspicious activity. If no suspect has been identified by that date, the bank gets an additional 30 days to try to identify one, but filing cannot be delayed beyond 60 calendar days from initial detection.8Federal Reserve. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions Situations involving ongoing criminal activity require the bank to notify law enforcement by phone immediately in addition to filing the report.
The SAR includes a narrative section where the compliance officer explains what the bank observed and why it looked suspicious. The report goes to FinCEN electronically, and the bank keeps a copy with all supporting documentation for five years.8Federal Reserve. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions These reports feed a database that federal law enforcement and intelligence agencies use to build cases.
Why the Bank Will Never Tell You
Federal law prohibits the bank and all of its employees from telling you that a SAR has been filed on your account. No one at the institution, whether a director, officer, teller, or former employee, may notify any person involved in the reported transaction that it has been reported, or reveal any information that would disclose the existence of the report.9Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority The same prohibition applies to current and former government employees who learn of the filing. The purpose is to keep suspects from destroying evidence, moving money, or fleeing before law enforcement can act.
Banks and their employees are also shielded from civil liability for filing a SAR. The statute protects any financial institution that discloses a possible violation, along with any director, officer, or employee involved in the disclosure, from being sued under any federal or state law, regulation, or contract for making the report or for failing to notify the subject.9Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority Courts have interpreted this safe harbor broadly, so a customer generally cannot sue a bank for filing a SAR even if the report turns out to be unfounded.
When an Account Gets Closed for AML Reasons
One outcome that catches customers off guard is having an account closed because the bank decided the AML risk was too high. The Treasury Department calls this “de-risking” and defines it as financial institutions terminating or restricting business relationships rather than managing the underlying risk on a case-by-case basis.10U.S. Department of the Treasury. The Department of the Treasury’s De-risking Strategy Treasury has publicly stated that broad, indiscriminate de-risking is inconsistent with the risk-based approach the AML framework is built on.
In practice, banks weigh the cost of enhanced monitoring against the revenue a customer generates, and the math often favors closing the account. The factors driving these decisions include the cost of additional AML compliance measures, the perceived risk of regulatory fines, reputational concerns, and the bank’s overall risk appetite.10U.S. Department of the Treasury. The Department of the Treasury’s De-risking Strategy If a SAR has been filed on your account, the bank cannot tell you that was the reason, because doing so would violate the anti-tipping rule. You may receive a generic notice that the bank is ending the relationship, with no further explanation.
De-risking disproportionately affects certain categories of customers: money service businesses, nonprofits operating in high-risk regions, and foreign correspondent banking relationships. If your account is closed for AML reasons, the bank typically gives a notice period to move your funds, but there is no federal rule guaranteeing a specific timeframe or requiring the bank to help you find another institution. The practical protection is keeping clear documentation of your income sources and business activities, so that you can answer a bank’s due diligence questions quickly and in writing when they come.