Anti-money laundering, usually shortened to AML, is the body of federal law and bank procedure built to stop criminals from moving illegal profits into the normal financial system. The rules sit on top of the Bank Secrecy Act and require banks, credit unions, money transmitters, casinos, broker-dealers, and a long list of other businesses to verify who their customers are, watch how money moves through their accounts, and report certain transactions to the government. For an ordinary customer, that is why opening an account involves an ID check and why a large cash deposit generates paperwork even when nothing is wrong.
How Money Laundering Actually Works
Every AML rule you encounter traces back to one of three stages criminals use to clean money.
The first is placement, where physical cash from illegal activity has to enter a regulated account. This is the riskiest step for the launderer because large amounts of currency must physically cross a bank counter, so the money is often broken into smaller deposits spread across accounts and branches.
The second is layering. Once the cash is inside the system, the goal is to put distance between the funds and their source through transfers, shell companies, foreign accounts, and transactions designed to look routine.
The third is integration. The money reappears as something that looks legitimate: a property purchase, a business investment, income from a front company. By this point, without the paper trail AML reporting creates earlier, the funds are hard to distinguish from lawful wealth.
Which Businesses Have to Follow AML Rules
Federal law casts an intentionally wide net. The Bank Secrecy Act defines “financial institution” to cover more than two dozen categories of business, many unrelated to traditional banking.1Office of the Law Revision Counsel. 31 U.S. Code 5312 – Definitions and Application Covered businesses include:
- Banks, credit unions, trust companies, thrifts, and U.S. branches of foreign banks
- SEC-registered broker-dealers, investment bankers, and investment companies
- Money service businesses, including currency exchanges, money transmitters, issuers of money orders and traveler’s checks, and the U.S. Postal Service
- Licensed casinos with annual gaming revenue above $1 million
- Insurance companies and loan companies
- Dealers in precious metals, stones, or jewels, and pawnbrokers
- Dealers in automobiles, airplanes, and boats
- Persons involved in real estate closings and settlements
The statute also lets the Treasury Secretary add any other business whose cash transactions are useful for criminal, tax, or regulatory investigations.1Office of the Law Revision Counsel. 31 U.S. Code 5312 – Definitions and Application That open-ended authority is how AML coverage expands as laundering techniques change.
What You’ll Be Asked for When You Open an Account
Section 326 of the USA PATRIOT Act requires every covered institution to run a Customer Identification Program that verifies the identity of each person opening an account.2Financial Crimes Enforcement Network. Interagency Interpretive Guidance on Customer Identification Program Requirements under Section 326 of the USA PATRIOT Act At a minimum, the bank has to collect:
- Your full legal name
- Your date of birth
- A residential or business address — a P.O. box alone does not qualify, because the institution needs a physical location where you can be found2Financial Crimes Enforcement Network. Interagency Interpretive Guidance on Customer Identification Program Requirements under Section 326 of the USA PATRIOT Act
- Your taxpayer identification number, which for most U.S. individuals is a Social Security Number
In practice you will also be asked for a government-issued photo ID such as a driver’s license or passport. Federal guidance describes these as “primary sources of identification” that banks are expected to obtain from most customers.2Financial Crimes Enforcement Network. Interagency Interpretive Guidance on Customer Identification Program Requirements under Section 326 of the USA PATRIOT Act The institution must also check your name against government lists of known or suspected terrorists.3Federal Register. Customer Identification Programs, Anti-Money Laundering Programs, and Beneficial Ownership Requirements for Banks Lacking a Federal Functional Regulator
If you are opening an account in the name of a company, the bank will also ask for the names of any individual who owns 25 percent or more of the entity, plus one person with significant management control.4Federal Register. Customer Due Diligence Requirements for Financial Institutions That beneficial ownership rule exists because shell companies are a favorite layering tool.
The Two Reports Banks File About Customer Transactions
Two mandatory reports do most of the work in AML enforcement. Both are filed electronically through FinCEN’s BSA E-Filing System.5Financial Crimes Enforcement Network. Mandatory E-Filing FAQs
Currency Transaction Reports
A Currency Transaction Report, or CTR, is triggered any time a customer conducts a cash transaction — deposit, withdrawal, exchange, or transfer — that exceeds $10,000 in a single business day. The $10,000 figure is set by regulation under authority delegated to the Treasury Secretary.6Office of the Law Revision Counsel. 31 U.S. Code 5313 – Reports on Domestic Coins and Currency Transactions A CTR is not an accusation. It is an automatic filing based purely on the dollar amount, and the institution has 15 calendar days from the transaction to file it.7Financial Crimes Enforcement Network. Frequently Asked Questions Regarding the FinCEN Currency Transaction Report (CTR)
Suspicious Activity Reports
A Suspicious Activity Report, or SAR, is triggered by behavior rather than a dollar amount alone. A bank must file a SAR when a transaction involves at least $5,000 and the bank suspects the funds are connected to illegal activity, are designed to evade reporting requirements, or have no apparent lawful purpose. Money service businesses face a lower threshold of $2,000.8Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions The institution has 30 calendar days from when it first detects the suspicious facts to file. If no suspect can be identified in that window, it gets an additional 30 days, but filing cannot be delayed more than 60 days from initial detection.9GovInfo. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
Records tied to these filings must be kept for five years.10eCFR. 31 CFR 1010.430 – Nature of Records and Retention Period Customers are not notified when a SAR is filed on their account.
Why Splitting Up Cash Deposits Is Itself a Crime
The most common way people try to avoid a CTR is by breaking a large cash amount into smaller deposits that each fall below $10,000. Federal law calls this “structuring,” and it is a crime even when the underlying money is completely legitimate. Under the BSA, you cannot structure or attempt to structure any transaction for the purpose of evading a reporting requirement, and you cannot cause a bank to file an inaccurate report or fail to file one at all.11FFIEC BSA/AML Manual. Appendix G – Structuring
This is where people get into serious trouble without realizing it. A business owner who deposits $8,000 on Monday and $7,000 on Wednesday to “avoid the paperwork” has committed a federal offense, even if the cash was lawful income. Bank staff are trained to recognize those patterns, and the deposits themselves generate SARs flagging the exact behavior the depositor was trying to hide.
New Residential Real Estate Reporting in 2026
Real estate has long been an integration tool. Criminals use shell companies to buy property with illicit cash, converting dirty money into a tangible, appreciating asset. Beginning March 1, 2026, FinCEN requires certain real estate professionals involved in closings and settlements to report information on non-financed transfers of residential property.12FinCEN. Quick Reference Guide Residential Real Estate Reporting A transfer triggers reporting when all four of these conditions are met:
- The property is residential.
- The transfer is non-financed, meaning no loan secured by the property was extended by a financial institution already subject to AML and SAR obligations.
- The property is transferred to a certain type of entity or trust rather than an individual buying in their own name.
- No regulatory exemption applies.
The filing deadline is the later of the last day of the month after closing or 30 calendar days after the closing date.12FinCEN. Quick Reference Guide Residential Real Estate Reporting The rule is aimed at all-cash purchases by entities because those deals bypass the bank underwriting where AML checks would normally happen.
Penalties for Money Laundering
Federal law separates two different kinds of offense: the crime of laundering money, and the separate offense of failing to follow BSA reporting rules. The penalties for actual laundering are much heavier.
Under 18 U.S.C. 1956, anyone who conducts a financial transaction knowing the funds represent proceeds of illegal activity faces up to 20 years in federal prison and a fine of up to $500,000 or twice the value of the property involved, whichever is greater.13Office of the Law Revision Counsel. 18 U.S. Code 1956 – Laundering of Monetary Instruments The same penalties reach anyone who transports funds across U.S. borders as part of a laundering scheme.
A related statute, 18 U.S.C. 1957, covers monetary transactions above $10,000 using funds derived from illegal activity. Maximum prison time is 10 years, with a fine of up to twice the criminally derived property involved.14Office of the Law Revision Counsel. 18 U.S. Code 1957 – Engaging in Monetary Transactions in Property Derived from Specified Unlawful Activity The key difference is that Section 1957 does not require prosecutors to prove you intended to conceal the money’s source, only that you knowingly used it.
On top of prison and fines, the government can seize any property involved in or traceable to a money laundering violation through civil forfeiture.15Office of the Law Revision Counsel. 18 U.S. Code 981 – Civil Forfeiture That includes real estate, vehicles, bank accounts, and business assets.
Penalties for Reporting and Compliance Failures
Banks and their employees face a separate track of penalties for failing to meet BSA reporting and recordkeeping obligations, even when no underlying crime is being laundered.
Civil penalties scale with intent. A negligent violation carries a fine of up to $500. A willful violation jumps to as much as $25,000 or the amount of the transaction, capped at $100,000, whichever is greater. Violations of certain enhanced due diligence rules or special measures can reach up to $1 million or twice the transaction amount, and these figures are subject to inflation adjustments.16Office of the Law Revision Counsel. 31 U.S. Code 5321 – Civil Penalties In practice, enforcement actions against banks regularly reach into the millions because a single breakdown can involve thousands of individual violations. Regulators can also revoke a bank’s charter, and individual employees can be permanently barred from the industry.17FFIEC BSA/AML Manual. Introduction
When a compliance failure is willful rather than careless, prosecutors can bring criminal charges under 31 U.S.C. 5322. A willful violation of BSA reporting or recordkeeping rules carries a fine of up to $250,000 and up to five years in prison. If the violation happens while breaking another federal law, or as part of a pattern of illegal activity involving more than $100,000 in a 12-month period, the maximum fine doubles to $500,000 and the prison term doubles to 10 years.18Office of the Law Revision Counsel. 31 U.S. Code 5322 – Criminal Penalties The gap between the two tracks is why the willfulness question dominates nearly every BSA enforcement case.