What Is an AML Questionnaire? Contents, Uses, and Updates

An AML questionnaire is the form a bank or other regulated business asks you to complete so it can meet its anti-money-laundering obligations before opening or maintaining your account. It gathers your identity, ownership structure, business activities, funding sources, geography, and regulatory status, and the institution uses those answers to decide how risky your account looks and how closely it needs to be watched. The questionnaire is how federal Customer Due Diligence and Know Your Customer rules get applied to you in practice.¹

What the Questionnaire Asks For

The questions fall into a handful of categories. Each one is tied to a specific rule the institution has to satisfy, which is why the form can feel repetitive or intrusive even for a straightforward business.

Identity and Legal Structure

For an individual, expect to provide your name, date of birth, residential or business address, and a taxpayer identification number. Non-U.S. persons give a passport number or alien identification card number instead. For a legal entity, the address has to be a physical location (principal place of business or similar), not just a P.O. box or mailing address.²

U.S. entities give a Taxpayer Identification Number, usually the EIN.³ Foreign businesses without a U.S. tax ID submit alternative government-issued documentation that proves the business exists.² The entity section also typically asks for the full legal name, any trade names, the jurisdiction of formation, the entity type, and the date of formation.

Beneficial Owners

If the customer is a legal entity, the questionnaire has to identify its beneficial owners. The CDD Rule uses two separate prongs, and both apply at the same time.⁴

The ownership prong captures every individual who directly or indirectly holds 25 percent or more of the entity’s equity. Depending on how ownership is split, that can be anywhere from zero to four people. The control prong captures one person with significant responsibility to manage or direct the entity, with the regulation naming the CEO, CFO, COO, managing member, general partner, president, and treasurer as examples. The same person can satisfy both prongs.

For each beneficial owner, you’ll provide name, date of birth, address, and an identification number, usually accompanied by a copy of a government-issued photo ID so the institution can verify identity.⁴

Business Activities and Geography

This is where the institution starts shaping its view of your risk. Expect questions about your primary industry, the products and services you offer, your customer base, and the volume and currencies you expect to run through the account. A cash-heavy business is treated as inherently riskier than one that moves money electronically.

Geographic exposure gets its own weight. The form will ask where you operate, where your other bank accounts sit, and where senior management is based. Activity in jurisdictions the Financial Action Task Force has flagged for AML deficiencies pushes risk up, and FinCEN has advised institutions to factor FATF’s assessments into their risk-based policies.⁵ Correspondent banking relationships and complex international trade also draw a closer look.

Source of Funds and Source of Wealth

The form asks where the money is coming from on two levels. For the entity, it wants to know whether account funds come from operating revenue, a capital contribution, investment income, or something else. For beneficial owners, it asks about personal wealth, especially when the entity is new and has no operating history to explain large deposits.

Your answers set a baseline for what normal activity on the account should look like. If later transactions don’t match the picture you painted, that mismatch is exactly what compliance monitoring is designed to catch. A company that described modest domestic revenue and then receives a large wire from an unrelated foreign jurisdiction creates the kind of inconsistency that generates internal alerts.

Regulatory Status and Licensing

Expect questions about whether your entity is already regulated. Independently supervised entities often present lower risk, and some categories, including banks, government agencies, and publicly traded companies, qualify for exemptions from the beneficial ownership identification requirement.⁴

If you run a Money Services Business, you must register with the Treasury Department by filing FinCEN Form 107 within 180 days of establishment.⁶ The questionnaire will ask about MSB status and other specialized licenses, and it will ask you to disclose current or past enforcement actions, investigations, or compliance deficiencies. Those answers feed directly into your risk rating.

Sanctions and Politically Exposed Persons

Everything you provide gets screened against sanctions lists, most importantly the Office of Foreign Assets Control’s Specially Designated Nationals and Blocked Persons list. U.S. businesses may not transact with anyone on the SDN list, and institutions face enforcement for failing to catch a hit.⁷ Screening covers the entity, its beneficial owners, directors, and other associated individuals.

Some forms also ask whether any beneficial owner or senior officer is a Politically Exposed Person. The BSA doesn’t formally define the term, but the industry uses it for foreign individuals who hold or have held prominent public functions, along with their immediate family and close associates.⁸ PEP status doesn’t disqualify you from an account, but it moves you into a higher-risk category and triggers deeper due diligence.

The CTA Exemption Does Not Change This

A common source of confusion: in March 2025, FinCEN issued an interim final rule exempting all domestic entities from Corporate Transparency Act beneficial ownership reporting, leaving only foreign entities registered to do business in the United States subject to that filing.⁹ That change applies to what you file directly with FinCEN. It does not touch the separate CDD Rule that requires banks to collect beneficial ownership information from you at account opening.¹ Your bank will still ask, whether or not you file a BOI report.

What the Bank Does With Your Answers

Once the completed questionnaire is in, your answers run through a risk-scoring model. Different data points carry different weights. A domestic business with one identifiable owner in a low-risk industry scores very differently from a multi-layered holding structure with beneficial owners in FATF-flagged jurisdictions. You end up assigned to a tier, typically low, medium, or high.

That tier controls how closely the account is watched. Low-risk clients get standard transaction monitoring. High-risk clients get Enhanced Due Diligence, which can mean a request for audited financial statements, a detailed business plan, or documentation showing the source of a specific large transaction. Cash-intensive businesses, PEP-connected clients, and entities operating in sanctioned or high-risk geographies almost always land in EDD.

The tier also sets how sensitive automated monitoring is. On a high-risk account, smaller or less unusual transactions can generate alerts, and anything inconsistent with the profile you described can prompt a Suspicious Activity Report to FinCEN.

Updates After the Account Is Open

Submitting the questionnaire once isn’t the end of it. The CDD Rule requires ongoing monitoring and, on a risk basis, keeping customer information current.¹ Federal rules don’t dictate a specific review schedule, and institutions set risk-based periodic review cycles themselves.¹⁰ In practice, most institutions review high-risk clients annually and lower-risk clients every two to three years.

Certain events trigger a refresh regardless of the schedule: a change in beneficial ownership, expansion into a new country, a notable shift in transaction patterns, or a hit on a sanctions or negative-news screen. All AML records, including completed questionnaires, CIP verification materials, and beneficial ownership certifications, must be retained for five years and be accessible within a reasonable period.¹¹ That retention window is also why your bank sometimes asks for documents it seems to have had before: older records may have aged out.

If You Refuse or Give False Answers

The direct BSA penalties fall on the institution, not usually on the customer, but the practical consequences on your side are real. A bank is not required to do business with anyone, and a client who won’t complete basic due diligence is a risk no compliance department will accept. Refuse the questionnaire and the account either doesn’t open or gets closed.

Providing materially false information is a different problem. Depending on the circumstances, it can expose you to liability for fraud or for aiding and abetting a BSA violation. Delays, inconsistencies, or outdated answers during a periodic review can also trigger account restrictions, frozen transactions, or termination of the banking relationship. Keeping the information current and accurate is the straightforward path through.

1
FinCEN. Information on Complying with the Customer Due Diligence (CDD) Final Rule
2
eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
3
Internal Revenue Service. U.S. Taxpayer Identification Number Requirement
4
eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers
5
Financial Crimes Enforcement Network. Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering, Combating the Financing of Terrorism, and Counter-Proliferation Finance Deficiencies
6
Financial Crimes Enforcement Network. Money Services Business (MSB) Registration
7
U.S. Department of the Treasury. Starting an OFAC Compliance Program
8
FFIEC BSA/AML InfoBase. Risks Associated with Money Laundering and Terrorist Financing – Politically Exposed Persons
9
Financial Crimes Enforcement Network. FinCEN Removes Beneficial Ownership Reporting Requirements for U.S. Companies and U.S. Persons
10
FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements
11
eCFR. 31 CFR 1010.430 – Nature of Records and Retention Period