What Is an AML Program and What Must It Include?

The pillars of an AML compliance program, for banks and money services businesses, and why a written policy on a shelf is not enough.

Published	14 October 2026

Every bank and money services business needs an AML program. The rules for it are part of the bank secrecy act. Here is what goes in one.

What an AML program is

An AML program is more than a written policy. An institution builds it to detect and report laundering.

For money services businesses, § 1022.210 requires each one to develop, implement, and maintain an effective anti-money laundering program. In short, each business must write the program, put it to work, and keep it going. The rule says an effective program is built to stop money laundering and terrorist financing. It keeps the business from being used for those crimes. Those are three different jobs. Writing it down is just the first.

The program must also be approved from the top. FinCEN's guidance says the AML program must be approved by the owner of the financial institution or the owner's representative.

Who is required to have an AML program

Banks come first. The FFIEC manual says banks must establish and maintain procedures reasonably designed to assure and monitor compliance with BSA regulatory requirements. That duty is the core of BSA anti money laundering work for banks.

Money services businesses have their own rule. FinCEN's guidance says the BSA requires MSBs to develop, implement, and maintain an effective written anti-money laundering program.

The program pillars

The FFIEC manual sets out what a bank's BSA/AML compliance program must provide. It names these parts.

First, the program must provide a system of internal controls to assure ongoing compliance. The manual says watching for suspicious activity is a key internal control. Reporting it is also a key internal control. This is where the bank spots activity and files reports.

Second, the program must be tested independently. That can be bank staff or an outside firm.

Third, the program must name a person to watch day-to-day compliance. Someone owns the program by name.

Fourth comes a customer identification program. Its steps are based on risk. The manual says these procedures are risk-based.

The MSB rule has its own list. § 1022.210 says the program must incorporate policies, procedures, and internal controls reasonably designed to assure compliance with the chapter. It says the program must designate a person to assure day to day compliance with the program and the chapter. And it says the program must train the right staff. That training covers how to spot suspicious transactions.

Why written policies alone are not enough

The FFIEC manual is blunt here. It says written policies, procedures, and processes alone are not enough. A good program needs more. A program that exists on paper and nowhere else fails the test.

The manual also says the program should match the bank's own risks. These include money laundering and terrorist financing risks. A program copied from another firm will not fit. FinCEN's guidance says MSBs should structure their AML programs to be risk-based.

How the risk assessment connects to the program

The risk assessment is what tells the program where to look. The FFIEC manual says a bank's BSA/AML risk assessment should give a full analysis of its money laundering and terrorist financing risks.

That analysis is not a private document. The manual says the BSA/AML risk assessment should go to all business lines, the board, management, and the right staff. People who see customers every day need to know what the risks are.

There is no fixed checklist of risk categories. The manual says there are no required risk categories. Their number and detail vary. They depend on a bank's size, complexity, and structure. A small bank and a large one will not write the same assessment. The AML risk assessment ties the program to the firm's own risk.

Training and reviews: keeping the program alive

Training is a pillar, not a favor. For money services businesses, § 1022.210 says the program must provide education and training of appropriate personnel, including training in detecting suspicious transactions. A teller who has never been taught what to look for cannot look for it.

Independent testing keeps the program honest. The FFIEC manual says the program must provide independent testing for compliance. The testing can be conducted by bank personnel or an outside party.

Under all of it sits culture. FinCEN's guidance says the BSA framework expects financial institutions to operate under a culture of compliance supported by senior leadership. A program survives when the people at the top want it to.

What examiners look for

Examiners do not start with the binder. The FFIEC manual says examiners must understand a bank's money laundering and terrorist financing risks to evaluate its BSA/AML compliance program.

What they find has a formal home. The manual says exam findings must go in the report of examination or supervisory correspondence.

Money services businesses are examined too. § 1022.320 says money services businesses shall be examined by FinCEN or its delegatees for compliance with the section.