Anti-Money Laundering

Its role in the system

The filter that stops the financial system from becoming a laundry for criminal, corrupt and terrorist money, or a way around sanctions. Banks and other financial firms check their clients and report suspicious transactions, the financial intelligence unit analyses those signals, and investigators and prosecutors turn them into cases and recovered assets.

Functions

1. Standards — 🌍 the FATF (Financial Action Task Force, created by the G7 in 1989) issues forty recommendations that countries write into national law, assesses those countries and maintains the grey and black lists. 🌍 MONEYVAL does the same job inside the Council of Europe.
2. Front-line monitoring — banks, payment and crypto firms, insurers, notaries, estate agents and auditors are legally required to identify their clients and the people who ultimately own them (KYC, know your customer), assess the risk and report suspicious transactions.
3. Financial intelligence (FIU) — a state unit receives those reports, combines them with other data, maps out the scheme and hands material to law enforcement (🇺🇸 FinCEN, 🇫🇷 Tracfin, 🇩🇪 the FIU at the customs administration). It exchanges information with its foreign counterparts through 🌍 the Egmont Group, more than one hundred and eighty units.
4. Sanctions — states publish lists of people, companies and whole sectors that nobody may do business with, and freeze their assets (🇺🇸 OFAC, 🇪🇺 the Council of the EU, 🇬🇧 OFSI). Financial firms screen every client and every payment against them.
5. The anti-corruption angle — investigating illicit enrichment and money laundering by public officials, checking asset declarations, freezing and recovering assets (🇪🇺 the European Public Prosecutor's Office and OLAF, 🇬🇧 the SFO, 🇺🇸 the DOJ's Money Laundering and Asset Recovery Section).
6. Ownership transparency — registers of the ultimate beneficial owners of companies. Who gets to see them is a compromise between transparency and privacy: in 2022 the EU Court of Justice struck down unrestricted public access.

What makes it special

• The front line is private — and sanctions reach across borders: financial firms do the work and carry the cost, while the state writes the rules, supervises and punishes. Fines for failure run into billions: 🇫🇷 BNP Paribas pleaded guilty in 2014 and agreed to pay eight point nine billion dollars over transactions with countries under US sanctions. That is also why US sanctions touch any settlement in dollars and European and Asian banks fear OFAC at least as much as their own regulator; since 2022 the programmes against Russia have been the largest in history, and sanctions compliance has become a profession of its own.
• The machine filters, the human decides: monitoring has long been automated, and it works in two layers. The first is hard-coded rule scenarios: transfers broken up into amounts just under the reporting threshold, money that arrives and leaves again immediately, business with higher-risk countries. The second is machine-learning scoring that looks for behaviour unusual for that particular client. A separate circuit screens sanctions lists and politically exposed persons (PEPs), with fuzzy matching of names across different transliterations. The central problem is false positives: in a Bank Policy Institute study, US banks worked through roughly sixteen million alerts in 2017, filed a little over six hundred and forty thousand suspicious activity reports, and law enforcement came back for more detail on only four per cent of those reports (the median). Clients are increasingly identified remotely (eKYC: a photo of the document, a selfie and a liveness check, so that a photograph or a video cannot be held up to the camera); 🇪🇺 the EBA has had dedicated guidelines on doing this safely since 2 October 2023. Instead of a one-off check every few years the market is moving to perpetual KYC, where the client profile is recalculated automatically as soon as register data or behaviour changes. Crypto flows are followed with blockchain analytics. The state does the mirror image — SupTech: supervisors and FIUs are moving to machine analytics themselves (a 🌍 BIS review from 2019 describes 🇳🇱 the Dutch central bank building network analysis of suspicious flows and 🇨🇦 the FIU FINTRAC building a risk-scoring model).
• Intelligence, not police — and where it borders its neighbours: an FIU does not arrest or prosecute — its product is analysis for investigators, and the client never learns that a report was filed, because warning them is a criminal offence in itself (tipping off). From there the roles split: the prudential supervisor checks whether a bank's anti-money laundering systems work at all; the FIU analyses specific money; investigators and prosecutors prove the crime in court. The three depend on each other, and a break in any one of them shows up as impunity. This is not the same thing as fraud against a consumer: AML work traces money of criminal origin, it does not protect the person who was deceived. The scale of the second is its own story — in 2024 payment fraud in the European Economic Area cost 4.2 billion euro, and eighty-five per cent of the losses on transfers fell on payers themselves, because the victim is talked into confirming the transfer with their own hands.
• The EU is centralising: 🇪🇺 AMLA, the EU Anti-Money Laundering Authority in Frankfurt, has been operating since July 2025; the single EU anti-money laundering regulation applies from July 2027; and from 2028 AMLA will directly supervise several dozen — up to forty — of the riskiest cross-border financial firms, to remove the weakest-link problem in national supervision.
• 🇨🇳 China: the financial intelligence unit sits inside the central bank: the People's Bank of China is itself the lead anti-money-laundering authority, and suspicious transaction reports are collected and analysed by its monitoring centre, CAMLMAC. The revised law passed in November 2024 and in force since 1 January 2025 requires firms to identify beneficial owners for the first time, extends the duties from banks to estate agents, lawyers, accountants and precious-metals dealers, and reaches conduct outside the country.
• 🇯🇵 Japan: the financial intelligence unit sits inside the police: JAFIC belongs neither to the finance ministry nor to the central bank but to the National Police Agency, where it has been since 2007 — so the analysis of suspicious money is produced in the same house that investigates it. The model does not make the country immune to criticism: after the 🌍 FATF assessment in 2021 Japan was placed in enhanced follow-up, and by October 2024 it had closed the gaps far enough that not a single recommendation was still rated only partially compliant.

Why it matters

When the filter fails, billions in criminal money move through ordinary banks, corruption goes unpunished, and the country risks losing access to the global financial system: foreign banks close correspondent accounts, and transfers slow down for everybody.

Links to other zones · 14

• Audit & AssuranceAuditors and forensic teams in Audit & Assurance find the traces of fraud and asset stripping, and in the 🇪🇺 EU they are themselves obliged entities under Anti-Money Laundering and report suspicious client activity.
• Banking & Credit InstitutionsAnti-Money Laundering leans on Banking & Credit Institutions: banks screen clients, monitor transactions, report to the financial intelligence unit and block sanctioned payments.
• Card networksCard networks and acquiring banks have to cut off sanctioned payments and shell merchants used to push banned transactions; Anti-Money Laundering monitoring runs around the clock in both the scheme and the acquirer.
• Corporations & Corporate FinanceAnti-Money Laundering keeps registers of the beneficial owners of companies, and sanctions lists cover firms and whole sectors, not only individuals — so sanctions compliance has become a function of its own inside Corporations & Corporate Finance.
• Crypto / CBDCThe FATF travel rule of 2019 requires sender and beneficiary data on transfers in Crypto / CBDC; exchanges run identity checks, and blockchain analytics helps Anti-Money Laundering follow the money.
• Crypto / DigitalExchanges and wallet providers in Crypto / Digital are obliged entities for Anti-Money Laundering: the FATF requires sender and beneficiary data with every transfer, and sanctions lists now name individual blockchain addresses.
• Digital paymentsPayment fintechs are obliged entities for Anti-Money Laundering; fast remote onboarding makes Digital payments convenient for money mules, so their client checks are no lighter than a bank's.
• Education & CertificationAnti-Money Laundering is a certified profession with compulsory recurring training, so Education & Certification is not an extra here: the CAMS credential has to be renewed every three years, and AML statutes set a deadline for training a newly appointed responsible officer.
• Fiscal PolicyTax and customs authorities under Fiscal Policy uncover evasion, cash smuggling and laundering through faked trade prices — everyday material for Anti-Money Laundering.
• InsuranceInsurers are obliged entities too: Anti-Money Laundering requires them to identify the client and the beneficial owner, screen them against sanctions lists and report suspicious transactions.
• International transfersInternational transfers and correspondent accounts are the main field for sanctions screening; risky countries and clients are often simply cut off from the network, which Anti-Money Laundering calls de-risking.
• Real estate marketThe Real estate market is a classic laundering channel, so estate agents and notaries are also obliged under Anti-Money Laundering to identify clients and the source of their funds.
• Regulation & SupervisionRegulation & Supervision checks the quality of firms' Anti-Money Laundering systems and can fine them or withdraw the licence, and the financial intelligence unit and the supervisor exchange information about risks.
• Technology & InfrastructureAnti-money laundering is mostly software, and the Technology zone supplies it: transaction monitoring (hard-coded rule scenarios plus machine-learning scoring), sanctions and PEP screening with fuzzy matching of names across transliterations, remote identification with a liveness check (eKYC), continuously refreshed client profiles (perpetual KYC), and blockchain analytics for crypto flows. A fintech almost never builds that stack itself — it buys it as a service from RegTech vendors, while the licensed bank whose licence the service runs on stays answerable to the regulator: 🇺🇸 in August 2022 the OCC required Blue Ridge Bank to oversee anti-money laundering compliance at every fintech partner and to clear each new one in advance. The state answers in kind with SupTech: machine analytics on the supervisor's and the FIU's side.

Regulation and supervision

Careers in this zone · 7

All zones of the Atlas

• Clearing & settlement
• Exchanges & platforms
• Retail access
• Banking & Credit Institutions
• Corporations & Corporate Finance
• Development Banks
• Investment & Pension Funds
• Fiscal Policy
• Financial Market Infrastructure
• Monetary Policy
• Regulation & Supervision
• Households & Individuals
• Insurance
• Commodities market
• Crypto / Digital
• Debt market
• Derivatives
• Stock market
• FX market
• Real estate market
• Card networks
• Crypto / CBDC
• Digital payments
• Interbank systems
• International transfers
• Sovereign Wealth Funds
• State Insurance & Guarantees
• Audit & Assurance
• Consulting & Advisory
• Credit Information
• Education & Certification
• Financial Media & Data
• Ratings & Indices
• Technology & Infrastructure