United States AML/CFT Framework: A Reference Guide

The United States anti-money-laundering (AML) and countering-the-financing-of-terrorism (CFT) regime is built on the Bank Secrecy Act (BSA) as its umbrella statute, layered over decades of subsequent legislation. In practice, US obligations fall into two stacked duties: a BSA "program" duty administered by FinCEN and the prudential regulators, and a separate sanctions duty administered by OFAC. The two carry different legal standards and are addressed below.

Regulators and authorities

The largest enforcement actions frequently combine DOJ, OFAC and FinCEN.

History — timeline

Current framework — core obligations

A covered financial institution's BSA/AML program today rests on the following elements, as set out in the FFIEC BSA/AML Examination Manual:

• AML program — the "four/five pillars": (1) internal controls and policies; (2) a designated BSA/AML compliance officer; (3) ongoing training; (4) independent testing and audit; and, since the 2018 CDD Rule, a fifth pillar — ongoing Customer Due Diligence, including beneficial-ownership identification.
• CIP (Customer Identification Program): verify the identity of customers at account opening (PATRIOT Act §326).
• CDD and beneficial ownership (2018 rule): identify and verify legal-entity beneficial owners — a 25% ownership prong plus a control-prong individual — and conduct risk-based ongoing monitoring.
• Reporting: SARs (suspicious activity) and CTRs (cash over $10,000); plus CMIR, FBAR, and Form 8300.
• Recordkeeping: including the funds-transfer "Travel Rule" (originator and beneficiary information on transmittals of $3,000 or more).
• Information sharing: §314(a) (responding to law-enforcement queries) and §314(b) (voluntary institution-to-institution sharing, with a safe harbor).
• Sanctions screening (OFAC): screen customers and transactions against OFAC lists — legally separate from the BSA program but operationally part of the same compliance function.

Sanctions obligations (OFAC)

• Lists: OFAC publishes the Specially Designated Nationals and Blocked Persons (SDN) List and a broader Consolidated Sanctions List (non-SDN lists such as SSI and FSE). US persons are generally prohibited from dealing with listed parties and with entities 50% or more owned by them (the "OFAC 50 Percent Rule").
• Strict-liability standard: OFAC civil enforcement applies a strict-liability standard — a US person can be penalized for a prohibited transaction even without knowledge or intent. This differs from the negligence/reasonableness standard generally applied to BSA program failures.
• Penalty scale: Under IEEPA-based programs, the statutory maximum civil penalty is the greater of approximately $377,700 per violation (inflation-adjusted) or twice the transaction value; criminal penalties can reach $1M and 20 years. Correspondent-banking failures have produced the largest settlements, including BNP Paribas (approximately $8.9B, 2014), Standard Chartered, and HSBC.
• Expectations: OFAC's Framework for Compliance Commitments sets out the expectation of a risk-based sanctions compliance program: management commitment, risk assessment, internal controls, testing, and training.

Enforcement

Civil penalties for BSA program failures can be substantial and are often paired with mandated remediation or monitorships; willful violations carry criminal exposure. The AMLA raised BSA penalty ceilings and added a whistleblower incentive and protection program. The costliest cases typically combine sanctions breaches with AML program deficiencies in cross-border and correspondent-banking contexts, reflecting that screening and program controls are examined together.

Recent and proposed developments

Corporate Transparency Act / BOI registry. BOI reporting took effect on January 1, 2024 and was subsequently challenged on constitutional grounds. On March 21, 2025, FinCEN issued an interim final rule that redefined "reporting company" to cover only foreign entities registered to do business in the US, with separate deadlines for those foreign entities. FinCEN has stated it was reviewing public comments toward a final rule. The scope of BOI reporting is the subject of ongoing rulemaking and litigation and may change; current obligations should be verified against FinCEN's published guidance. Separately, some states (for example, New York's LLC Transparency Act) have enacted their own beneficial-ownership regimes.

AML/CFT program reform (proposed, as of April 2026). On April 10, 2026, FinCEN, together with the prudential agencies, issued a proposed rule to reform AML/CFT program requirements under the BSA — shifting toward a risk-based, effectiveness-and-outcomes model and requiring programs to incorporate the national AML/CFT priorities. As proposed, the rule contemplates a 12-month implementation window after any final rule. The proposal is not final and remains subject to the rulemaking process.

Other AMLA implementation in progress. This includes the 2024 investment-adviser AML rule, residential-real-estate and gatekeeper rulemakings, broader BSA modernization, and periodic refresh of the national priorities (required at least every four years).

Sources & primary authorities

URLs checked 2026-06-20.

---

This guide is general information, not legal advice, and is current as of 2026-06-20.