Compliance: AML, KYC and sanctions

Financial crime compliance is where most new banks meet their first serious supervisory findings. It is also the area that correspondent banks examine most closely before opening accounts. A bank with a sound capital plan but weak anti-money laundering controls will struggle to obtain a licence and, once licensed, to connect to the international payment system.

The global standard: FATF

The Financial Action Task Force sets the international standard in its 40 Recommendations. The current text, adopted in 2012, was last updated in October 2025. Countries implement the Recommendations through law, and the FATF and its regional bodies assess each country through mutual evaluations.

The Recommendations most relevant to banks are listed below.

Recommendation	Subject
R.1	Assessing risks and applying a risk-based approach
R.6 and R.7	Targeted financial sanctions on terrorism and proliferation
R.10	Customer due diligence
R.11	Record keeping
R.12	Politically exposed persons
R.13	Correspondent banking
R.15	New technologies, including virtual assets
R.16	Payment transparency, formerly wire transfers
R.17 to R.19	Reliance on third parties, internal controls, higher-risk countries
R.20 and R.21	Suspicious transaction reporting and tipping-off
R.24 and R.25	Beneficial ownership of legal persons and arrangements

The foundation is the risk-based approach in R.1. Measures should be proportionate to the risks identified, which means more scrutiny for higher-risk customers and products and simplified measures where risk is demonstrably lower.

Know your customer and customer due diligence

Recommendation 10 prohibits anonymous accounts and accounts in obviously fictitious names. It requires CDD when establishing a business relationship, for occasional transactions above USD/EUR 15,000, when there is suspicion of money laundering or terrorist financing, and when the institution doubts previously obtained identification data.

The CDD measures are:

1. Identifying the customer and verifying identity using reliable, independent source documents, data or information.
2. Identifying the beneficial owner and taking reasonable measures to verify identity, including understanding the ownership and control structure of legal persons and arrangements.
3. Understanding, and as appropriate obtaining information on, the purpose and intended nature of the relationship.
4. Conducting ongoing due diligence and scrutiny of transactions to ensure they are consistent with the institution’s knowledge of the customer, including, where necessary, the source of funds.

If an institution cannot complete CDD, it should not open the account or should end the relationship, and should consider filing a suspicious transaction report. Under R.11, transaction and CDD records must be kept for at least five years.

Enhanced due diligence

Enhanced due diligence (EDD) applies where risk is higher. Typical triggers are complex ownership structures, cash-intensive businesses, customers linked to higher-risk countries, private banking, and non-face-to-face relationships without strong verification. EDD measures include more evidence on source of funds and source of wealth, senior management approval and more frequent review.

Beneficial ownership

A beneficial owner is the natural person who ultimately owns or controls a customer. R.24 requires countries to ensure that adequate, accurate and up-to-date beneficial ownership information is available to authorities, through a register or an alternative mechanism. It also prohibits new bearer shares and requires measures against misuse of nominee shareholders and directors.

The EU sets a common threshold. Under the Anti-Money Laundering Regulation, an ownership interest means direct or indirect ownership of 25% or more of the shares, voting rights or other ownership interest in a corporate entity. Control through other means can also make a person a beneficial owner, and a 25% threshold does not remove the need to understand the full structure.

Politically exposed persons

A PEP is someone entrusted with a prominent public function, such as a head of state, senior politician, senior judge or senior official of a state-owned enterprise. Family members and close associates are covered too.

For foreign PEPs, R.12 requires institutions to:

1. Have risk-management systems to determine whether a customer or beneficial owner is a PEP.
2. Obtain senior management approval to establish or continue the relationship.
3. Take reasonable measures to establish source of wealth and source of funds.
4. Conduct enhanced ongoing monitoring.

For domestic PEPs and people with prominent functions at international organisations, these measures apply where the relationship is higher risk.

Sanctions screening

Sanctions are legal prohibitions, not risk judgements. Under R.6, countries must freeze “without delay” the funds of persons designated by the UN Security Council for terrorism, and R.7 applies the same logic to proliferation financing.

Banks also apply the autonomous sanctions of the jurisdictions where they operate. In the EU these are Council regulations. Banks that make payments in other currencies must also take account of the sanctions regimes their correspondent banks apply, because a payment that breaches those regimes will be stopped in the chain.

A sanctions programme covers:

1. Screening customers, beneficial owners and connected parties at onboarding and whenever lists change.
2. Screening payments, including names of parties, banks, vessels and locations, in real time before execution.
3. Managing alerts with documented decisions, avoiding both false comfort and excessive blocking.
4. Freezing and reporting matches to the competent authority.
5. Controls against evasion, such as stripping or altering payment information.

Transaction monitoring and suspicious activity reports

Transaction monitoring compares customer activity with the expected profile and with known typologies. Monitoring is usually automated, with scenarios and thresholds tuned to the bank’s own customer base, and reviewed by trained analysts.

Under R.20, an institution that “suspects or has reasonable grounds to suspect” that funds are the proceeds of crime or related to terrorist financing must report promptly to the financial intelligence unit. These reports are called suspicious transaction reports or suspicious activity reports depending on the jurisdiction.

R.21 protects staff who report in good faith and prohibits tipping-off, which means disclosing to the customer or others that a report has been filed. A bank must therefore manage the customer relationship carefully after filing, without revealing the report.

The EU AML package and AMLA

The EU adopted a package in 2024 that moves most rules from directives into a directly applicable regulation and creates an EU authority.

Instrument	What it does	Key date
Regulation (EU) 2024/1624 (AMLR)	Single rulebook for obliged entities: CDD, beneficial ownership, PEPs, reporting, an EU-wide limit on cash payments by traders in goods and services of EUR 10,000	Applies from 10 July 2027, with a later date for certain entities
Directive (EU) 2024/1640 (AMLD6)	National supervisors, FIUs, beneficial ownership registers, bank account registers	General transposition by 10 July 2027, with earlier dates for some articles
Regulation (EU) 2024/1620 (AMLA)	Creates the Anti-Money Laundering Authority, seated in Frankfurt am Main	Applies from 1 July 2025, with some articles earlier

AMLA will directly supervise a limited number of high-risk credit and financial institutions operating in at least six Member States. The regulation requires the first selection process to start by 1 July 2027, and states that direct supervision of selected entities should commence in 2028. If more than 40 entities qualify in the first round, AMLA supervises the 40 operating in the highest number of Member States.

For other institutions, national supervisors remain in charge, with AMLA coordinating and setting technical standards.

The travel rule

The travel rule requires payment information about the originator and beneficiary to accompany a transfer through the payment chain. It derives from FATF R.16.

In the EU, Regulation (EU) 2023/1113 applies from 30 December 2024 to transfers of funds and of crypto-assets. For transfers of funds, full payer and payee information is required above EUR 1,000, with lighter requirements for smaller transfers that are not linked. For crypto-assets, the regulation applies the same requirements “regardless of their amount and of whether they are domestic or cross-border transfers”.

The FATF revised R.16 and its interpretive note in June 2025, renaming it payment transparency. According to the CSSF’s summary, the changes standardise the information required in payment messages, clarify responsibilities along the payment chain, add measures against fraud, misrouting and error such as payee verification, and are to take effect by the end of 2030.

Country risk and public lists

The FATF publishes two lists after each plenary. At its June 2026 plenary, as summarised by Malta’s FIAU, the Democratic People’s Republic of Korea, Iran and Myanmar remained high-risk jurisdictions subject to a call for action. Bosnia and Herzegovina and Iraq were added to the list of jurisdictions under increased monitoring, and Algeria and Namibia were removed.

The EU maintains its own list of high-risk third countries. The European Commission adopted amendments in December 2025 that added Russia, Bolivia and the British Virgin Islands with effect from 29 January 2026. EU obliged entities must apply enhanced due diligence to relationships and transactions involving listed countries.

What regulators expect from a new bank

1. A business-wide risk assessment covering customers, products, channels and countries, approved by the board.
2. A money laundering reporting officer with authority, resources and direct access to the board.
3. Written policies and procedures that match the actual onboarding and monitoring systems.
4. Tested systems for identity verification, screening and monitoring, with documented tuning.
5. Training for all staff, with specialist training for front office and compliance.
6. Independent testing by internal audit or an external reviewer.
7. Consistency with the business plan. Regulators compare the AML framework with the target customers and countries in the application, and challenge gaps.

The next article looks at correspondent banking, where these controls are tested by other banks as well as by supervisors.