In 2024, TD Bank, an American subsidiary of the multinational TD Bank Group, was fined $3 billion for what the Department of Justice described as ālong-term, pervasive, and systemic deficienciesā in AML monitoring.
It violated the Bank Secrecy Act, and by making its services āconvenient for criminalsā, it opened the doors to drug cartels. It was the largest-ever fine issued to a US bank in relation to AML/KYC penalties, and it made the organisationās competitors very nervous, drawing attention to the changing AML/KYC landscape and the need for US AML/KYC compliance.
Table of Contents
What are the Main AML & KYC Regulations in the US?
AML regulations in the US are governed by a series of rules, largely governed by the Bank Secrecy Act (BSA), established in 1970. This law set the foundations for everything that followed and is still central to US AML/KYC requirements. The BSA meant that banks were required to:
- Report cash transactions over $10,000
- Create a paper trail by maintaining detailed financial records
- Confirm the identities of all individuals conducting financial transactions
Since then, there have been various other AML regulations in the US:
- Money Laundering Control Act (1986): Made money laundering a federal crime and increased reporting and recordkeeping demands.
- Anti-Drug Abuse Act (1988): Increased the scope of cash reporting, including ID verification on purchases over $3,000.
- Annunzio-Wylie Anti-Money Laundering Act (1992): Wire transfers required recordkeeping and verification. It also established the Bank Secrecy Act Advisory Group (BSAAG).
- Money Laundering Suppression Act (1994): More procedures, streamlined exemption, and new rules on Money Services Businesses (MSB), including outlawing unregistered MSBs.
- Money Laundering and Financial Crimes Strategy Act (1998): Called for the creation of AML strategies and task forces to strengthen US AML and KYC requirements.
- USA PATRIOT Act (2001): Added various new regulations to stop terrorism funding, including prohibiting financial institutions from doing business with shell banks, expanding regulations to more organisations, and increasing AML and KYC penalties.
- Intelligence Reform & Terrorism Prevention Act (2004): Amended the BSA to include new reporting measures.
- Anti-Money Laundering Act (AMLA) (2020): Implemented some of the most significant changes in decades, with increased penalties, the creation of a registration database for beneficial owners, greater whistleblowing protections and rewards, more information sharing requirements, and stricter reporting and recordkeeping.
Who Must Comply with the US AML/KYC Requirements?
US AML/KYC requirements apply to various businesses tasked with providing services and handling money, including:
- Financial institutions
- Money service businesses
- Insurance companies
- Casinos
- Real estate agents
- Antique dealers
- Precious metal dealers
- Jewellers
The rules differ from industry to industry, with financial institutions typically subjected to stricter regulations than real estate agents, for example. Just because your company is not on this list does not mean it is not subject to AML regulations, as shown in this list of surprising sectors subject to AML laws.
Who Regulates KYC and AML in the US?
US AML/KYC requirements are overseen by various industry-specific agencies, including:
FinCen
The Financial Crimes Enforcement Network (FinCEN), a division of the Department of the Treasury, is tasked with safeguarding the US financial system, and that includes the enforcement of AML and KYC laws. In one of its most recent rulings, set to take effect in 2026, it imposed new AML regulations on registered investment advisers.
OFAC
The Office of Foreign Assets Control (OFAC) sets and enforces laws related to economic sanctions, according to foreign policy. AML regulations are key to its operations, as sanctions compliance is integral to preventing money laundering and other financial crimes.
SEC
The Securities and Exchange Commission (SEC) was established after the Wall Street crash of 1929, with a view to preventing market manipulation and ensuring fairness, honesty, and transparency in securities markets. It promotes US AML/KYC compliance measures among brokers and dealers and has been known to act against companies found to be in violation of these laws.
FRB
The Federal Reserve Board (FRB) enforces AML laws for financial institutions in the Federal Reserve System. It examines AML compliance programs to determine their efficacy and ensure banks and other financial instructions are meeting regulations.
What are the Latest Changes & Updates in the US AML/KYC?
As noted above, the Anti-Money Laundering Act 2020 (AMLA) was introduced to deal with the threat of online money laundering in the United States. Prior to this, everything was centred around the Bank Secrecy Act (BSA), launched in 1970, and the Patriot Act of 2001.
The AMLA requires all companies to report ownership information to FinCEN. The information is then stored in a database, where it can be accessed by relevant authorities as part of ongoing money laundering investigations.
On September 30, 2022, FinCEN published the Beneficial Ownership Information Reporting Rule, better known as the āFinal Ruleā. The rule required specific legal entities to submit a report relating to the beneficial owner of a reporting company.
Initially slated for January 1, 2024, the implementation date was later changed to March 26, 2025, and then amended so that ābeneficial reporting companiesā became exempt.
From 2026, investment advisors will be required to implement AML systems. There have also been calls to modernise AML regulations in the US, making them more robust and capable of meeting demands in this high-tech, digitally driven world.
Elsewhere, authorities have focused their efforts on the cryptocurrency sector. President Trump signed an executive order in early 2025 that outlined the importance of cryptocurrency and the need for promoting cryptocurrencies among the general public while keeping them safe from harm.
Cryptocurrency and AML Compliance
There have been a few updates to AML crypto regulations in the last few years, and as authorities are increasingly focusing on digital currencies and their exposure to money laundering and fraud, we will likely see changes more in line with general US AML and KYC compliance in the coming years.
Currently, cryptocurrency services must undertake various protocols:
- Risk Assessment: Risk-based measures to address high-risk customers and transactions.
- KYC and Customer Due Diligence: Verify a customerās ID and determine their level of risk.
- Transaction Monitoring: Monitor all transactions for suspicious patterns.
- Suspicious Activity Reporting: Report suspicious activity to the relevant authorities.
- Compliance Programs: Create and maintain programs designed to meet AML crypto regulations.
- Record Keeping: Keep records of customers and transactions in case they need to be inspected at a later date.
- Employee Training: Ensure employees are trained in AML compliance and understand how to identify and deal with red flags.
Authorities have recently clamped down on AML violations by fining companies found to be in violation of US AML/KYC requirements. In 2025, for instance, BitMEX was fined over $100 million while OKX was hit with a fine of over $500 million.
Historically, cryptocurrency exchanges were accorded more freedoms than traditional financial institutions and money service providers, but that is clearly no longer the case, and crypto companies are coming under stricter controls.
AML/KYC Compliance Steps & Procedures
US AML and KYC compliance is a multi-stage process that includes various steps:
| Customer Identification | The organisation must confirm that the customer is who they say they are, providing a paper trail for customer identification and guarding against fraud. |
| Customer Due Diligence (CDD) | Due diligence checks dig deeper into the customerās documents to find red flags that could warrant further investigation. |
| Enhanced Due Diligence (EDD) | A rigorous due diligence process designed for high-risk customers and transactions. |
| Continued Monitoring | Ongoing monitoring helps companies to spot suspicious transactions and activities. |
| Reporting | Suspicious activities and transactions should be reported to the respective authorities where applicable. |
| Compliance Reports | The company should conduct regular audits of their systems, as well as reports showing that they adhere to AML and KYC policies. |
| Sanctions and PEP Screening | Checking sanctions lists and screening for politically exposed persons (PEPs) is essential, especially since the war in Ukraine and the many sanctions resulting from it. |
| Adverse Media Checks | Adverse media screening checks news and media for red flags relating to specific clients and can protect the company while also meeting sanctions regulations. |
What are the Penalties for AML Non-Compliance in the US?
Failure to meet AML regulations can result in both civil fines and criminal penalties. An individual who violates the BSA can face a fine of up to $250,000, five years in prison, or both. That includes employees of companies subject to AML requirements. If another law is broken while violating AML laws, they could be hit with fines up to $500,000 and 10 years in prison.
For companies, AML and KYC penalties vary based on the severity of the violation and the size of the transaction(s) in question, but fines are fixed as either $1 million or double the size of the transaction(s).
The OFAC can also levy substantial fines and criminal penalties for companies that violate sanctions laws.Ā
A company that does not strictly adhere to AML/KYC and sanctions rulings faces severe financial and reputational risk, emphasising the importance of proper risk management and dedicated compliance.
If you are subject to US AML and KYC requirements, either because you are based in the US or conduct business with US entities, contact A Data Pro to assist with your compliance needs. We provide various risk management solutions, including due diligence reports and sanctions list checking, helping you meet these regulations and ensure your business is wholly compliant.
Ask to Speak to an Expert
FAQs
What are the main AML and KYC regulations in the United States?
U.S. AML regulations are built on the Bank Secrecy Act of 1970, which requires reporting of cash transactions over $10,000, maintaining detailed financial records, and confirming customer identities. Over the years, laws such as the Money Laundering Control Act, USA PATRIOT Act, and Anti-Money Laundering Act of 2020 have expanded these requirements, introducing stricter reporting rules, beneficial ownership disclosure, and tougher penalties for non-compliance.
Who needs to comply with U.S. AML and KYC requirements?
AML and KYC rules in the U.S. apply to a wide range of entities, including banks, money service businesses, casinos, real estate agents, insurance companies, antique and precious metals dealers, and jewelers. Even industries not traditionally associated with banking may be subject to these regulations if they handle significant financial transactions.
Which agencies regulate AML and KYC compliance in the United States?
Several agencies oversee AML and KYC in the U.S., each with industry-specific responsibilities. The Financial Crimes Enforcement Network (FinCEN) enforces BSA requirements and collects beneficial ownership data. The Office of Foreign Assets Control (OFAC) manages sanctions enforcement. The Securities and Exchange Commission (SEC) regulates brokers and dealers for AML compliance. The Federal Reserve Board (FRB) ensures AML standards are met within the Federal Reserve System.
What recent changes have been made to U.S. AML and KYC rules?
Recent changes include the Anti-Money Laundering Act of 2020, which introduced beneficial ownership reporting to FinCEN and enhanced whistleblower protections. New rules require certain companies to file ownership reports, with deadlines now set into 2025. From 2026, registered investment advisers will also be required to implement AML programs. The cryptocurrency sector is facing tighter scrutiny, with exchanges now subject to the same KYC, transaction monitoring, and reporting obligations as traditional financial institutions.
What are the penalties for failing to comply with U.S. AML laws?
Individuals who violate the Bank Secrecy Act can face fines up to $250,000, five years in prison, or both, with penalties rising to $500,000 and ten years in prison if other laws are broken in the process. For companies, fines can reach $1 million or double the transaction amount. Sanctions violations enforced by OFAC can also result in substantial financial and criminal penalties, making strict compliance essential for both legal and reputational reasons.
