Anti-money laundering (AML) compliance is the program a bank or other regulated business runs to keep criminal money out of its accounts: verifying who its customers are, screening them against sanctions and watchlists, monitoring their transactions, and reporting suspicious activity to the government. In the United States, the Bank Secrecy Act requires it of a defined set of financial institutions. If you’re a lender, investor, or platform outside that group, most of the program doesn’t apply to you, but one piece does: screening the companies and people you do business with.
For institutions covered by the Bank Secrecy Act (BSA), Financial Crimes Enforcement Network (FinCEN) rules require a written program with five core parts: internal policies and controls, a designated compliance officer, ongoing employee training, independent testing, and customer due diligence, including identifying the beneficial owners of business customers. Day to day, the program runs on four activities: customer due diligence at onboarding, screening against sanctions and watchlists, transaction monitoring, and filing reports such as suspicious activity reports (SARs) and currency transaction reports (CTRs). The scale explains the rules: the United Nations Office on Drugs and Crime estimates that 2% to 5% of global GDP is laundered each year.
We don’t run bank AML programs. Transaction monitoring and SAR filing happen inside the institution that holds the account. The rest of this article covers screening, because it’s the piece that reaches beyond banks.
AML screening runs a name, a company or a person, against curated risk data. It does not look at money. That distinction carries more weight than anything else here, so it is worth sitting with. Screening asks who you are dealing with. It does not ask what they have been doing with their funds, and if you are the counterparty rather than the bank holding the account, their payment activity is not something any provider can show you.
Four layers sit behind the screen.
Sanctions. Official designation and embargo regimes: the Office of Foreign Assets Control (OFAC) programs, including the Specially Designated Nationals list, plus European Union, United Kingdom, and United Nations regimes and a range of national lists. This is the layer with actual legal teeth, and we take it apart in detail in what sanctions screening verifies on a business.
Regulatory and law enforcement actions. Debarments, exclusion lists, enforcement penalties, cease-trade orders, disciplinary findings, and wanted lists, published by official bodies. This layer earns its place by catching parties an authority has already moved against, which often lands earlier than a court record surfaces.
Politically exposed persons. Current and former PEPs ranked by seniority, along with their relatives and close associates. Political exposure is not an accusation. It is a signal that a relationship warrants more scrutiny than average, and that the scrutiny should be documented.
Adverse media tied to serious crime. Curated reporting on parties charged, indicted, prosecuted, or convicted in categories like fraud, bribery, organized crime, and cybercrime. The qualifier does the work. This layer is built from official action rather than general negative press, which is a narrower and more defensible thing than a news sweep. We separate the two in adverse media screening.
Coverage for our own screen is listed on our sanctions screening page. Coverage figures are close to table stakes at this point, though. What actually varies between providers is what happens to a match once the system finds one.
This is the part most AML writing skips, and it is the part that decides what you actually need.
The Bank Secrecy Act and the regulations under it require formal AML programs at a defined set of institutions: banks, credit unions, money services businesses, broker-dealers, casinos, and several other named categories. Those obligations run well past screening a counterparty, and the institutions carrying them already know it.
If you are a commercial lender outside that perimeter, a private investor, an independent sponsor, a marketplace, a general contractor, or a procurement team, you may have no statutory obligation to maintain an AML program at all. A fair number of teams in that position conclude the whole topic belongs to somebody else.
Our read is that this collapses two separate questions. Whether you are required to run a program and whether you are exposed are not the same inquiry, and the second does not wait on the first. AML due diligence is worth running on its merits, not because a regulator asked.
Sanctions make the cleanest case. OFAC's prohibitions reach US persons generally, not only regulated financial institutions. Paying a designated party, contracting with one, or taking an ownership position alongside one is a problem whether or not you maintain a compliance program, and unlike much of the regulatory world it does not turn on whether you knew. OFAC’s Economic Sanctions Enforcement Guidelines treat a lack of intent as a factor in the penalty, not a defense. That is why a one-credit screen turns up in commercial workflows with no Bank Secrecy Act connection at all.
Sitting outside the regulated perimeter carries an advantage worth knowing, too. Because a commercial screen on a business and its principals is not an employment, tenancy, or consumer credit decision, the Fair Credit Reporting Act (FCRA) framework does not apply. That means a wider set of records, a longer lookback, and no requirement to get the subject to sign off first. We work through that in does a non-FCRA background check require consent.
Any screen worth running returns too many possible matches on purpose. AML watchlist coverage extends to relatives and associates, matching runs across transliterations and dozens of languages, and a common surname will collide with somebody on a global list who has no connection to your subject. A missed designation is the more expensive error of the two, so the matching is tuned to over-return.
Which means the screen hands you a question. Somebody has to answer it.
On our Preliminary Report, answering it is not the client's job. Searches that come back clean release in minutes. A sanctions, watchlist, or OFAC match is held before release and reviewed by an investigator, who confirms whether it belongs to the subject and suppresses it when it does not. Clients do not receive raw, unreviewed adverse hits to sort out themselves.
That review confirms identity, and only identity. It is not direct source verification, which is what our Advanced and Deep Dive reports add, where investigators gather records from courts and registries directly. The distance between those two things is the subject of database screening versus investigative due diligence, and deciding which a given deal warrants is the question behind right-sizing diligence.
The four layers are global, official, and reasonably current. What they are not is local, and what they are not is financial.
A designation screen will not surface a tax lien filed in a county courthouse last month, a judgment entered against the company, a secured interest already claimed against the equipment, or the financial condition that determines whether a counterparty can pay you at all. Those records sit somewhere the watchlists never reach, and they decide far more commercial deals than sanctions ever will. On how thin a clean database result can be, see what a clean due diligence check can still miss and reading liens and judgments in due diligence on a company.
There is a second limit that is easy to miss. A screen can only check the names you hand it. If the person actually controlling the entity is not on the filing, the screen searches the wrong subject and comes back clean, accurately. That is a live problem in layered ownership, and it is why ownership is separate work rather than a byproduct of the screen. See where ultimate beneficial owner records run out in what UBO checks can verify and what they cannot, and where entity verification stops in what know your business verification confirms.
A clean result is also a snapshot. Designations get added after onboarding, and the screen you ran on day one will not catch them, which is the tradeoff in point-in-time screening versus continuous monitoring.
For most commercial counterparties the sanctions and watchlist layer is enough, and it does not need to be bought on its own. It arrives as one credit inside a broader screen that also covers judgments, liens, bankruptcies, and corporate records, which is why most teams shopping for an AML check service do not need AML software so much as a screen that happens to include this layer.
The cases we would escalate are narrow: the counterparty or its ownership sits outside the United States, ownership is layered enough that you cannot tell who you are actually screening, or a match came back and the question has shifted from whether it is your subject to what they actually did. Where the worry is being defrauded rather than being sanctioned, fraud risk management through business diligence is the closer fit.
If you want help deciding how much AML due diligence a given counterparty warrants, hit Get Started below. Our investigators will look at what you are screening and come back with where each level fits, at no additional cost. Our sanctions screening service covers the layer itself, and commercial lending and specialty finance shows how this tends to sit inside a working diligence process.
.png)
