Originally published: January 31, 2023. Last updated: Oct 15, 2026.
Money laundering has never been more expensive to ignore. In October 2024, TD Bank pleaded guilty to Bank Secrecy Act violations and agreed to pay more than $3 billion in penalties, the largest such penalty in US history, after failing to monitor $18.3 trillion in customer activity. A year earlier, Binance paid $4.3 billion and its founder resigned over similar failures. These are not stories about criminal masterminds outsmarting the system; they are stories about compliance programs that did not keep up. For any financial institution, from community banks to fintech startups, preventing money laundering is now a core business risk, not a back-office checkbox. This guide lays out the seven controls that actually work, updated for the 2024-2025 enforcement wave and the regulatory shifts that changed the rules.
The scale explains the scrutiny. The EU Home Affairs office, citing UN Office on Drugs and Crime estimates, puts laundered funds at 2 to 5 percent of global GDP every year, roughly $800 billion to $2 trillion. Regulators have responded with bigger sticks and sharper expectations, and the institutions that thrive are the ones that treat anti-money laundering as a risk discipline woven into daily operations. For the broader picture of institutional risk, see the guide to business risks every enterprise should watch and the cybersecurity measures for businesses, since financial crime and cybercrime increasingly share the same plumbing.
1. Build a Risk-Based BSA/AML Program, Not a Template
Regulators expect a written program scaled to the institution’s actual risk profile: customer types, products, delivery channels, and geographies. A money-services business handling cross-border remittances needs a fundamentally different program than a community bank doing local mortgages. The program must name a designated BSA compliance officer, set internal controls, provide ongoing training, and include independent testing. Off-the-shelf templates that nobody customized are exactly what examiners flag first.
2. Know Your Customer, Then Keep Knowing Them
Customer due diligence starts at onboarding: verify identity, understand the nature and purpose of the relationship, and build a risk profile. But the critical shift is ongoing monitoring. A customer’s risk profile on day one is not their profile in year three. One major 2025 development changed the landscape: FinCEN’s March 2025 interim final rule removed beneficial-ownership reporting requirements for US-created companies and US persons under the Corporate Transparency Act, leaving the obligation on foreign entities registered to do business in the US. Institutions should update their customer due diligence procedures to reflect this reversal rather than collecting information the rule no longer requires.
3. Modernize Transaction Monitoring With AI
Legacy rule-based monitoring generates false-positive rates above 85 percent, burying investigators in noise while real suspicious activity slips through. AI and machine-learning models, now used by 56 percent of financial institutions for AML according to 2025 industry data, cut false positives by learning normal behavior per customer segment and flagging genuine anomalies. The TD Bank case is the cautionary tale: $18.3 trillion in unmonitored activity. Monitoring must cover all channels, including digital wallets, instant payments, and crypto-adjacent products, with scenarios tuned to the institution’s risk assessment and refreshed as typologies evolve.
4. File Suspicious Activity Reports With Discipline
Suspicious Activity Reports are the intelligence feed law enforcement actually uses, and filing quality matters as much as filing volume. Narratives should tell the story: who, what, when, where, why it is suspicious, and how it was detected. Late, vague, or defensive filings draw examiner criticism. Institutions should track filing timeliness (generally within 30 days of initial detection), maintain a clear escalation path from front-line staff to the investigations team, and never tip off the customer. The ICIJ account of the TD Bank guilty plea shows how monitoring gaps become criminal liability.
5. Screen Relentlessly Against Sanctions and Watchlists
Sanctions screening is not a one-time onboarding check. Customer bases, beneficial owners, and transaction counterparties must be screened at onboarding and on an ongoing basis against OFAC, EU, UN, and other applicable lists, with fuzzy-matching tuned to catch transliteration variants. Payment screening should run in real time where the product allows it. The Department of Justice case against Binance centered partly on failures to implement adequate sanctions controls, a $4.3 billion lesson in what happens when screening is treated as optional.
6. Test Independently and Often
An AML program that is never independently tested is a hope, not a control. Independent testing, by internal audit or a qualified third party, should review the risk assessment, the monitoring scenarios, SAR decision-making, training effectiveness, and data integrity on a cycle matched to risk (at least annually for most institutions). Findings must go to the board with remediation deadlines, not sit in a drawer. Examiners increasingly ask for evidence that prior findings were actually fixed.
7. Put the Board and the Culture to Work
Every major enforcement action of the last decade cites governance failures: boards that never discussed AML, compliance officers without authority or budget, and cultures where revenue beat compliance. The board should receive regular, substantive AML reporting, approve the risk assessment, and ensure the BSA officer has direct access and adequate resources. Training must be role-specific: tellers, relationship managers, and executives each need different content. And in 2025, there is a new supervisor to watch in Europe: the EU’s Anti-Money Laundering Authority became operational in Frankfurt on July 1, 2025, and will directly supervise up to 40 high-risk cross-border institutions starting in 2028, according to AMLA itself. Cross-border institutions should be aligning programs now.
Frequently Asked Questions
What is the biggest money laundering penalty ever imposed?
TD Bank’s October 2024 guilty plea produced penalties exceeding $3 billion, including a record $1.3 billion FinCEN penalty, making it the largest Bank Secrecy Act penalty in US history. Binance’s $4.3 billion November 2023 settlement is larger in total but covered multiple violations beyond BSA failures.
Do US companies still have to file beneficial ownership reports with FinCEN?
No. FinCEN’s March 2025 interim final rule removed the requirement for US-created companies and US persons. Only foreign entities registered to do business in the US must still report beneficial ownership information. Institutions should update customer due diligence procedures accordingly.
What does the EU’s new Anti-Money Laundering Authority do?
AMLA, operational since July 2025 and based in Frankfurt, coordinates EU AML supervision and will directly supervise up to 40 high-risk cross-border financial institutions starting in 2028. It represents the EU’s shift from national-only supervision to centralized oversight.
How much money is laundered globally each year?
The UN Office on Drugs and Crime estimates 2 to 5 percent of global GDP is laundered annually, roughly $800 billion to $2 trillion. The EU cites a range of €715 billion to €1.87 trillion for its own estimates.
Why do transaction monitoring systems generate so many false positives?
Legacy rule-based systems use static thresholds that flag normal behavior, producing false-positive rates above 85 percent. AI-based monitoring learns each customer segment’s normal patterns and flags genuine anomalies, which is why adoption has reached 56 percent of institutions.
Which countries are on the FATF grey list in late 2025?
After the October 2025 plenary removed Burkina Faso, Mozambique, Nigeria, and South Africa, 19 jurisdictions remain under increased monitoring, including Monaco, Lebanon, Venezuela, and the British Virgin Islands. Institutions should apply enhanced due diligence to transactions touching listed jurisdictions.
