What it means
Money laundering is the process of taking proceeds from crime and moving them through enough legitimate-looking steps that the origin becomes untraceable. AML is the defensive system built to interrupt that process at the points where criminal money touches regulated businesses.
The core obligations sit in three layers. First, customer due diligence, which means verifying identity and understanding the nature of the business relationship before accepting money; second, ongoing monitoring of transactions against what you would expect from that customer; third, reporting suspicious activity to the relevant financial intelligence unit and keeping records that prove you did all three.
For a business, AML matters for two very different reasons. The obvious one is legal exposure, since penalties for weak controls are severe and personal liability for named compliance officers is real.
The less obvious one is commercial: banks routinely close accounts of clients whose own AML controls look weak, and losing banking access can be existential for a small company. The practical work is heavily process-driven.
A firm typically maintains a written AML policy, a risk assessment scoring customers and products by exposure, a named responsible officer, staff training records and an escalation path for suspicious activity reports. Higher-risk relationships, such as politically exposed persons or customers in sanctioned jurisdictions, attract enhanced due diligence rather than the standard checks.
A crucial nuance is tipping off. Once a suspicious activity report is filed, telling the customer that they are under scrutiny is itself an offence in most jurisdictions, which is why front-line staff are trained to escalate quietly rather than confront.
Another nuance is that AML overlaps with, but is not identical to, sanctions screening and counter-terrorist financing. Sanctions work on lists of prohibited names and countries and is largely binary, whereas AML is risk-based and asks whether a pattern of behaviour looks wrong given what you know about the customer.
In practice
Real-world examples.
Example
An accountancy firm onboards a new client who wants to route large consultancy payments through the firm's client account. The partner runs identity checks, cannot get a straight answer about the underlying contracts, and declines the engagement rather than risk handling proceeds of crime.
Example
A payments company notices a small online retailer whose average transaction jumps from $40 to $3,800 overnight, with most payments coming from cards issued in a country the merchant does not sell to. The monitoring system flags the pattern, the compliance team files a suspicious activity report and freezes settlement without telling the merchant why.
Example
A property agency selling a $2.4 million apartment must verify the source of the buyer's funds. The buyer offers a bank statement showing the money arriving three days earlier from an unnamed offshore entity, so the agency requests documentary evidence of where it originated before proceeding.
Think of it
“AML is the effort to stop money laundering-rules and systems to prevent it.
Case study
Seen in the real world.
Harbourline Exchange is an invented currency exchange business used here as a purely illustrative example. It operated four high street branches and had grown quickly by offering better rates than the banks, with an AML policy that had not been updated in five years.
During a routine supervisory visit, the regulator found that branch staff had been recording customer identity checks inconsistently, that the firm's risk assessment did not distinguish between a tourist changing $300 and a repeat customer moving $9,000 a week in cash, and that no suspicious activity report had ever been filed despite obvious structuring patterns in the records. Structuring means splitting a large sum into several smaller transactions to stay under reporting thresholds.
In this fictional scenario the business was given a remediation deadline, hired a compliance officer, rebuilt its customer risk model and retrained every branch. The direct cost was around $340,000 in the first year, but the outcome the owners cared about most was keeping their banking relationship, which their clearing bank had already warned was under review.
Watch out
Common mistakes.
- Believing AML is only a banking issue, when accountants, lawyers, estate agents, art dealers and many payment firms carry the same core obligations.
- Treating customer due diligence as a one-off task completed at onboarding, when the rules require ongoing monitoring as the relationship and the customer's behaviour change.
- Asking a customer directly why their transaction looked odd after a report has been filed, which can amount to the separate offence of tipping off.
Questions
People also ask.
What is the difference between AML and KYC?
Know Your Customer is the identity verification and customer understanding component, which sits inside the broader AML framework alongside monitoring, reporting and record keeping.
Does a suspicious activity report accuse the customer of a crime?
No, it is a report of suspicion passed to the authorities for assessment, and most reports never lead to any action against the customer.
How long should AML records be kept?
Retention periods vary by jurisdiction but five years after the end of the business relationship is the common baseline, and firms usually keep them longer where litigation is possible.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%