Hodder Law’s Easy Guide to AML Compliance Policies

All crypto businesses looking to perform OTC (over-the-counter) crypto to fiat conversions and bitcoin ATM operations are required to register with the Financial Crimes Enforcement Network (FinCEN) and implement an Anti-Money Laundering (AML) Compliance Policy. 

An AML Compliance Policy allows your crypto business to operate in the United States in compliance with the Bank Secrecy Act laws. Without proper AML Compliance, you won’t be able to get a bank account, and if discovered by law enforcement, you could face severe penalties under the Bank Secrecy Act. 

What is an AML Compliance Policy?

TL;DR: An AML Compliance Policy is put in place to protect your crypto business from being used by criminals to launder the proceeds of illegal transactions. 

AML regulations began to be discussed in the 1970s. One of the first pieces of official legislation was the Bank Secrecy Act (BSA), enacted in 1970. The AML framework has expanded over the years in response to major events such as 9/11, which led to the creation of the USA PATRIOT Act. 

Today, an AML Compliance Policy is an essential legal policy created by an AML lawyer or a lawyer who specializes in this domain. It outlines procedures for Know-your-customer, customer due diligence, transaction monitoring, record-keeping, and reporting suspicious activities to relevant financial authorities. 

Navigating each state’s unique money transmission laws and regulations can be complex and challenging, especially regarding AML compliance. That’s why having a well-researched and carefully crafted AML Compliance Policy created by a knowledgeable AML lawyer and legal team is essential.

Why the need for an AML Compliance Policy?

TL;DR: An AML Compliance Policy protects you against money laundering and shows the government and other financial institutions that you are committed to running a legitimate money services business. 

An AML Compliance Policy, also known as an AML Policy, helps prevent, detect, and report the illicit movement of money, known as money laundering. This movement could potentially fund criminal activities such as terrorism, drug, and human trafficking.  

There are three actions the U.S. government considers money laundering:

First is placement, which is physically getting illegal cash into the financial system. It can also be known as “structuring,” breaking down large sums into smaller deposits to avoid detection. 

The second is layering, which means moving money around to hide its origin. This is commonly seen with “shell companies” and via wire transfers or international trades. 

Third is integration, which happens when the money is reintroduced into the system disguised as a legitimate source. A typical example is when illicit funds buy luxury real estate or high-value assets such as art or cars.   

Money Laundering in the crypto industry 

Money laundering continues to be a major concern in the cryptocurrency industry. Scammers often try to exploit anonymity and the decentralized structure of crypto to access funds through illegal activities. A top concern is social engineering. 

Ransomware and layering transactions are among the key issues flagged as high-risk behaviors. Addressing these concerns requires a robust AML policy, increased transparency, and collaboration across the industry to safeguard the ecosystem while preserving its innovative potential. Hiring an AML lawyer to help navigate these complex issues is strongly recommended. 

Who needs an AML Compliance Policy?

Most businesses offering financial services to the public should have an AML policy as a best practice. This includes:

• Banks and Credit Unions
• Investment Firms  
• Insurance Companies 
• Money Service Businesses (MSBs) 
• Credit Card Companies and Payment Processors
• Cryptocurrency Exchanges and Wallet Providers
• Precious Metals and Gem Dealers
• Casinos and Gambling Businesses
• Crowdfunding Platforms

The more common application of the AML Policy, especially in the crypto industry, is protecting people from scams. 

A well-designed Compliance Program will trigger warnings, and the potential scam victim will often be alerted before the transaction is processed. 

How does an AML Compliance Policy work, and what does it include?

TL;DR: AML Policies can include Customer Due Diligence (CDD), Know-Your-Customer (KYC), Enhanced Due Diligence (EDD), Risk Reports, Transaction Monitoring, Record Keeping, Internal Control, and Governance, Employee Training and Awareness, and Independent Auditing Services. 

There are several key components to an AML Compliance Policy that protect your business and your customers from money laundering. These components include:

#1: Customer Due Diligence

Customer Due Diligence requires that the Money Service Business verify the customer’s identity to understand why they are performing the transaction and assess their risk level.

It is recommended that an enhanced version of CDD, Enhance Due Diligence (EDD), be implemented for high-risk businesses and customers. EDD requires extensive background checks. 

#2: Risk Assessment Reports

Identify and assess the risk levels of customers, products, geographic regions, and transactions. 

#3: Transaction Monitoring and Reporting

Operators must also monitor all transactions and report suspicious activity to law enforcement through a Suspicious Activity Report. This can be done by implementing an automated system that flags certain transactions. 

The AML Policy will create a set of criteria that warrants a Suspicious Activity Report (SAR), which means the Operator will be required to send law enforcement a report about the transaction, including the KYC details collected about the customer. The trigger for a SAR is $2,000 + suspicion that the transaction involves illegal proceeds.

#4: Detailed Record-Keeping and Documentation 

As part of the AML Compliance Policy, the operator must keep detailed records of transactions, customer information documentation, and due diligence reports. FinCEN requires these to be kept for five years. 

These reports and documents must be easily accessible for audits or potential investigations. 

#5: Internal Controls and Governance 

You must declare that you will establish and maintain strong internal policies and procedures to protect against AML risks. As part of the requirements, a Company needs to assign a Compliance Officer and perform regular independent audits of its AML policy and procedures.

#6: Employee Training and Awareness 

Another FinCEN requirement that must be included in the AML Compliance Policy is staff training. There needs to be some initial training for any staff, as well as ongoing training on an annual basis. This training needs to be maintained in a log, and your bank may request to see a copy of it, along with any IRS Title 31 Auditor. Your staff must know how to spot red flags, detect suspicious activity, and report the activity immediately. 

#7: Independent Audits 

Lastly, your AML Compliance Policy must include the promise to conduct independent audits by an independent party. These audits will test the effectiveness of your AML compliance program and policy and ensure they adhere to any changes in regulations or risk profiles. 

Challenges Businesses Face with AML Compliance Policies 

As the internet, technology, and money services evolve, businesses face many challenges with their AML Compliance Policy. These can include: 

• Evolving regulatory laws and requirements 
• Expensive compliance programs 
• False positives in transaction monitoring
• Risk assessment of profiles
• Data privacy and collection
• Cross-border transactions 
• Insider threats and human error
• Emerging technologies or changes in technologies
• New payment methods 
• Sophisticated criminals 
• Resource constraints and/or talent shortages

Ready for an Excellent AML Compliance Policy? We Can Help 

Our team has crafted many flexible AML policies that can be customized to suit your business needs while following the legal requirements outlined in the Bank Secrecy Act. Adopting and implementing a firm Policy allows you to meet industry expectations and continue your operations smoothly.

We have helped hundreds of businesses launch and operate their BTC ATM businesses and Over-the-Counter (OTC) operations. 

Book your free consultation call today, and we’ll help you confidently navigate all your AML compliance needs.