AML & KYC in USA: 2026 Update

AML & KYC in the USA form one of the world';s most complex and actively enforced compliance frameworks. The Bank Secrecy Act, the Anti-Money Laundering Act, and a growing body of FinCEN rules impose layered obligations on financial institutions, fintechs, and increasingly on non-financial businesses. Recent reforms have expanded the scope of covered entities and introduced new beneficial ownership reporting requirements that affect virtually every small and mid-sized company operating in the country. This guide explains the current framework, the key regulators, the practical steps businesses must take, and the risks of non-compliance.

The Bank Secrecy Act, enacted in 1970 and substantially amended since, is the foundation of AML & KYC in the USA. It requires financial institutions to assist government agencies in detecting and preventing money laundering by maintaining records, filing reports, and implementing internal compliance programmes. The term "financial institution" under the BSA is broad: it covers banks, credit unions, broker-dealers, money services businesses, casinos, insurance companies, and certain other entities.

The Anti-Money Laundering Act of recent years significantly modernised the BSA framework. It directed FinCEN - the Financial Crimes Enforcement Network, the primary AML regulator within the Department of the Treasury - to update its priorities, improve information sharing, and strengthen beneficial ownership rules. FinCEN publishes national AML/CFT priorities that covered institutions must incorporate into their risk-based programmes.

The USA PATRIOT Act added a further layer by requiring financial institutions to implement Customer Identification Programmes. A CIP is the formal KYC mechanism: it mandates that institutions collect, verify, and record identifying information for every customer before or at the time of account opening. The minimum data points include full legal name, date of birth, address, and an identification number such as a tax identification number or passport number.

The Office of the Comptroller of the Currency, the Federal Reserve, the Federal Deposit Insurance Corporation, and the Securities and Exchange Commission each supervise compliance within their respective sectors. Non-compliance can result in civil money penalties, criminal referrals, and reputational damage that is difficult to reverse.

One of the most significant recent developments in AML & KYC in the USA is the implementation of the Corporate Transparency Act. The CTA requires most corporations, limited liability companies, and similar entities formed or registered to do business in the USA to report their beneficial owners to FinCEN. A beneficial owner is any individual who directly or indirectly owns or controls at least 25 percent of the entity, or who exercises substantial control over it.

The reporting obligation covers both domestic and foreign entities registered to operate in the USA. Exemptions exist for large operating companies meeting specific thresholds, regulated entities such as banks and SEC-registered issuers, and certain other categories. Foreign founders and investors should not assume they are exempt simply because the entity is foreign-owned.

Required information for each beneficial owner includes full legal name, date of birth, residential address, and a copy of an acceptable identification document such as a passport or driver';s licence. The same information must be provided for company applicants - the individuals who filed the formation documents.

In practice, many foreign-owned entities underestimate the reach of the CTA. A common mistake is assuming that a single-member LLC with no US operations falls outside the reporting requirement. In most cases it does not, unless a specific statutory exemption applies. Entities must also update their FinCEN reports within 30 days of any change in beneficial ownership or company information.

KYC obligations in the USA go well beyond collecting a passport copy. Under FinCEN';s Customer Due Diligence rule, covered financial institutions must identify and verify the identity of beneficial owners of legal entity customers at the time of account opening. This rule applies to banks, broker-dealers, mutual funds, futures commission merchants, and introducing brokers in commodities.

The CDD rule requires institutions to maintain a risk-based understanding of the nature and purpose of customer relationships and to conduct ongoing monitoring to identify and report suspicious transactions. Enhanced due diligence is required for higher-risk customers, including politically exposed persons, customers from high-risk jurisdictions, and those with complex ownership structures.

Fintechs operating in the USA face the same substantive obligations as traditional banks, though the supervisory pathway may differ. A fintech holding a money transmitter licence in one or more states is a money services business under the BSA and must register with FinCEN, implement a written AML programme, designate a compliance officer, conduct employee training, and undergo independent testing. State-level money transmitter licences add further KYC requirements that vary by state.

A non-obvious requirement for many foreign fintechs entering the US market is that the AML programme must be in place before the business begins operating, not after the first customer is onboarded. Regulators have penalised institutions that launched products and then attempted to retrofit compliance.

The Suspicious Activity Report is the primary mechanism through which financial institutions communicate potential financial crime to law enforcement. Under the BSA, covered institutions must file a SAR with FinCEN within 30 days of detecting a known or suspected violation of law or a suspicious transaction involving at least USD 5,000. The threshold is lower - USD 2,000 - for money services businesses in certain circumstances.

Currency Transaction Reports are a separate obligation. Any financial institution that receives or pays out more than USD 10,000 in currency in a single transaction, or in related transactions, must file a CTR with FinCEN within 15 days. Structuring transactions to avoid the CTR threshold - known as "structuring" - is itself a federal crime regardless of whether the underlying funds are legitimate.

Effective transaction monitoring requires systems calibrated to the institution';s specific risk profile. A common mistake among smaller institutions and fintechs is deploying generic monitoring rules that generate excessive false positives, overwhelming compliance teams and causing genuine suspicious activity to be missed. Regulators expect institutions to tune their systems and document the rationale for alert thresholds.

The USA is a member of the Financial Action Task Force, the international standard-setting body for AML and counter-terrorist financing. FATF';s mutual evaluation of the USA identified areas for improvement, particularly regarding the coverage of certain non-financial businesses and professions. Ongoing legislative and regulatory activity reflects efforts to address those findings.

If your business is assessing its transaction monitoring obligations or building a SAR filing programme, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.

The BSA';s reach extends beyond banks and fintechs. Certain non-financial businesses and professions - referred to as DNFBPs in FATF terminology - are subject to AML obligations in the USA, though the coverage is less comprehensive than in many other jurisdictions.

Casinos and card clubs are fully covered and must implement AML programmes, file SARs and CTRs, and comply with record-keeping requirements. Dealers in precious metals, precious stones, and jewels are covered when they engage in cash transactions above USD 50,000. Real estate professionals, lawyers, and accountants are currently subject to limited formal AML obligations under federal law, though FinCEN has proposed rules that would extend requirements to certain real estate transactions and investment advisers.

The proposed real estate rule, if finalised, would require certain professionals involved in non-financed residential real estate transactions to collect and report beneficial ownership information. This would represent a significant expansion of AML & KYC in the USA beyond the financial sector. Foreign investors acquiring US real estate through shell companies should be aware that geographic targeting orders already require title insurance companies in certain metropolitan areas to identify the natural persons behind purchasing entities.

Investment advisers registered with the SEC are subject to a proposed AML rule that would require them to implement BSA-compliant programmes, file SARs, and apply CDD requirements. The rule, if adopted, would close a significant gap in the US AML framework that FATF has previously highlighted.

In practice, founders of family offices, real estate holding structures, and investment vehicles should not assume they fall outside the AML perimeter. The regulatory direction is clearly toward broader coverage, and building compliance infrastructure early is less costly than retrofitting it under regulatory pressure.

Enforcement of AML & KYC obligations in the USA is robust and well-resourced. The Department of Justice, FinCEN, the OCC, the Federal Reserve, and state regulators all have authority to impose penalties. Civil money penalties can reach tens of millions of dollars for systemic failures. Criminal prosecution of institutions and individuals is not uncommon.

Recent enforcement actions have focused on several recurring themes. Inadequate customer due diligence - particularly for high-risk customers and correspondent banking relationships - has been a consistent finding. Failure to file SARs on a timely basis, or failure to file at all despite clear red flags, has resulted in significant penalties. Deficient AML programmes that exist on paper but are not implemented in practice attract the most severe regulatory responses.

Deferred prosecution agreements and consent orders often require institutions to engage independent monitors for periods of several years. The cost of a monitorship - in management time, legal fees, and operational disruption - frequently exceeds the original penalty. Many underestimate this downstream cost when assessing the risk of non-compliance.

For foreign-owned entities and international groups operating in the USA, a particular risk is the extraterritorial reach of US AML law. Correspondent banking relationships, dollar-clearing arrangements, and US-listed securities can all bring a foreign entity within the jurisdiction of US regulators. Groups with any US nexus should assess their global AML programme against US standards, not only the standards of their home jurisdiction.

What businesses are required to register with FinCEN as money services businesses?

Any business that provides money transmission, currency exchange, cheque cashing, issuance or sale of money orders or traveller';s cheques, or prepaid access products must register with FinCEN as a money services business if it operates in the USA. The registration requirement applies regardless of whether the business holds a state money transmitter licence. Foreign-located MSBs that conduct transactions with US persons are also required to register. Failure to register is a federal crime and can result in criminal prosecution of the business and its principals. Registration must be renewed every two years, and changes in ownership or control must be reported promptly.

How long does it take to build a compliant AML programme, and what does it cost?

The timeline and cost depend heavily on the size and complexity of the business. A basic AML programme for a small fintech or MSB - covering written policies, a compliance officer designation, employee training, and independent testing - can typically be assembled in four to eight weeks with appropriate legal and compliance support. Professional fees for programme development usually start from the low thousands of USD for straightforward businesses and rise significantly for complex institutions. Ongoing costs include annual independent testing, staff training, and technology for transaction monitoring. Institutions that underinvest in compliance infrastructure at launch frequently face much higher remediation costs later, particularly if a regulatory examination identifies deficiencies.

Does the Corporate Transparency Act apply to foreign companies doing business in the USA?

Yes. Foreign entities that are registered to do business in any US state are "reporting companies" under the CTA and must file beneficial ownership information with FinCEN unless a specific exemption applies. The exemptions are narrowly drawn and do not cover most small or mid-sized foreign-owned entities. A foreign company that registers a subsidiary or branch in the USA, or that registers to do business directly, must report its beneficial owners - meaning individuals who own 25 percent or more or who exercise substantial control. The information is filed directly with FinCEN through its secure online system and is not publicly accessible, though it is available to law enforcement and certain other authorised users.

AML & KYC compliance in the USA is a multi-layered obligation that spans federal statutes, FinCEN rules, sector-specific regulations, and state-level requirements. The framework is actively enforced, and the direction of recent reform is toward broader coverage and stricter standards. Businesses entering the US market or expanding their US operations should assess their compliance obligations early and build programmes that reflect the actual risk profile of their activities.

VLO Law Firms advises international clients on AML & KYC matters in the USA. We can assist with compliance programme development, FinCEN registration, Corporate Transparency Act filings, and regulatory risk assessments. To request a consultation, contact: info@vlolawfirm.com