Anti-money laundering (AML) and counter-financing of terrorism (CFT) compliance has never been more complex — or more consequential. With regulatory frameworks evolving across jurisdictions and enforcement agencies intensifying their scrutiny of financial institutions and corporates alike, organisations need a clear, current understanding of what AML/CFT compliance demands and how to meet it.
This article provides a comprehensive overview of AML/CFT regulatory requirements and practical compliance obligations for financial institutions and corporate organisations operating in today’s global environment.
What Are AML/CFT Regulations?
AML (Anti-Money Laundering) and CFT (Counter-Financing of Terrorism) regulations are legal and regulatory frameworks designed to prevent criminals from disguising illegally obtained funds as legitimate income, and to block the flow of funds to terrorist organisations. Together, they form the cornerstone of the global financial crime compliance infrastructure.
The principal international standard-setter is the Financial Action Task Force (FATF), whose Recommendations form the basis for national AML/CFT legislation in over 200 jurisdictions. Key regional frameworks include the EU’s Anti-Money Laundering Directives (currently the 6th AMLD), the US Bank Secrecy Act and FinCEN regulations, and the UK’s Proceeds of Crime Act and Money Laundering Regulations.
Core Compliance Obligations
1. Customer Due Diligence (CDD)
All regulated entities must identify and verify the identity of their customers and, where applicable, the beneficial owners of legal entities. This includes applying Enhanced Due Diligence (EDD) to higher-risk customers such as Politically Exposed Persons (PEPs), customers from high-risk jurisdictions, and those involved in complex or unusual transactions.
2. Transaction Monitoring
Organisations must maintain systems capable of detecting and flagging unusual or suspicious transaction patterns. This requires both technology-driven monitoring tools and human review processes — and those systems must be regularly tested and validated against current risk typologies.
3. Suspicious Activity Reporting (SAR)
Where suspicious activity is identified, regulated entities are legally obligated to file Suspicious Activity Reports (SARs) — or Suspicious Transaction Reports (STRs) — with the relevant Financial Intelligence Unit (FIU). Failure to file is itself a criminal offence in most jurisdictions.
4. Record-Keeping
Regulated entities must maintain records of customer identification information and transaction data for a minimum period — typically five years — and make those records available to regulators on request.
5. AML Programme Infrastructure
Regulated organisations must have a written AML programme in place, including policies and procedures, a designated compliance officer, a risk assessment framework, staff training, and an independent audit or testing function.
Common Compliance Gaps and How to Address Them
Despite significant investment in AML programmes, regulators continue to identify recurring deficiencies across the industry. The most common include:
- Inadequate customer risk rating — Risk segmentation that fails to reflect true exposure, particularly for high-risk geographies and PEP relationships.
- Transaction monitoring gaps — Outdated models that generate excessive false positives while missing genuine red flags.
- Insufficient EDD — Superficial enhanced due diligence that meets the letter but not the spirit of regulatory requirements.
- Weak governance — Compliance functions that lack the authority, resources, or board-level engagement to operate effectively.
- Inadequate training — Front-line staff who cannot recognise the red flags they are expected to escalate.
The Regulatory Enforcement Landscape
AML enforcement has intensified substantially over the past decade. Regulators in the US, UK, EU, and beyond have imposed record fines on financial institutions for AML programme failures — with penalties reaching billions of dollars in the most serious cases. Beyond financial penalties, institutions face deferred prosecution agreements, licence restrictions, reputational damage, and in some cases, criminal liability for senior individuals.
The regulatory message is clear: AML compliance is not a box-ticking exercise. It requires genuine programme effectiveness, evidence-based risk management, and a culture of compliance from the top of the organisation down.
How Baretzky & Partners Can Help
Baretzky & Partners LLP offers specialist AML advisory services across the full compliance lifecycle — from programme design and KYC framework development through to regulatory response and remediation. Our advisors bring direct regulatory and operational experience across the FATF, EU, US, and UK frameworks.
If your organisation is facing an AML programme review, regulatory inquiry, or simply wants to benchmark and strengthen its current controls, speak with our AML team or contact us directly.
Baretzky & Partners LLP is a multinational risk mitigation and cyber intelligence advisory firm with specialist AML and financial crime advisory practices operating across 116 countries.