In plain words
Think of an airport. Passengers show a passport at check-in, bags go through a scanner, and staff watch for anything unusual on the way to the gate. If something looks wrong, they call the police rather than deal with it themselves. Anti-money laundering (AML) works the same way for money: check who comes in, watch what moves, and report what looks suspicious.
Money laundering is the process of making money from crime look legitimate. Criminals need bank accounts, wallets and payment apps to do it, so the law makes every regulated financial firm a checkpoint. A fintech with an e-money or payment licence, or one working under someone else’s, is part of that system from the first customer.
The global standard is set by the Financial Action Task Force (FATF), an intergovernmental body whose recommendations most countries turn into law. 2 AML rules usually cover terrorist financing too, and work alongside sanctions rules, which ban dealing with named people, companies and countries.
How it works
How an AML programme works
Four duties that run every day, not a one-off check.
-
1
Assess the risk
The firm writes down which customers, products, countries and channels expose it to money laundering, and sets its controls to match.
-
2
Know the customer
KYC for people, KYB for businesses, and screening against sanctions and PEP lists before the account opens.
-
3
Watch the activity
Transaction monitoring compares what customers do with what was expected and raises alerts for review.
-
4
Report and record
Real suspicions go to the authorities as a suspicious activity report (SAR). Every check and decision is kept for years.
The three stages AML tries to catch
Money laundering is usually described in three stages. Each one leaves a different kind of trace, which is why AML combines several controls rather than relying on one.
- PlacementCriminal money first enters the financial system, for example as cash deposits, card top-ups or payments into newly opened accounts. Onboarding checks and limits on new accounts matter most here.
- LayeringThe money is moved around, often quickly and through many accounts, products or countries, to hide where it came from. Transaction monitoring is the main defence.
- IntegrationThe money comes back out looking legitimate, for example as salary, business income or a property purchase. Understanding a customer’s source of funds helps catch it.
A small fintech rarely sees all three. A wallet or remittance app is most exposed to the first two, which is why regulators look closely at how quickly new products open accounts and move money.
The building blocks regulators expect
In the UK these duties come from the Money Laundering Regulations 2017. 1 Other markets use different words for broadly the same list.
Risk assessment
A written, business-wide assessment of where the money laundering risk sits, kept up to date as the product changes.
Policies and an MLRO
Written policies approved by senior management, and a named MLRO who is accountable for them.
Customer due diligence
Standard checks for most customers and enhanced due diligence for higher-risk ones, including PEPs.
Screening and monitoring
Sanctions screening of customers and payments, and ongoing monitoring of activity.
Reporting
A way for staff to raise concerns internally, and for the MLRO to file reports. Telling a customer about a report can be a criminal offence.
Training and records
Regular staff training, and records of checks, alerts and decisions kept for the period the law sets.
A policy on paper is not an AML programme. Regulators and partner banks ask for evidence that the controls actually run: alerts that were reviewed, decisions with reasons, and reports that were filed on time. We describe what that evidence looks like in the evidence-first MVP blueprint.
AML in the UK, EU and Gulf
| Market | Main rules | What to know |
|---|---|---|
| United Kingdom | Money Laundering Regulations 2017 and the Proceeds of Crime Act 2002 1 | The FCA supervises AML for most fintechs. SARs go to the National Crime Agency |
| European Union | National laws based on the AML directives, moving to a single AML Regulation 3 | The Regulation applies directly in every member state from July 2027. A new EU authority, AMLA, coordinates national supervisors |
| UAE | Federal AML law, with rules from the CBUAE and the free zone regulators | Suspicious transactions are reported to the UAE Financial Intelligence Unit |
| Saudi Arabia | Saudi AML law, with rules from SAMA | Reports go to the national financial intelligence unit. Expect local data and language requirements |
For crypto products the same principles apply, with extra tools such as KYT and the travel rule. The jump in AML scope is one reason stablecoin features change the UAE launch route.
Example: a remittance app spots a pattern
Karim runs compliance at a small remittance app that sends money from the UK to North Africa.
- Onboarding. A new customer passes KYC and says she will send around £300 a month to family.
- Alert. Within two weeks, twelve different people pay money into her wallet and she sends it all straight out to one account abroad. A monitoring rule flags it.
- Review. An analyst looks at the case in the back office. The pattern does not match the stated purpose, and the customer’s explanation does not add up.
- Report. Karim, as MLRO, files a SAR. The team does not tell the customer, and follows the authority’s process before letting any more money move.
- Record. The alert, the review, the decision and the report are all kept, so the firm can show what it did and why.
Common misconceptions
“AML is the licence holder’s job, not ours.”
The licence holder stays responsible, but it relies on your product to collect data, run checks and keep records. If your product cannot, the partnership is at risk.
“Good KYC means we are covered.”
KYC only tells you who the customer was on day one. Most laundering shows up later, in how the account is used.
“More alerts mean better AML.”
Thousands of alerts that nobody can review properly are a weakness, not a strength. Regulators look at quality and follow-through.
FAQ
What does AML mean in banking?
AML stands for anti-money laundering. It is the set of laws and internal controls that banks, e-money and payment firms use to stop criminals from moving or hiding the proceeds of crime through their accounts.
What are the three stages of money laundering?
Placement, when criminal cash first enters the financial system; layering, when it is moved around to hide where it came from; and integration, when it comes back out looking like legitimate money. AML controls try to catch it at each stage.
What is the difference between AML and KYC?
KYC is about knowing who your customer is. AML is the wider programme that includes KYC, plus sanctions screening, transaction monitoring, reporting suspicious activity, staff training and record keeping.
Who is responsible for AML in a fintech?
The firm's senior management is responsible overall, and a named Money Laundering Reporting Officer (MLRO) is accountable for the AML programme and for reporting suspicions to the authorities. If you work under a partner's licence, the partner remains responsible and will impose its own AML standards on you.
What happens if a fintech fails at AML?
Regulators can impose fines, restrict the business or withdraw its licence, and individuals can face personal consequences. Partner banks and EMIs may also end the relationship, which can stop a product overnight.
What is the new EU AML package?
A set of EU laws adopted in 2024: a single AML Regulation that applies directly in every member state from July 2027, a new AML directive, and a new EU authority, AMLA, that coordinates national supervisors and will directly supervise some of the riskiest firms.
Sources
-
1
LG
legislation.gov.uk The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017
https://www.legislation.gov.uk/uksi/2017/692/contents -
2
F
FATF Financial Action Task Force
https://www.fatf-gafi.org/ -
3
EL
EUR-Lex Regulation (EU) 2024/1624 on preventing the use of the financial system for money laundering or terrorist financing
https://eur-lex.europa.eu/eli/reg/2024/1624/oj
