Global AML regulations are the interlocking set of international standards, regional laws, and national statutes that require financial institutions and certain other businesses to verify who their customers are, monitor their transactions, report suspicious activity, and keep records that let investigators trace illicit money years later. The framework starts with the Financial Action Task Force’s 40 Recommendations and reaches individual businesses through instruments like the EU’s 2024 Anti-Money Laundering Regulation and the U.S. Bank Secrecy Act. Non-compliance carries prison terms of up to 20 years in the United States and institutional fines that routinely run into tens of millions of dollars.
Where the Rules Come From
The Financial Action Task Force was organized by the G-7 in 1989 and functions as the international standard-setter for anti-money laundering, counter-terrorist financing, and counter-proliferation financing.1U.S. Department of the Treasury. Financial Action Task Force It has 39 member countries and nine regional bodies, and between them they cover almost every jurisdiction on earth. Its 40 Recommendations are the document each member is expected to translate into domestic law.
Countries are graded on how well they do that. FATF mutual evaluations are peer reviews in which experts from other member countries spend roughly 18 months examining a nation’s laws, regulations, and enforcement in practice, culminating in an on-site visit and a report to the full plenary.2Financial Action Task Force. Mutual Evaluations The evaluated country has no vote on its own ratings.
The Recommendations are revised as new threats emerge. In 2018, the FATF added definitions for “virtual asset” and “virtual asset service provider” to Recommendation 15. In February 2025, it revised the risk-based approach standards to emphasize proportionality, pushing countries to allow simplified measures in genuinely lower-risk areas.3Financial Action Task Force. The FATF Recommendations
What Grey and Black Listing Mean
The FATF publishes two lists that function as global warnings. The grey list, formally “Jurisdictions under Increased Monitoring,” identifies countries with strategic deficiencies that have committed to fixing them on an agreed timetable. As of February 2026, 22 jurisdictions sit on the grey list.4Financial Action Task Force. Jurisdictions under Increased Monitoring – 13 February 2026 Grey-listed countries typically see higher transaction costs, increased scrutiny from correspondent banks, and difficulty attracting foreign investment.
The black list, “High-Risk Jurisdictions subject to a Call for Action,” is far more severe. As of February 2026, three jurisdictions carry that designation: the Democratic People’s Republic of Korea, Iran, and Myanmar.5Financial Action Task Force. High-Risk Jurisdictions Subject to a Call for Action – 13 February 2026 The FATF calls on all member countries to apply enhanced due diligence to transactions involving these jurisdictions and, in some cases, to apply countermeasures that can effectively cut a country off from the global banking system.
How Global Standards Reach Businesses
FATF standards do not bind a private institution directly. They reach businesses through regional bodies and national statutes.
The European Union
Directive (EU) 2018/1673, the 6th Anti-Money Laundering Directive, harmonized the definition of money laundering offenses across member states and set a broad list of predicate crimes running from drug trafficking and tax offenses through cybercrime and environmental crime. Serious laundering offenses must carry a maximum prison sentence of at least four years.6EUR-Lex. Directive (EU) 2018/1673
In 2024, the EU went further. Regulation (EU) 2024/1624, the Anti-Money Laundering Regulation, replaces the previous directive-based approach with directly applicable rules and eliminates much of the fragmented national implementation that undermined earlier efforts.7EUR-Lex. Regulation (EU) 2024/1624 – AMLR The package also establishes the Anti-Money Laundering Authority (AMLA), a centralized EU body with direct supervisory powers, and introduces a union-wide limit on large cash payments of EUR 10,000. Member states may set a lower threshold.
The United States
The U.S. framework is built on the Bank Secrecy Act. Banks must file Currency Transaction Reports for cash transactions above $10,000 conducted by or on behalf of a single person in a day.8Financial Crimes Enforcement Network. Notice to Customers – A CTR Reference Guide Businesses outside the banking sector that receive more than $10,000 in cash from a single transaction, or from related transactions within 12 months, must file Form 8300 with the IRS and FinCEN.9Internal Revenue Service. Understand How to Report Large Cash Transactions “Cash” for that purpose includes cashier’s checks, bank drafts, and money orders with a face value of $10,000 or less when the recipient knows the payer is trying to avoid the reporting threshold.
Beneficial ownership reporting under the Corporate Transparency Act has narrowed significantly. In March 2025, FinCEN issued an interim final rule exempting all entities created in the United States. Only entities formed under foreign law that have registered to do business in a U.S. state or tribal jurisdiction remain subject to the reporting requirement.10Financial Crimes Enforcement Network. Beneficial Ownership Information Reporting
What Financial Institutions Have To Do
The core operational obligation is customer due diligence. FATF Recommendation 10 requires financial institutions to verify the identity of every customer when establishing a business relationship and for occasional transactions above USD/EUR 15,000.11Financial Action Task Force. The FATF Recommendations The process, commonly called Know Your Customer, means collecting identifying information, verifying it against independent sources, understanding the purpose of the relationship, and monitoring the account on an ongoing basis.
Beneficial Ownership
When the customer is a legal entity, institutions must identify the natural persons who ultimately own or control it. The common threshold for controlling ownership is 25 percent of shares or voting rights, though some jurisdictions set it lower. The EU’s 2024 regulation keeps the 25 percent baseline but authorizes member states to lower it to as little as 15 percent for higher-risk sectors.7EUR-Lex. Regulation (EU) 2024/1624 – AMLR In the United States, FinCEN’s customer due diligence rule uses the 25 percent threshold for the ownership prong.12FFIEC BSA/AML InfoBase. Beneficial Ownership Requirements for Legal Entity Customers
Where no one meets the ownership threshold, the institution identifies whoever exercises control through other means. If that fails too, it identifies the senior managing official. The layered approach is designed to keep criminals from hiding behind shell companies and layered trusts where no single person appears to own enough to trigger scrutiny.
Politically Exposed Persons
PEPs are individuals entrusted with a prominent public function: heads of state, senior politicians, senior government officials, judges, military officers, and senior executives of state-owned corporations. The designation extends to family members and known close associates.13Financial Action Task Force. Politically Exposed Persons (Recommendations 12 and 22) Foreign PEPs are always treated as high-risk. Enhanced measures include senior management approval for the relationship, investigation into the source of wealth and funds, and intensified ongoing monitoring.
Enhanced and Simplified Due Diligence
Standard due diligence covers most customers. Enhanced measures apply to customers from high-risk jurisdictions, unusually large or complex transactions, PEPs, and any relationship where the risk assessment calls for it. Enhanced measures usually mean more documentation on source of wealth, source of funds for specific transactions, and more frequent transaction monitoring.
Simplified due diligence is permitted only for genuinely low-risk relationships, such as publicly traded companies subject to disclosure requirements or transparent government bodies. The 2025 FATF revisions push countries to actively encourage simplified measures in low-risk scenarios rather than defaulting to full checks everywhere.
Virtual Assets and the Travel Rule
Cryptocurrency and other virtual assets are covered by the same framework. Exchanges, custodial wallet providers, and platforms that facilitate transfers of digital tokens are treated as virtual asset service providers.
The Travel Rule is codified in FATF Recommendation 16. As updated at the June 2025 plenary, it requires standardized originator and beneficiary information (name, address, and date of birth) to accompany cross-border peer-to-peer payments above USD/EUR 1,000.14Financial Action Task Force. FATF Updates Standards on Recommendation 16 on Payment Transparency Implementation dates differ. Australia’s Travel Rule regulations take effect on July 1, 2026, with no minimum transaction threshold and mandatory verification for self-hosted wallets. Some EU member states have already been enforcing similar requirements under the Transfer of Funds Regulation.
Compliance is operationally difficult. Unlike traditional bank wires, where SWIFT messaging already carries sender and receiver details, virtual asset transfers often lack a built-in messaging layer, so service providers must adopt interoperable protocols to transmit the required information alongside the transfer.
Reporting Suspicious Activity
Each country designates a Financial Intelligence Unit as the central agency for receiving, analyzing, and disseminating suspicious transaction reports.15Egmont Group. Financial Intelligence Units Banks, money service businesses, casinos, real estate professionals, and other regulated entities file these reports when activity does not fit a customer’s known profile or appears designed to evade reporting thresholds. The FIU analyzes the data, looks for patterns individual institutions cannot see on their own, and refers credible threats to law enforcement.
A bank does not report suspicious activity directly to the police; it reports to the FIU, which then decides what warrants a criminal referral. The Egmont Group connects FIUs across borders through a secure platform for exchanging financial intelligence when illicit funds move between jurisdictions.16Financial Crimes Enforcement Network. FinCEN Statement Noting the Release of the Egmont Groups White Paper
Records You Must Keep
AML frameworks require institutions to keep records for years after a customer relationship ends. Under the U.S. Bank Secrecy Act, the Secretary of the Treasury can require records to be retained for up to five years.17eCFR. 31 CFR 1010.410 – Records To Be Made and Retained by Financial Institutions The EU’s 2024 AML Regulation similarly mandates retention periods to ensure records are available for cross-border investigations. The requirement covers customer identification documents, transaction records, and the analysis performed during due diligence.
Penalties for Non-Compliance
Criminal Penalties for Individuals
In the United States, the primary money laundering statute carries a maximum sentence of 20 years in prison and a fine of up to $500,000 or twice the value of the property involved in the transaction, whichever is greater.18Office of the Law Revision Counsel. 18 U.S. Code 1956 – Laundering of Monetary Instruments A related statute covering monetary transactions in criminally derived property carries up to 10 years in prison, with a potential fine of up to twice the amount involved.19Office of the Law Revision Counsel. 18 USC 1957 – Engaging in Monetary Transactions in Property Derived From Specified Unlawful Activity
Within the EU, the 6th Anti-Money Laundering Directive requires member states to set maximum prison terms of at least four years for serious laundering offenses.6EUR-Lex. Directive (EU) 2018/1673 Many member states set their actual maximums considerably higher. The directive also allows prosecution of legal entities, which can face fines, exclusion from public contracts, or judicial winding-up.
Institutional Penalties
Civil penalties against institutions that fail to maintain adequate AML programs frequently dwarf criminal fines. In one recent example, in March 2026 the SEC and FinCEN imposed combined penalties of $80 million against a broker-dealer for sweeping AML and Bank Secrecy Act compliance failures, with $35 million payable directly to the Treasury.
Cross-Border Enforcement
When investigators need to freeze accounts, seize property, or compel testimony abroad, they work through mutual legal assistance treaties and two foundational UN conventions. The 1988 Vienna Convention required countries to criminalize the laundering of drug trafficking proceeds.20United Nations Office on Drugs and Crime. Money Laundering and the Financing of Terrorism The 2000 Palermo Convention extended that obligation to the proceeds of all serious crimes and built out the frameworks for extradition, mutual legal assistance, and law enforcement cooperation still in use today.21United Nations Office on Drugs and Crime. United Nations Convention Against Transnational Organized Crime and the Protocols Thereto
Asset recovery in practice is slow. Proving in a foreign court that specific funds came from criminal activity involves complex litigation, differing standards of evidence, and often years of proceedings. When assets are recovered, they may be shared between cooperating countries or returned to the victims of the underlying crime.