Anti-Money Laundering and FinTech

Anti-money laundering (AML) and FinTech is the legal framework for preventing the money laundering (ML) and the terrorist financing (TF) in the financial technology. The framework — the FATF (the Financial Action Task Force, the 40 recommendations), the BSA (the Bank Secrecy Act, the US), the AMLD (the EU Anti-Money Laundering Directives, 1–6), the FinCEN (the US), and the national FIUs — is the comprehensive.

The framework has the dual obligation. The first is the customer due diligence (the KYC — the Know Your Customer, the CDD — the Customer Due Diligence, the EDD — the Enhanced Due Diligence), the identification form. The second is the reporting (the SAR — the Suspicious Activity Report, the STR — the Suspicious Transaction Report, the CTR — the Currency Transaction Report), the detection form.

This page covers the FATF standards, the KYC/CDD obligations, the suspicious activity reporting, the FinTech AML challenges, the RegTech transformation, and the practical compliance.

The FATF is the global standard. The Financial Action Task Force (the FATF, the 1989, the 39 members, the 40 recommendations) is the global standard for the AML/CFT, and it sets the recommendations. The 200+ countries commit.

The risk-based approach is the core. The FATF's risk-based approach (the RBA) requires the financial institutions to assess the ML/TF risk (the customer, the product, the geography, the channel) and the mitigate.

The mutual evaluation is the enforcement. The FATF's mutual evaluation (the peer review, the country assessment) and the "gray list" (the jurisdictions under the increased monitoring) and the "black list" (the high-risk jurisdictions) are the enforcement.

The KYC is the identification. The Know Your Customer (the KYC) is the identification of the customer: the CIP (the Customer Identification Program — the name, the DOB, the address, the ID number), the verification (the document, the non-document, the biometric).

The CDD is the due diligence. The Customer Due Diligence (the CDD) is the understanding of the customer: the purpose of the relationship, the nature of the business, the source of funds, the source of wealth, the beneficial ownership (the UBO — the Ultimate Beneficial Owner, the 25% threshold).

The EDD is the enhanced. The Enhanced Due Diligence (the EDD) is the deeper for the high-risk: the PEP (the Politically Exposed Person), the high-risk jurisdiction, the high-risk product, the high-risk customer.

The SAR is the report. The Suspicious Activity Report (the SAR, the US) and the Suspicious Transaction Report (the STR, the international) is the report of the suspicious transaction — the known or the suspected violation, the $5K+ (the US threshold).

The FIU is the recipient. The Financial Intelligence Unit (the FIU — the FinCEN in the US, the UK FIU, the India FIU-IND) is the recipient of the SAR/STR, and it analyzes and the disseminates to the law enforcement.

The CTR is the related. The Currency Transaction Report (the CTR, the $10K+ in the US) is the report of the large currency transaction, and the Structuring (the "smurfing" — the breaking of the transaction to avoid the CTR) is the crime.

The digital onboarding is the challenge. The FinTech (the digital, the remote, the no-branch) has the AML challenge: the digital onboarding (the no face-to-face, the identity verification), the digital KYC (the eKYC, the video KYC, the biometric), and the digital CDD (the API, the data, the automation).

The crypto is the challenge. The crypto (the Bitcoin, the Ethereum, the DeFi, the NFT) has the AML challenge: the pseudonymity (the no-name, the wallet address), the cross-border (the no-jurisdiction), the mixer (the Tornado Cash, the anonymity), the DeFi (the no-intermediary). The FATF's "travel rule" (the VASP — the Virtual Asset Service Provider) is the response.

The speed is the challenge. The FinTech (the real-time, the instant, the 24/7) has the AML challenge: the real-time screening (the sanctions, the PEP, the adverse media), the real-time decision (the approve, the reject, the review), the real-time reporting (the SAR/STR).

The RegTech is the technology. The RegTech (the Regulatory Technology) is the technology for the AML/CFT: the AI/ML (the anomaly detection, the transaction monitoring, the risk scoring), the blockchain (the immutable, the traceable), the API (the data, the integration), the cloud (the scale, the cost).

The AI/ML is the core. The AI/ML (the anomaly detection — the unusual pattern, the transaction monitoring — the rule + the ML, the risk scoring — the dynamic) is the core RegTech for the AML/CFT. The false positive is the challenge, and the tuning is the response.

The KYC utility is the related. The KYC utility (the shared, the centralized — the KYC, the CDD, the UBO) is the related RegTech, and it reduces the duplication (the customer, the institution).

The practical compliance has four elements. First, the risk assessment: the FinTech must assess the ML/TF risk and the risk-based approach. Second, the KYC/CDD: the FinTech must perform the KYC (the CIP), the CDD (the UBO, the source of funds), the EDD (the PEP, the high-risk).

Third, the monitoring: the FinTech must monitor the transactions (the real-time, the AI/ML, the anomaly detection) and the report (the SAR/STR, the CTR). Fourth, the governance: the FinTech must build the AML/CFT governance (the AML officer, the policy, the training, the audit, the regulator).

The strategic point is that the AML/CFT for the FinTech is a risk-based, technology-enabled, lifecycle, not a one-time. The FinTech that builds the risk assessment, the KYC/CDD, the monitoring, and the governance into the lifecycle is the one that prevents.