AML/CFT Programme Policy Template (AMLR, BSA, MLR 2017)

AML/CFT Programme Policy: [Institution name]

The board-approved policy that sets up an institution's anti-money laundering and countering the financing of terrorism (AML/CFT) programme: legal basis, governance and the money laundering reporting officer (MLRO), business-wide risk assessment, customer due diligence, monitoring and suspicious activity reporting, targeted financial sanctions, record keeping, training, independent testing, group-wide controls and review. Based on public law as of 2026-10: the EU Anti-Money Laundering Directive (Directive (EU) 2015/849 as amended by Directive (EU) 2018/843, applied through national law until 2027-07-09) shown side by side with the EU Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624, applies from 2027-07-10), the US Bank Secrecy Act programme rule for banks (31 CFR 1020.210), the FinCEN AML/CFT programme proposal of 2026-04-07 (a proposal, not law), and the UK Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017). FATF Recommendations are cited by number and title only. Replace every [bracketed] value and every row marked Example. This is a document format, not legal, regulatory or financial advice. Obtain the law or standard for the normative text and check local law.

Document control

Approvals

Revision history

Contents

• 1. Purpose, scope and legal basis
• 2. Policy statement and risk appetite
• 3. Governance, roles and responsibilities
• 4. Business-wide risk assessment
• 5. Customer due diligence
• 6. Ongoing monitoring
• 7. Suspicious activity reporting and confidentiality
• 8. Targeted financial sanctions and proliferation financing
• 9. Record keeping
• 10. Training, awareness and staff screening
• 11. Independent testing and audit
• 12. Group-wide policies and information sharing
• 13. Management information, breaches and exceptions
• 14. Regulatory change and AMLR transition
• 15. Related procedures and templates
• 16. Glossary and references
• Standard and licence note

1. Purpose, scope and legal basis

1.1 Purpose

This policy sets the minimum standards that [Institution name] applies to prevent its products, services and staff from being used for money laundering (ML), terrorist financing (TF), proliferation financing (PF) and the non-implementation or evasion of targeted financial sanctions. It establishes the AML/CFT programme required by the laws listed in section 1.3, names who is accountable for each part of it, and sets how the programme is approved, tested and kept current.

The policy is binding on all employees, directors, temporary staff, agents and distributors of the entities listed in section 1.2. Where a local law sets a stricter standard than this policy, the local standard applies and the local MLRO records the difference in the group deviations register (section 12). Where this policy is stricter than local law, this policy applies unless local law forbids it.

1.2 Entities in scope

1.3 Legal basis (as of 2026-10, check local law)

FinCEN published a notice of proposed rulemaking on 2026-04-07 (Docket FINCEN-2026-0034) that would restate the programme requirement as an "effective, risk-based, and reasonably designed" programme, make a documented risk assessment process explicit, and require the risk assessment to take account of the national AML/CFT priorities. The comment period closed on 2026-06-09 and the proposed effective date is twelve months after a final rule. Until a final rule is published, the US branch continues to apply 31 CFR 1020.210 as it stands. Treat the proposal as a planning input only.

2. Policy statement and risk appetite

[Institution name] has no appetite for knowingly facilitating money laundering, terrorist financing, proliferation financing or sanctions breaches. It accepts that some residual financial crime risk remains in any banking business and manages that risk within the limits approved in the risk appetite statement. It will not enter into, or will exit, a relationship whose risk it cannot understand, mitigate and monitor with its existing controls.

The following relationships are prohibited across the group, regardless of rating, approval level or commercial value:

The board sets the quantitative financial crime metrics in the risk appetite statement (Risk Appetite Statement (finance/risk-appetite-statement), metric RAS-CMP-01, overdue periodic reviews of high-risk customers). The MLRO reports performance against those metrics monthly (section 13).

3. Governance, roles and responsibilities

The management body is ultimately responsible for the programme. It approves this policy and the business-wide risk assessment, allocates resources, and receives at least one annual report on the effectiveness of AML/CFT controls. One member of the management body in its management function is appointed as compliance manager; that person ensures that the programme is implemented, resourced and proportionate to the risks, and reports to the management body on its implementation.

The MLRO (the compliance officer under AMLR Art. 11(3) and the nominated officer under UK MLR 2017) has sufficient seniority, independence and access to information to run the programme. The MLRO is the contact point for supervisors and for the financial intelligence unit (FIU), decides on external suspicious activity reports, and may escalate any concern directly to the management body and its supervisory function. Removal of the MLRO requires prior notice to the management body and notice to the supervisor.

The compliance functions receive staff, data and technology proportionate to the size, nature and risk of the business. The MLRO proposes the annual resourcing plan; the compliance manager presents it to the management body together with any gap between required and available resources. Commercial targets never form part of the MLRO's or financial crime compliance staff's variable remuneration.

4. Business-wide risk assessment

The MLRO prepares a documented business-wide (enterprise-wide) ML/TF risk assessment that also covers proliferation financing and the risk of non-implementation or evasion of targeted financial sanctions. It considers customers, products and services, transactions, delivery channels and geographies, and uses the supranational, national and sectoral risk assessments, FATF publications, supervisory communications and, for the US branch, the national AML/CFT priorities. The method and the current results are recorded in the AML Business-Wide Risk Assessment (compliance/aml-business-risk-assessment).

The management body approves the assessment at least annually. The MLRO updates it earlier when a trigger occurs: a new product, service, delivery channel or technology; entry into a new country or customer segment; a material change in a national or supranational risk assessment; a significant supervisory finding; or a material incident. Before any new product or channel is launched, the product approval process requires a documented ML/TF/sanctions risk assessment signed by the MLRO.

The results of the assessment feed the customer risk rating methodology, the transaction monitoring coverage plan, the sanctions screening scope, the training plan and the independent testing plan. Each high residual risk in the assessment must have a remediation action with an owner and a due date.

5. Customer due diligence

5.1 When CDD applies

The institution applies customer due diligence when it establishes a business relationship; when it carries out an occasional transaction at or above the threshold set in applicable law; when there is a suspicion of ML or TF regardless of any threshold or exemption; and when it doubts the accuracy or adequacy of identification data obtained earlier. No account is opened and no transaction is executed for a new customer until identity verification is complete, except where applicable law expressly allows verification during the establishment of the relationship and the MLRO has approved that exception in the CDD procedure.

5.2 Minimum CDD measures

For every customer the institution identifies the customer and verifies identity using reliable, independent sources, including qualified electronic identification where available. It identifies the beneficial owners, takes reasonable measures to verify them and understands the ownership and control structure. It obtains information on the purpose and intended nature of the relationship and on the customer's business or occupation, checks the customer and beneficial owners against sanctions lists, determines whether any of them is a politically exposed person (PEP), a family member or a known close associate, and verifies the authority and identity of anyone acting on the customer's behalf.

For the US branch, the customer identification programme under 31 CFR 1020.220 and the beneficial ownership requirements for legal entity customers under 31 CFR 1010.230 apply in addition, as set out in the US addendum. The result of CDD is a customer profile recorded using the KYC/CDD Customer Profile (compliance/kyc-cdd-profile).

5.3 Risk-based extent: simplified and enhanced due diligence

Each customer receives a risk rating under the Customer Risk Rating Methodology (compliance/customer-risk-rating-methodology). The rating sets the CDD level and the periodic review frequency.

Enhanced due diligence applies to all PEPs, their family members and known close associates, whether the PEP is domestic, foreign or holds a prominent function in an international organisation (EU law, now and under the AMLR, and UK law make no domestic or foreign distinction for applying EDD; US branch: senior foreign political figures for private banking accounts under 31 CFR 1010.620); to customers connected with high-risk third countries identified by the European Commission; to cross-border correspondent relationships with respondent institutions outside the EU (US branch: 31 CFR 1010.610); to private banking accounts for non-US persons at the US branch (31 CFR 1010.620); to complex or unusually large transactions without an apparent economic purpose; and to any customer the methodology rates high. EDD includes establishing source of wealth and source of funds, senior management approval and enhanced ongoing monitoring, documented using the EDD Memo (compliance/edd-memo). For UK business, MLR 2017 reg. 35(3A) (inserted by SI 2023/1371 from 2024-01-10) makes a lower level of risk the starting point for domestic PEPs, their family members and known close associates, so the extent of EDD is normally less than for a non-domestic PEP unless other enhanced risk factors are present; EDD itself still applies. Correspondent relationships are assessed with the Correspondent Banking Due Diligence (compliance/correspondent-banking-due-diligence) template.

5.4 Reliance and outsourcing

The institution may rely on another obliged entity for identification and verification only where the law allows it and the relying business line has confirmed that the third party is supervised for AML/CFT, will provide copies of CDD data without delay, and is not established in a high-risk third country. Responsibility for CDD stays with the institution. Outsourced CDD tasks are governed by a written agreement that gives the MLRO audit and access rights, and the vendor is included in the outsourcing register and the independent test plan.

5.5 Inability to complete CDD

If CDD cannot be completed, the institution does not open the account, does not carry out the transaction and terminates any existing relationship, subject to legal constraints on exiting (for example payment account access rights). The first line records the reason and the MLRO considers whether a suspicious activity report is required.

6. Ongoing monitoring

The institution monitors each business relationship throughout its life. It scrutinises transactions to confirm that they are consistent with what it knows of the customer, the customer's business and risk profile and, where necessary, the source of funds. It keeps documents, data and information up to date on a risk-based cycle (section 5.3) and on events: a change in ownership, control, activity or residence; an alert or investigation outcome; a production order; or an adverse media hit.

Automated transaction monitoring covers all products and channels identified as in scope in the coverage plan. Each scenario is documented with its typology, logic, parameters, data inputs, tuning history and validation results using the Transaction Monitoring Scenario Specification (compliance/transaction-monitoring-scenario-spec). The transaction monitoring and screening systems are classified as models where they meet the institution's model definition and are tiered, validated and monitored under the Model Risk Management Policy (finance/model-risk-management-policy).

7. Suspicious activity reporting and confidentiality

Every employee who knows or suspects, or has reasonable grounds to suspect, that funds are the proceeds of criminal activity or are related to terrorist financing must report it promptly to the MLRO through the internal unusual activity report channel. Staff do not investigate on their own and do not discuss the matter with the customer or with colleagues who do not need to know. Reporting to the MLRO discharges the employee's personal reporting obligation where the law provides this.

The MLRO, or a delegate with written authority, assesses each internal report and decides whether to file an external report with the FIU. Decisions not to file are recorded with a short rationale. External reports are filed within the deadlines in applicable law; for the US branch, a SAR is filed under 31 CFR 1020.320 within 30 calendar days after initial detection of facts that may constitute a basis for filing (with the extensions the rule allows when no suspect is identified). Narratives are prepared with the SAR/STR Narrative (compliance/sar-str-narrative) template.

Where a transaction is suspected of being related to ML or TF, the institution refrains from carrying it out until it has reported to the FIU and complied with any instruction, unless refraining is impossible or would frustrate an investigation. The existence and content of a report, and the fact that an analysis is under way, are confidential. Disclosure to the customer or a third party (tipping off) is prohibited and is a disciplinary matter and, in many jurisdictions, a criminal offence. Information on reports is shared within the group only under the group information sharing rules in section 12.

8. Targeted financial sanctions and proliferation financing

The institution complies with the United Nations, European Union, Member State, United States (for the US branch and for any US-dollar activity that touches US persons) and, where relevant, United Kingdom sanctions regimes. It screens customers, beneficial owners, authorised persons and relevant counterparties at onboarding, on every list update and on any change in customer data, and screens payments and trade documents before execution. It also checks whether sanctioned persons own or control a legal entity customer.

A confirmed match leads to immediate freezing or rejection as the regime requires, and to reporting to the competent authority within the applicable deadline. Licences and exemptions are applied only after written confirmation from the sanctions team. The restrictive measures exposure assessment expected by EBA/GL/2024/14 forms part of the business-wide risk assessment and of the Sanctions Exposure Assessment (compliance/sanctions-exposure-assessment). Operating rules are in the Sanctions Compliance Procedure (compliance/sanctions-compliance-procedure).

Proliferation financing risk is assessed as a distinct risk area. Customers trading in dual-use goods, operating in sectors exposed to proliferation networks, or shipping through transit hubs used for circumvention receive enhanced scrutiny, including review of end-user and end-use information on trade finance transactions.

9. Record keeping

The institution keeps CDD documents and information, the assessments and decisions on internal and external suspicious activity reports, and transaction records sufficient to reconstruct individual transactions. Records are kept for five years after the end of the business relationship or the date of the occasional transaction, unless applicable law or a competent authority requires a longer period, and are then deleted in line with data protection law. Where a legal proceeding or authority request is pending, the MLRO places a legal hold.

The retention schedule is maintained in the institution's records schedule (ISO 15489 Records Retention Schedule (compliance/iso-15489-records-schedule)) and the data protection record of processing (GDPR Record of Processing Activities (compliance/gdpr-ropa)).

10. Training, awareness and staff screening

All staff receive AML/CFT and sanctions training on joining and at least annually, adapted to their role and the risks they face. Staff in high-risk roles (onboarding, relationship management for high-risk segments, payments operations, trade finance, monitoring and investigations) receive additional specialist training. The management body receives annual training on its responsibilities, the results of the business-wide risk assessment and emerging typologies.

Completion rates are reported monthly; staff who miss the deadline lose system access to high-risk processes until training is complete. Employees, agents and distributors in roles relevant to AML/CFT are screened before appointment and periodically for integrity and good repute, proportionate to the role.

11. Independent testing and audit

Internal audit, or a qualified external party where internal audit lacks the expertise, independently tests the design and operating effectiveness of the programme. The test covers the risk assessment, CDD and EDD, monitoring and reporting, sanctions, record keeping, training and governance, and re-performs samples of files and decisions. The frequency is risk-based and at least every [12 to 18] months for the parent and the US branch.

Results are reported directly to the audit committee and to the management body, with management responses and due dates. The MLRO tracks remediation and reports overdue findings monthly. Test results are documented in the AML Independent Test Report (compliance/aml-independent-test-report); the audit plan sits in the Internal Audit Charter and Plan (compliance/internal-audit-charter-and-plan).

12. Group-wide policies and information sharing

Each subsidiary and branch adopts this policy, or a local policy at least as strict, within [60] days of group approval and records any deviation required by local law in the group deviations register with the group MLRO's approval. Where a third country's law prevents the application of group standards, the group MLRO informs the home supervisor and applies additional measures to manage the risk, up to exiting the activity.

Information on customers, beneficial owners, accounts and transactions, including information on suspicious activity reports where the law allows, is shared within the group for AML/CFT purposes under the group data sharing protocol, with data protection safeguards and confidentiality controls. The US branch may share information with other US financial institutions under the voluntary information sharing provisions of section 314(b) of the USA PATRIOT Act (31 CFR 1010.540) after giving the required notice to FinCEN, and responds to 314(a) requests (31 CFR 1010.520) within the stated deadline.

13. Management information, breaches and exceptions

The MLRO reports monthly to the compliance manager and quarterly to the management body on the following indicators, with commentary on trends and actions. At least annually the MLRO submits a written report on the effectiveness of the programme, the results of the risk assessment, resource adequacy and the status of remediation.

A breach of this policy is any failure to meet a mandatory standard. It is recorded in the compliance incident log, assessed for regulatory reporting and root cause, and remediated. Exceptions are granted only by the MLRO (or the management body for exceptions the MLRO declines), in writing, for a defined period not exceeding [12] months and with compensating controls. Prohibited relationships (section 2) are not eligible for exceptions.

14. Regulatory change and AMLR transition

The MLRO maintains a regulatory change log and assesses each change within [30] days of publication. For the EU transition, the MLRO runs a gap analysis between the current national law and the AMLR, the AMLA regulatory technical standards (including the standards on customer due diligence once adopted) and the AMLA guidelines on business-wide risk assessment, internal policies and ongoing monitoring, and presents an implementation plan to the management body.

15. Related procedures and templates

16. Glossary and references

References (obtain the current official versions):

• FATF Recommendations (International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation), as amended, cited by number and title only: R.1, R.6, R.7, R.10 to R.16, R.18 to R.21.
• Directive (EU) 2015/849 (AMLD4) as amended by Directive (EU) 2018/843 (AMLD5), as transposed in national law; EUR-Lex.
• Regulation (EU) 2024/1624 (AMLR), Arts 9, 10, 11, 12, 16, 17, 20, 26, 34, 42 to 46, 69, 77 and 90; applies from 2027-07-10; EUR-Lex.
• Directive (EU) 2024/1640 (AMLD6); EUR-Lex.
• EBA Guidelines on ML/TF risk factors (EBA/GL/2021/02, as amended); EBA Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures (EBA/GL/2024/14).
• 31 CFR 1020.210, 1020.220, 1020.320, 1010.230, 1010.430, 1010.520, 1010.540, 1010.610, 1010.620; eCFR.
• FinCEN notice of proposed rulemaking on AML/CFT programmes, 2026-04-07, Docket FINCEN-2026-0034 (proposal).
• FFIEC Bank Secrecy Act/Anti-Money Laundering Examination Manual.
• The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692), regs 18 to 21, 24, 27 to 35, 40, as amended (including SI 2023/1371, domestic PEPs, in force 2024-01-10); legislation.gov.uk.
• Related template: Policy Document (business/policy-document) for house style.

Standard and licence note

Based on public law: EU legislation from EUR-Lex (Directive (EU) 2015/849, Directive (EU) 2018/843, Regulation (EU) 2024/1624 and Directive (EU) 2024/1640), reused with acknowledgement and summarised in original wording; US federal regulations in 31 CFR Chapter X and FinCEN publications (US government works, public domain); and the UK Money Laundering Regulations 2017 (Crown copyright, Open Government Licence v3.0 where stated). EBA guidelines are cited by number with acknowledgement and no text is reproduced. FATF Recommendations and AMLA publications are cited by number and title only; no text is reproduced or paraphrased. This template is not affiliated with or endorsed by any of these bodies. The FinCEN 2026 rule is a proposal and is labelled as such. Fernhollow Bank, its entities and all figures are fictional. This template is original text written for this collection. Check the current official version of each law, rule and guideline before use. Template licence: MIT.