Checklist · Business

Building an AML Program and Filing Beneficial Ownership Information: A Practical Checklist

31 U.S.C. § 5312

Type
Checklist
Jurisdiction
National
Date
2025-12-09
Topic
Business

This checklist covers building an anti-money-laundering program and meeting the reporting obligations that apply to it. It begins with determining coverage and writing the risk assessment that drives everything else. It then covers the five program pillars, customer identification, and beneficial ownership collection. Separate sections cover the reporting obligations by type, including the large cash payment report that reaches every business. Later sections cover sanctions screening, structuring prevention, recordkeeping, and examination readiness. The final sections cover responding to problems and the proportionate program an ordinary business actually needs.

Building an AML Program and Filing Beneficial Ownership Information: A Practical Checklist

Business > Beneficial Ownership, Anti-Money Laundering, and the Bank Secrecy Act | Published 9 December 2025 - Updated 7 July 2026 | UpLaw - uplaw.us

Determine coverage first

☐ Read the definition of financial institution at 31 U.S.C. § 5312 against what the business actually does, not what it calls itself. ☐ Check whether an industry regulation part applies: banks at 31 C.F.R. Part 1020, money services businesses at 31 C.F.R. Part 1022, brokers and dealers at 31 C.F.R. Part 1023, mutual funds at 31 C.F.R. Part 1024, futures commission merchants at 31 C.F.R. Part 1026, dealers in precious metals and stones at 31 C.F.R. Part 1027, credit card system operators at 31 C.F.R. Part 1028, loan and finance companies at 31 C.F.R. Part 1029, and housing enterprises at 31 C.F.R. Part 1030. ☐ Read the general part at 31 C.F.R. Part 1010 regardless. ☐ Register as a money services business where required under 31 U.S.C. § 5330. ☐ Confirm state licensing for money transmission separately, since state requirements are independent. ☐ ⚠️ Remember that every trade or business, covered or not, must report large cash payments under 31 U.S.C. § 5331 and 26 U.S.C. § 6050i.

Write the risk assessment

☐ Inventory products and services, and for each ask how it could be misused and what would be visible if it were. ☐ Inventory customer types by category rather than by name. ☐ Inventory geographies — operations, customers, and counterparties. ☐ Inventory delivery channels, flagging non-face-to-face onboarding and agent networks. ☐ Rate inherent risk for each item, with the reasoning stated. ☐ Describe the controls and rate residual risk. ☐ Map every identified risk to a control and every monitoring rule to a risk; gaps in that mapping are the most common examination finding. ☐ Be honest. An assessment rating everything low risk is not credible. ☐ Date it, version it, and keep prior versions. ☐ Update on a fixed cycle and on any material change — new product, new market, acquisition, or shift in customer mix.

Build the five pillars

☐ Written policies, procedures, and controls proportionate to the assessed risk. ☐ Designate a compliance officer with real authority, direct access to senior management or the board, and a budget. Document the appointment and the authority. ☐ Train by role, using scenarios rather than definitions, and retain curricula and attendance. ☐ Arrange independent testing by someone who did not build the program, at a frequency matched to risk, and track remediation to closure. ☐ Implement customer due diligence with risk-based ongoing monitoring, as required under 31 U.S.C. § 5318. ☐ Obtain board or senior management approval of the program and report on effectiveness, not only on volumes.

Customer identification and beneficial ownership

☐ Verify identity at onboarding — name, address, identification number, date of birth — with documentary or non-documentary methods, and record which was used. ☐ Collect beneficial ownership for legal entity customers: the natural persons owning at or above the applicable threshold and a person exercising significant control. ☐ Understand and record the nature and purpose of the relationship. This is the element examiners test most and institutions document least. ☐ Risk-rate each customer at onboarding and on review. ☐ Apply enhanced diligence to correspondent relationships, politically exposed persons, cash-intensive businesses, complex ownership structures, and high-risk geographies. ☐ Refresh information on a schedule and on trigger events. ☐ For registry reporting, confirm whether the entity is required to report beneficial ownership, whether an exemption applies, and what the current filing requirements are — and date the advice, because this framework has moved repeatedly. ☐ Track changes in ownership and control and file updates within the required period. ☐ Maintain an ownership chart for every entity customer and for the business itself; a bank will eventually ask.

Reporting obligations

☐ Currency transaction reports — 31 U.S.C. § 5313, for currency transactions above the threshold. Routine; not an accusation. ☐ Suspicious activity reports — under 31 U.S.C. § 5318. File within the deadline measured from initial detection, not from the end of the investigation. ☐ Continuing activity reports at the required intervals where suspicious activity persists. ☐ Confidentiality — under 31 U.S.C. § 5319, never disclose a filing or its existence to the subject. ☐ Large cash payments — 31 U.S.C. § 5331 and 26 U.S.C. § 6050i, including related transactions that aggregate over time. ☐ Foreign financial accounts — 31 U.S.C. § 5314; note that non-willful penalties apply per report after Bittner v. United States. ☐ Currency transported internationally — 31 U.S.C. § 5316. ☐ Respond to geographic targeting orders issued under 31 U.S.C. § 5326. ☐ Watch for special measures under 31 U.S.C. § 5318A. ☐ Understand penalty exposure — civil at 31 U.S.C. § 5321, criminal at 31 U.S.C. § 5322.

Prevent structuring — yours and your customers'

☐ Train every employee who takes payments that helping a customer split a payment to avoid a report is a crime under 31 U.S.C. § 5324. ☐ Prohibit any employee from advising on reporting thresholds, and script the response: "We report what the law requires; it is routine." ☐ Monitor for patterns of payments just below the threshold from the same customer. ☐ Advise business clients directly: deposit what you have when you have it. ☐ Document any refusal to accept a structured payment. ☐ Know the forfeiture exposure and the proportionality limits from United States v. Bajakajian and Timbs v. Indiana. ☐ Note that the historical knowledge requirement from Ratzlaf v. United States was removed by amendment, so lack of knowledge that structuring is illegal is not a defense.

Sanctions screening

☐ Screen all counterparties — customers, beneficial owners, vendors, and payment counterparties — against the lists administered under 31 C.F.R. Part 501 and the authority at 50 U.S.C. § 1701. ☐ Apply ownership attribution rules to entities owned by blocked parties. ☐ Rescreen on list updates, not only at onboarding. ☐ Distinguish blocking from rejecting and follow the reporting obligation for each. ☐ Apply for a license before engaging in an otherwise prohibited transaction, not after. ☐ Remember that liability is strict — no knowledge element, no materiality threshold. ☐ Document screening configuration, match tolerances, and alert dispositions.

Monitoring and alert handling

☐ Configure monitoring against the risk assessment, and document the rationale for each rule and threshold. ☐ Capture staff referrals in the same queue as automated alerts; they are the most valuable and most neglected source. ☐ Investigate against the customer profile: what does this customer do, what does the account normally look like, what changed, and is there an explanation consistent with what we know. ☐ Document every disposition in enough detail that a reader two years later understands the decision. Undocumented review is treated as no review. ☐ Document decisions not to file as carefully as decisions to file; examiners test the "no file" population. ☐ Measure the deadline from initial detection, and diary it. ☐ Write narratives in plain chronological prose with amounts, dates, and an explanation of why the activity is suspicious. ☐ Separate the reporting decision from the relationship decision, and document each with its own rationale. ☐ Tune periodically using outcomes: which rules produce filings and which produce volume without signal. ☐ Track alert aging, because backlogs are a finding in themselves.

Recordkeeping and retention

☐ Retain records for the required periods, generally five years and sometimes longer, and know where they are. ☐ Retain customer identification and diligence records for the required period after the relationship ends. ☐ Retain transmittal records for funds transfers at or above the applicable threshold. ☐ Retain report filings and supporting documentation. ☐ Retain training records, testing reports, and remediation evidence. ☐ Confirm recordkeeping mandates under 12 U.S.C. § 1829b and the related provisions at 12 U.S.C. § 1951, 12 U.S.C. § 1953, and 12 U.S.C. § 1959. ☐ Segregate suspicious activity report materials with restricted access, given the confidentiality obligation.

Examination readiness

☐ Maintain a current, indexed file: risk assessment with version history; written program; approvals and board reporting; compliance officer appointment and authority; training curricula and records; independent testing reports with remediation tracking; monitoring documentation; alert statistics and samples; filing log; diligence procedures and sample files; ownership records; screening configuration; and retention policies. ☐ Write a short orienting narrative describing the business, its risks, its program, and its known gaps with remediation dates. ☐ Close prior findings and be able to prove it; unremediated findings are the most damaging item in any subsequent examination. ☐ Prepare people, not only documents. Staff will be interviewed and should describe what they do consistently with the manual. ☐ Be candid about gaps. A dated remediation plan in progress is far better than a gap discovered by an examiner.

Responding to problems

☐ Missed filings discovered internally — file them with an explanation, document the process failure, and remediate. Voluntary disclosure is treated substantially better than discovery. ☐ A subpoena or records request — confirm scope, preserve everything, and handle report materials separately given confidentiality. ☐ A customer asking whether a report was filed — decline to discuss, without confirming or denying. ☐ An account closure by your bank — escalate in writing, ask what would change the decision, and prepare a complete package for the next institution. ☐ A structuring allegation — establish the source of funds, the pattern, and who advised it. ☐ An examination finding — remediate on a tracked timeline and report progress. ☐ A look-back review — scope it with counsel, staff it adequately, and file what it identifies. ☐ A sanctions match — block or reject as required, report within the deadline, and do not release funds without authorization.

The proportionate program for an ordinary business

Most businesses reading this are not financial institutions and should not build a bank's program. What they need fits on two pages and takes an afternoon.

Page one: coverage and triggers. State whether the business is a covered financial institution and under which part, or whether its only obligations are the large cash payment report and sanctions compliance. State the cash reporting threshold and the related-transaction rule in plain language. State that structuring is a crime and that no employee may advise a customer about avoiding a report.

Page two: process. Name the person responsible. Describe what happens when a reportable payment is received, who prepares the report, and by when. Describe the sanctions screening step, when it happens, and who resolves a possible match. Describe what documentation is kept and for how long. Name the outside counsel or advisor to call.

Then train the people who take payments. Not the finance department — the salespeople, the front desk, the service writers. They are the ones who will be asked to split a payment, and they are the ones who will notice the customer who always pays just under the threshold.

Then screen. Sanctions screening tools are inexpensive, the regime is strict liability, and the exposure is not proportionate to the size of the business.

Then document. Every unusual transaction that was accepted, with a sentence about why. Every one that was declined, with a sentence about why. The file is the defense.

And prepare the banking package. Entity documents, ownership chart, the two-page procedure, transaction volume projections, and a named compliance contact. Institutions do not decline relationships they can explain to an examiner in one paragraph, and de-risking is a real risk with no appeal.

☐ Review the two-page procedure annually and after any change in the business. ☐ Refresh training annually, with the cash and structuring content repeated verbatim. ☐ Re-screen counterparties on list updates. ☐ Keep the ownership chart current, because it is the document most often requested and least often maintained. ☐ Diarize the banking relationship review and provide what the bank needs before it asks.

📌 The gap between spending nothing on this and spending a little is enormous. The gap between a little and a lot is much smaller. Advise clients accordingly, and resist the temptation to sell a bank's program to a business that needs a procedure.

Sector-specific additions

If the business is a money services business. Register under 31 U.S.C. § 5330, comply with 31 C.F.R. Part 1022, obtain state licenses separately, maintain agent oversight with contractual conduct standards and periodic review, keep transmittal records, and treat the banking relationship as the existential risk rather than the regulator. Build the program at a level a bank's examiners will accept.

If the business deals in digital assets. Determine whether the activity is money transmission, register accordingly, and understand that unlicensed transmission is charged under 18 U.S.C. § 1960. Use chain analytics as a diligence tool, document counterparty risk, and address the treatment of self-hosted wallets in writing.

If the business handles real estate closings. Prepare to collect beneficial ownership and payment source information for non-financed transfers to entities, because geographic orders under 31 U.S.C. § 5326 have targeted these repeatedly and permanent obligations are the direction of travel. Verify wire instructions independently, which addresses both this obligation and fraud exposure.

If the business sells high-value goods. Car dealers, jewelers, boat sellers, and art and antiquities dealers face the large cash payment obligation, the related-transaction aggregation rule, and — for some — 31 C.F.R. Part 1027. Flag any customer account with a prior cash payment and review monthly for follow-on payments.

If the business is a charity operating abroad. Prepare documentation of program purpose, recipient diligence, and disbursement controls in advance of the bank's request, and expect enhanced diligence as a matter of course.

If the business is a professional service firm. The large cash payment obligation applies; trust accounts are a recognized risk channel; and professional conduct rules already prohibit assisting client wrongdoing. Verify the client, understand the source of funds for significant transactions, refuse to be a conduit, and document the diligence.

Annual maintenance calendar

☐ Risk assessment review and update — [month]. ☐ Program document review and approval — [month]. ☐ Independent testing — [month], with remediation tracked to closure. ☐ Training delivery — [month], by role, with records retained. ☐ Monitoring rule tuning based on outcomes — [month]. ☐ Sanctions screening configuration review — [month]. ☐ Customer information refresh for high-risk relationships — ongoing, with a completion target. ☐ Ownership chart refresh — [month]. ☐ Banking relationship package update — before renewal. ☐ Retention schedule audit — [month]. ☐ Board or management reporting on program effectiveness — [quarterly].

Common failures, and what causes them

A nominal compliance officer. Someone holds the title, reports to the revenue side, has no budget, and cannot stop a relationship. Every serious enforcement action in this field includes some version of this fact. The fix is documented authority and a reporting line that does not run through the people whose revenue is at stake.

Training that nobody applies. An annual slide deck delivered to everyone, covering definitions rather than situations. The fix is role-specific scenarios: what the teller does when a customer asks about the threshold, what the salesperson does when offered cash in two payments, what the analyst does when an alert has no explanation.

Independent testing that is not independent. The person who built the program tests it, or a vendor produces a template report with no sampling. The fix is a tester with no stake in the outcome and a scope that includes alert dispositions.

Monitoring that does not match the risk assessment. Rules inherited from a vendor's defaults, thresholds nobody chose, and no documentation of why either was selected. The fix is a mapping document tying each rule to an identified risk.

Alert dispositions closed with a phrase. "Reviewed, no concern." Two years later nobody can explain the decision. The fix is a minimum documentation standard enforced by supervisory review.

Findings that stay open. A prior examination identified a gap, the remediation slipped, and the next examination finds it unchanged. This is the single most damaging pattern available, and it is entirely within the institution's control.

Stale customer information. Ownership changed, the business model changed, and the file still describes the customer as it was at onboarding. The fix is trigger-based refresh in addition to periodic review.

And for ordinary businesses: nobody told the front line. The finance department knows about the cash reporting obligation and the people who actually receive cash do not. That single gap accounts for most of the missed reports and nearly all of the structuring exposure.

Related Documents