Toolkit · Business

The AML Program, Suspicious Activity Reporting, and Beneficial Ownership Toolkit

31 U.S.C. § 5311

Type
Toolkit
Jurisdiction
National
Date
2025-11-02
Topic
Business

This toolkit supplies the working documents for an anti-money-laundering program. Tool 1 is a risk assessment template with the four required categories, and Tool 2 is a program outline covering the five pillars. Tool 3 is a customer due diligence and beneficial ownership collection form, and Tool 4 is an alert disposition standard with a narrative format. Tool 5 is a cash payment reporting procedure for ordinary businesses, and Tool 6 is a sanctions screening protocol. Tool 7 is a banking relationship package for businesses facing de-risking, and Tool 8 is an examination readiness index. Tool 9 is a consolidated authority table.

The AML Program, Suspicious Activity Reporting, and Beneficial Ownership Toolkit

Business > Beneficial Ownership, Anti-Money Laundering, and the Bank Secrecy Act | Published 2 November 2025 - Updated 12 February 2026 | UpLaw - uplaw.us

How to use this toolkit. Institutions start with Tool 1; ordinary businesses start with Tool 5. Bracketed text is for completion. The guide supplies the doctrine and the checklist supplies the sequence.

TOOL 1 — RISK ASSESSMENT TEMPLATE

Entity: [ ] · Version: [ ] · Date: [ ] · Prepared by: [ ] · Approved by: [ ] · Next review: [ ]

Section A — Products and services

Product or service Volume Risk description Inherent rating Controls Residual rating
[Cash handling] [ ] [ ] [H/M/L] [ ] [ ]
[Wire transfers] [ ] [ ] [ ] [ ] [ ]
[Remote deposit] [ ] [ ] [ ] [ ] [ ]
[Prepaid or stored value] [ ] [ ] [ ] [ ] [ ]

Section B — Customers

Customer category Count Risk description Inherent rating Controls Residual rating
[Cash-intensive retail] [ ] [ ] [ ] [ ] [ ]
[Money services businesses] [ ] [ ] [ ] [ ] [ ]
[Entities with layered ownership] [ ] [ ] [ ] [ ] [ ]
[Non-resident customers] [ ] [ ] [ ] [ ] [ ]

Section C — Geographies. [Operations; customer locations; counterparty jurisdictions; rating and rationale for each.]

Section D — Delivery channels. [Face-to-face; online; mobile; agents; intermediaries. Flag non-face-to-face onboarding and agent networks.]

Section E — Risk-to-control mapping. [Every identified risk maps to a control; every monitoring rule maps to a risk. List any gaps and the remediation date.]

Section F — Accepted risks. [Risks the business accepts, why, and what compensating controls apply. An assessment rating everything low risk is not credible.]

TOOL 2 — PROGRAM OUTLINE

1. Purpose and scope. [Business description; which parts apply — general provisions at 31 C.F.R. Part 1010 and the industry part; statutory basis at 31 U.S.C. § 5311 and 31 U.S.C. § 5318.]

2. Governance. [Compliance officer name, title, reporting line, authority to decline or exit a relationship, budget, and access to the board.]

3. Risk assessment. [Reference to Tool 1; update cadence; trigger events.]

4. Customer identification and due diligence. [Identity verification methods; beneficial ownership collection; risk rating; enhanced diligence triggers; refresh cadence.]

5. Monitoring and reporting. [Rule inventory and rationale; alert workflow; investigation standard; disposition documentation; filing deadlines measured from initial detection; continuing activity reporting; confidentiality under 31 U.S.C. § 5319.]

6. Currency and cash reporting. [Thresholds; aggregation; 31 U.S.C. § 5313 and, for trades and businesses, 31 U.S.C. § 5331 and 26 U.S.C. § 6050i.]

7. Structuring prohibition. [No employee may advise a customer regarding reporting thresholds; escalation of suspected structuring under 31 U.S.C. § 5324.]

8. Sanctions. [Screening scope and frequency; blocking and rejecting; reporting; licensing; authority at 50 U.S.C. § 1701 and 31 C.F.R. Part 501.]

9. Training. [By role; frequency; content; records.]

10. Independent testing. [Scope; independence; frequency; remediation tracking.]

11. Recordkeeping. [Retention periods; location; access restrictions for report materials.]

12. Approval and review. [Board approval date; annual review date.]

TOOL 3 — DUE DILIGENCE AND OWNERSHIP FORM

Customer: [ ] · Onboarded: [ ] · Risk rating: [ ] · Reviewer: [ ]

1. Identity. [Legal name; formation jurisdiction and date; principal address; identification number; verification method and documents retained.]

2. Ownership chart. [Diagram to natural persons. Identify every person at or above the applicable ownership threshold and every person exercising significant control.]

Name Role Ownership % Identification verified Sanctions screened Date
[ ] [owner / control person] [ ] [ ] [ ] [ ]

3. Nature and purpose of the relationship. [What the business does; expected products used; expected volumes and transaction types; expected counterparties and geographies. This is the element examiners test most.]

4. Source of funds and wealth (where risk warrants). [ ]

5. Risk factors present. [Cash intensity; complex ownership; high-risk geography; politically exposed person; non-face-to-face onboarding; adverse media.]

6. Enhanced diligence performed. [ ]

7. Decision. [Accept / accept with conditions / decline.] Approver: [ ] Date: [ ]

8. Refresh schedule. [Date; trigger events.]

TOOL 4 — ALERT DISPOSITION STANDARD AND NARRATIVE FORMAT

Minimum disposition documentation (every alert, filed or not)

☐ Alert identifier, date generated, and rule triggered ☐ Customer profile summary: what they do, expected activity ☐ Activity reviewed: dates, amounts, counterparties, channels ☐ What was unusual relative to the profile ☐ What was checked: account history, related accounts, prior alerts, negative news, customer contact if any ☐ Explanation obtained, if any, and whether it is consistent with the profile ☐ Conclusion and reasoning ☐ Decision: file / no file / continue monitoring, with the reviewer and date ☐ If filing: date of initial detection, filing deadline, and filing date

Narrative format

"Who. [Subject name, account number, relationship type, tenure, and stated business.] What. [The activity, in chronological order, with dates, amounts, counterparties, and channels.] When. [Period covered and date of initial detection.] Where. [Branches, jurisdictions, and channels involved.] Why suspicious. [Explain in plain language why this activity is inconsistent with the known profile and what pattern it resembles.] What the institution did. [Contact attempted, explanation received, relationship decision, and whether prior reports were filed on this subject.]"

⚠️ A narrative that recites transaction data without explaining the suspicion is a deficient filing. Write it so a reader with no access to the account understands the concern.

TOOL 5 — CASH PAYMENT PROCEDURE (ORDINARY BUSINESSES)

[Business] — cash payment procedure, effective [date] · Owner: [name, phone]

1. What must be reported. Any cash received in a trade or business exceeding the threshold, in a single transaction or in related transactions, must be reported under 31 U.S.C. § 5331 and 26 U.S.C. § 6050i.

2. Related transactions. Multiple payments from the same customer within the applicable period aggregate. Any customer account with a prior cash payment is flagged and reviewed monthly for follow-on payments.

3. Who prepares the report. [Name/role], within [days] of the transaction. [Name] reviews and files.

4. Customer notice. [Where required, the business provides the customer the required written statement by the applicable date.]

5. Prohibited conduct. No employee may discuss reporting thresholds with a customer, suggest splitting a payment, or structure any transaction. Arranging transactions to avoid a report is a felony under 31 U.S.C. § 5324. Script: "We report cash payments as the law requires. It is routine and it is not a problem."

6. Escalation. Any customer who asks how to avoid a report, or who repeatedly pays just under the threshold, is escalated to [name] the same day and the conversation is documented.

7. Records. Reports and supporting documents are retained for [period] at [location].

8. Training. Every employee who receives payments is trained at hire and annually, and the training covers items 1, 2, and 5 verbatim.

TOOL 6 — SANCTIONS SCREENING PROTOCOL

☐ Scope. Customers, beneficial owners and control persons, vendors, payment counterparties, and shipping destinations. ☐ Timing. At onboarding, before each significant transaction, and on every list update. ☐ Ownership attribution. Apply the aggregation rules for entities owned by blocked parties. ☐ Match handling. Define tolerance settings, document the review of each possible match, and require a second reviewer for a decision to release. ☐ Blocking versus rejecting. Follow the correct action and the corresponding reporting obligation. ☐ Licensing. Apply before engaging in an otherwise prohibited transaction. ☐ Documentation. Retain screening configuration, list versions, alert records, and dispositions. ☐ Authority. 50 U.S.C. § 1701; administration at 31 C.F.R. Part 501. ☐ ⚠️ Liability is strict. There is no knowledge element and no materiality threshold.

TOOL 7 — BANKING RELATIONSHIP PACKAGE

Prepared for [institution] · [date]

1. About the business. [What it does, how it makes money, how long it has operated, ownership.]

2. Ownership chart. [To natural persons, with identification and screening confirmations.]

3. Licenses and registrations. [State licenses; money services business registration under 31 U.S.C. § 5330 if applicable.]

4. Compliance program. [Attach the program and the risk assessment summary; name the compliance officer with contact details.]

5. Expected activity. [Transaction types, volumes, counterparties, geographies, and seasonality — stated precisely, because variance from stated expectations is what generates alerts.]

6. Controls. [Screening, monitoring, recordkeeping, training, independent testing.]

7. References. [Prior banking relationships and why they ended, stated candidly.]

8. Contact protocol. [Who the bank calls, how fast the business responds, and an annual review offer.]

📌 Institutions do not decline relationships they can explain to an examiner in one paragraph. This package is that paragraph, with support.

TOOL 8 — EXAMINATION READINESS INDEX

☐ Risk assessment, current and prior versions, with approval dates ☐ Written program with board or management approval ☐ Compliance officer appointment, authority, reporting line, and resources ☐ Training curricula, attendance, and testing results by role ☐ Independent testing reports, management responses, and remediation tracking to closure ☐ Monitoring rule inventory with rationale and tuning history ☐ Alert volumes, aging, and a disposition sample ☐ Report filing log with detection and filing dates ☐ Customer identification and diligence procedures with sample files by risk tier ☐ Beneficial ownership collection records and refresh evidence ☐ Sanctions screening configuration, list versions, and dispositions ☐ Recordkeeping and retention policy with location map ☐ Prior examination findings and proof of closure ☐ Orienting narrative describing the business, its risks, its program, and known gaps with remediation dates

TOOL 9 — AUTHORITY TABLE

Provision Subject
31 U.S.C. § 5311 Purpose of the reporting framework
31 U.S.C. § 5312 Definitions, including financial institution
31 U.S.C. § 5313 Currency transaction reports
31 U.S.C. § 5314 Foreign financial account reports
31 U.S.C. § 5316 International currency transportation
31 U.S.C. § 5318 Programs, diligence, and suspicious activity reporting
31 U.S.C. § 5318A Special measures
31 U.S.C. § 5319 Confidentiality of reports
31 U.S.C. § 5321 Civil penalties
31 U.S.C. § 5322 Criminal penalties
31 U.S.C. § 5324 Structuring
31 U.S.C. § 5326 Records searches and targeting orders
31 U.S.C. § 5330 Money services business registration
31 U.S.C. § 5331 Large cash payments in a trade or business
31 U.S.C. § 5332 Bulk cash smuggling
26 U.S.C. § 6050i Cash payment reporting, tax parallel
12 U.S.C. § 1829b Retention of records
12 U.S.C. § 1951 Congressional findings on recordkeeping
12 U.S.C. § 1953 Recordkeeping requirements
12 U.S.C. § 1955 Injunctions
12 U.S.C. § 1959 Compliance
18 U.S.C. § 1956 Money laundering
18 U.S.C. § 1957 Monetary transactions in criminally derived property
18 U.S.C. § 1960 Unlicensed money transmitting
50 U.S.C. § 1701 Sanctions authority
31 C.F.R. Part 1010 General provisions
31 C.F.R. Part 1020 Banks
31 C.F.R. Part 1022 Money services businesses
31 C.F.R. Part 1023 Brokers and dealers in securities
31 C.F.R. Part 1024 Mutual funds
31 C.F.R. Part 1026 Futures commission merchants
31 C.F.R. Part 1027 Dealers in precious metals and stones
31 C.F.R. Part 1028 Operators of credit card systems
31 C.F.R. Part 1029 Loan and finance companies
31 C.F.R. Part 1030 Housing government-sponsored enterprises
31 C.F.R. Part 501 Sanctions reporting and procedures
California Bankers Assn. v. Shultz Constitutionality of the framework
Ratzlaf v. United States Structuring knowledge element, later amended
United States v. Bajakajian Excessive fines and currency forfeiture
Timbs v. Indiana Excessive Fines Clause applies to states
Bittner v. United States Non-willful account reporting penalties per report
Cuellar v. United States Concealment element of laundering
United States v. Santos Meaning of proceeds
Whitfield v. United States No overt act for laundering conspiracy

Closing note

Institutions: the program is what you can show you did. Build Tool 1, enforce Tool 4, and keep Tool 8 current. Ordinary businesses: Tool 5 and Tool 6 are the whole program, and they take an afternoon.

TOOL 10 — INCIDENT AND ESCALATION PROTOCOL

Triggers requiring same-day escalation to the compliance officer

☐ A customer asks how to avoid a report, or how to structure a payment ☐ A pattern of payments just below a reporting threshold ☐ A possible sanctions match on any party to a transaction ☐ A law enforcement inquiry, subpoena, or grand jury demand ☐ Adverse media on a customer or beneficial owner ☐ A discovered missed or late report ☐ A monitoring system outage affecting alert generation ☐ A bank notifying the business of account review or closure ☐ An employee suspected of assisting a customer to avoid reporting

Immediate steps

  1. Open a file with a date, an owner, and a single point of contact.
  2. Preserve records and suspend any deletion schedule.
  3. Determine whether a reporting obligation is triggered and calculate the deadline from initial detection.
  4. Segregate suspicious activity report materials with restricted access given the confidentiality obligation.
  5. Decide the relationship question separately from the reporting question and document each.
  6. Notify counsel where law enforcement, sanctions, or possible employee misconduct is involved.
  7. Record the corrective action and the date completed.

Within thirty days

☐ Determine whether the incident reflects a control failure or an isolated event, using the alert and filing data ☐ Remediate the control and document the change ☐ Update training if the failure was behavioral ☐ Report to senior management or the board ☐ Consider voluntary disclosure where a reporting failure occurred, since the difference between disclosure and discovery is substantial

TOOL 11 — SELF-ASSESSMENT SCORECARD

Element Evidence available Rating Gap Owner Due
Risk assessment current and mapped to controls [ ] [ ] [ ] [ ] [ ]
Compliance officer authority documented [ ] [ ] [ ] [ ] [ ]
Training by role, with records [ ] [ ] [ ] [ ] [ ]
Independent testing genuinely independent [ ] [ ] [ ] [ ] [ ]
Prior findings closed [ ] [ ] [ ] [ ] [ ]
Diligence files complete for high-risk customers [ ] [ ] [ ] [ ] [ ]
Ownership information current [ ] [ ] [ ] [ ] [ ]
Alert dispositions meet the documentation standard [ ] [ ] [ ] [ ] [ ]
Filing deadlines measured from detection [ ] [ ] [ ] [ ] [ ]
Cash reporting and aggregation controls working [ ] [ ] [ ] [ ] [ ]
Sanctions screening scope and frequency adequate [ ] [ ] [ ] [ ] [ ]
Records retained and locatable [ ] [ ] [ ] [ ] [ ]

📌 Run this quarterly and report the results. A program that grades itself honestly and remediates on a tracked timeline is treated very differently from one whose gaps are found by someone else.

Related Documents