Who needs a program
AML compliance obligations under the Bank Secrecy Act apply to banks and to a range of other financial businesses defined by regulation, including money services businesses and broker-dealers. Companies that transmit money or virtual currency may need to register with FinCEN and, in many states, obtain money transmitter licenses; in New York, virtual currency businesses generally need authorization from the Department of Financial Services. Even companies that are not directly covered often face contractual AML demands from a sponsor bank or payment processor. Working out which rules apply to your business model is the first step, and the answer is not always obvious.
What examiners and partners look for
A written program matters, but regulators and partner banks tend to care less about how polished it reads and more about whether it fits the business's real risks and works in practice. In examinations and partner reviews, attention usually goes to whether alerts are actually reviewed and the reasons for each decision written down. Keep risk assessments, alert reviews, training records, and past audit findings organized and easy to produce. If you discover that reports were missed or monitoring was not running, talk with counsel about remediation and whether disclosure is called for, and do not alter past records. Fixing the gap going forward and documenting how it happened are separate tasks.
Building or repairing a program
Our starting point is your products, customers, geographic exposure, and partners, and whatever program documents already exist. For a new business, that becomes a plan for registration, licensing, and a program that matches how money actually moves. For an existing one facing an exam, a bank's remediation demand, or a consent order, we focus on the gaps most likely to be found and on a realistic remediation timeline. We can also advise on how to respond when a bank or examiner asks pointed questions, and on how compliance decisions are documented so they hold up later.
