Who needs one and what it is for
Under the Bank Secrecy Act, banks, money services businesses, broker-dealers, casinos, and certain other businesses must maintain an anti money laundering program, and many fintech and crypto companies fall into these categories even when they do not think of themselves as financial institutions. The program is meant to be risk-based, built around the company's own customers, products, and geography rather than copied from a template. Regulators look at whether it works in practice, including how suspicious activity is identified and reported. New York's financial regulator adds its own monitoring and certification requirements for institutions it supervises. Federal rules for some types of firms have been adopted and then delayed, so their current status needs checking.
Where programs tend to fall short
A common weakness is a written policy that does not match how the business really operates. Others include a monitoring system whose alerts pile up unreviewed, customer due diligence that stops at onboarding, thin documentation of why alerts were closed, and a compliance officer without enough authority or staff. Before an exam or a partner review, gather the current policies, the risk assessment, recent independent testing reports, training records, and samples of how alerts and suspicious activity reports were handled. Suspicious activity reports are confidential, and disclosing their existence outside permitted channels is itself a violation.
Starting point for a review
An AML program review begins with the business model and which regulators and rules actually apply, then compares the written program with how the operation runs day to day. Where gaps exist, the priority is usually to fix the largest risks first and to document the remediation as it happens. If there is already a regulatory finding or a bank partner's demand, we review it closely and help set a realistic timeline for the response. We also talk about who inside the company owns the program going forward and how often it should be tested.
