AML Compliance: KYC, CDD, and Suspicious Activity Reporting

CDD is triggered at account opening, at the formation of a business relationship, and when a one-time transaction exceeds a threshold (typically USD/EUR 15,000, or USD 3,000 for wire transfers in the United States). It has four components under FATF Recommendation 10: identify and verify the customer, identify and verify the beneficial owner, understand the purpose and intended nature of the relationship, and conduct ongoing monitoring.

1. Customer identification
   For natural persons: full legal name, date of birth, nationality, and government-issued identity document number, verified against the original document. For legal entities: registered name, registration number, legal form, registered address, and identity of directors and authorized signatories.
2. Beneficial ownership identification
   Identifying natural persons who own 25 percent or more of the entity (10 percent in some jurisdictions for PEP-connected entities), or who exercise effective control through other means. Where ownership is obscured by corporate layers, the institution must look through each layer. If no individual meets the threshold, the senior managing official is identified as a fallback.
3. Purpose and nature of relationship
   Understanding what the customer does, why they need this account or product, the expected transaction volumes and counterparties, and the source of funds. This builds the baseline against which future transactions are assessed for anomalies.
4. Ongoing monitoring
   Screening transactions against the expected profile, updating CDD records when circumstances change, and re-performing CDD for existing customers periodically or when triggered by a suspicious event or change in risk rating.

Politically exposed persons receive enhanced scrutiny because their position gives them the opportunity to misuse public funds or exert influence over government processes, and because their wealth may be the product of bribery or corruption. FATF Recommendation 12 requires that for foreign PEPs (individuals from other countries), institutions must apply EDD automatically. For domestic PEPs and international organization PEPs, EDD is triggered by a risk-based assessment.

The Riggs Bank case (2004) illustrates what happens when EDD fails. Riggs, a Washington DC bank with a niche in diplomatic accounts, maintained accounts for the government of Equatorial Guinea and for former Chilean dictator Augusto Pinochet. FinCEN and the OCC found that Riggs had failed to apply EDD to either relationship, had filed inadequate SARs, and had allowed tens of millions of dollars of suspect funds to move through the accounts without scrutiny. Riggs was fined USD 41 million, the largest US bank AML fine at the time, and was subsequently acquired and wound down.

Beneficial ownership transparency is FATF Recommendation 24's core requirement. For years, satisfying it relied on financial institutions conducting their own CDD to look through corporate structures. The global push since 2015 has been toward central government-maintained registers that record who ultimately owns and controls each legal entity, accessible to competent authorities and, in many jurisdictions, to the public.

• UK: the People with Significant Control (PSC) register at Companies House, in force since 2016, requires UK companies to record any person owning more than 25 percent or exercising significant influence. The Register of Overseas Entities (2022) extended this to foreign companies owning UK property.
• EU: the 4th AMLD required member states to create central beneficial ownership registers accessible to competent authorities and obliged entities. The 5th AMLD made registers publicly accessible. The European Court of Justice's November 2022 ruling in Joined Cases C-37/20 and C-601/20 (Luxembourg Business Registers) found that unconditional public access breached the Charter of Fundamental Rights, prompting member states to restrict access to entities demonstrating a legitimate interest.
• US: the Corporate Transparency Act (2021, in effect from January 2024) requires most US entities to report beneficial owners to FinCEN's Beneficial Ownership Information system. Reports are accessible to law enforcement and, with customer consent, to financial institutions for CDD purposes, but not to the general public.

The obligation to report suspicious transactions is the diagnostic tool of the AML system. A reporting entity, typically a bank, money service business, securities firm, or DNFBP, files a SAR (US) or STR (most other jurisdictions) when it has a suspicion of money laundering or terrorist financing. The suspicion standard is intentionally low: reasonable grounds to suspect, not proof. The institution is not required to investigate to certainty before filing.

In the United States, FinCEN received more than 3.6 million SARs in fiscal year 2022. The utility of the system depends on the quality of filings: a SAR with adequate detail about the transaction, the suspicious indicators, the parties, and the accounts is a usable intelligence product. A SAR that says only 'unusual transaction' is nearly worthless. FinCEN's guidance and the Financial Crimes Enforcement Network's SAR activity reviews emphasize that the narrative section is the most important part of the filing.

Correspondent banking is a critical infrastructure risk in the AML system. A US or European correspondent bank providing dollar or euro clearing to a respondent bank in a smaller jurisdiction cannot apply its own CDD to the respondent's customers. It must rely on the respondent's AML program. If the respondent has weak controls, the correspondent's infrastructure becomes a conduit. The BIS reports that the number of active correspondent banking relationships has been declining since 2011.

• Nested correspondent accounts: a respondent bank allows its own respondents (sub-correspondents) to access the correspondent's infrastructure indirectly, creating additional layers the correspondent cannot see into. FATF Recommendation 13 prohibits entering correspondent relationships with shell banks and requires measures to prevent accounts being used by other undisclosed respondents.
• De-risking consequences: when major banks exit correspondent relationships with entire regions or categories of customer, including remittance companies, money service businesses, and small Pacific island or Caribbean jurisdictions, the flows do not stop. They migrate to informal value transfer channels, hawala networks, or cryptocurrency, which are harder for investigators to follow and carry no STR reporting obligations.
• The World Bank-CPMI survey: a 2015 survey by the World Bank and the Committee on Payments and Market Infrastructures found that 75 percent of large international banks had terminated some correspondent relationships in the prior five years, with Caribbean, Central Asian, and Pacific island banks most affected.