Anti-money laundering, almost always abbreviated to AML, refers to the laws, regulations, and institutional procedures designed to prevent criminals from disguising illegally obtained money as legitimate income. Banks, payment processors, casinos, and a growing list of other businesses are legally required to operate AML programmes. Failing to do so can result in heavy fines, licence revocations, and criminal charges against individual executives.
Where the term comes from
The phrase "money laundering" comes from the idea of making dirty money clean. Al Capone's gang famously used cash-intensive laundromats to blend criminal proceeds with legitimate business revenue in the 1930s. The term stuck. "Anti-money laundering" entered formal legal language during the 1970s and 1980s as governments began building statutory frameworks to tackle the problem. The Financial Action Task Force (FATF), established in 1989 by the G7, became the global standard-setter for AML policy and still sets the benchmark that most national regulators follow today.
The three stages of money laundering
AML rules are built around disrupting a three-stage process that criminals use to integrate illegal funds into the financial system.
- Placement: The illegal cash enters the financial system, often by depositing it into bank accounts, purchasing casino chips, or buying high-value goods.
- Layering: The money moves through a series of transactions designed to obscure its origin. Wire transfers, shell companies, and cryptocurrency exchanges are common tools at this stage.
- Integration: The now-"cleaned" funds re-enter the legitimate economy as seemingly lawful income, through real estate purchases, business investments, or other assets.
AML controls aim to catch criminal activity at the placement and layering stages, before the money becomes difficult to trace.
What AML compliance requires in practice
For most regulated businesses, AML compliance involves several concrete obligations. Customer due diligence (CDD) sits at the core: firms must verify who their customers are before doing business with them. This is closely related to KYC (know your customer) procedures, which govern the identity-verification process specifically. KYC is one component of a broader AML framework, not a synonym for it.
Beyond identity checks, AML programmes require ongoing transaction monitoring. Businesses must flag unusual patterns, such as large cash deposits just below reporting thresholds (a technique called "structuring" or "smurfing"), rapid transfers between accounts, or transactions involving high-risk jurisdictions. When something looks suspicious, the institution files a Suspicious Activity Report (SAR) with the relevant financial intelligence unit.
Staff training is also a legal requirement in most jurisdictions. Employees handling financial transactions need to recognise red flags, and firms must appoint a dedicated Money Laundering Reporting Officer (MLRO) who takes responsibility for AML compliance internally.
Which industries are covered
Banking gets the most attention, but AML obligations extend well beyond it. Real estate agents, law firms, accountants, notaries, and high-value dealers (art, jewellery, luxury vehicles) all fall under AML rules in most developed markets. The gambling sector faces particularly detailed requirements: a casino must monitor player deposits, withdrawals, and betting patterns in much the same way a bank monitors account activity. This is why metrics like GGR (gross gaming revenue) are tracked with such precision inside licensed gambling operations, where regulators use financial data to audit whether operators are correctly separating player funds and reporting anomalies.
Cryptocurrency exchanges and digital asset platforms have faced increasing AML scrutiny since the mid-2010s. Most major jurisdictions now require crypto platforms to register with financial regulators and apply the same CDD and transaction-monitoring rules that banks follow.
Key legislation around the world
The United States passed the Bank Secrecy Act in 1970, making it one of the earliest AML frameworks in the world. The EU has updated its Anti-Money Laundering Directive (AMLD) six times since 1991, with the sixth iteration (6AMLD) expanding criminal liability and introducing a list of 22 predicate offences. The UK's Proceeds of Crime Act 2002 remains the central domestic statute, supplemented by the Money Laundering Regulations 2017 and subsequent amendments.
FATF publishes a "grey list" and a "black list" of countries it considers to have weak AML controls. Being placed on either list can make it difficult for a country's banks to access correspondent banking relationships, effectively limiting their access to global financial infrastructure.
Penalties for AML failures
Regulators enforce AML rules with significant financial penalties. In 2012, HSBC paid $1.9 billion to US authorities after being found to have processed funds for drug cartels and sanctioned states. In 2021, NatWest pleaded guilty in a UK court and was fined £264.8 million for failing to monitor £400 million in suspicious deposits from a Bradford jeweller. Individual compliance officers can also face personal fines or prosecution, which is why the MLRO role carries real legal weight.
AML vs CFT
AML is often paired with CFT, which stands for Combating the Financing of Terrorism. Both share the same toolset: transaction monitoring, customer due diligence, and suspicious activity reporting. The difference is the goal. AML targets proceeds of crime flowing into the financial system. CFT targets money flowing out to fund terrorist operations. Regulators increasingly treat the two as a single discipline, and most compliance programmes address both under the umbrella term "AML/CFT."
The scale of the problem gives the discipline its weight. The United Nations Office on Drugs and Crime estimates that between 2% and 5% of global GDP is laundered each year. That range puts the figure somewhere between $800 billion and $2 trillion annually. AML frameworks exist to shrink that number, one flagged transaction at a time.