AML, KYC and Sanctions Screening

Why This Topic Matters to a Treasury Professional

Anti-Money Laundering (AML), Know Your Customer (KYC) and sanctions screening sit at the intersection of financial regulation and daily treasury operations. On the AFP CTP exam this material appears within the Financial Regulatory and Operational Risk domain, but its reach is far wider than a compliance footnote. Every time a treasury department opens a bank account, onboards a new bank, sends a cross-border wire, adds a vendor to the payment master file, or restructures a legal entity, it triggers AML, KYC or sanctions obligations somewhere in the chain.

The consequences of getting it wrong are severe and highly visible:

• Regulatory penalties – banks have paid fines in the billions of dollars for AML and sanctions failures, and corporations themselves face civil and criminal liability for sanctions violations.
• Operational disruption – payments can be frozen, rejected or delayed; new accounts can take weeks to open because of document requests.
• Reputational damage – being named in a money-laundering or sanctions enforcement action harms relationships with banks, investors and customers.
• Strict liability – under U.S. sanctions law, a company can be penalized even if it did not know it was dealing with a sanctioned party.

The CTP exam expects you to understand these regimes from the corporate treasurer's perspective: what the rules are, who enforces them, what banks will ask of you, and how to design controls that keep the organization compliant.

Part 1: Anti-Money Laundering (AML)

What money laundering is
Money laundering is the process of disguising the origin of illegally obtained funds so that they appear legitimate. The classic three-stage model, which is frequently tested, is:

1. Placement – introducing illicit cash into the financial system (for example, depositing cash in amounts designed to avoid reporting thresholds, a practice called structuring or smurfing).
2. Layering – conducting a series of complex transactions (wires, shell companies, trades, conversions) to obscure the audit trail.
3. Integration – returning the funds to the launderer in a form that appears legitimate (real estate, business investments, luxury assets).

Terrorist financing is often grouped with AML (the combined term is AML/CFT – Combating the Financing of Terrorism). The key difference is that terrorist financing may involve legitimately sourced funds used for illegitimate purposes, so the red flags differ.

Key U.S. AML legislation and regulators
• Bank Secrecy Act (BSA) of 1970 – the foundational U.S. AML law. Requires financial institutions to keep records and file reports that may be useful in criminal, tax or regulatory investigations. The BSA is the source of Currency Transaction Reports (CTRs).
• Money Laundering Control Act of 1986 – made money laundering a federal crime and prohibited structuring transactions to evade reporting.
• USA PATRIOT Act of 2001 – dramatically expanded AML obligations after September 11. Title III (the International Money Laundering Abatement and Anti-Terrorist Financing Act) introduced mandatory Customer Identification Programs (CIP), enhanced due diligence for correspondent and private banking accounts, prohibited U.S. banks from dealing with foreign shell banks, and enabled information sharing between institutions and government (Sections 314(a) and 314(b)).
• Anti-Money Laundering Act of 2020 (AMLA) – the most significant update since the PATRIOT Act. It expanded whistleblower protections, increased penalties, and included the Corporate Transparency Act (CTA), which requires many companies to report beneficial ownership information to FinCEN.
• FinCEN (Financial Crimes Enforcement Network) – a bureau of the U.S. Treasury Department that administers the BSA, collects and analyzes reports (CTRs, SARs) and issues regulations and guidance.
• Bank regulators (OCC, Federal Reserve, FDIC, NCUA) – examine banks for BSA/AML compliance and can impose enforcement actions.

Key AML reports
• Currency Transaction Report (CTR) – filed by financial institutions for cash transactions exceeding $10,000 in a single business day (aggregated by customer). Businesses that receive more than $10,000 in cash in a trade or business file Form 8300 with the IRS/FinCEN.
• Suspicious Activity Report (SAR) – filed when a financial institution knows, suspects or has reason to suspect that a transaction involves funds from illegal activity, is designed to evade BSA requirements, or has no apparent lawful purpose. SARs are confidential; it is a federal crime for a bank to disclose to a customer that a SAR has been filed (the no tipping off rule). Thresholds are generally $5,000 for banks when a suspect can be identified, but suspicious activity can be reported at any amount.
• Report of Foreign Bank and Financial Accounts (FBAR, FinCEN Form 114) – U.S. persons (including corporations) with a financial interest in or signature authority over foreign financial accounts whose aggregate value exceeds $10,000 at any time in the year must file annually. This is a frequent treasury obligation because treasury staff often hold signature authority over foreign accounts.

The five pillars of a BSA/AML compliance program
Banks (and by extension their corporate customers who want to understand what banks require) must maintain:
1. A system of internal controls.
2. Independent testing (audit).
3. A designated BSA/AML compliance officer.
4. Ongoing training for appropriate personnel.
5. Risk-based procedures for ongoing customer due diligence (added by the 2016 FinCEN CDD Rule).

International AML framework
• Financial Action Task Force (FATF) – an intergovernmental body that sets global AML/CFT standards (the FATF 40 Recommendations) and publishes lists of high-risk and non-cooperative jurisdictions (the so-called black and grey lists). FATF does not enforce directly; member countries implement its recommendations in national law.
• EU Anti-Money Laundering Directives (AMLDs) and the new EU AML Authority (AMLA).
• Wolfsberg Group – an association of global banks that develops AML/KYC industry standards and questionnaires (the Wolfsberg CBDDQ) widely used in correspondent banking.
• Egmont Group – a network of national financial intelligence units (FIUs) such as FinCEN.

Part 2: Know Your Customer (KYC)

What KYC is
KYC is the set of procedures a financial institution uses to verify the identity of its customers, understand the nature of their business and assess the money-laundering risk they present. KYC is the preventive front end of AML. The core components are:

• Customer Identification Program (CIP) – required by the USA PATRIOT Act Section 326. At account opening the bank must collect, at a minimum, the customer's name, address, date of birth (for individuals) and identification number (Taxpayer ID / EIN for businesses), and must verify that information through documentary or non-documentary methods. Banks must also check customers against government lists.
• Customer Due Diligence (CDD) – understanding the nature and purpose of the relationship to develop a customer risk profile and conducting ongoing monitoring.
• Beneficial Ownership Rule (FinCEN CDD Final Rule, effective May 2018) – banks must identify and verify the beneficial owners of legal entity customers. Beneficial owners are defined under two prongs: the ownership prong (each individual owning 25% or more of the equity) and the control prong (at least one individual with significant managerial control, such as a CEO, CFO or treasurer). This is why treasurers are routinely asked to complete beneficial ownership certification forms when opening accounts.
• Enhanced Due Diligence (EDD) – deeper scrutiny for higher-risk customers, such as Politically Exposed Persons (PEPs), customers in high-risk jurisdictions, cash-intensive businesses, money services businesses, correspondent banks and private banking clients. EDD may include source-of-wealth verification, senior management approval and more frequent reviews.
• Ongoing monitoring and periodic refresh – KYC is not a one-time event. Banks re-verify information on a risk-based cycle (often annually for high risk, every three to five years for low risk) and whenever a triggering event occurs (ownership change, new jurisdiction, unusual activity).

Corporate Transparency Act (CTA)
Separate from bank KYC, the CTA requires reporting companies to file Beneficial Ownership Information (BOI) reports with FinCEN. Many large operating companies, regulated entities and public companies are exempt (for example, entities with more than 20 full-time U.S. employees, more than $5 million in gross receipts and a U.S. operating presence). Treasury and legal departments must track which subsidiaries and special purpose entities fall within scope. Note that the scope of CTA enforcement has shifted over time, so the exam will generally test the concept rather than the latest implementation detail.

Why KYC is a treasury burden
Corporate treasurers experience KYC as a cost and a delay:
• Opening a new account, especially in a foreign jurisdiction, can take weeks or months because of documentation requests (articles of incorporation, board resolutions, organizational charts, beneficial ownership certifications, passports of signatories, audited financials).
• Every bank asks for similar documents in slightly different formats, and periodic refresh requests multiply across dozens of bank relationships.
• Changes in authorized signers or legal entity structure must be communicated promptly.

Treasury responses include maintaining a centralized KYC document repository, using bank account management (BAM) or eBAM tools, leveraging the SWIFT KYC Registry for corporates, rationalizing the number of banks and accounts, and standardizing legal entity documentation. Legal Entity Identifiers (LEIs) also simplify entity identification.

Part 3: Sanctions Screening

What sanctions are
Economic sanctions are government-imposed restrictions on dealings with specified countries, regimes, entities, individuals or sectors to achieve foreign policy and national security objectives. Sanctions can be:
• Comprehensive (country-based) – broad prohibitions on virtually all transactions with a jurisdiction (historically Cuba, Iran, North Korea, Syria, and the Crimea and other occupied regions of Ukraine).
• Targeted or list-based – restrictions on named individuals and entities regardless of location.
• Sectoral – restrictions on specific activities (for example, certain debt or equity financing) with companies in designated sectors of a country's economy.
• Secondary sanctions – penalties on non-U.S. persons who engage in significant transactions with sanctioned parties, extending the practical reach of U.S. sanctions globally.

Key sanctions authorities
• OFAC (Office of Foreign Assets Control) – a U.S. Treasury office that administers and enforces U.S. sanctions. OFAC maintains the Specially Designated Nationals and Blocked Persons (SDN) List as well as other lists (Sectoral Sanctions Identifications, Foreign Sanctions Evaders, Non-SDN lists). OFAC regulations apply to all U.S. persons: U.S. citizens and permanent residents wherever located, entities organized under U.S. law and their foreign branches, and anyone physically in the United States. Certain programs (such as Cuba and Iran) extend to foreign subsidiaries owned or controlled by U.S. persons. Any transaction cleared in U.S. dollars touches the U.S. financial system and is therefore within OFAC's reach.
• OFAC 50 Percent Rule – any entity owned 50% or more, individually or in the aggregate, by one or more blocked persons is itself considered blocked, even if not named on the SDN list. This is why screening must extend to ownership structures, not just names.
• United Nations Security Council – imposes sanctions that member states must implement.
• European Union – implements sanctions through Council Regulations binding on all member states.
• UK OFSI (Office of Financial Sanctions Implementation) – HM Treasury's sanctions enforcer, increasingly important post-Brexit.
• Other national authorities (Canada, Australia, Japan, Switzerland and so on).

Blocking versus rejecting
This distinction is commonly tested:
• Blocked (frozen) transactions – when a transaction involves a blocked person (for example, an SDN), the U.S. financial institution must block the funds, placing them in an interest-bearing blocked account. The funds cannot be returned to the originator or released without an OFAC license. The institution must report the blocking to OFAC within 10 business days.
• Rejected transactions – when a transaction is prohibited but does not involve a blockable interest (for example, a payment to a non-sanctioned party in a comprehensively sanctioned country under certain programs), the institution must reject it and return the funds, and report the rejection to OFAC.

Strict liability and penalties
OFAC violations are strict liability civil offenses: intent and knowledge are not required for a civil penalty, although they affect its size. Penalties can reach the greater of a statutory maximum per violation (which is adjusted for inflation and differs by program) or twice the value of the underlying transaction. Willful violations can also lead to criminal prosecution. OFAC's Enforcement Guidelines reward voluntary self-disclosure and a strong compliance program with substantially reduced penalties.

Licenses
• General licenses – published authorizations allowing certain categories of transactions that would otherwise be prohibited (for example, humanitarian trade or winding down existing contracts).
• Specific licenses – issued to a particular applicant in response to a written request.

How sanctions screening works operationally
Banks screen every payment message (SWIFT MT103, ISO 20022 pacs.008, ACH, checks) against sanctions lists using automated filters that use fuzzy-logic matching to catch misspellings, transliterations and aliases. Screening generates alerts, most of which are false positives (name coincidences) that an analyst must clear. A true match results in blocking or rejection. Screening also covers customers at onboarding and on an ongoing basis whenever lists are updated.

For corporations, the same discipline applies to:
• Vendor and customer master files (screen before onboarding and periodically thereafter).
• Beneficiaries in payment files before release.
• Counterparties in trade finance, letters of credit and supply chain finance.
• Employees and agents in high-risk jurisdictions.
• Merger and acquisition targets (successor liability for sanctions violations is real).
• Investments and portfolio holdings.

OFAC's 2019 Framework for OFAC Compliance Commitments describes the five essential components of a sanctions compliance program: management commitment, risk assessment, internal controls, testing and auditing, and training. The exam may reference these as best practice for corporates as well as banks.

Part 4: How AML, KYC and Sanctions Fit Together in Treasury Operations

Think of the three as layers of the same defensive wall:
• KYC answers: Who am I dealing with? It is performed at onboarding and refreshed periodically.
• Sanctions screening answers: Am I allowed to deal with them at all? It is binary, list-driven and applied in real time to every transaction.
• AML monitoring answers: Is their behavior consistent with what I know about them? It is pattern-based and ongoing, producing SARs when behavior is suspicious.

Treasury touches each layer when it:
• Opens, modifies or closes bank accounts (KYC documentation, signatory verification).
• Selects banks and evaluates counterparty risk (bank AML reputation and enforcement history).
• Executes payments, especially cross-border wires (sanctions filters may delay or stop payments; incomplete beneficiary information triggers requests for information).
• Manages intercompany funding and pooling structures across jurisdictions (regulators scrutinize complex intercompany flows that resemble layering).
• Handles cash receipts (Form 8300 obligations for cash over $10,000).
• Maintains signature authority over foreign accounts (FBAR filing).
• Implements payment controls (dual approval, positive pay, vendor validation) that double as AML/fraud controls.

Red flags treasury professionals should recognize
• Requests to route payments through unrelated third parties or unexpected countries.
• Payments just below reporting thresholds or unusual cash activity.
• Counterparties unwilling to provide ownership information.
• Use of shell companies with no apparent business purpose.
• Sudden changes in vendor bank account details (also a business email compromise indicator).
• Transactions inconsistent with the stated business of the counterparty.

Part 5: Exam Tips – Answering Questions on AML, KYC and Sanctions Screening

Tip 1: Know the acronyms and who does what. The exam loves to test whether you can match the agency to the function. FinCEN administers the BSA and receives SARs and CTRs. OFAC administers sanctions and the SDN list. FATF sets international AML standards but does not enforce. Bank regulators (OCC, Fed, FDIC) examine banks for compliance. If a question asks who publishes the SDN list, the answer is OFAC, never FinCEN.

Tip 2: Memorize the numbers. Several thresholds appear repeatedly: $10,000 for CTRs and Form 8300 (cash, more than $10,000); $10,000 aggregate for FBAR; 25% for the beneficial ownership prong; 50% for OFAC's ownership rule; 10 business days to report blocked property. When two answer choices differ only by a number, the question is testing recall.

Tip 3: Link each law to its defining contribution. BSA = recordkeeping and reporting (CTRs). Money Laundering Control Act = made laundering a crime and prohibited structuring. USA PATRIOT Act = CIP, shell bank prohibition, correspondent banking EDD, information sharing. AMLA 2020 / Corporate Transparency Act = beneficial ownership reporting to FinCEN and whistleblower rewards. If a question mentions customer identification at account opening, think PATRIOT Act.

Tip 4: Distinguish KYC from AML monitoring and from sanctions screening. KYC is identity and risk profiling at onboarding; AML monitoring is ongoing behavioral analysis producing SARs; sanctions screening is list matching on every transaction. A question describing a bank asking for articles of incorporation and beneficial owner passports is about KYC/CIP. A question describing a wire stopped because the beneficiary name resembled a listed party is about sanctions screening. A question describing unusual patterns of deposits is about AML transaction monitoring.

Tip 5: Remember blocking versus rejecting. Blocked funds are frozen in a blocked account and cannot be returned without a license; rejected transactions are refused and returned. Both are reported to OFAC.

Tip 6: Understand strict liability and its implications. If an answer choice suggests that a company is not liable because it did not know its counterparty was sanctioned, that choice is wrong under U.S. sanctions law. The correct framing is that lack of knowledge may mitigate the penalty but does not eliminate liability. Similarly, voluntary self-disclosure reduces penalties, so questions about the best response to discovering a violation usually point toward investigating, stopping the activity and self-reporting.

Tip 7: Recognize the SAR confidentiality rule. A treasury professional cannot be told by their bank that a SAR has been filed, and a bank employee who discloses one commits a crime. If an answer choice has the bank informing the customer about a SAR, eliminate it.

Tip 8: Know the three stages of money laundering in order. Placement, layering, integration. Questions may describe a scenario and ask which stage it represents: depositing cash is placement; wiring funds through multiple shell companies is layering; buying real estate with the proceeds is integration.

Tip 9: Approach scenario questions from the treasurer's seat. When asked what treasury should do to reduce KYC burden or payment delays, the best answers typically involve centralizing documentation, rationalizing bank relationships, using eBAM or the SWIFT KYC Registry, screening vendors before onboarding, and providing complete beneficiary information on payments. Answers that suggest avoiding compliance or circumventing documentation requests are never correct.

Tip 10: Watch for the global dimension. Questions may test that U.S. dollar clearing brings foreign transactions within OFAC jurisdiction, that foreign subsidiaries can be covered under certain programs, that EU and UK sanctions may differ from U.S. sanctions, and that FATF grey-listing increases a jurisdiction's compliance costs and bank scrutiny. A multinational must comply with every regime that touches its transactions, and the most restrictive applicable rule usually governs in practice.

Tip 11: Use elimination on best-practice questions. AFP exam questions often present four plausible controls and ask for the most effective or the first step. Risk assessment typically comes first; screening before payment release beats screening after; ongoing monitoring beats one-time checks; board-level commitment appears in every regulatory framework as the foundation of a compliance program.

Tip 12: Connect to the broader operational risk domain. Sanctions and AML controls overlap with payment fraud controls (dual authorization, callback verification of bank account changes, vendor master file governance). A question may frame a control as fraud prevention while the correct reasoning involves AML or sanctions compliance, or vice versa. Recognizing that these controls serve multiple risk objectives will help you choose the most complete answer.

Quick Review Summary
• AML prevents disguising illicit funds; stages are placement, layering, integration.
• BSA (1970) created CTRs and recordkeeping; PATRIOT Act (2001) created CIP and shell bank bans; AMLA/CTA (2020) created FinCEN beneficial ownership reporting.
• FinCEN receives CTRs (cash over $10,000) and SARs (confidential, no tipping off).
• KYC = CIP + CDD + beneficial ownership (25% ownership prong plus control prong) + EDD for high risk + ongoing refresh.
• OFAC enforces U.S. sanctions, publishes the SDN list, applies the 50% rule, imposes strict liability, and requires blocking or rejecting with reporting.
• FATF sets global standards; EU, UN and UK OFSI run parallel regimes.
• Treasury impact: account opening delays, payment holds, FBAR and Form 8300 filings, vendor screening, documentation management.
• Best practices: centralized KYC repository, eBAM/SWIFT KYC Registry, pre-payment screening, risk assessment, training, testing, management commitment and voluntary self-disclosure when violations are found.