AI Anti-Money Laundering Policy Writing Guide 2026: A Structured Framework for CDD, Suspicious Transaction Reporting, and Risk Assessment

An AML policy is not a compliance declaration that "the company will comply with anti-money laundering laws" — it is a risk control document that determines whether customers can open accounts, whether suspicious transactions can be identified, and whether evidence can be produced in money laundering cases. The problem with most AML policies is that CDD is written vaguely ("know your customer" — know what? how to tier?) and STR is fuzzy ("report suspicious transactions promptly" — what's suspicious? to whom? what deadline?). The biggest trap when using AI to write an AML policy is asking it to "write a standard AML template" — FATF recommendations provide frameworks but not your actual customer types and business scenarios. What's useful is quantifying your actual customer tiers, suspicious transaction identification criteria, and reporting deadlines.

I. The Five-Element Structure of an AML Policy

An enforceable AML policy contains five elements: Customer Due Diligence (CDD — who is your customer/three-tier classification/beneficial owner identification), Suspicious Transaction Reporting (STR — what transactions are suspicious/identification criteria/reporting workflow/deadlines), Risk Assessment (customer/product/geography/channel four-dimension risk rating), Training and Awareness (AML training all staff/key positions/content/frequency), and Record Retention (CDD records/transaction records/STR records/audit records retained ≥5 years). The five elements are sequential: without CDD you don't know the risk, without STR identification money laundering passes through, without risk assessment resources are misallocated, without training employees lack awareness, without records you can't prove compliance.

"I need to write an AML policy for [company type/industry/whether financial institution]. Here are the customer types and business scenarios: [paste]. Please organize by five elements: 1.CDD (three tiers: simplified CDD — low-risk customers (ID verification); standard CDD — medium-risk (ID+address+occupation+transaction purpose); enhanced CDD — high-risk (face-to-face/fund sources/beneficial owner/ongoing monitoring); beneficial owner identification — ≥25% equity penetration) 2.STR (identification criteria: large cash ≥50K/frequent small splits/inconsistent with customer profile/purposeless transfers; workflow: front desk detects→compliance reviews→report to regulator within 5 working days; retain STR copy ≥5 years) 3.Risk Assessment (customer rating: low/medium/high; product risk: cash/cross-border/crypto high-risk; geography risk: high-risk country list; channel risk: face-to-face vs non-face-to-face) 4.Training (all staff annual ≥2 hours/key positions (front desk/compliance/audit) ≥8 hours/content includes identification methods+case analysis+reporting workflow) 5.Record Retention (CDD ≥5 years/transaction records ≥5 years/STR ≥5 years/training ≥5 years). Standards must be quantified."

II. Customer Due Diligence (CDD): Three Tiers + Beneficial Owner

CDD is the first gate of AML — without investigating customers you're opening the door for money launderers. Three-tier CDD: Simplified CDD (low-risk customers — personal ID verification/corporate license verification, applicable: low-risk retail customers/small transactions/government entities, no beneficial owner identification needed), Standard CDD (medium-risk — ID+address+occupation+income source+transaction purpose+expected frequency and amount, applicable: most corporate and individual customers, beneficial owner identification required), Enhanced Due Diligence (EDD) (high-risk — face-to-face meeting/detailed fund source verification/wealth source verification/beneficial owner penetration/ongoing monitoring/periodic review, applicable: high-risk geography customers/PEPs/cash-intensive/crypto/cross-border). Beneficial owner identification: penetrate equity layers to identify the ultimate actual controller with ≥25% equity; if unidentifiable, treat as high-risk requiring EDD.

"Here are the customer types and risk status: [paste]. Please detail by three tiers + beneficial owner: 1.Simplified CDD (①applicable: low-risk retail individuals/government entities/listed companies ②measures: ID/business license verification+list screening (sanctions/PEP lists)③no beneficial owner identification needed ④trigger: single transaction <10K/annual cumulative <50K) 2.Standard CDD (①applicable: most corporate and individual customers ②measures: ID+address+occupation+income source+transaction purpose+expected frequency/amount ③beneficial owner: penetrate ≥25% equity to actual controller ④list screening: sanctions/PEP/adverse media ⑤trigger: single 10K-500K/annual 50K-2M) 3.Enhanced EDD (①applicable: high-risk geography/PEPs/cash-intensive/crypto/cross-border/unidentifiable beneficial owner ②measures: face-to-face (video or in-person)/detailed fund source (bank statements/contracts/tax)/wealth source verification/ongoing monitoring/periodic review (semi-annual/annual)③approval: compliance director approval required to establish relationship ④trigger: single ≥500K/annual ≥2M/high-risk geography/PEP ⑤ongoing monitoring: transaction behavior deviation triggers immediate review). Generate CDD matrix: tier|applicable|measures|beneficial owner|list screening|approval|trigger|review frequency."

III. Suspicious Transaction Reporting: Identification + Workflow + Deadlines

STR is the core detection mechanism of AML — without identifying suspicious transactions, money laundering flows freely. Five identification dimensions: Large Abnormal (cash ≥50K/corporate transfer ≥500K inconsistent with customer profile), Split Transactions (frequent small transactions to evade large-amount reporting — multiple <50K same day totaling ≥50K), Abnormal Patterns (quick in-and-out/fund nature inconsistent with occupation/purposeless cross-border transfers), High-Risk Association (linked to high-risk geography/sanctions list/PEP), Behavioral Anomalies (customer refuses CDD/provides false info/demands secrecy/rushes transaction). Reporting workflow: front desk detects→compliance reviews (2 working days)→decide whether to report→report to AML monitoring center within 5 working days→retain STR copy ≥5 years→ongoing monitoring of that customer.

"Here are the transaction monitoring rules and suspicious cases: [paste]. Please detail identification + workflow + deadlines: 1.Identification Criteria (①large abnormal: cash ≥50K/corporate ≥500K inconsistent with customer identity/occupation/income ②split: multiple <50K same day/short period totaling ≥50K/evading large-amount reporting ③abnormal patterns: quick in-and-out (in then out within 24h)/fund nature inconsistent with occupation (individual account large corporate transfers)/purposeless cross-border ④high-risk association: linked to high-risk countries/sanctions/PEP ⑤behavioral: refuses CDD/false info/demands secrecy/rushes/withdraws then retries differently) 2.Reporting Workflow (①detection: front desk/system alert→fill STR registration form (customer/transaction/anomaly reason)②review: compliance reviews within 2 working days — confirm suspicious (after excluding normal business)③decision: compliance director decides whether to report ④report: within 5 working days to AML monitoring center (online system/written)⑤retention: STR copy + supporting materials ≥5 years ⑥follow-up: ongoing monitoring/may freeze account/may terminate relationship/tipping-off prohibited — cannot inform customer that STR filed) 3.System Monitoring Rules (①large-amount reporting: cash ≥50K/corporate ≥500K/cross-border ≥200K auto-generates large-amount report ②suspicious alerts: split/quick in-and-out/behavioral deviation→system alert ③list screening: real-time comparison with sanctions/PEP/high-risk lists ④periodic retroactive: quarterly full transaction retroactive analysis). Generate STR workflow: detect→register→review→decide→report→retain→monitor."

IV. Risk Assessment and Customer Rating: Four Dimensions

Risk assessment is the resource allocation basis for AML — without assessment all customers are treated the same, high-risk slips through and low-risk wastes resources. Four dimensions: Customer Risk (low — ordinary retail/government; medium — general corporate/high-net-worth; high — PEP/cash-intensive/crypto/high-risk geography), Product Risk (low — savings/time deposits; medium — corporate transfers/wealth management; high — cash/cross-border remittance/crypto/private banking), Geography Risk (low — local/low-risk countries; high — FATF high-risk list/offshore financial centers/sanctioned countries), Channel Risk (low — face-to-face onboarding; high — non-face-to-face/remote/agent onboarding). Composite rating = highest tier across four dimensions weighted — customer 40%+product 25%+geography 25%+channel 10%. Rating determines CDD tier and monitoring frequency.

"Here are customer/product/geography/channel distribution: [paste]. Please detail four dimensions + rating: 1.Customer Risk (40% weight)(①low: ordinary retail individuals/government/listed companies ②medium: general corporate/high-net-worth/professional investors ③high: PEP/cash-intensive (restaurants/retail/entertainment)/crypto dealers/high-risk geography/unidentifiable beneficial owner) 2.Product Risk (25% weight)(①low: savings/time deposits/payroll ②medium: corporate transfers/wealth management/insurance ③high: cash deposits/cross-border remittance/crypto/private banking/trust) 3.Geography Risk (25% weight)(①low: local/low-risk countries (FATF white list)②medium: general countries ③high: FATF black/grey list/offshore centers/sanctioned — prohibited or requires EDD) 4.Channel Risk (10% weight)(①low: face-to-face onboarding (reliable identity verification)②medium: video-verified onboarding ③high: pure online non-face-to-face/agent onboarding/third-party introduction — requires additional verification) 5.Composite Rating (customer×40%+product×25%+geography×25%+channel×10%→highest tier determines: any dimension high = composite high/any medium = composite medium/all low = low). Generate rating matrix: dimension|low|medium|high|weight. Rating determines CDD tier (low→simplified/medium→standard/high→EDD) and monitoring frequency (low→annual/medium→semi-annual/high→ongoing+quarterly review)."

V. Common Mistakes Checklist

• CDD written as "know your customer": not executable. Fix: three tiers + specific measures
• No beneficial owner identification: insufficient penetration. Fix: ≥25% equity to actual controller
• STR no identification criteria: relies on experience. Fix: five dimensions + system monitoring
• STR no reporting deadline: "promptly." Fix: within 5 working days
• Tipping-off: informing customer of report. Fix: prohibited + confidentiality obligation
• No tiered risk assessment: one-size-fits-all. Fix: four dimensions + composite rating
• Records retained too short: only 1-2 years. Fix: CDD/transactions/STR all ≥5 years

VI. Complete Example

Company: Financial institution AML policy (excerpts CDD+STR+assessment).
CDD: ①Simplified — low-risk retail (ID verify+list screening/single <10K)②Standard — general corporate and individual (ID+address+occupation+income+purpose+beneficial owner ≥25% penetration/single 10K-500K)③Enhanced EDD — PEP/high-risk geography/cash-intensive (face-to-face+fund source+wealth source+ongoing monitoring+compliance director approval/single ≥500K/semi-annual review).
STR: Five identification criteria (large abnormal ≥50K/split/abnormal patterns/high-risk association/behavioral)→detect register→compliance 2 working day review→compliance director decision→5 working day report to monitoring center→retain ≥5 years→ongoing monitoring→tipping-off prohibited. System: large-amount auto-report (cash ≥50K/corporate ≥500K/cross-border ≥200K)+suspicious alerts (split/quick in-out/deviation)+real-time list screening+quarterly retroactive.
Assessment: Customer 40% (low/med/high)+Product 25% (savings low/transfers med/cash cross-border high)+Geography 25% (local low/FATF black list high)+Channel 10% (face-to-face low/non-face-to-face high). Any high = composite high. Rating determines CDD tier and monitoring frequency (low→annual/med→semi-annual/high→ongoing+quarterly).
Training: All staff annual ≥2 hours/key positions (front desk/compliance/audit) ≥8 hours/includes identification+cases+reporting.
Records: CDD/transactions/STR/training all ≥5 years.

This article focuses on AML policy writing. When building a complete compliance system, also see AI Anti-Corruption Policy Writing Guide (bribery red lines and whistleblower mechanisms), AI Audit Report Writing Guide (AML special audit methods), and AI Compliance Training Plan Writing Guide (AML training design).

Frequently Asked Questions

Q1: Do non-financial institutions need an AML policy?

Depends on business nature. Financial institutions (banks/payment/insurance/securities) and designated non-financial businesses (real estate/jewelry/auction/lawyers/accounting/trust) are statutory AML obligated entities and must have AML policies. General enterprises have no statutory AML obligation but should consider one if: ①accepting large cash payments — may be exploited for laundering②cross-border business — involves high-risk geography③supply chain finance — complex fund flows. Non-financial AML policies can be simplified (focus on large cash monitoring and customer identity verification) but core elements (CDD/STR/records) cannot be omitted. If unsure whether needed, consult a compliance advisor or local AML regulator.

Q2: How to identify the beneficial owner?

Penetrate equity layers to identify the ultimate actual controller. Method: ①collect corporate ownership structure — trace shareholders layer by layer from the customer entity②identify direct or indirect shareholders with ≥25% equity — penetrate each equity layer until reaching a natural person③if no natural person with ≥25%, identify the person who actually controls the entity through other means (agreements/family relationships)④if unidentifiable, rate the customer as high-risk and require EDD including face-to-face/fund source verification. For listed companies, beneficial owner identification can be waived (equity is publicly transparent). Record retention: beneficial owner identity (name/ID number/address)+equity penetration path diagram, ≥5 years.

Q3: Can you tell the customer after finding a suspicious transaction?

Absolutely not. This is called tipping-off (disclosure), strictly prohibited by AML regulations — revealing to the customer or third parties that an STR has been or will be filed constitutes a criminal offense. Correct approach after finding a suspicious transaction: ①process the transaction normally (don't refuse or delay, to avoid raising suspicion)②secretly fill out the STR registration form③report to compliance for review④compliance decides and reports to regulator within 5 working days⑤ongoing monitoring of subsequent transactions⑥strict confidentiality throughout reporting and processing. If the customer asks about account freezes or reviews, only state "handled per bank compliance procedures" — never reveal STR-related information. Violating the tipping-off prohibition exposes individuals and institutions to criminal penalties.

Author: UseAIWriter Editorial | Updated: 2026-10-27 | Written by UseAIWriter Editorial. Please cite the source when reposting.