Anti-Money Laundering (AML)

Money laundering is the work of taking money earned illegally and making it look like it came from a legitimate source. It almost always moves through three stages, and the SIE expects you to name them in order.

1. Placement: the dirty cash first enters the financial system, for example as a bank deposit. This is the riskiest stage for the launderer, because raw cash is the easiest point to detect.
2. Layering: the funds are moved through a web of transactions, transfers, trades, and shell entities, to break the trail back to the original crime.
3. Integration: the now-"cleaned" money returns to the criminal in a form that looks legitimate, such as proceeds from a business or an investment sale.

A quick way to hold the order: the money is placed in, layered to hide it, then integrated back out.

AML duties trace back to two federal laws, and the exam likes to ask which one did what.

Bank Secrecy Act (BSA), 1970

The original framework. It requires financial institutions to help the government detect and prevent money laundering, and it established currency reporting (the CTR) and the recordkeeping rules.

USA PATRIOT Act, 2001

Passed after 9/11, it sharply expanded AML obligations. Four sections come up most:

• Section 314(a): lets law enforcement ask financial institutions for information about specific people suspected of terrorism or money laundering.
• Section 314(b): lets financial institutions voluntarily share information with each other to spot and report suspected laundering.
• Section 326: requires a Customer Identification Program (CIP), verifying the identity of anyone opening an account.
• Section 352: requires every broker-dealer to maintain a written AML compliance program.

Section 352's required AML program rests on four pillars, and every FINRA member firm must have all four.

1. Written policies and procedures, tailored to the firm's size and business.
2. A designated AML compliance officer, who must be a registered principal responsible for overseeing the program.
3. Ongoing employee training, appropriate to each person's role.
4. Independent testing, an audit by a party independent of the compliance function, whether internal audit or an outside firm.

The newer CDD rule is sometimes called the "fifth pillar," and it is covered next.

FinCEN's Customer Due Diligence (CDD) rule, effective 2018, sharpened what a firm must know about its customers. It has four core requirements:

1. Identify and verify each customer's identity (the CIP step).
2. Identify and verify the beneficial owners of a legal-entity customer.
3. Understand the nature and purpose of the relationship to build a customer risk profile.
4. Conduct ongoing monitoring to keep information current and report suspicious activity.

Beneficial ownership

When a legal entity (an LLC, corporation, partnership, or trust) opens an account, the firm must identify two things: each individual who owns 25% or more of the entity (the ownership prong), and one individual with significant managerial control (the control prong), which is required even when no single person owns 25%.

OFAC screening

Separately, firms must screen customers against the Office of Foreign Assets Control's Specially Designated Nationals (SDN) list. A match generally means the firm cannot do business with that person and must block the assets and report to OFAC, since these are sanctioned individuals and entities.

The SIE often hands you a scenario and asks whether it looks suspicious. The single most tested red flag is structuring.

• Structuring (smurfing): breaking a large cash transaction into pieces each just under $10,000 to dodge a CTR filing. It is illegal on its own, even when the underlying money is perfectly legitimate.
• A customer who is reluctant to provide required identification.
• Transactions with no apparent business purpose or economic rationale.
• Frequent wire transfers to or from high-risk jurisdictions.
• An account used as a pass-through, where money flows in and right back out.
• A customer unusually focused on the firm's reporting thresholds.
• Third-party deposits with no clear connection to the account holder.

When something fits one of these patterns, the firm investigates and, where warranted, files a SAR, without ever telling the customer.

When a customer is, or is closely tied to, a senior foreign political figure, the account carries an elevated risk of holding the proceeds of bribery or corruption. Under Section 312 of the USA PATRIOT Act, firms must apply enhanced due diligence to these relationships, going beyond the standard CIP and CDD.

Who counts as a PEP

A Politically Exposed Person (also called a senior foreign political figure) covers three groups:

• The official: a current or former senior official of a foreign government, a major foreign political party, or a foreign government-owned enterprise, plus senior executives of international organizations.
• Immediate family: spouses, parents, siblings, children, and in-laws of the official.
• Close associates: known advisors, financial managers, or business partners publicly tied to the official.

The rule targets foreign figures; domestic U.S. officials are generally not treated as PEPs under it, though a firm may add scrutiny based on its own risk assessment.

What enhanced due diligence adds

EDD layers extra steps onto a normal account: senior management approval before opening (a compliance analyst alone is not enough), extra verification of the customer's source of funds and source of wealth, and more sensitive, more frequent monitoring. Crucially, PEPs are not prohibited customers; the rule imposes scrutiny, not a ban. On the exam, a customer connected to a foreign official by family or business almost always means EDD applies, not that the account must be refused.