How to Build an AML Program From Scratch (Step-by-Step Guide)

Step 1 is a business risk assessment, and it's non-negotiable as the starting point. Before you write a single policy, you need to understand what you're defending against. A risk assessment identifies the specific ways your business model, product mix, customer base, and geographic location create money laundering exposure — and it provides the documented foundation that justifies every other element of your program. Examiners who find a program without a current risk assessment often assume the worst about what else is missing.

Step 2 is your written AML policy. This document describes your internal controls — the specific procedures your staff follows to prevent, detect, and report suspicious activity. It should cover customer identification, transaction monitoring, suspicious activity reporting, recordkeeping, and employee training. Write it to describe what your team actually does, not what you aspire to do. Regulators have an excellent instinct for policies that have never been read by the employees who are supposed to follow them.

Step 3 is designating your BSA compliance officer and building your training curriculum. The BSA officer must have actual authority, actual knowledge, and actual time allocated to the role — not just a title on an org chart. For most small businesses, this means either investing in a senior staff member's compliance education or engaging an external compliance professional on a consulting basis. Your training program must cover every employee who could encounter BSA-relevant activity, and every training session must be documented with content, date, and attendees.

Step 4 is building your customer due diligence and transaction monitoring procedures. These are the operational core of your program — the everyday activities that make your internal controls real rather than theoretical. Your CDD procedures define what information you collect before doing business with a customer. Your transaction monitoring procedures define how you identify and respond to unusual activity. Both must be specific, practical, and linked to the risks identified in your risk assessment.

Step 5 is independent testing and program maintenance. Schedule your first external program review within 12 months of implementation, and use the findings to improve before regulators arrive. Then build maintenance into your operating rhythm: annual risk assessment updates, regular training cycles, monthly monitoring reviews, and quarterly reporting to senior management. An AML program is not a document — it's a practice, and practices require maintenance.