An AML compliance program is the written, risk-based set of policies, controls and people a financial institution uses to prevent money laundering and terrorist financing. FATF standards expect internal controls, a management-level compliance officer, employee screening, ongoing training and an independent audit, built on a risk assessment and proportionate to risk and size.
Each regulator turns those standards into its own rules, so the exact contents, approval steps and filing deadlines differ by jurisdiction. The structure below follows the FATF framework and uses the BSP and AMLC rules as the worked example; confirm the specific requirements against your own regulator's text.
This guide is written for CCOs, AMLCOs and board risk committee members who need to explain what the program is, test whether it works, and defend it to an examiner.
What is an AML compliance program?
It is an institution's documented and operating system for identifying, assessing and controlling money laundering, terrorist financing and proliferation financing risk.
The FATF calls for financial institutions to implement programmes against money laundering and terrorist financing in Recommendation 18. Its interpretive note lists the minimum elements: internal policies, procedures and controls, compliance management arrangements including a compliance officer at management level, screening procedures for hiring employees, an ongoing training programme, and an independent audit function. National rules adopt the same frame. Rule 16 of the Philippines' 2018 AMLA implementing rules requires every covered person to adopt a written, risk-based money laundering and terrorism financing prevention programme. AML compliance, in other words, is not a single control. It is the whole system and the evidence that it runs.
Which regulation requires financial institutions to have an AML compliance program?
The FATF Recommendations set the international standard, and each country's AML law and rules make it binding on institutions there.
FATF Recommendation 18 is the global source, applied through national legislation and supervisory rules. In the Philippines, the requirement comes from the Anti-Money Laundering Act and Rule 16 of its implementing rules, supported by the BSP's AML provisions in its manuals of regulations for supervised institutions. The same implementing rules make the board of directors ultimately responsible for compliance. Other Southeast Asian regimes follow the same pattern under their own regulators, a comparison our regional AML regulations hub lays out.
What are the core components of an AML compliance program?
Governance, a risk assessment, written policies, customer due diligence, monitoring and screening, reporting, record keeping, training and independent testing.
Governance and the compliance officer
The board approves the program and owns the outcome, and a compliance officer at management level runs it day to day. The officer needs the authority to escalate, the access to data, and the time to do the job, which a lean team often under-resources. For BSP-supervised institutions, our guide to AML compliance after the grey-list exit sets out the obligations this role carries today.
Risk assessment
The institution-wide risk assessment identifies which customers, products, channels and geographies carry the most risk. Every other component should trace back to it. Our enterprise-wide risk assessment template shows how to build one.
Policies, procedures and controls
The written program translates the risk assessment into rules staff can follow, with named owners and approval dates. A policy that has not been updated since the last product launch is a finding waiting to happen.
Customer due diligence
Know-your-customer checks at onboarding, enhanced due diligence for higher-risk customers, beneficial ownership for legal persons, and refresh when risk changes. KYC and AML compliance are often spoken of together for this reason: due diligence is the input every later control depends on. A customer risk rating connects the two, turning due diligence findings into the level of monitoring each customer receives.
Monitoring and screening
Transaction monitoring finds unusual activity against the customer's expected profile, and name screening checks customers and counterparties against sanctions, PEP and watchlists.
Reporting and record keeping
Suspicious and covered transaction reports go to the financial intelligence unit on the regulator's clock. In the Philippines that is the next working day from the determination of suspicion for an STR, as our STR versus CTR guide sets out. FATF Recommendation 11 expects records to be kept for at least five years.
Training and employee screening
Staff need role-specific training on red flags and escalation, and hiring needs screening proportionate to the role.
Independent testing
An independent audit tests whether the program is designed well and operating as written. Our guide to what examiners look for in independent testing turns this into an audit scope.
How do examiners judge whether a program is effective?
By results: whether the controls find risk, produce useful reports and change decisions, not whether the policy manual is complete.
The FATF's assessment methodology rates effectiveness through immediate outcomes, and the one that reaches private institutions most directly asks whether they apply preventive measures commensurate with their risks. Our explainer on the FATF immediate outcomes maps them to what a compliance team must show. In practice, an examiner tests a sample of customers against the risk assessment, a sample of alerts against their dispositions, and a sample of reports against their timestamps. Each test asks the same question. Can the institution show, from its records, why it did what it did?
What does AML compliance cost to run?
The cost is mostly people and data, and it scales with the institution's risk and size, which is exactly what the FATF's proportionality principle allows.
The FATF interpretive note says programme measures should take account of the institution's money laundering and terrorist financing risk and the size of the business. A small institution with a simple product set is not expected to run the program of a large universal bank. The main cost drivers are the number of alerts analysts must review, the share of those that are false positives, manual effort in reporting, and the time spent assembling evidence for examinations. Cutting cost without cutting coverage usually means reducing duplicate and low-value alerts and automating the evidence trail. Headline industry cost figures circulate widely, but few are traceable to a published method, so an institution is better served by measuring its own cost per alert and per filing.
How should a lean compliance team prioritise?
Start with the risk assessment, then put effort where it changes outcomes: monitoring quality, reporting timeliness and the decision record.
Five priorities hold for most teams of five to fifteen people. First, keep the risk assessment current, because an outdated one undermines every control built on it. Second, tune monitoring so analysts spend their time on alerts that matter. Third, track every reporting deadline from the moment suspicion is determined. Fourth, make each alert disposition and due diligence decision traceable to a person and a reason. Fifth, commission independent testing before the examiner arrives, not after. None of these requires a larger team. Each requires that the work leaves evidence.
How does Fyscal ARCX support the program?
Fyscal ARCX runs the operating layer of the program, screening, monitoring, investigation and reporting, on one record, so the evidence of effectiveness is produced as the work is done. Named parties are screened against sanctions, PEP and watchlists. A compliance team defines its own monitoring variables and scenarios and tests them against historical data before activation. Each alert opens one case per customer with a timestamped trail of reviews and approvals, and Regulatory Reporting prepares filings and tracks their deadlines. The policies, risk assessment and training remain the institution's own, and ARCX makes the controls they describe auditable.