Best AML Software for Banks in 2026
AML software for banks compared by size and job: human sign-off, audit trails and exam evidence across Sphinx, Verafin, Actimize, Oracle, SAS and more.
TL;DR: AML compliance is the set of written controls, reports and governance a financial institution must maintain under the Bank Secrecy Act to detect and report money laundering and other financial crime. Regulators judge the program by what the institution actually does, and on October 13, 2026, Treasury announced more than $1.21 billion in penalties against Bank of America for failing that test. FinCEN's April 2026 proposal to rewrite the program rule had not been finalized as of early November 2026, so the current rule still governs.
AML Compliance in Plain Terms
AML compliance is an institution's continuing duty to know its customers, watch their activity, report what the law requires, and prove all of that to an examiner. Money laundering, in FinCEN's description, is the disguising of criminal proceeds so they appear to come from a legal source. The Bank Secrecy Act of 1970 is the core U.S. statute. FinCEN administers it, and the Money Laundering Control Act of 1986 made laundering a federal crime and directed banks to keep procedures that monitor BSA compliance.
People use "AML compliance" and "BSA compliance" almost interchangeably, and the FFIEC BSA/AML Examination Manual, the handbook examiners work from, joins the two terms. Sanctions work usually lands on the same desk, though the Manual notes that OFAC regulations are not part of the BSA. A new program owner should treat them as separate legal regimes that share staff, data and screening tools.
The reporting standard is suspicion. Under 31 CFR 1020.320, a bank reports a transaction of at least $5,000 when it knows, suspects or has reason to suspect the activity involves illegal proceeds, is designed to evade the BSA, or has no apparent lawful purpose and no reasonable explanation after review.
Who the BSA Reaches
The BSA applies to "financial institutions," a defined term much wider than banks. Under 31 CFR 1010.100(t), the category covers banks, broker-dealers, money services businesses, casinos and card clubs with more than $1 million in gross annual gaming revenue, futures commission merchants, introducing brokers in commodities, and mutual funds. FinCEN's program rules also extend to other categories such as loan or finance companies. The rule for registered investment advisers has been delayed to January 1, 2028.
Fintechs are where new owners most often inherit a wrong assumption. A company that accepts and transmits funds or other value can be a money transmitter, and therefore a money services business with its own program obligation, regardless of how it describes itself. The federal banking agencies said in a July 2024 joint statement that when a third party handles monitoring, customer identification or due diligence for a bank, the bank remains responsible for meeting the requirements.
What a Program Has to Contain
A U.S. bank's AML program must be written and must contain a defined set of components. The FFIEC Manual's program section and 31 CFR 1020.210 require:
- A system of internal controls to assure ongoing compliance
- Independent testing, by bank personnel or an outside party
- A designated individual responsible for day-to-day compliance
- Training for appropriate personnel
- Risk-based procedures for ongoing customer due diligence, including beneficial owners of legal entity customers
- A customer identification program
Sphinx's guide to the five pillars of an AML compliance program covers what each component demands, and the personal side of the third item is in BSA officer responsibilities. A risk-based approach to AML explains why two institutions with the same components can reasonably run very different controls.
The daily work comes from the reports and records the program has to produce. For a bank, the recurring duties include filing a SAR within 30 calendar days of initial detection, or up to 60 days when no suspect has been identified; filing a CTR on currency transactions above $10,000; keeping each SAR and its supporting documentation for five years; and keeping the existence of a SAR confidential. That prohibition binds every director, officer, employee and agent.
What Examiners Actually Test
Examiners test whether the written program operates as described and fits the institution's risk. The FFIEC Manual is direct: written policies, procedures and processes alone are not sufficient, and reviewing them is only a first step. Examination and testing procedures have to support the overall conclusion, and that conclusion is specific to the bank.
The Manual's closing procedures show what examiners weigh when they reach it:
- Whether the institution understands its illicit finance risks, and whether the risk assessment reaches business lines, management and the board
- Whether actual practices correspond to written policies, procedures and processes
- Whether independent testing is adequate in coverage and frequency for the risk profile
- Whether the designated officer is competent and has authority, independence and access to resources
- Whether the board and senior management oversee the program and commit to timely corrective action
Severity matters as much as existence. The Manual says minor weaknesses, deficiencies and technical violations alone do not indicate an inadequate program. Systemic or repeat violations are a different category, and examiners assess those on the nature, duration and severity of the problem. The Manual also directs examiners to note whether a deficiency was found first by the bank or its testers, or only surfaced in the exam. An institution that finds its own problems starts from a better position.
What Failure Costs
Consequences run from a written finding to a mandatory enforcement order. Under the federal banking agencies' 2020 joint statement on BSA/AML enforcement, an agency shall issue a cease and desist order when an institution fails to have a written program covering the required components, fails to implement one, or fails to correct a previously reported problem. Isolated or technical violations generally fall outside that requirement. Enforcement also reaches beyond the penalty: the Federal Reserve notes that AML effectiveness must be considered when agencies evaluate bank mergers and holding company applications.
The most recent large case shows how the findings connect. Treasury's October 13, 2026 announcement of more than $1.21 billion in penalties against Bank of America described over $5 billion in suspicious activity not reported on time. The OCC found that the BSA officer and staff lacked sufficient skills, that key personnel were not appropriately trained, and that the audit function missed longstanding concerns examiners later uncovered. The bank must also complete a third-party lookback and independent reviews.
Small institutions are well represented in the data. Crowe's review of 2024 enforcement counted 42 BSA/AML actions, up from 29 in 2023, and 54% of the actions against banks went to institutions under $1 billion in assets.
Repeat failures are priced differently. FinCEN penalized UBS Financial Services $14.5 million in 2018 and $125 million in August 2026, after the firm failed to fix the monitoring weakness behind the first order. Individuals carry exposure too. Under 31 U.S.C. 5322, a willful violation can bring a fine of up to $250,000 and five years in prison, rising to $500,000 and ten years when it is part of a pattern of illegal activity above $100,000 in 12 months or occurs alongside another federal violation. A convicted director, officer or employee must also repay bonuses from the year of the violation or the following year.
The Rule Is Moving, and Still Applies
FinCEN has proposed replacing the program rule, and the existing text remains in force. On April 7, 2026, FinCEN issued a proposed AML/CFT program rule that superseded its July 2024 proposal. The OCC, FDIC and NCUA proposed parallel changes that month, and the Federal Reserve followed in July. FinCEN's comment period closed June 9, 2026. The Federal Register's FinCEN index still listed the rule only as a proposal through October 2026, and FinCEN proposes a 12-month implementation period after any final rule.
The proposal would make risk assessment processes an explicit requirement inside internal controls and would judge a program on whether it is established and then maintained. Sphinx's explainer on FinCEN's effectiveness-based AML rule covers that framework. A new owner should build to 31 CFR 1020.210 and the regulator's current rule, and start the risk assessment work the proposal would require, since that work is useful under either version.
The First 90 Days in the Seat
Anyone newly responsible for AML should establish the actual state of the program before changing anything. A workable order:
- Find the board minutes that designate the responsible officer and that approve the current program.
- Read the last exam report and independent test, and list every open issue with an owner and a date. An unresolved issue that was previously reported is the one that can force an order.
- Compare the risk assessment with the current list of products, customers and geographies. Anything live and missing is the first task.
- Walk one alert from generation to disposition, and one SAR from decision to filing to board notification. Compare both with the written procedure.
- Pull aging for alerts, open cases and SAR deadlines.
- List every third party performing a BSA function, and confirm the institution can reach its data.
- Put staffing and system gaps in writing in the next board report.
Where Sphinx Fits
Sphinx is an investigation layer that works inside the tools a compliance team already uses. Its AI agents prepare evidence on alerts and cases, apply the team's SOPs and produce a traceable recommendation, and the team keeps final approval. Sphinx reports 94-98% agreement with analysts and a 3.2-minute median case. Sphinx does not score transactions, block payments in real time, verify a person's face or connect to bank accounts, so a program still needs its own monitoring, screening and identity controls.
Frequently Asked Questions
What does AML compliance mean?
AML compliance means maintaining a written, risk-appropriate program and meeting the reporting and recordkeeping duties of the Bank Secrecy Act. For a bank, that covers internal controls, independent testing, a designated officer, training, customer due diligence and a customer identification program. Regulators also expect actual practice to match the written program.
Is AML compliance the same as KYC?
No. KYC, meaning customer identification and due diligence, is one part of an AML program. AML compliance also includes transaction monitoring, SAR and CTR filing, recordkeeping, training, independent testing and board oversight.
Do fintechs have to comply with AML rules?
A fintech that meets a BSA definition, such as a money transmitter, carries its own program obligation under 31 CFR 1022.210. A fintech outside those definitions usually performs controls under contract for a sponsor bank. The federal banking agencies have said the bank remains responsible for those functions even when a third party performs them.
Who enforces AML compliance in the United States?
FinCEN holds overall authority for enforcing the BSA. The OCC, Federal Reserve, FDIC and NCUA examine the institutions they supervise and can bring their own actions, and criminal cases can follow under 31 U.S.C. 5322.
Has FinCEN's AML program rule changed?
Not yet. FinCEN proposed a new AML/CFT program rule on April 7, 2026, and the Federal Register still listed it only as a proposal through October 2026. FinCEN proposes a 12-month implementation period after a final rule, so 31 CFR 1020.210 and the banking agencies' current rules remain the operative standard.
