Six Building Blocks Every Broker-Dealer AML Program Needs

Every broker-dealer in the United States must run a written anti-money laundering program. FINRA Rule 3310 sets the minimum: detect and report suspicious activity, comply with the Bank Secrecy Act, test the program independently, name an AML compliance person, train staff, and carry out risk-based customer due diligence.

That is the framework. The detail is where firms get fined.

Anti-money laundering (AML) is one of the most heavily enforced areas of securities regulation. In March 2026, one broker-dealer faced $120 million in penalties from three regulators for AML failures that ran for years. The same rules sit inside the SIE and Series 7 exams, and they shape some of the most in-demand roles in compliance.

This guide covers every requirement a broker-dealer must meet, the deadlines and dollar thresholds behind each one, the red flags regulators keep finding, and what it all means if you are building a career in the securities industry. If you are preparing for the industry exams, FRC’s Securities Industry Essentials (SIE) Exam Preparation course teaches AML across two dedicated chapters, and Series 7 Exam Preparation builds on it at account-opening level.

Six Building Blocks Every Broker-Dealer AML Program Needs

Where Broker-Dealer AML Rules Come From

Broker-dealer AML obligations sit on three layers of law and regulation. Each layer adds something the one before it did not.

The foundation is the Bank Secrecy Act of 1970. It created the reporting and recordkeeping system that lets the government follow money through financial institutions, including broker-dealers.

The second layer is the USA PATRIOT Act, passed in October 2001. Its Title III turned AML from a reporting exercise into a full compliance program. Section 352 required financial institutions, broker-dealers included, to build formal AML programs, and Section 326 created the customer identification rules every new account now passes through.

The third layer is the regulators. The Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Treasury, writes and enforces the Bank Secrecy Act regulations. The Securities and Exchange Commission (SEC) examines firms under the Securities Exchange Act of 1934, and FINRA turns the obligations into a membership rule it can examine and enforce directly. For a full picture of how FINRA fits into that structure, see What Is FINRA? A Complete Guide.

Broker-dealers have carried a formal AML program requirement since 2002. Investment advisers have not. FinCEN’s AML rule for registered investment advisers has been pushed back to January 1, 2028, which leaves broker-dealers as the securities firms with the longest-running and most tested AML obligations.

The Six Required Elements of FINRA Rule 3310

FINRA Rule 3310 requires every member firm to develop and implement a written AML program approved in writing by a member of senior management. The program must contain six elements.

First, policies and procedures that can reasonably be expected to detect and cause the reporting of suspicious transactions. Second, policies, procedures and internal controls reasonably designed to comply with the Bank Secrecy Act and its regulations.

Third, independent testing. Most firms must test their AML program every calendar year. Firms that do not execute customer transactions or hold customer accounts, such as firms that trade only for their own account or deal only with other broker-dealers, may test every two years instead.

The test must be run by someone with working knowledge of the Bank Secrecy Act. It cannot be run by the person who performs the functions being tested, by the AML compliance person, or by anyone who reports to either of them. FINRA also expects firms to test more often when their circumstances call for it.

Fourth, a designated AML compliance person, who must be an associated person of the firm. The firm must give FINRA this person’s name, title, mailing address, email address and phone number, and promptly report any change.

Fifth, ongoing training for the right people. Sixth, risk-based customer due diligence, which FINRA added in 2018 to match FinCEN’s customer due diligence rule.

Customer Identification: The Four Facts Every Account Starts With

Every new account opens with a Customer Identification Program. Before opening an account for an individual, the firm must collect four pieces of information: name, date of birth, address and an identification number, which for a U.S. person is usually a Social Security number.

The address must be a residential or business street address for an individual, not just a post office box. For non-U.S. persons, the identification number can be a taxpayer identification number, a passport number and country of issuance, an alien identification card number, or the number and country of issuance of another government-issued photo ID.

Collecting the information is only the first step. The firm must verify the customer’s identity within a reasonable time before or after the account opens, using documents, non-documentary methods or both. It must keep records of the information and the verification, generally for five years after the account closes.

The firm must also check whether the customer appears on any government list of known or suspected terrorists, and give customers notice that their information is being collected to verify their identity. CIP sits alongside broader Know Your Customer (KYC) obligations, including FINRA Rule 2090, which requires reasonable diligence to know the essential facts about every customer, and FINRA Rule 4512, which sets the customer account information a firm must hold.

FINRA’s 2026 oversight report shows where this goes wrong. Firms auto-approved accounts despite identity red flags, including Social Security numbers belonging to deceased people. FINRA also warned that fraudsters now use generative AI to produce fake ID documents, cloned voices and deepfake selfies to get through verification.

Beneficial Ownership and the 25 Percent Test

When the customer is a company rather than a person, the firm must look through the entity to the people behind it. FinCEN’s customer due diligence rule, which broker-dealers have had to follow since May 11, 2018, sets two tests.

The ownership test captures every individual who owns 25 percent or more of the equity in the legal entity. The control test captures one individual with significant responsibility to control, manage or direct the entity, such as a chief executive, chief financial officer or managing member.

A company can have up to four owners under the first test, or none. It always has one person under the control test. That is why a firm can never open an entity account with no named individual at all.

Beneficial ownership is not a one-time check. Under Rule 3310, firms must understand the nature and purpose of each customer relationship to build a risk profile, then monitor the account on an ongoing basis and update customer information, including beneficial owners, when the risk calls for it. This is ongoing due diligence, not a box ticked at account opening.

Suspicious Activity Reports: $5,000 and 30 Days

A broker-dealer must file a Suspicious Activity Report with FinCEN when a transaction, conducted or attempted, involves or aggregates at least $5,000 and the firm knows, suspects or has reason to suspect it falls into one of four categories.

The transaction involves funds from illegal activity, or is meant to hide them. It is designed to evade Bank Secrecy Act reporting, for example through structuring. It has no business or apparent lawful purpose and is not the sort of activity the customer would normally be expected to carry out. Or it uses the broker-dealer to facilitate criminal activity.

The deadline is 30 calendar days from the date the firm first detects facts that may justify a filing. If no suspect has been identified, the firm can take another 30 days to identify one, but the report can never be delayed beyond 60 days from initial detection. The firm must keep the SAR and its supporting documents for five years from the filing date.

Reports are filed electronically through FinCEN’s BSA E-Filing System, and the obligation itself comes from 31 U.S.C. 5318(g), the Bank Secrecy Act provision behind every SAR.

SARs are confidential. A firm cannot tell the customer, or anyone outside the permitted exceptions, that a report has been filed or is being considered. Tipping off a customer is itself a violation, which is why front-line staff are trained to escalate concerns internally rather than question the customer about them.

Currency Transaction Reports and the $10,000 Line

A separate report applies to physical cash. When a customer conducts a currency transaction of more than $10,000 in a single business day, the firm must file a Currency Transaction Report with FinCEN, generally within 15 days.

Multiple cash transactions by or on behalf of the same person on the same day are added together. Two deposits of $6,000 in one day trigger the report just as a single $12,000 deposit would.

Broker-dealers handle far less cash than banks, so CTRs are rarer in the securities industry. The rule still applies, and the exam still tests it.

Structuring: The Offense Hidden in Smaller Deposits

Structuring means breaking up transactions to avoid a reporting threshold. A customer who deposits $9,500 on Monday, $9,000 on Tuesday and $9,800 on Wednesday to stay under the $10,000 CTR line is structuring.

Structuring is a federal crime in its own right, even when the money is entirely legal. It is also one of the four SAR categories, which means a pattern like this should lead to a SAR even though no single deposit triggered a CTR.

FinCEN’s October 2025 SAR FAQs addressed activity sitting just under reporting thresholds. Firms are expected to judge the pattern, not just the individual transactions.

Placement, Layering and Integration

Money laundering follows three stages, and every AML control is built to catch at least one of them.

Placement is the moment illicit money first enters the financial system, often in amounts designed to avoid attention. Layering is the movement that follows: transfers between accounts, firms and countries, trades with no economic purpose, all meant to distance the money from its source.

Integration is the final stage, when the money returns to the economy looking legitimate. Broker-dealers are especially exposed to layering, because securities accounts let money move quickly through liquid assets and across borders.

Here is how the three stages can look at a securities firm. Placement might be a series of cashier’s checks or wires from unrelated third parties funding a new account. Layering might be rapid buying and selling of low-priced stock with no regard for profit or loss, or journaling assets between linked accounts. Integration is the final wire out, presented as the proceeds of an ordinary investment.

OFAC Sanctions Screening

Sanctions compliance runs alongside AML. The Office of Foreign Assets Control (OFAC), part of the Treasury, maintains lists of sanctioned individuals, entities and countries.

The best known is the Specially Designated Nationals and Blocked Persons List, usually called the SDN list. Broker-dealers screen customers, beneficial owners and transaction counterparties against it.

Broker-dealers must block accounts and property belonging to sanctioned parties and reject transactions OFAC has not licensed. Blocked or rejected transactions must be reported to OFAC within 10 business days. Firms holding blocked property must also file an annual report, due by September 30 each year, covering property held as of June 30.

OFAC screening is strict liability territory. A firm cannot argue it did not intend to deal with a sanctioned party. It needs systems that screen customers and transactions against current lists.

Information Sharing Under Sections 314(a) and 314(b)

Section 314 of the PATRIOT Act opened two channels for sharing information about money laundering and terrorist financing.

Under Section 314(a), FinCEN sends requests on behalf of law enforcement asking financial institutions to search their records for named individuals and entities. Broker-dealers must search their accounts and transactions and report any match to FinCEN, generally within 14 days, and keep the request confidential.

Section 314(b) is voluntary. Financial institutions that register with FinCEN can share information with each other about suspected money laundering or terrorist financing under a legal safe harbor. FinCEN’s June 2026 guidance confirmed that the safe harbor covers suspected fraud as well.

Foreign Correspondent Accounts and Shell Banks

Broker-dealers that hold accounts for foreign financial institutions face extra requirements. They may not maintain correspondent accounts for foreign shell banks, which are banks with no physical presence in any country.

Firms must take reasonable steps to make sure a foreign correspondent is not providing services to shell banks indirectly. They must keep records of the foreign bank’s owners and an agent in the United States for service of legal process, and run a risk-based due diligence program on these accounts.

FINRA’s 2026 oversight report flagged weak due diligence and monitoring of foreign financial institution accounts as a recurring finding.

Red Flags FINRA Sees Most Often

FINRA’s annual oversight reports read like a list of the ways money laundering and fraud actually get through. Knowing these patterns is what separates a capable compliance analyst from someone who only knows the rules.

Small-cap and low-priced securities top the list. Red flags include customers buying far beyond their stated net worth, possible nominee accounts and coordinated trading that appears designed to inflate a price. FINRA also highlights “investment club” pump-and-dump schemes run through encrypted messaging apps.

Account takeovers and new account fraud are rising fast, increasingly powered by generative AI. Fraudulent transfer requests to move a customer’s assets to another firm, gold bar courier scams and crypto confidence fraud all appear in the 2026 report.

Firms also fall short when their monitoring does not fit their business. FINRA keeps finding weak procedures for omnibus accounts, red flags spotted by cybersecurity or fraud teams that never reach AML staff, and customers whose activity bears no relationship to their stated occupation or resources.

What Failure Costs: Recent Enforcement

The penalties for weak AML programs are large, and they arrive from several regulators at once.

In March 2026, FinCEN, the SEC and FINRA brought coordinated actions against Canaccord Genuity. FinCEN imposed an $80 million civil money penalty, with $5 million suspended pending a compliance review, and the SEC and FINRA each imposed $20 million. FinCEN found the firm willfully failed to run an effective AML program from about March 2018 to June 2024, leaving at least 160 suspicious activity reports unfiled.

The findings show how programs fail in practice. Four employees with no prior AML experience reviewed more than 100 surveillance reports. Key reports went unreviewed for months, in some cases years. There was no formal AML training before November 2021, and entity accounts were opened without beneficial owners being identified.

Smaller firms are not exempt. In October 2025, FINRA fined EFG Capital International $650,000 under Rule 3310 and FINRA Rule 2010 for failing to monitor almost 1,000 wire transfers totaling about $305 million. A high-risk jurisdiction alert malfunctioned and missed around $30 million in transfers. The firm had already paid $800,000 for similar AML failures in 2018.

AML failures also tend to sit next to supervision failures under FINRA Rule 3110, and FINRA Rule 3120 requires firms to test and verify that their supervisory procedures actually work. To see how FINRA builds and settles these cases, read What Are FINRA Enforcement Actions?

When Individuals Pay, Not Just Firms

AML penalties do not stop at the firm. FINRA can fine, suspend or bar the individuals responsible, including the AML compliance officer.

In 2014, FINRA fined Brown Brothers Harriman $8 million for AML failures involving penny stock transactions. Its former AML compliance officer was personally fined $25,000 and suspended for one month.

The criminal exposure is heavier still. A willful violation of the Bank Secrecy Act can carry up to five years in prison, rising to ten years when it is part of a pattern of illegal activity. Money laundering itself, under 18 U.S.C. 1956, carries up to 20 years.

Clearing Firms, Introducing Firms and Shared Responsibility

Many broker-dealers do not hold customer assets themselves. An introducing firm opens accounts and deals with customers, while a clearing firm carries the accounts, settles trades and holds the money and securities.

Both firms need their own AML program. Each must monitor for suspicious activity it can see, and either can be responsible for filing a SAR on the same activity. A joint SAR can be filed when both firms are involved.

The CIP rule lets one firm rely on another for parts of customer identification. That reliance is allowed only when it is reasonable, the other institution is subject to an AML program rule and regulated by a federal functional regulator, and it signs a contract and certifies each year that it has implemented its AML program and will carry out the specified CIP requirements.

Where AML Shows Up on the SIE and Series 7

AML is tested from the very first licensing exam. The SIE covers the USA PATRIOT Act, CIP, SARs, CTRs, OFAC and the stages of money laundering, and every candidate is expected to know the thresholds and deadlines in this guide.

FRC’s SIE course places AML in two chapters. Chapter 2, Overview of Regulation, covers the USA PATRIOT Act and AML within the regulatory framework. Chapter 15, Account Compliance and Supervision, covers CIP and AML at account level, inside the Trading, Accounts and Prohibited Activities section that carries 31 percent of the exam, or 23 of the 75 scored questions.

The Series 7 goes further, because opening accounts and evaluating customers is one of the four functions the exam is built around. A registered representative is often the first person to notice something wrong, so the exam expects you to apply AML rules to real account scenarios. The Series 24 then tests the supervisory side, where principals oversee the program itself.

FRC’s courses are delivered by AI teachers, so every lesson is explained with the same clarity and accuracy, every time, rather than depending on whichever instructor you happen to get. Both courses can be spread over two, three or four months with interest-free payment plans, so cost is no reason to delay. Every month you wait is a month other candidates spend getting ahead of you. FRC’s programs and memberships are open to everyone, and you can compare every USA course on the FRC course list.

AML Careers: Where This Knowledge Takes You

AML knowledge is a career asset in its own right. Every broker-dealer needs people to run surveillance, investigate alerts, complete customer due diligence, file SARs, test programs and train staff.

The enforcement cases above show what firms fear most: reviewers without AML experience, alerts left unreviewed and training that never happened. A candidate who can show real AML knowledge speaks directly to that fear.

Roles range from AML analyst and KYC analyst to financial crimes investigator, compliance associate and, eventually, AML compliance officer. For the full route into the profession, see How to Become a Compliance Officer in the USA.

Studying is one thing. Showing an employer you are studying is another. FRC’s Digital Profile displays your real-time course progress, and the FRC Video Resume lets a hiring manager hear you explain your interest in compliance before the interview. One QR code on your resume connects them to both.

What’s Changing in 2026

AML regulation is being reshaped. On April 7, 2026, FinCEN proposed a new rule to modernize AML and countering-the-financing-of-terrorism programs across financial institutions covered by the Bank Secrecy Act, with a stronger focus on risk-based programs. The comment period closed on June 9, 2026, and the rule has not yet been finalized.

The investment adviser AML rule now takes effect on January 1, 2028. FinCEN’s October 2025 SAR FAQs clarified near-threshold structuring, continuing-activity reviews and how firms should document a decision not to file.

The core of broker-dealer AML does not change with these updates. Know the customer, watch the activity, report what is suspicious, keep the records and test the program. Every new rule builds on that foundation.

Frequently Asked Questions

What is FINRA Rule 3310?

FINRA Rule 3310 is the rule requiring every FINRA member firm to establish and maintain a written AML program. It must include suspicious activity detection and reporting, Bank Secrecy Act compliance controls, independent testing, a designated AML compliance person, ongoing training and risk-based customer due diligence.

How often must a broker-dealer test its AML program?

Most broker-dealers must run an independent test every calendar year. Firms that do not execute customer transactions or hold customer accounts, such as proprietary trading firms, may test every two years.

What is the SAR threshold for broker-dealers?

Broker-dealers must file a SAR for suspicious transactions involving or aggregating at least $5,000. The filing is due within 30 calendar days of initial detection, extendable by 30 days to identify a suspect, with an absolute limit of 60 days.

Can a broker-dealer tell a customer about a SAR?

No. A SAR, and any information that would reveal one exists, is confidential. Disclosing it to the customer is prohibited.

What is the difference between a SAR and a CTR?

A CTR is automatic and objective: any cash transaction over $10,000 in a business day triggers one, whatever the reason. A SAR depends on suspicion: it applies to transactions of $5,000 or more that the firm suspects involve illegal funds, evasion, no lawful purpose or criminal facilitation.

Who can be the AML compliance officer at a broker-dealer?

The AML compliance person must be an associated person of the firm, and the firm must report their contact details to FINRA. The role is usually held by a senior compliance professional.

Is AML on the SIE exam?

Yes. The SIE tests the USA PATRIOT Act, customer identification, SARs, CTRs, OFAC and the stages of money laundering. The Series 7 and Series 24 then test AML at account and supervisory level.

The Bottom Line

Broker-dealer AML comes down to six required elements under FINRA Rule 3310, backed by firm deadlines and dollar thresholds: four CIP data points, a 25 percent ownership test, $5,000 and 30 days for SARs, $10,000 for CTRs and annual independent testing for most firms. Regulators enforce every one of them, and recent penalties show that a weak program can cost a firm well over $100 million.

For anyone entering the industry, these rules are not optional reading. They run through the SIE, the Series 7 and the Series 24, and they sit at the center of one of the industry’s most active career paths.

Start with the Securities Industry Essentials (SIE) Exam Preparation course to build the foundation, move on to Series 7 Exam Preparation when you are ready to apply it, and use your Digital Profile to let employers see your progress along the way.