What is Anti-money laundering?
Also: AML
The regulatory regime that obligates payment institutions to detect and report suspicious activity.
Anti-Money Laundering (AML) refers to the comprehensive legal framework that obligates financial institutions, including payment processors and acquirers, to prevent, detect, and report activities related to financial crime.
Governed internationally by standards from the Financial Action Task Force (FATF) and implemented regionally through laws like the EU's Anti-Money Laundering Directives (e. g. , 6AMLD) and the UK's Proceeds of Crime Act 2002, AML compliance is non-negotiable.
The core of AML in payments involves three pillars: conducting robust Customer Due Diligence (often as Know Your Business, or KYB), performing ongoing transaction monitoring, and reporting suspicious activity to the relevant authorities,
such as the UK's National Crime Agency (NCA) or the US Financial Crimes Enforcement Network (FinCEN).
Transaction monitoring systems analyse payments for patterns indicative of the three stages of money laundering. 'Placement' could appear as many small cash-value top-ups to a digital wallet.
'Layering' might involve moving funds between multiple merchant accounts or using complex refund and payout schemes to obscure the trail. 'Integration' happens when the laundered funds are used to pay for seemingly legitimate goods or services.
A common misconception is that AML systems only flag large transactions. Modern systems focus on behaviour, flagging velocity (high frequency transactions in a short period), unusual linkages (multiple customers using the same card), and deviances from a merchant's established processing profile.
Every regulated payment firm must have a designated Money Laundering Reporting Officer (MLRO) who is personally responsible for the firm's AML programme.
Worked example
An online Marketplace for digital art, with a typical average transaction value (ATV) of £150, is monitored by its acquirer's AML system.
The system flags an alert when one new seller account receives 200 separate payments of £950 each over a 24-hour period from 200 different buyers, all using newly issued prepaid cards.
This pattern is anomalous because the volume is high, the transaction value is just under a common reporting threshold, and the use of new prepaid cards is a known high-risk indicator for placement of illicit funds.
The acquirer's risk team investigates and places an immediate hold on the seller's £190,000 in pending settlements. The MLRO determines there are sufficient grounds for suspicion and files a Suspicious Activity Report (SAR) with the relevant financial intelligence unit.
By law, the acquirer cannot inform the merchant that a SAR has been filed (an offence known as 'tipping off'). The funds remain frozen pending a response from the authorities.
Scheme notes
AML compliance is primarily a legal and regulatory obligation, not one created by the card schemes. However, Visa and Mastercard enforce these legal requirements stringently through their own risk programmes.
Mastercard's Business Risk Assessment and Mitigation (BRAM) programme and Visa's programmes targeting Transaction laundering explicitly require acquirers to have systems in place to prevent their merchants from being used for illegal purposes.
If a merchant is found to be engaged in money laundering, the acquirer faces significant scheme fines, often starting at $25,000 per incident, in addition to regulatory penalties.
Repeated AML failings can lead to an acquirer losing their scheme membership, making this a critical area of operational risk for them.
Why it matters for merchants
The primary impact of AML regulations on a merchant is the risk of sudden fund freezes and account termination. If an acquirer's monitoring system flags suspicious activity, they will block payouts to mitigate their risk and fulfil their legal duty to investigate.
This can halt a merchant's cash flow without warning.
A confirmed case of money laundering or Transaction laundering will lead to immediate MID termination and the merchant being placed on industry watchlists like the MATCH list, making it extremely difficult to secure payment processing in the future.
While Cardflo's AML monitoring is a regulatory requirement for us, it also serves to protect legitimate merchants by maintaining the integrity of our network of acquirer partners.
Frequently asked
How does AML compliance affect merchant settlement times?
While standard settlements occur on a fixed cycle, AML triggers may lead to temporary funds holding or account freezes while an acquirer investigates suspicious transactions.
If a merchant cannot provide proof of delivery or valid invoices when requested during an AML check, settlement may be delayed indefinitely until the compliance team clears the activity.
What is the difference between AML and sanctions screening?
AML is a broad set of procedures used to detect the movement of illicit wealth, whereas sanctions screening is a specific subset of these controls that checks entities against lists such as OFAC or the HM Treasury consolidated list.
Sanctions screening ensures that a merchant or customer is not a prohibited individual or located in a restricted territory, which is a mandatory component of a complete AML programme.
What is the difference between Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF)?
AML is focused on preventing the legitimisation of proceeds from crime, while CTF is specifically aimed at stopping the funding of terrorist activities.
Although they are often discussed together and use similar techniques (like KYC and transaction monitoring), the legal frameworks for CTF often have lower or even zero-value thresholds for reporting.
The source of terrorist funds can be legitimate, making detection reliant on behavioural analysis and intelligence, whereas money laundering always starts with criminal proceeds.
What is a SAR, and will I be told if one is filed for my business?
A SAR is a Suspicious Activity Report filed by a financial institution with a national Financial Intelligence Unit (FIU) when they suspect a client's transactions may be related to financial crime. You will not be notified.
It is a criminal offence in many jurisdictions, including the UK, for the reporting institution to do anything that might 'tip off' the subject of a SAR that they are under suspicion.
How do AML rules affect my settlement times or reserves?
If your business model or transaction patterns are deemed to have a higher inherent AML risk, your acquirer may enforce risk mitigation measures. This could include extending your settlement time from T+1 to T+3 or T+5 to allow for more detailed review of transactions.
They may also require a higher rolling reserve to be held against potential future liabilities arising from illicit activity.
What is 'Transaction laundering' and how does it relate to AML?
Transaction laundering is a specific form of money laundering where a registered merchant processes payments on behalf of another, undisclosed business. For example, a legitimate online bookshop (Merchant A) could process payments for an illicit online casino (Merchant B).
This is a serious violation of card scheme rules and AML laws, as it hides the true nature of the transactions from the acquirer and circumvents KYB controls.
Are cryptocurrency payments subject to the same AML rules?
Yes. Global regulators have extended AML/CTF obligations to the digital asset space.
In the EU, regulations like the Markets in Crypto-Assets (MiCA) and the updated AML directives explicitly bring Crypto Asset Service Providers (CASPs) under the same regulatory umbrella as traditional financial institutions. This includes requirements for KYC, transaction monitoring, and reporting suspicious activity to authorities.
See how Anti-money laundering plays out in practice
Industries and regions where this term drives real acquiring, routing, or dispute decisions.
Related terms
Regulated identity-verification of the merchant (KYB) and, where relevant, the merchant's customers (KYC).
The licensed bank or financial institution that holds the merchant's MID and settles card transactions on the merchant's behalf.
Onboarding due diligence on a legal entity: incorporation, licences, UBOs, sanctions, and business model, mandated for acquirers under AML rules.
Processing prohibited or third-party sales through an unrelated merchant's MID; a top BRAM violation drawing Mastercard fines from USD 25,000 upward.
Related guides.
Ready to improve your payments setup?
Tell us about your business. We'll match you with the right acquiring partners and the right route, typically inside a week.