# Anti Money Laundering Deep

> SKILL: AML/CFT Compliance — Complete Program Design

- Skill: `nickgallick/anti-money-laundering-deep` (Agent Skill)
- Install (CLI): `npx skillmds@latest add nickgallick/anti-money-laundering-deep`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nickgallick/anti-money-laundering-deep/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: nickgallick (https://skillmd.com/u/nickgallick)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/nickgallick/anti-money-laundering-deep

---

# SKILL: AML/CFT Compliance — Complete Program Design
**Version:** 1.0.0 | **Domain:** BSA, FinCEN, OFAC, Travel Rule, Transaction Monitoring

---

## BSA/AML Program: The Five Pillars
**Authority:** Bank Secrecy Act, 31 U.S.C. §§ 5311-5336; 31 C.F.R. Part 1022 (MSB rules)

For a registered Money Services Business, your AML program MUST include all five pillars. Failure to implement = criminal violation (31 U.S.C. § 5322).

1. **Written AML policies and procedures** — documented, specific to your business
2. **Designated BSA Compliance Officer** — named individual, responsible for the program
3. **Ongoing employee training** — annual at minimum; document who was trained and when
4. **Independent testing/audit** — annual review by someone not responsible for running the program (external auditor or qualified internal auditor who doesn't run compliance day-to-day)
5. **Customer Due Diligence (CDD)** — including beneficial ownership for legal entity customers

---

## Customer Due Diligence (CDD)

### Individual Customers
Collect and verify at onboarding:
- Full legal name
- Date of birth
- Residential address
- Government-issued ID number (SSN for US persons; foreign equivalent for non-US)

**Verification methods:**
- Document verification (ID scan): verify government ID is genuine and matches the person
- Database verification: check against identity databases (LexisNexis RiskView, Socure, Jumio, Onfido)
- Cost: $0.50-$3.00 per verification depending on provider and depth

**Understanding the customer relationship:**
- What is the purpose of the account?
- What level of activity is expected?
- This allows you to set a "baseline" for transaction monitoring

### Legal Entity Customers (if applicable)
**FinCEN Beneficial Ownership Rule (31 C.F.R. § 1010.230):**
- Collect information on all individuals owning ≥25% of the entity AND one individual with significant management control
- Verify their identities under the same CDD procedures
- Applies when opening accounts for corporations, LLCs, partnerships, etc.

### Enhanced Due Diligence (EDD)

**Triggers for EDD:**
- Transaction above $10,000 (CTR threshold)
- Customer is a Politically Exposed Person (PEP): current or former government official, senior executive of state-owned enterprise, or family member/close associate of same
- Customer is from a high-risk jurisdiction (FATF grey/blacklist: Iran, North Korea, Myanmar, currently listed jurisdictions at www.fatf-gafi.org/en/topics/high-risk-and-other-monitored-jurisdictions.html)
- Unusual transaction pattern inconsistent with stated purpose

**EDD requirements:**
- Source of funds: where does the money come from?
- Source of wealth: how did they accumulate their overall wealth?
- Enhanced monitoring: more frequent review, lower suspicious activity thresholds
- Senior management approval to maintain the relationship

**PEP screening tools:**
- World-Check (Refinitiv/LSEG): industry standard; comprehensive PEP and adverse media database
- Dow Jones Watchlist: similar coverage
- LexisNexis WorldCompliance: good for US-centric businesses
- Cost: $500-$5,000/month depending on volume

---

## OFAC Sanctions Compliance

**Authority:** International Emergency Economic Powers Act (IEEPA), 50 U.S.C. §§ 1701-1708; Trading with the Enemy Act (TWEA)

### The SDN List
- OFAC Specially Designated Nationals and Blocked Persons List: www.treasury.gov/ofac/downloads/sdnlist.txt
- Over 13,000 names (individuals, entities, vessels, aircraft)
- Also screen: Consolidated Sanctions List (includes all OFAC lists), Sectoral Sanctions (CAATSA targets in Russia, etc.)

### Screening Obligations
- **At onboarding:** Screen every new customer before activating their account
- **Every transaction:** Screen sender and receiver of every transaction
- **Periodic rescreening:** Daily rescreening of existing customer base (SDN list updates frequently)
- **Wallet screening:** Screen blockchain wallet addresses against OFAC's crypto-specific designations

### Crypto Wallet Designations
**Tornado Cash (August 2022):** OFAC sanctioned the smart contracts themselves — not just the operators. Any interaction with the designated Tornado Cash contracts = potential OFAC violation.
- *Van Loon v. Department of Treasury* (5th Cir. 2024): Court ruled OFAC CANNOT sanction immutable smart contract code under IEEPA (the code is not "property" of a person). BUT: OFAC may relist under different authority, and the case is ongoing.
- **Current risk:** Unclear. Until fully resolved, avoid any interaction with Tornado Cash-associated addresses.

**If a match is found:**
1. Immediately freeze/block the account — do NOT process any transaction
2. Do NOT tell the customer you've blocked them (tipping off = potential criminal liability; OFAC requires confidentiality)
3. File a blocking report with OFAC within **10 business days** at ofac.treas.gov
4. Preserve ALL records related to the blocked transaction
5. Consult OFAC counsel before unfreezing or releasing any blocked funds

**Penalty for violations:**
- Civil: up to $20 million per transaction under IEEPA (50 U.S.C. § 1705(b))
- Criminal: up to $1 million per violation + 20 years imprisonment
- **Strict liability:** No knowledge or intent required for civil OFAC violations. If you transact with an SDN, you're liable even if you didn't know.

**Compliance tools:**
- Chainalysis Sanctions Oracle: on-chain, real-time screening of wallet addresses against OFAC designations. Integrates directly into smart contracts.
- Elliptic Lens: similar; good for multi-chain coverage
- TRM Labs: blockchain risk intelligence; covers OFAC + AML risk scoring
- Comply Advantage: comprehensive sanctions screening for traditional + crypto

---

## Suspicious Activity Reports (SARs)

**Authority:** 31 U.S.C. § 5318(g); 31 C.F.R. § 1022.320

### Filing Requirement
- If you know, suspect, or have reason to suspect a transaction involves funds from illegal activity, is designed to evade BSA reporting, or has no lawful purpose → file a SAR
- **Threshold:** No minimum dollar threshold for SARs (unlike CTRs, which are $10K+)
- **Deadline:** File within **30 calendar days** of initial detection of suspicious activity
- If no suspect can be identified at 30 days: 60-day extension available

### SAR Confidentiality — CRITICAL
- 31 U.S.C. § 5318(g)(2): It is a federal crime to notify any person involved in the suspicious activity that a SAR has been filed
- **NEVER tell a customer:** "We filed a suspicious activity report on your account" or "Your account is under investigation" or anything that suggests SAR filing
- This includes: refusing to answer questions, deflecting with generic policy language
- If a customer asks why their account is restricted: "We are unable to discuss the status of any regulatory filings" — no more

### SAR Content Requirements
- **Narrative:** The most important part. Describe specifically: what happened, when, how much, why it's suspicious, what you found in your investigation
- Supporting data: all identifiers (wallet addresses, transaction hashes, IP addresses, user ID, KYC records)
- Financial summary: total amounts involved
- The SAR is reviewed by FinCEN's Financial Intelligence Unit — a good narrative gets read; a bad one gets filed and forgotten

**File SARs at:** BSA E-Filing System — bsaefiling.fincen.treas.gov

---

## Currency Transaction Reports (CTRs)

**Authority:** 31 U.S.C. § 5313; 31 C.F.R. § 1022.310

- Required for cash transactions exceeding **$10,000** in a single business day
- **Crypto context:** Cash means fiat currency. Crypto-to-crypto transactions: CTR not required (but SAR may be if suspicious)
- If you accept fiat deposits (bank wires, ACH, debit cards): track per-customer daily totals
- Aggregation rule: multiple transactions on the same day by the same customer = aggregated for CTR purposes

---

## Transaction Monitoring

### Automated Rules to Implement
**High-value transactions:**
- Flag any single transaction >$3,000 (Travel Rule threshold)
- Flag cumulative daily volume >$10,000 per user (CTR consideration)

**Behavioral flags:**
- Rapid deposit/withdrawal ("in-out") pattern with minimal platform activity (layering indicator)
- Sudden large transaction inconsistent with user's established pattern
- Multiple accounts from same IP/device
- User attempts to evade transaction limits by breaking into smaller amounts (structuring)

**Blockchain-specific flags:**
- Incoming transaction from: known mixer/tumbler address (Tornado Cash, Wasabi Wallet outputs)
- Incoming transaction from: exchange associated with dark web markets
- Incoming transaction from: newly created wallet with large balance and no transaction history
- Outgoing transaction to: OFAC-sanctioned address (should be blocked, not just flagged)

**Tools:**
- Chainalysis KYT (Know Your Transaction): real-time blockchain transaction monitoring; assigns risk scores; used by Coinbase, major banks
- Elliptic Navigator: similar; good multi-chain coverage
- TRM Labs: transaction monitoring + compliance workflows
- Cost: varies by transaction volume; typically $2,000-$20,000/month for growing platforms

---

## Travel Rule Compliance

**Authority:** FATF Recommendation 16; 31 C.F.R. § 1010.410(f) (wire transfer recordkeeping rule, threshold $3,000)

### What It Requires
When a VASP (Virtual Asset Service Provider) transmits crypto:
- **Originator information:** Name, account (wallet address), physical address OR national ID OR customer ID number, date/place of birth
- **Beneficiary information:** Name and account (wallet address)
- Must be transmitted TO the beneficiary's VASP simultaneously with the transaction

### Who It Applies To
- VASPs that transmit crypto on behalf of customers
- **Non-custodial platforms:** If users interact directly with your smart contract and you never transmit on their behalf → strong argument Travel Rule doesn't apply
- **Custodial platforms:** Almost certainly applies; you are transmitting crypto on behalf of users

### Implementation Protocols
- **TRISA (Travel Rule Information Sharing Architecture):** www.trisa.io — open protocol for VASP-to-VASP Travel Rule data exchange
- **Sygna Bridge:** Proprietary Travel Rule solution from CoolBitX; widely used in Asia
- **Notabene:** Travel Rule compliance platform; supports TRISA and other protocols; used by Coinbase, Crypto.com
- **VerifyVASP:** Another protocol option

**The "Sunrise Problem":** Not all VASPs are Travel Rule compliant. If you send to a VASP that can't receive Travel Rule data → some jurisdictions allow you to send anyway with a record; others require you to withhold the transaction. Know your jurisdiction's rules.

---

## AML Record Retention

**Authority:** 31 C.F.R. § 1022.410

- All KYC records: **minimum 5 years** from account closure
- All transaction records: **minimum 5 years**
- SAR filings: 5 years from date of filing
- CTR filings: 5 years from date of filing
- AML program documentation: 5 years
- Training records: 5 years

**Storage:** Encrypted, access-controlled. Two separate backups minimum. Accessible to authorized compliance personnel and to law enforcement with proper legal process.

---

*This is legal research and intelligence, not legal advice. Consult qualified legal counsel before taking action.*