Skip to main content ホーム クリエイター thomasmoreai legal-skills-open aml-compliance-program
aml-compliance-program Drafts board-ready Anti-Money Laundering compliance programs for U.S. financial institutions under BSA/FinCEN requirements. Covers CIP, CDD, EDD, SAR/CTR reporting, OFAC screening, risk assessment, training, independent testing, and governance structures. Use when creating or updating AML policies, BSA compliance programs, or financial institution regulatory documentation. Trigger keywords: AML, BSA, FinCEN, Bank Secrecy Act, anti-money laundering, SAR, CTR, OFAC, CIP, CDD, KYC, compliance program.
インストールへ移動 Skills Marketplace コミュニティが作成したAIスキルを発見・探索
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/ThomasMoreAI/legal-skills-open --skill aml-compliance-programコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Zipをダウンロード ダウンロード中... このリポジトリの他の Skills fetching-arbitration-rules Use when retrieving arbitration institutional rules (ICC, LCIA, SCC, SIAC, HKIAC, VIAC, МКАС/МАК при ТПП України, UNCITRAL) — fetching current version, verifying redaction applicable to the date of arbitration agreement, constructing URLs for official rule texts
determining-pl-request-regime Use when choosing the Polish legal regime for letters, requests, applications, complaints, petitions, public-information requests, KPA filings, PPSA complaints, RODO access requests, registry extracts, court-file access, tax/ZUS/cudzoziemcy/USC procedures, or professional lawyer letters. Prevents mixing UDIP, KPA, PPSA, RODO, registry, special-procedure, and advocate/radca letter regimes.
applying-new-york-convention Use when preparing applications for recognition and enforcement of foreign arbitral awards in Poland, applications for setting aside arbitral awards under KPC art. 1205–1211, or opposing such applications — mapping Article V of the 1958 New York Convention to art. 1214–1215 of the Polish KPC, identifying grounds for refusal, structuring public policy arguments
name aml-compliance-program title AML Compliance Program description Drafts board-ready Anti-Money Laundering compliance programs for U.S. financial institutions under BSA/FinCEN requirements. Covers CIP, CDD, EDD, SAR/CTR reporting, OFAC screening, risk assessment, training, independent testing, and governance structures. Use when creating or updating AML policies, BSA compliance programs, or financial institution regulatory documentation. Trigger keywords: AML, BSA, FinCEN, Bank Secrecy Act, anti-money laundering, SAR, CTR, OFAC, CIP, CDD, KYC, compliance program. author CaseMark author_url https://github.com/CaseMark/skills/tree/main/skills/legal/aml-compliance-program license Apache-2.0 version 0.1.0 execution_mode open jurisdiction us practice white-collar language en tags ["drafting","memo","research"]
AML Compliance Program
Produces a comprehensive, board-ready AML compliance program tailored to a financial institution's risk profile, satisfying BSA, FinCEN, and federal/state requirements.
Checkpoint A: Pre-Draft Intake (Mandatory)
Before drafting, collect from the user:
Existing policies — current AML program, risk assessments, exam reports, regulatory correspondenceInstitutional profile — org chart, business lines, products, customer demographics, geographic footprintRisk data — prior assessments, audit findings, enforcement actions, consent ordersApplicable regulations — confirm institution type (bank, MSB, broker-dealer) to determine which CFR parts, FinCEN guidance, and agency bulletins apply
Do not proceed until items 1–2 are addressed. Items 3–4 may be developed during drafting if unavailable.
Quick Start
Draft a numbered policy document covering all sections below. Calibrate depth to the institution's size, complexity, and risk profile.
Step 1: Program Foundation
Element Requirement Board endorsement Explicit board/senior management approval and oversight Scope All business lines, customer relationships, geographies, transaction types Risk-based approach Controls calibrated to risk assessment findings Resource commitment Adequate personnel, technology, budget
Step 2: AML Compliance Officer
Element Requirement Qualifications CAMS or equivalent; demonstrated BSA/AML expertise Reporting line Direct to senior management; regular board access Independence Evaluation tied to compliance effectiveness, not production Authority Unrestricted access to all records, systems, personnel
Core duties: Regulatory contact (FinCEN, regulators, law enforcement) · SAR/CTR/BSA filing oversight · risk assessment coordination · training management · independent testing oversight · program design and updates.
Step 3: Customer Identification Program (CIP)
Per 31 CFR § 1020.220:
Data Point Individual Legal Entity
Full legal name Required Required Date of birth Required N/A Address Residential/business street Principal place of business ID number SSN/TIN or passport + country EIN or equivalent
Verification: Documentary (government ID / incorporation docs) · Non-documentary (consumer reporting, public databases) · Non-face-to-face (additional measures for remote channels).
Retention: 5 years after account closure.
Step 4: Customer Due Diligence (CDD)
Identify beneficial owners: each individual ≥25% equity + one with significant management control
Collect via certification form; verify per CIP standards
Update ownership on risk-based schedule and upon known changes
Document relationship purpose, business activities, anticipated activity, source of funds
Build expected transaction profiles (type, industry, geography, history)
Ongoing monitoring: automated systems, periodic reviews, exception reporting
Step 5: Enhanced Due Diligence (EDD) Category Examples PEPs Per FinCEN guidance High-risk geographies FATF high-risk/monitored jurisdictions Complex ownership Opaque structures obscuring beneficial ownership High-risk businesses MSBs, virtual currency exchanges, cash-intensive Elevated risk rating Multiple risk factors per internal methodology
Requirements: Background investigation · senior management approval · enhanced monitoring (lower thresholds, more frequent reviews) · documented risk rating methodology (customer × geography × product × activity).
Step 6: Suspicious Activity Reporting (SAR)
Threshold: ≥ $5,000 where institution knows/suspects illegal activity, BSA evasion, no business purpose, or criminal facilitationDeadlines: 30 days (suspect identified) · 60 days (no suspect identified)Key indicators: Structuring · activity inconsistent with profile · large currency transactions · wire transfers lacking rationale or involving high-risk jurisdictions · recordkeeping/CIP avoidance · shell company transactionsConfidentiality: Federal law prohibits disclosure to subjects; civil/criminal penalties for violation; records retained 5 years; need-to-know access onlyEscalation: Immediate report to Compliance Officer; good-faith reporters protected
Step 7: Currency Transaction Reporting (CTR) Per 31 CFR §§ 1010.310, 1020.310:
Element Requirement Threshold Currency transactions > $10,000 per person per business day Aggregation Multiple transactions by/on behalf of same person in one day Filing deadline 15 calendar days via BSA E-Filing Currency Coin and paper money only (excludes cashier's checks, money orders)
Exemptions (31 CFR § 1020.315): Banks, government entities, listed public companies, qualifying businesses. Require documentation, approval, biennial renewal, annual review.
Step 8: OFAC Compliance Trigger Timing Account opening Before relationship established Existing customers Minimum annually; risk-based frequency Transactions (wires, ACH) Real-time or near real-time
Lists: SDN, Consolidated Sanctions, country-based programs.
Blocking — mandatory for sanctioned persons' property; interest-bearing account; report to OFAC within 10 business daysRejection — prohibited transactions not requiring blocking; notify originator; document decision Retention: All screening records ≥ 5 years.
Step 9: Risk Assessment Dimension Factors Products/services Velocity, geographic reach, anonymity, abuse susceptibility Customers Type, occupation, geography, relationship characteristics Entities Ownership structure, business purpose, formation jurisdiction Geography Physical presence, customer concentrations, FATF/State Dept. flags
Assess inherent (pre-controls) and residual (post-controls) risk. Conduct annually minimum or upon significant changes. Findings drive CDD intensity, monitoring sensitivity, and resource allocation.
Step 10: Training Audience Timing All employees/officers/directors Annual minimum New hires Within 30 days or before customer-facing duties High-risk positions Role-specific schedule with specialized content
Core curriculum: Institution AML policies · BSA/PATRIOT Act/FinCEN/OFAC · ML/TF typologies · red flags · CIP/CDD procedures · reporting obligations.
Documentation: Attendance records, completion certificates, comprehension assessments.
Step 11: Independent Testing Element Standard Independence Personnel independent of AML function Frequency 12–18 months; higher-risk more frequent Reporting Findings to Compliance Officer, management, board
Scope: Regulatory compliance · policy adequacy · risk assessment methodology · transaction monitoring effectiveness · training adequacy · SAR/CTR timeliness · CIP/CDD compliance · OFAC procedures.
Remediation: Management response required; action plans with timelines; follow-up verification.
Step 12: Governance Board duties: Approve program and updates · review risk assessment · receive quarterly compliance reports · review testing results · allocate resources.
Quarterly metrics: SAR/CTR activity, OFAC screening, CDD/EDD activities, training completion, testing findings, regulatory developments.
Change management: Document rationale → compliance + legal review → management/board approval → communicate to personnel → maintain version history.
Step 13: Recordkeeping Record Type Retention SARs + supporting docs 5 years from filing CTRs + supporting docs 5 years from filing CIP/CDD/beneficial ownership 5 years after account closure OFAC screening/blocking 5 years minimum Risk assessments, testing, training 5 years minimum
Organized for prompt retrieval upon regulatory request. Security controls and audit trails for SAR-related records.
Checkpoint B: Post-Draft Review (Mandatory) After delivering the draft, ask the user:
Does the program scope match your institution's business lines and risk profile?
Are the CIP/CDD/EDD thresholds appropriate for your customer base?
Do the governance and reporting structures align with your board/committee framework?
Any enforcement history, consent orders, or MRAs that require specific program provisions?
Quality Checks
Guidelines
Mark uncertain CFR citations with [VERIFY] — regulations change; confirm at drafting date
OFAC obligations are strict liability — err on the side of caution in all screening procedures
SAR confidentiality violations carry serious penalties — embed protections in every relevant procedure and training module
Program must be reviewed regularly for regulatory changes, emerging risks, and implementation lessons
Consult legal counsel for interpretation questions
