US AML regulations are changing. Are they getting stricter or more lax? It’s complicated

The landscape of anti-money laundering (AML) regulation in the US has recently undergone significant shifts with both tightening and loosening in ways that seem misaligned with the real risks. On one hand, regulatory requirements for small transactions are tightening significantly. On the other, corporate transparency measures aimed at tackling large-scale financial crime are being relaxed. These changes not only impact businesses within the US but also hold real implications for UK and global companies. 

A tale of two policies or who bears the burden?

In a surprising move, the US Treasury announced it will not enforce the Corporate Transparency Act (CTA), a key regulation aimed at preventing financial crime by requiring companies to disclose their beneficial owners. Originally seen as a major step toward greater financial transparency, the law has now been deemed too burdensome for businesses.

This decision effectively allows anonymous shell companies, one of the most commonly used vehicles for large-scale money laundering, to continue operating without oversight. Compliance costs for businesses could be reduced in the short term, but there could be long-term consequences of allowing illicit actors to move large sums of money undetected.

The announcement also revealed that the Treasury Department will develop a rule narrowing the scope of the CTA to foreign reporting companies only. It is unclear if the proposed rulemaking will require reporting of foreign beneficial owners of US reporting companies. 

Meanwhile, the Financial Crimes Enforcement Network (FinCEN) has issued a new Geographic Targeting Order (GTO) that dramatically lowers the reporting threshold for Money Services Businesses (MSBs) in certain areas along the Mexican border. Transactions as small as $200 now trigger mandatory reporting, a sharp drop from the previous $10,000 limit.

The stated objective of this change is to combat drug cartels and transnational criminal organizations. However, the effectiveness of such a measure is unclear. Will drug cartels really rely on $200 transactions to launder money? There’s no evidence to suggest this, yet this move places a disproportionate compliance burden on MSBs that cater to migrant workers and legitimate cross-border remittances.

SARs and over-reporting

One of the well-documented issues in AML enforcement is over-reporting, where financial institutions file excessive Suspicious Activity Reports (SARs) out of an abundance of caution. This has been particularly evident in the UK, where the Financial Intelligence Unit (FIU) is overwhelmed with reports, many of which lack actionable intelligence.

The new FinCEN requirement will likely result in a similar scenario in the US. Law enforcement agencies will be inundated with an avalanche of low-value reports, making it harder to identify truly suspicious transactions. By prioritizing the monitoring of small cash transactions while relaxing corporate transparency requirements, US regulators may be exacerbating this problem. Will law enforcement agencies have the capacity to process the surge in reports from MSBs while still being able to track down high-level financial crime? That remains to be seen.

What are the implications for UK and global businesses?

For UK and international businesses operating in or with the US, these new regulatory shifts  pose a number of challenges.

  • UK-based financial institutions with US operations may face heightened compliance costs, especially those facilitating cross-border remittances. The lowered reporting threshold means more paperwork, more scrutiny and higher operational costs.
  • While US shell companies continue to enjoy anonymity, UK and EU firms must adhere to stringent beneficial ownership disclosure rules. This discrepancy creates an uneven playing field, where bad actors can simply shift operations to the more permissive US framework.
  • The lack of enforcement of the Corporate Transparency Act creates regulatory uncertainty. Businesses navigating US compliance frameworks may find themselves in a gray area where rules exist on paper but are not enforced. This complicates international compliance efforts, as global firms must reconcile divergent AML regimes.

     

A step back in the fight against financial crime?

The unintended consequence of these policies could be devastating. While regulatory scrutiny will increase on low-value transactions, those who truly seek to exploit the financial system could likely continue to operate under the veil of anonymity. 

Given these regulatory inconsistencies, UK and global businesses must take a proactive approach to AML compliance. Companies should reassess their risk frameworks, ensuring that they are prepared for the heightened scrutiny on small transactions while not neglecting high-risk areas. Businesses with US operations must also closely monitor FinCEN guidance and enforcement actions to stay ahead of any further changes. 

Collaboration with industry groups and regulators could help push for a more balanced approach to AML enforcement that targets real threats rather than overwhelming businesses with excessive reporting requirements. The bottom line is stay vigilant, stay informed and ensure compliance strategies remain adaptable in this evolving regulatory environment.

Check out Vinciworks’ comprehensive suite of AML courses. They are packed with realistic scenarios, real-life case studies and customisation options that will help you stay protected.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.