United States: Complying With AML Laws: Challenges For The Fintech Industry

Last Updated: September 6 2016
Article by Jodi L. Avergun and Colleen D. Kukowski

Most Read Contributor in United States, September 2017

"Silicon Valley is coming. There are hundreds of startups with a lot of brains and money working on various alternatives to traditional banking."

This warning came not from a pundit or Silicon Valley lobbyist, but from Jamie Dimon, the Chairman and Chief Executive Officer of JPMorgan Chase & Co. New technology in the financial industry is changing how people manage their finances. This merger of financial services with technology, referred to as "fintech," is a booming industry. In 2014 alone, technology-focused venture capital firms invested $12.2 billion in fintech startups, a threefold increase over the previous year. Startups are not the only companies racing to join the industry. Heavyweights in the financial services industry, such as JPMorgan Chase and Goldman Sachs, are also adopting fintech services such as peer-to-peer payments and same-day approval of small business loans.

But if Silicon Valley is coming, so is the government. A major challenge to the growing fintech industry comes from government scrutiny and enforcement actions – particularly as they relate to money laundering and the financing of terrorist activity. Since government scrutiny is a likely reality, this article urges fintech companies to be aware of their anti-money laundering obligations and the challenges that they face in designing a robust AML compliance program sufficient to satisfy regulators.

How Does Fintech Work?

Most fintech transactions occur through an application on a smartphone or company website and are completed on an accelerated timetable. Fintech companies' offerings vary, but include the following categories of services:

Mobile Payment Systems and Digital Wallets: Mobile payment and digital wallet apps, such as Venmo, allow users to store, send and receive funds from their account on the app. Users open an account with the app and have the option of linking their credit card or bank account to their Venmo account. Users can then transfer funds from their app account to another app user's account. When one user transfers money to another user's account, the recipient can choose to either store those funds in his/her app account for future payments, or transfer those funds to the linked credit card or bank account.

Peer-to-Peer Money Transfer: Peer-to-peer money transfer companies, such as TransferWise, use peer-to-peer technology to avoid bank fees charged for sending money overseas. If a user wants to transfer money from the U.S. to Europe, for example, the company finds a user who is seeking to transfer money in the opposite direction (Europe to the U.S.), and then makes the transfers from the local euro or dollar accounts, so that no currency crosses a border. Peer-to-peer money transfer systems are the high tech equivalent of the ancient Islamic hawala money transfer system, which transfers money without actually moving it across borders.

Online Marketplace Lending: Companies that offer online marketplace lending use online platforms to lend either directly or indirectly to small businesses and consumers. Companies operating in this industry tend to fall into three categories:

  • Balance sheet lenders that originate loans for borrowers (for example, OnDeck);
  • Bank-affiliated online lenders that originate loans for borrowers; and
  • Peer-to-peer lenders that sell securities to obtain the financing to enable third parties to fund borrowers (for example, Lending Club).

Scrutiny of and Potential Action Against Fintech Companies

The anonymity and speed of fintech services raise the risk that terrorists and criminals will exploit fintech to support their illicit activity. As a result, fintech companies should expect and be prepared for government scrutiny of their compliance with AML laws.

For example, when the Paris attacks aroused suspicions that ISIS is using fintech, European Union ministers agreed to strengthen controls on payment methods that can be conducted anonymously. Domestically, it appears that a $28,500 loan from peer-to-peer lender Prosper to the San Bernardino shooter Syed Rizwan Farook may have helped Farook pay for ammunition, pipe bomb components and target practice at local gun ranges. Even if Prosper and its third-party lender, WebBank, committed no wrongdoing, regulators will seek assurance that online lenders and other fintech companies are fully complying with AML laws designed to prevent and detect illicit transaction.

The recent Liberty Reserve prosecutions may also prompt regulators to examine fintech companies' compliance with AML laws. Liberty Reserve was an online payment processor and digital currency system that was closed in 2013. In January 2016, Liberty Reserve's co-founder pleaded guilty to money laundering conspiracy and acknowledged that Liberty Reserve was "susceptible" to being used for criminal activity. The indictment against Liberty Reserve, which is still pending, alleges that "unlike traditional banks or legitimate online payment processors, Liberty Reserve did not require users to validate their identity information, such as by providing official identification documents or a credit card," which made Liberty Reserve Transactions anonymous and untraceable. Consequently, the government alleges, the merchants who accepted Liberty Reserve payments included computer hackers, unregulated gambling businesses, drug dealing websites, and traffickers of stolen credit card data and personal identity information.

AML Regulations That Apply to Fintech Companies

Even though fintech services vary greatly from traditional financial services, many are subject to the same AML regulations as other financial institutions. For example, because digital wallets, mobile payment systems, and peer-to-peer transfer systems are all money service businesses ("MSBs"), they are subject to the Bank Secrecy Act's ("BSA") reporting and compliance requirements. Specifically, MSBs are required to: (1) register with the Treasury Department; (2) develop an effective AML program; (3) file Currency Transaction Reports for transactions that exceed $10,000; and (4) file Suspicious Activity Reports ("SARs") when the company knows, suspects, or has reason to suspect that a transaction may involve money laundering or other illicit activity. Furthermore, Section 326 of the USA PATRIOT Act requires that financial institutions have customer identification programs in place and maintain related customer due diligence standards, referred to as "know your customer" ("KYC").

These regulations are robust. An AML compliance program must be in writing and must provide: (1) a system of internal controls to ensure ongoing compliance (which includes verifying customer identification); (2) independent testing for compliance; (3) an individual designated as responsible for coordinating and monitoring day-to-day compliance; and (4) training for appropriate personnel. Fintech MSBs must also make and retain records for any fund transmissions amounting to $3,000 or more.

AML Challenges for the Fintech Industry

To comply with the law – and to ensure that their services are not exploited by bad actors – companies offering fintech services must know how to comply with AML regulations, as well as how to avoid common pitfalls in fintech compliance programs. Detailed below are just a few of the challenges that fintech companies face in complying with AML regulations:

  • Fintech companies need to have operational AML programs as soon as their business opens. Fintech companies are required to have robust AML programs that are fully operational when they begin offering financial services. However, because many fintech companies start small and grow over time, there may be a gap between when a company first offers financial services and when its compliance program is fully running. As a result, financial transactions may go unmonitored, and companies may unwittingly operate without complying with all regulations, and thus may be vulnerable to prosecution or enforcement action.

For example, in May 2015, the Financial Crimes Enforcement Network (FinCEN) assessed a $700,000 civil money penalty against Ripple Labs, a digital currency operator, for its failure to register as an MSB and its failure to implement and maintain an adequate AML program. Although Ripple Labs began selling digital currency in August 2013, it did not fully implement its AML compliance program until nearly a year after it began its sales. During that year, Ripple Labs engaged in a series of transactions for which it failed to generate the required SARs.

  • Rapidly growing fintech companies need to ensure that their compliance program grows in scale with their business. Once a fintech company has established an AML compliance program, the AML compliance program may not keep pace with the company's business. For example, an effective AML program requires conducting KYC due diligence. A fintech startup may conduct adequate KYCs on the company's initial customer base; however, the KYC process may be overwhelmed as the company grows and attracts larger volumes of customers from diverse backgrounds and locations. Similar problems may arise in generating SARs and satisfying other reporting requirements as transactions taking place across an app increase rapidly over a year.

As Bruce Wallace, chief digital officer of Silicon Valley Bank Financial Group, recently observed:

"Banks have hundreds, sometimes thousands, of employees committed to compliance functions. Just think for a moment of a startup with five or six employees, mostly engineers, who now have to navigate the landscape of a highly complex regulatory environment. In many cases, it's not as simple as 'if your fintech company does X' then you simply put this specific program in place. They have to spend a lot of cycles figuring out what they need to be in compliance with and then build and institutionalize their program."
  • Anonymous payments should not be permitted for any transaction, regardless of amount. Financial institutions are required to verify a customer's identity. Given that anonymous payments were the focal point of the Liberty Reserve prosecutions, and attracted the scrutiny of European regulators after the Paris attacks, fintech companies should be wary of allowing users to process any payments without verifying their identities – regardless of transaction limits. Some fintech companies currently allow users to complete low-valued transactions (for example, $299.99 or less) without requiring the users to verify their identities. Fintech companies need to consider the possibility of conducting KYC procedures on all users, no matter how small the amount of the transaction. For example, the 2004 Madrid bombers used the sales of Moroccan hashish to support their terrorist attacks. Similar payments for drugs, so long as they fall under the $300 transaction limit, can still occur anonymously on some mobile payment and digital wallet systems. When multiple small payments are layered or aggregated, terrorists (or other criminals) have the means to finance low-cost attacks such as those in Paris and San Bernardino. Undoubtedly alert to this threat, regulators are not likely to hesitate to take action against fintech companies that allow the threat to persist.
  • Peer-to-peer lending companies need to implement fully operational AML programs whether they are subject to the BSA regulations or not. The recent scrutiny of Prosper's loan to San Bernardino shooter Syed Rizwan Farook confirms the importance of peer-to-peer lending companies having full AML programs in place. Because the banks that originate their loans bear full responsibility for complying with the BSA's AML requirements, peer-to-peer lending companies may not have the same incentives to ensure that they are adequately detecting, reporting and preventing money laundering or terrorist financing. Nevertheless, peer-to-peer lenders cannot take a laissez-faire approach to putting adequate KYCs in place. Although a peer-to-peer lender may not be liable for failing to comply with the BSA, it can still suffer reputational damage if a loan made to a customer is implicated in a terrorist or criminal scheme.


As the fintech industry transforms traditional banking practices, it falls under enhanced government scrutiny. Without a thorough AML compliance program in place, fintech companies risk damage to their reputation and the loss of investor and customer confidence in their business. In order to continue growing without the risk of not complying with AML laws, fintech companies – and the financial institutions that partner with them – must know the AML requirements that apply to their business, identify potential weaknesses within their AML compliance programs, and implement gold standard AML compliance programs. 

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

In association with
Related Video
Up-coming Events Search
Font Size:
Mondaq on Twitter
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).
Email Address
Company Name
Confirm Password
Mondaq Topics -- Select your Interests
 Law Performance
 Law Practice
 Media & IT
 Real Estate
 Wealth Mgt
Asia Pacific
European Union
Latin America
Middle East
United States
Worldwide Updates
Check to state you have read and
agree to our Terms and Conditions

Terms & Conditions and Privacy Statement

Mondaq.com (the Website) is owned and managed by Mondaq Ltd and as a user you are granted a non-exclusive, revocable license to access the Website under its terms and conditions of use. Your use of the Website constitutes your agreement to the following terms and conditions of use. Mondaq Ltd may terminate your use of the Website if you are in breach of these terms and conditions or if Mondaq Ltd decides to terminate your license of use for whatever reason.

Use of www.mondaq.com

You may use the Website but are required to register as a user if you wish to read the full text of the content and articles available (the Content). You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these terms & conditions or with the prior written consent of Mondaq Ltd. You may not use electronic or other means to extract details or information about Mondaq.com’s content, users or contributors in order to offer them any services or products which compete directly or indirectly with Mondaq Ltd’s services and products.


Mondaq Ltd and/or its respective suppliers make no representations about the suitability of the information contained in the documents and related graphics published on this server for any purpose. All such documents and related graphics are provided "as is" without warranty of any kind. Mondaq Ltd and/or its respective suppliers hereby disclaim all warranties and conditions with regard to this information, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall Mondaq Ltd and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use or performance of information available from this server.

The documents and related graphics published on this server could include technical inaccuracies or typographical errors. Changes are periodically added to the information herein. Mondaq Ltd and/or its respective suppliers may make improvements and/or changes in the product(s) and/or the program(s) described herein at any time.


Mondaq Ltd requires you to register and provide information that personally identifies you, including what sort of information you are interested in, for three primary purposes:

  • To allow you to personalize the Mondaq websites you are visiting.
  • To enable features such as password reminder, newsletter alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our information providers who provide information free for your use.

Mondaq (and its affiliate sites) do not sell or provide your details to third parties other than information providers. The reason we provide our information providers with this information is so that they can measure the response their articles are receiving and provide you with information about their products and services.

If you do not want us to provide your name and email address you may opt out by clicking here .

If you do not wish to receive any future announcements of products and services offered by Mondaq by clicking here .

Information Collection and Use

We require site users to register with Mondaq (and its affiliate sites) to view the free information on the site. We also collect information from our users at several different points on the websites: this is so that we can customise the sites according to individual usage, provide 'session-aware' functionality, and ensure that content is acquired and developed appropriately. This gives us an overall picture of our user profiles, which in turn shows to our Editorial Contributors the type of person they are reaching by posting articles on Mondaq (and its affiliate sites) – meaning more free content for registered users.

We are only able to provide the material on the Mondaq (and its affiliate sites) site free to site visitors because we can pass on information about the pages that users are viewing and the personal information users provide to us (e.g. email addresses) to reputable contributing firms such as law firms who author those pages. We do not sell or rent information to anyone else other than the authors of those pages, who may change from time to time. Should you wish us not to disclose your details to any of these parties, please tick the box above or tick the box marked "Opt out of Registration Information Disclosure" on the Your Profile page. We and our author organisations may only contact you via email or other means if you allow us to do so. Users can opt out of contact when they register on the site, or send an email to unsubscribe@mondaq.com with “no disclosure” in the subject heading

Mondaq News Alerts

In order to receive Mondaq News Alerts, users have to complete a separate registration form. This is a personalised service where users choose regions and topics of interest and we send it only to those users who have requested it. Users can stop receiving these Alerts by going to the Mondaq News Alerts page and deselecting all interest areas. In the same way users can amend their personal preferences to add or remove subject areas.


A cookie is a small text file written to a user’s hard drive that contains an identifying user number. The cookies do not contain any personal information about users. We use the cookie so users do not have to log in every time they use the service and the cookie will automatically expire if you do not visit the Mondaq website (or its affiliate sites) for 12 months. We also use the cookie to personalise a user's experience of the site (for example to show information specific to a user's region). As the Mondaq sites are fully personalised and cookies are essential to its core technology the site will function unpredictably with browsers that do not support cookies - or where cookies are disabled (in these circumstances we advise you to attempt to locate the information you require elsewhere on the web). However if you are concerned about the presence of a Mondaq cookie on your machine you can also choose to expire the cookie immediately (remove it) by selecting the 'Log Off' menu option as the last thing you do when you use the site.

Some of our business partners may use cookies on our site (for example, advertisers). However, we have no access to or control over these cookies and we are not aware of any at present that do so.

Log Files

We use IP addresses to analyse trends, administer the site, track movement, and gather broad demographic information for aggregate use. IP addresses are not linked to personally identifiable information.


This web site contains links to other sites. Please be aware that Mondaq (or its affiliate sites) are not responsible for the privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of these third party sites. This privacy statement applies solely to information collected by this Web site.

Surveys & Contests

From time-to-time our site requests information from users via surveys or contests. Participation in these surveys or contests is completely voluntary and the user therefore has a choice whether or not to disclose any information requested. Information requested may include contact information (such as name and delivery address), and demographic information (such as postcode, age level). Contact information will be used to notify the winners and award prizes. Survey information will be used for purposes of monitoring or improving the functionality of the site.


If a user elects to use our referral service for informing a friend about our site, we ask them for the friend’s name and email address. Mondaq stores this information and may contact the friend to invite them to register with Mondaq, but they will not be contacted more than once. The friend may contact Mondaq to request the removal of this information from our database.


This website takes every reasonable precaution to protect our users’ information. When users submit sensitive information via the website, your information is protected using firewalls and other security technology. If you have any questions about the security at our website, you can send an email to webmaster@mondaq.com.

Correcting/Updating Personal Information

If a user’s personally identifiable information changes (such as postcode), or if a user no longer desires our service, we will endeavour to provide a way to correct, update or remove that user’s personal data provided to us. This can usually be done at the “Your Profile” page or by sending an email to EditorialAdvisor@mondaq.com.

Notification of Changes

If we decide to change our Terms & Conditions or Privacy Policy, we will post those changes on our site so our users are always aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it. If at any point we decide to use personally identifiable information in a manner different from that stated at the time it was collected, we will notify users by way of an email. Users will have a choice as to whether or not we use their information in this different manner. We will use information in accordance with the privacy policy under which the information was collected.

How to contact Mondaq

You can contact us with comments or queries at enquiries@mondaq.com.

If for some reason you believe Mondaq Ltd. has not adhered to these principles, please notify us by e-mail at problems@mondaq.com and we will use commercially reasonable efforts to determine and correct the problem promptly.