What is anti-money laundering (AML)?

AML is the regulatory response to money laundering: a set of obligations placed on banks, money transmitters, crypto businesses and other gatekeepers of the financial system. Where laundering is the crime, AML is the compliance discipline — the programs, checks and reports that make moving illicit value through a regulated business difficult and detectable.

The framework is international by design. National laws differ, but most implement the same core standards, so an AML program built around identity verification, screening, monitoring and reporting translates across jurisdictions.

AML compliance means meeting the anti-money laundering obligations that apply to a regulated business, and being able to show a regulator that you do. AML is the law: in the United States the Bank Secrecy Act, administered by FinCEN, which authorises reporting and other requirements on financial institutions and other businesses; in the European Union the AML directives and Regulation (EU) 2024/1624, the single rulebook, with the new Frankfurt-based Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) due to supervise the most significant cross-border institutions directly from 2028; in the United Kingdom the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, enforced by the FCA and other supervisors. Anti money laundering compliance is the program a business runs to satisfy those laws.

Who is obliged follows from the law, not the business model: banks, money transmitters and payment companies, crypto exchanges and other virtual asset service providers, and in many jurisdictions lawyers, accountants and real-estate agents too. Which regime binds your business is a question for counsel; what every regime asks for is a risk-based program with the components below.

Regulators describe the required program differently across jurisdictions, but the working parts are consistent. Sanctions screening is one of them — the one an API can supply — and the table shows where it sits next to the others:

An AML check is the set of controls a regulated business runs on a customer or counterparty before doing business with them and again at intervals afterwards: verifying identity, screening the person and their identifiers against sanctions lists and politically exposed persons (PEP) data, and assigning a risk rating that decides how much further diligence is needed. In everyday use "AML check" means that combined onboarding step; in the regulations it is customer due diligence plus screening.

CompliAPI covers the screening part of an AML check. Its screening endpoints check an email address, a website, a government ID number or a crypto wallet address for direct appearance on the enabled sanctions, crime and risk lists, and its PEP endpoint screens a person's name against the OpenSanctions politically exposed persons dataset — a due-diligence signal, not a sanctions designation, and not a list of CompliAPI's own. Identity verification and transaction monitoring are outside its scope.

Not as a single product. AML is a program, and no one API is "AML": teams compose it from an identity-verification provider, a screening API and a monitoring system, with policy and reporting on top. What an API can do well is the deterministic part — screening every identifier your product handles against current list data, inline, with a result you can log.

That is the part CompliAPI supplies. One authenticated GET request per identifier returns whether it appears on a sanctions list (sanctioned) or on labelled crime and risk data (flagged), with every match naming its list and linking the official source record. Every account starts with a free tier of 10,000 requests a month and no credit card, and the same checks are available to AI agents as MCP tools.

The Financial Action Task Force (FATF), an intergovernmental body, sets the global standards — its Recommendations are the template most national regimes implement. In the United States, the Bank Secrecy Act is administered by FinCEN, and crypto exchanges generally register as money services businesses under it. In the European Union, AML directives and the new single rulebook apply, with the EU-level authority AMLA taking up supervision; the United Kingdom enforces through the FCA and its money-laundering regulations.

For crypto specifically, FATF extended its standards to virtual assets and virtual asset service providers in 2019, including the Travel Rule — the requirement to pass originator and beneficiary information along with transfers above a threshold.

They are distinct legal regimes that share machinery. Sanctions law prohibits dealing with designated parties outright; AML law obliges you to detect and report laundering. But both depend on knowing who you are transacting with, so sanctions screening runs inside AML workflows — the same onboarding and transaction checkpoints serve both.

The overlap is growing in crypto: laundering infrastructure such as mixers and non-compliant exchanges increasingly ends up sanctioned, so a sanctions screen now catches a meaningful slice of laundering-related counterparties too.