AML Compliance Is a Marketing Asset Most Fintechs Don't Use

Anti-money-laundering compliance occupies a strange position in fintech. It's expensive, it's non-negotiable, it consumes a meaningful share of engineering and operations, and in my experience it seldom shows up in anything customer-facing beyond a compliance page. Fintech AML compliance is the set of controls a company uses to detect and report money laundering, from customer checks to suspicious activity reports, and a fintech that can show its program clearly has an edge with the banks it depends on.

Key takeaways

• Banks stay responsible for compliance even when a fintech partner does the daily work, so sponsor banks assess a prospective partner's AML program before signing.
• Regulators are asking whether programs work: FinCEN's April 2026 proposal stresses "program effectiveness rather than mere technical compliance," and in October 2026 the OCC fined Bank of America a record $750 million over a deficient monitoring system.
• The credible public claim is dated and scoped, such as what the latest independent test covered (internal staff may perform it), and never reveals a suspicious activity report.

The quiet around it is odd, because AML is one of the first things a sponsor bank, an enterprise partner, an acquirer or a regulator asks about, and Bank Secrecy Act and AML weaknesses ran through the enforcement actions that reshaped banking as a service.

Treated as an asset rather than an obligation, it can help win the partnerships that decide whether a fintech operates at all.

Why do sponsor banks care about a fintech's AML program?

In a bank-fintech partnership, the bank stays responsible for its compliance obligations even when a partner does much of the day-to-day work. Depending on what the fintech does and how it's licensed, it may carry direct AML obligations of its own. When regulators examined those partnerships, the banks absorbed the consequences.

So sponsor banks assess a prospective partner's AML capability before signing, and depending on the arrangement the diligence can be detailed: transaction monitoring, sanctions screening, suspicious activity reporting, staffing, escalation paths, recordkeeping.

That's the commercial fact underneath the compliance conversation, and it means AML capability is closer to a license to operate than to overhead.

The rules themselves are being rewritten around whether a program works. In April 2026, FinCEN proposed replacing its AML program rules with a framework that separates flaws in a program's design from failures to carry it out, and a supervisory approach that focuses on "program effectiveness rather than mere technical compliance." Announcing it, Treasury Secretary Scott Bessent said Washington had for too long asked financial institutions "to measure success by the volume of paperwork." As of early November it is still a proposal.

Enforcement for programs that don't work in practice hasn't paused. In October 2026 the OCC fined Bank of America $750 million, the largest penalty in its history, finding that its deficient monitoring system failed to properly monitor trillions of dollars in transactions and that the bank's BSA officer and staff "lacked sufficient skills and expertise." FinCEN assessed $1.2 billion in the same matter, crediting the OCC's penalty.

The rulemaking and the enforcement ask the same question: does the program do what it says? A fintech can describe publicly what its testing covered and found, subject to legal and compliance review.

How should a fintech describe its AML compliance publicly?

A fintech should describe its AML program specifically: which controls it runs, at what stage, and who reviews them. Not "bank-grade compliance," which is a phrase that signals nothing. Finer operational detail, such as escalation triggers, belongs in partner diligence rather than on a public page, and compliance should decide where that line falls.

Describe your testing. The bank and money services business rules require independent testing or review of an AML program, which qualified internal staff may perform, so it isn't necessarily an outside audit. Say what the most recent review covered, when it happened and what it found, to the extent you're authorized to discuss it, and name an outside reviewer only if you hired one. A dated, scoped review provides evidence partners can evaluate, much as a SOC 2 report does in security sales.

Describe the staffing. Compliance is people as much as software. The bank and money services business rules require a designated person responsible for day-to-day compliance, and FinCEN's proposal would require covered institutions' AML/CFT officers to be based in the United States. A named compliance officer with relevant experience is more reassuring than a feature list, and prospective bank partners specifically look for it. Growth is where staffing gets tested. When New York's Department of Financial Services fined Block $40 million in April 2025 over Cash App's AML program, it said the company's rapid growth in 2019 and 2020 contributed to "a severe transaction alert backlog," and its superintendent put the lesson in one line: "Compliance functions must keep pace with company growth or expansion."

Publish what you can about outcomes: false positive reduction, time to resolution, and detection rates where you can define how they're measured. Which figures can go out is a question for compliance and counsel, not marketing, and any that do should come with the period, the method and the limits. I read every headline figure backwards before it goes out: a stat that says one in five customers uses a feature also says four in five don't. A lower false positive rate can read as a system that flags less, unless it sits beside what the system still catches. There is a hard line: federal rules make a suspicious activity report, and any information that would reveal one exists, confidential.

Don't imply you prevent everything. Overclaiming here is uniquely dangerous, because the failure case is a regulatory action that becomes public. Stating the limits of any monitoring system is what a sophisticated reader expects.

Where it belongs in the story

Three audiences care about a fintech's AML program, and each needs a different depth.

Sponsor banks and partners need the operational detail. This belongs in a dedicated, substantive page or document. Not a marketing page; closer to a technical trust center.

Enterprise customers need enough to satisfy their own vendor risk review. A summary of the applicable controls and a route to further documentation.

Press and investors need the strategic version: what makes the problem hard, what the company has built, and evidence of how it performs. In my experience it's the version that gets told least, because compliance teams write about compliance and marketing teams avoid the subject.

The story that's available and untold

Financial crime compliance is one of the few areas where a fintech has data nobody else has and a genuinely difficult technical problem that a general audience can understand.

The patterns in attempted fraud, how they shift, what a monitoring system actually catches and misses: that's substantive material that business and financial press covers when someone credible offers it. FinCEN's own September 2026 analysis of health care fraud combined aggregate findings from Bank Secrecy Act reports with individual examples, and the banking press covered it. FinCEN publishes these analyses under a legal mandate, though, and a private company has no such cover: a fintech's original data campaign needs its own legal and compliance review before it goes out. Done that way, the work positions the company as a serious operator rather than a marketing exercise, and it reaches exactly the audience that decides whether you're bankable.

What I see too often is a company that publishes nothing and describes its compliance as robust. That word does no work at all.

Common questions

What is AML compliance in fintech? It's the program a fintech, or its partner bank, runs to keep its services from being used to launder money. For money services businesses, federal rules require a written, risk-based program with internal controls, a designated compliance person, training and an independent review. Banks must also run ongoing customer due diligence. Which rules apply depends on the company's activities, regulatory status and jurisdiction.

What do sponsor banks evaluate in AML diligence? It depends on the arrangement, but reviews commonly cover transaction monitoring, sanctions screening, suspicious activity reporting, compliance staffing and experience, escalation procedures and recordkeeping. Banks also want evidence that the program works in practice, such as the scope, date and findings of the most recent independent test.

Can compliance be a competitive advantage? It can, when a company can show it. Evidence about its controls, compliance leadership and independent testing helps prospective bank partners assess it during diligence, which is where those partnerships are decided. Adjectives aren't evidence. Independent test findings, shared to the extent the company is authorized, give prospective partners something they can assess.

How should a fintech describe its compliance publicly? By describing the requirements that apply to it, its compliance leadership, and the scope and results of any testing it's authorized to discuss, rather than using adjectives like robust or bank-grade. Compliance should review public descriptions of controls, and compliance and counsel should decide which outcome figures, if any, can go out.

Is there a communications risk in discussing AML? Overclaiming is one. No monitoring system catches everything, and a company that implies otherwise has created a problem for itself if a failure becomes public. Confidentiality is another: a public statement must not reveal that a suspicious activity report exists. Describe the limits, and have compliance and counsel review what goes out.

Sources

• Financial Crimes Enforcement Network, FinCEN Proposes Rule to Fundamentally Reform Financial Institution Programs Designed to Fight Illicit Finance, April 7, 2026
• Financial Crimes Enforcement Network, Fact Sheet: Proposed Rule to Fundamentally Reform Financial Institution AML/CFT Programs, April 7, 2026
• Office of the Comptroller of the Currency, OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance, October 13, 2026
• Financial Crimes Enforcement Network, FinCEN Assesses $1.2 Billion Penalty against Bank of America, October 13, 2026
• New York State Department of Financial Services, Superintendent Adrienne A. Harris Secures $40 Million Settlement with Block, Inc. for Inadequate Anti-Money Laundering Program and Virtual Currency Compliance Failures on Cash App Platform, April 10, 2025
• Code of Federal Regulations, 31 CFR 1020.210, Anti-money laundering program requirements for banks, and 31 CFR 1022.210, Anti-money laundering programs for money services businesses
• Code of Federal Regulations, 31 CFR 1020.320, Reports by banks of suspicious transactions, paragraph (e)
• Financial Crimes Enforcement Network, Health Care Fraud: Trends in Bank Secrecy Act Data, September 9, 2026
• ABA Banking Journal, FinCEN releases financial trend analysis on healthcare fraud, September 10, 2026

Salient PR works with fintech, payments and embedded finance companies on regulatory and partnership communications. Regulatory details come from the agencies' own rules, orders and releases, listed above. Nothing here is legal or compliance advice.