# AML, KYC and sanctions screening in practice
In 2020, Capital One paid $80 million to the OCC (Office of the Comptroller of the Currency) after examiners found its BSA/AML (Bank Secrecy Act / Anti-Money Laundering) program had systemic gaps, including transaction monitoring rules that were switched off or never properly calibrated across product lines. No single hacker, no stolen dataset. Just a compliance control that quietly failed to do its job while millions of transactions flowed through it.
That gap is where this lesson lives. Let's trace what happens the moment someone taps "open account" on a neobank app, and see exactly where the legal obligations sit in the technology.
Before the flow, know the three pillars that every US fintech touching money must satisfy simultaneously:
1. The Bank Secrecy Act (BSA, 1970) and its regulator, FinCEN (Financial Crimes Enforcement Network, part of the US Treasury). BSA requires financial institutions to keep records and file reports that help detect money laundering, principal among them SARs (Suspicious Activity Reports) and CTRs (Currency Transaction Reports, triggered above $10,000 in cash).
2. The USA PATRIOT Act (2001), Section 326, which mandates a CIP (Customer Identification Program): every institution must verify who a customer actually is before opening an account. This is the legal root of "KYC" (Know Your Customer).
3. OFAC (Office of Foreign Assets Control), a Treasury office that enforces economic sanctions. It maintains the
In Europe, the equivalent architecture is the EU's AMLD (Anti-Money Laundering Directives, now on its 6th iteration, AMLD6) enforced by national regulators and, from 2025 onward, increasingly by AMLA (the new EU Anti-Money Laundering Authority based in Frankfurt), alongside EU sanctions lists maintained by the Council of the EU.
Picture a neobank like Chime, Revolut, or N26 (used here as illustrative real examples of the category, not as subjects of any specific enforcement claim).
Step 1: Identity capture and CIP. The app asks for name, date of birth, address, and SSN (Social Security Number) or equivalent. This satisfies the PATRIOT Act's CIP minimum. Behind the scenes, a vendor like Jumio, Onfido, or PersonaPersonaA semi-fictional, research-based representation of your ideal customer: their goals, frustrations, behaviours and decision criteria.Voir la définition complète → runs document verification (ID scan) plus liveness checks (a selfie matched against the ID photo) to confirm the person is real and present.
Step 2: KYC risk scoring. KYC goes beyond identity verification into judgment: is this customer, occupation, and expected activity plausible? A neobank customer expecting $2,000/month in payroll deposits gets a low risk score. Someone opening an account and immediately requesting $50,000 in wire transfers to an unrelated jurisdiction gets flagged for EDD (Enhanced Due Diligence).
Step 3: Sanctions screening, in real time. Before the account is even activated, the applicant's name is run against OFAC's SDN list and often the EU, UN, and UK equivalents. This is fuzzy matching, not exact string matching, because sanctioned parties use transliterations, aliases, and near-matches. A common name like "Mohammed Al Rashid" generates false positives against SDN entries; the system needs a human review queue, not just a yes/no gate.
Step 4: Ongoing transaction monitoring. This is where Capital One's failure actually happened. It's not enough to screen someone once at onboarding. Every transaction afterward runs through a rules engine that flags patterns: rapid movement of funds ("layering," a classic money laundering stage), structuring (multiple deposits just under the $10,000 CTRCTRClick-Through Rate (CTR) is the percentage of people who click a link, ad, or call to action out of those who viewed it.Voir la définition complète → threshold), or transfers to high-risk jurisdictions. These rules have thresholds, and thresholds have to be maintained, tested, and updated as products change. Capital One's problem: as it scaled small business banking products, monitoring rules for one platform weren't extended or properly configured for another, leaving large volumes of transactions essentially unmonitored for years. (OCC consent order, 2020)
Step 5: SAR filing. If monitoring or human review surfaces something suspicious, the institution files a SAR with FinCEN, generally within 30 days of detection. SARs are confidential; tipping off the customer is itself a violation.
For a fintech, this isn't one system, it's a chain of vendors and internal logic:
A simplified version of an OFAC screening rule might look like this in pseudocode:
def screen_transaction(sender, receiver, amount, country):
if fuzzy_match(sender.name, SDN_LIST, threshold=0.85):
return "BLOCK - manual review required"
if country in OFAC_SANCTIONED_COUNTRIES:
return "BLOCK - sanctioned jurisdiction"
if amount > 10000 and sender.recent_deposits_sum(days=1) < 10000:
flag_for_structuring_review(sender)
return "CLEAR"The fragility is obvious once you see it: the threshold=0.85 for fuzzy matching is a business judgment, not a law. Set it too high and sanctioned parties slip through. Set it too low and legitimate customers get blocked constantly (a real operational cost, and a customer complaints problem). Regulators examine exactly these calibration choices during exams.
Vérification des acquis
1. The Capital One enforcement action illustrates a key compliance risk. What was the core failure that led to the penalty?
2. A fintech's screening system flags a transaction because the counterparty's name partially matches an entry on OFAC's SDN List. The compliance team later confirms it was a false positive with no sanctions intent. Why does OFAC's strict liability standard still matter here?
3. A neobank verifies a new customer's identity documents and cross-checks their name against government watchlists before letting them open an account. Which legal requirement is this step primarily satisfying?
4. Select ALL correct answers about how the BSA, PATRIOT Act, and OFAC regimes differ in what they require of a fintech.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers about why compliance failures like the one described often go undetected until a regulatory exam.
Sélectionnez toutes les réponses correctes.
Neobanks and payment fintechs usually aren't banks themselves; they partner with a chartered bank (a "bank-as-a-service" or BaaS arrangement, for example Synapse-Evolve Bank, or Chime-Bancorp Bank). But BSA/AML obligations attach to the chartered bank, which pushes compliance requirements contractually down onto the fintech. When the fintech's screening stack is weaker than a traditional bank's, the sponsor bank is still on the hook with regulators, which is why sponsor banks have increasingly faced their own OCC and FDIC consent orders for inadequate oversight of fintech partners (see the 2024 enforcement actions against several BaaS sponsor banks).
This is a structural tension unique to fintech: fast-scaling startups building consumer growth loops, sitting on top of a compliance regime designed for slow-moving, heavily staffed banks.