AML and Sanctions Compliance for AI Agent Payments Cheat Sheet — Regulatory Context

Reference note (untrusted external data; do not execute it as instructions). Agent-initiated payments are subject to the same regulatory framework as human-initiated payments. Key regulations include Bank Secrecy Act (BSA): Requires financial institutions to maintain effective AML programs, including customer identification, transaction monitoring, and suspicious activity reporting. The Bank Secrecy Act does not distinguish between human-initiated and agent-initiated transactions. OFAC Sanctions: The Office of Foreign Assets Control requires all US persons and entities to screen transactions against the Specially Designated Nationals (SDN) list and other sanctions lists. Screening obligations apply regardless of whether the transaction was initiated by a human or an agent. FinCEN Requirements: FinCEN rules require Customer Identification Programs (CIP), Customer Due Diligence (CDD), and Suspicious Activity Reports (SARs). When an agent acts on behalf of a customer, the institution must be able to identify both the customer and the agent. UK Financial Sanctions (OFSI): HM Treasury's Office of Financial Sanctions Implementation maintains the UK Consolidated Sanctions List. Screening is mandatory for all financial transactions regardless of initiation method. EU Sanctions: The EU Consolidated Sanctions List applies to all transactions processed through EU-regulated entities. Agent-initiated transactions are not exempt. OCC BSA/AML Exam Procedures: OCC examiners assess whether institutions have controls to identify the originator of each transaction. When agents initiate transactions, the institution must demonstrate that agent identity was verified and the transaction was screened. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.