AML in wealth management concentrates in one place: the enhanced due diligence file for a high-risk client, where a firm must show how the client became wealthy and where their money comes from before taking it. That file passes through three signatures. A KYC analyst prepares it, a senior analyst who did not prepare it checks it, and a BSA/AML officer, MLRO or other senior manager decides whether the firm will take the client. The rules say more about the last signature than most procedures do, and regulators have fined firms whose approvers did not know what they were approving. Botminds' Source of Wealth Verification is built around this chain: its agents read, reconcile and test the evidence, and the three people sign, each seeing the unexplained amount in dollars before they do.
The rules and cases below are quoted from US, UK, EU and Singapore regulators. The roles and sample file are the solution's fictional ones.
Who signs the source of wealth file, and what each signature attests
Agent
Agents read and reconcileRead every document in its language, rebuild the wealth as dated streams, test plausibility, screen news, size the unexplained amount.
Never: decide, submit or contact the client
A person decides
KYC analyst preparesAttests that every stream is evidenced to the firm's standard or that its gap is stated in money, and approves any request to the client.
Never: check or approve their own file
A person decides
Private banker sendsSends the approved request through the firm's client system; sees the file's status, not its adverse media.
Never: approve the request they send
A person decides
Senior analyst checksAttests that each sentence of the narrative is supported by the cited page; returns the file with a reason code if not.
Never: check a file they prepared
A person decides
BSA/AML Officer decidesApproves, approves with conditions, declines or escalates, with a reason code, the open amount stated and an e-signature.
Never: decide without seeing the gap in money
AML in wealth management: why the source of wealth file is the hard part
Most anti-money laundering controls in a wealth manager are systems: screening, transaction monitoring, identity checks. The source of wealth file is judgement, written down, and it is where recent enforcement has landed. In August 2026 FinCEN imposed a $125 million penalty on UBS Financial Services, "the largest penalty ever imposed against a broker-dealer for BSA violations to date", citing among other failures risks "associated with these customers’ source of wealth" in services to high-risk clients with ties to Russia and Latin America (FinCEN, 3 August 2026). In Singapore, the one finding common to the nine institutions MAS penalised in July 2025 was source of wealth.
FinCEN's release named the failure mode in one line. Risk-based due diligence "does not include, for example, a focus on simply “papering” dispositions of apparent risks but rather an objective identification and assessment of the risks presented". A signature on a papered file is the problem this page is about.
When the approval is the weak link
$125M
FinCEN penalty on a broker-dealer serving wealthy clients, August 2026, citing source-of-wealth risks
£1.88bn
transaction for ultra-high-net-worth PEPs whose approvers "misunderstood what their approval was for"
3
trust company executives MAS reprimanded as members of its new-business committee that approved higher-risk clients
Who approves a high-risk client?
Senior management approves, and "senior management" is defined by knowledge and authority, not job title. The UK regulations define it as an officer or employee with sufficient knowledge of the firm's money laundering risk exposure and sufficient authority to take decisions affecting it. The FCA's FG25/3 tells firms to "clearly document within its policies and procedures and internal controls those who are considered to meet this definition", and accepts that in lower-risk cases a less senior person may sign, provided that person has real authority to make the decision and the decision is written down (FCA FG25/3, July 2025).
The EU's single rulebook uses the same two tests. From 10 July 2027, "senior management" means members of the management body and "officers and employees with sufficient knowledge of the obliged entity’s money laundering and terrorist financing risk exposure and sufficient seniority to take decisions affecting its risk exposure" (Regulation (EU) 2024/1624, Article 2). MAS's guidelines add a requirement on inputs: for politically exposed persons, approval "shall be obtained from senior management. Inputs should also be obtained from the bank’s AML/CFT compliance function" (Guidelines to MAS Notice 626, 8-5-3). The US private-banking rule names no approver; it requires the firm's program to say who decides when diligence cannot be completed. How regimes compare on politically exposed persons specifically is the subject of PEP Screening's guide to PEP senior management approval.
What is the BSA/AML officer responsible for?
The BSA/AML officer is the individual a US firm designates as responsible for its anti-money laundering program, and for high-risk clients that usually means owning the decision or the policy behind it. FinCEN's consent order against UBS Financial Services restates the program duty: firms must "designate an individual or individuals responsible for implementing and monitoring the operations and internal controls of the program" (FinCEN Consent Order No. 2026-02). Registered investment advisers will have the same duty from 1 January 2028, when FinCEN's adviser rule requires them to maintain a program that includes "designating an AML/CFT compliance officer" (89 FR 72156).
In the UK the equivalent is the Money Laundering Reporting Officer, and FG25/3 draws a line worth copying: the MLRO, the senior manager holding the SMF17 function, need not be the one who signs off politically exposed clients, but the FCA expects the MLRO to know about every such client taken on or turned away. An officer who approves every file cannot also be the independent overseer of whether files are approved well. The fictional firm in the solution puts every high-risk client, every political exposure and every exception in front of its BSA/AML Officer, and gives policy and thresholds to the Head of Financial Crime Compliance.
Five people who carry one enhanced file in Source of Wealth Verification
Today
Reads 40 to 120 pages per file, half not in English, re-keys amounts and writes the narrative from scratch.
With agents
Opens a wealth history already read, reconciled and tested; approves one request for the missing document and edits a cited draft.
Still theirs: Approving client requests; the file's first signature
Today
Re-reads the evidence behind a free-text narrative to find where each claim came from.
With agents
Opens every sentence at its document and page; returns the file with a reason code where one does not hold.
Still theirs: Pass or return
Today
Signs a high-risk client without knowing, in dollars, how much wealth is still unexplained.
With agents
Sees the gap, the risk drivers and the recommendation, and decides with a reason code, conditions and an e-signature.
Still theirs: Every high-risk decision
Today
Forwards vague, repeated requests for "more documents" that stall the account.
With agents
Sends one approved request for the document that closes the gap; sees status, never adverse-media detail.
Still theirs: The relationship and every message to the client
Today
Rebuilds a file from emails and spreadsheets when an examiner asks how wealth was verified.
With agents
Hands the examiner one sealed export per client and approves every change to policy, thresholds and agents.
Still theirs: Policy, escalations and the examiner relationship
Can the relationship manager approve source of wealth?
No rule bans it by title, but the conflict is obvious and the regulators point away from it. The relationship manager is paid to win and keep the client. MAS reminded relationship managers in July 2025 that they are the first line of defence (what the nine penalised firms missed), and prohibited two of them from working in regulated finance for failing to raise red flags. The FCA's 2015 notice against Barclays describes front-office senior managers concerned "about the speed at which the due diligence process could be completed, with one manager expressing a desire to “race this through”" (FCA Final Notice, Barclays Bank plc, 25 November 2015).
The EU's new rule makes the conflict explicit for the wealthiest clients. For higher-risk relationships handling at least EUR 5 million for a client with EUR 50 million or more, firms must take measures for "preventing and managing conflicts of interest between the customer and senior management or employees of the obliged entity that undertake tasks related to that obliged entity’s compliance in relation to that customer" (AMLR Article 34(5)(c), from July 2027). In the solution, the private banker owns the relationship and sends requests, but cannot approve a request, cannot see adverse-media findings, and has no seat in the decision.
What each signature should attest, in money
A signature is only as useful as the statement it signs. Barclays' approvers, the FCA found, "had a very poor understanding of the financial crime risks involved and misunderstood what their approval was for". MAS reprimanded a trust company's senior managers who, as members of its New Business Committee, approved higher-risk customers without spotting, or properly weighing, several gaps in how their source of wealth had been corroborated (MAS, 4 July 2025). The cure is to make each signature attest to something specific and checkable.
What each signature on a source of wealth file should say
| Signature | Attests to | Stated in the file |
|---|---|---|
| Analyst (maker) | Each stream is evidenced to the firm's standard, or its gap is stated | Explained and unexplained amounts per stream; documents and pages cited |
| Senior analyst (checker) | Every claim in the narrative is supported by the page it cites | Pass, or return with a reason code per failing sentence |
| Approving officer | The firm accepts the client, with the open amount and conditions known | Decision, reason code, conditions, the unexplained amount at decision, attestation, e-signature |
| Escalation owner | Residual risk above tolerance is accepted, mitigated or refused | The amount above tolerance, the measures added, or the exit |
The checker reads a cited narrative; the sign-off chain sits beside it
What happens when source of wealth cannot be established?
The firm must follow a route it wrote down in advance: refuse, suspend, report, close, or accept the residual risk with senior approval and added controls. The US rule requires the route itself: a private-banking program must include procedures for when due diligence cannot be performed, saying when the firm should refuse to open the account, suspend activity, file a suspicious activity report or close it (31 CFR 1010.620(d)). The FCA's FG25/3 says that a firm unable to apply the enhanced measures it decided on "needs to comply with the requirement not to establish, or to terminate, a business relationship".
MAS draws the line between a gap and a doubt. Where a firm cannot corroborate a significant portion of a customer's wealth, it should take the case to senior management for approval before the relationship begins (the go-live checklist writes that rule as a setting) and consider added measures such as enhanced monitoring (MAS Circular AMLD 08/2024). Where there are red flags, the 2026 circular says senior management "should consider whether to establish business relations with the customer, and if so, whether additional risk mitigating measures are necessary" (AMLD 05/2026). In the solution's sample policy, an analyst records an exception with a reason code when a client cannot obtain a document, the BSA/AML Officer decides with the open amount stated, and more than 10% of net worth unexplained after two requests goes to the Head of Financial Crime Compliance.
The decision, with the open amount and the conditions on the record
What to look for in AML software for wealth management
Software for this work should make the chain of signatures harder to paper over, not easier. That is a different test from the usual feature list, and it can be run on a vendor's demonstration with a few of your own past files.
Questions to put to AML software for a wealth manager's enhanced files
- Does the approver see the unexplained amount in money?
Not a status such as "documents outstanding". If the gap is not on the decision screen, approvers will sign without it.
- Is maker, checker and approver separation enforced, per file?
A person who prepared a file should be unable to check or approve it, and the system, not a procedure, should stop them.
- Does each sign-off carry a reason code and an attestation?
So an examiner can read what the signer said they had checked.
- Can the relationship manager see adverse media?
They should see status, not findings, and should never approve their own client.
- Does it read documents in their original language?
With the translation beside the original and every figure cited to its page.
- Does it say what it will not do?
An agent that decides, contacts clients or clears true matches moves the signature from a person to a system.
- Can policy changes be approved and tested before they go live?
Thresholds and evidence standards should change only with a second person's approval, re-tested on past decided files.
Where Source of Wealth Verification fits, and where it does not
Botminds' Source of Wealth Verification is the enhanced file for high-risk wealth clients: the evidence, the wealth history, the tests, the request to the client, the cited narrative and the three signatures. Its seven agents read, rebuild, test, screen and size the gap; they never submit a narrative, contact a client, clear a true match or close a review. It works with the systems a wealth manager already has: the client onboarding system that opens enhanced files from its risk model, a screening service, news and corporate-registry data, the CRM through which bankers send requests, and core banking and custodian feeds.
It is not a screening engine, a transaction monitoring system or a client onboarding platform, and it does not replace the risk model that decides which clients are high risk. It is not for investor due diligence in funds, which Investor Services' investor KYC and AML onboarding covers, nor for a bank's corporate KYC. And it does not decide: every high-risk client is a person's decision. The cost case for the file it produces is set out in private banking software: price one enhanced file first, and what a firm prepares before go-live in the source of wealth checklist. The solution page follows one file through all five people.
Questions people ask
What does AML mean in wealth management?
The anti-money laundering program a wealth manager runs: identifying clients, assessing their risk, enhanced due diligence including source of wealth and funds for high-risk clients, screening, monitoring and suspicious activity reporting. Wealth management is singled out because, as MAS put it in 2024, it "presents inherently higher money laundering and terrorism financing (ML/TF) risks due to its client attributes, size of transactions and the complexity typically involved".
Do registered investment advisers need an AML program?
From 1 January 2028. FinCEN's rule for registered investment advisers and exempt reporting advisers was published in September 2024 and its effective date moved from 1 January 2026 to 1 January 2028. It includes a compliance officer and private-banking due diligence, which FinCEN said applies where an adviser manages more than the minimum aggregate deposit for a client.
Who signs off a PEP in the UK?
Senior management, meaning someone with sufficient knowledge of the firm's money laundering risk and sufficient authority to act on it. FG25/3 lets lower-risk PEP relationships be signed at a lower level of seniority, as long as the signer has that authority and the decision is documented, and says the MLRO may stay independent of individual sign-offs.
Can one person both prepare and approve a source of wealth file?
No rule names this exact case, but separating the roles is the point of a checker and an approver, and enforcement cases turn on approvers who did not understand what they signed. In the solution, the person who prepares a file can never check or approve it.
What should an examiner be able to see?
Who prepared, checked and approved the file, what each attested to, the evidence behind every amount, the unexplained amount at decision, and the policy in force that day. The solution exports this for one client as a PDF with an index and a JSON file under a SHA-256 seal.