US Insurance Company AML Rules: 31 CFR 1025 Guide

In the United States, insurance companies that issue certain life and investment-type products must run an anti-money laundering (AML) program and report suspicious transactions to FinCEN. The rules sit in Part 1025 of Title 31 of the Code of Federal Regulations. This guide explains which products and companies are covered, the four minimum elements of the program under 31 CFR 1025.210, and the suspicious activity reporting rule in 31 CFR 1025.320. For the UK position, see our guide to AML in the insurance sector for life insurers.

The regulation text below comes from the Cornell Legal Information Institute, the FFIEC BSA/AML manual copy of section 1025.320, and the 2020 edition of the CFR for the definitions. The 2020 edition is older, so check the current eCFR for any later change.

Which products and companies are covered

The program duty is tied to covered products, not to every insurance line. Under section 1025.100 in the 2020 edition, a covered product is one of three things:

• a permanent life insurance policy, other than a group life insurance policy;
• an annuity contract, other than a group annuity contract; or
• any other insurance product with features of cash value or investment.

A permanent life insurance policy is an agreement that contains a cash value or investment element and under which the insurer must pay a benefit on the insured's death. An annuity contract is an agreement under which the insurer promises to pay a fixed or variable income stream for a period of time. An insurance company, for these rules, is a person engaged within the United States as a business in issuing or underwriting a covered product. The definition expressly does not include insurance agents or brokers. The definitions section points to the general definitions in 31 CFR 1010.100 for terms it does not set out, which we did not read in full, so we do not state how term life, property and casualty, health or reinsurance business is treated.

The program under 31 CFR 1025.210

Each insurance company must have a written AML program that applies to its covered products. The text says the program must be reasonably designed to prevent the company being used to facilitate money laundering or terrorist financing, must be approved by senior management, and must be available to the Treasury Department, FinCEN or their designee on request. The section set a deadline of 2 May 2006 for development and implementation. It then lists four minimum elements.

1. Policies, procedures and internal controls based on the company's assessment of the money laundering and terrorist financing risks of its covered products. They must provide for compliance with the applicable Bank Secrecy Act requirements, integrate the company's insurance agents and brokers into the program, and obtain all relevant customer-related information needed for an effective program.
2. A compliance officer responsible for ensuring that the program is implemented effectively, including monitoring agents' and brokers' compliance, that it is updated as necessary, and that appropriate persons are educated and trained.
3. Ongoing training of appropriate persons. For employees, agents and brokers, the company may train them directly or verify that they received training for the covered products from another insurance company or a competent third party.
4. Independent testing to monitor and maintain an adequate program, including testing of agents' and brokers' compliance. Scope and frequency must match the risks of the covered products, and testing may be done by a third party or by any officer or employee other than the compliance officer.

An insurer that is registered, or required to register, as a securities broker-dealer is deemed to satisfy section 1025.210 for its broker-dealer activities if it has and follows an AML program under 31 CFR 1023.210.

Why agents and brokers matter

Insurance is sold through intermediaries, and the rule reflects that. The program must integrate agents and brokers, the compliance officer must monitor their compliance, training may be delivered directly or confirmed from another source, and independent testing must reach them. The insurer, not the agent, is responsible for filing suspicious activity reports on transactions conducted through its agents and brokers, and it must keep policies to gather customer information from all relevant sources, including them.

Suspicious activity reporting under 31 CFR 1025.320

Each insurance company must report to FinCEN any suspicious transaction involving a covered product that may relate to a possible violation of law or regulation, and may also report voluntarily. The transaction must be conducted or attempted by, at or through the insurer and involve or aggregate at least $5,000 in funds or other assets. The insurer must know, suspect or have reason to suspect that the transaction, or a pattern including it:

• involves funds from illegal activity, or is meant to hide or disguise them or their ownership, source, location or control;
• is designed, including through structuring, to evade Bank Secrecy Act requirements;
• has no business or apparent lawful purpose, or is unusual for that customer, with no reasonable explanation after examining the facts; or
• uses the insurer to facilitate criminal activity.

The report, called a SAR-IC, is due within 30 calendar days of initial detection. If no suspect is identified, filing may be delayed by up to 30 more days, for a maximum of 60 days. For terrorist financing or ongoing money laundering the insurer must also telephone law enforcement immediately. Records of each report and its supporting documentation must be kept for five years.

Two features are specific to insurance. No SAR-IC is required for false or fraudulent information submitted to obtain a policy or make a claim, unless the insurer has reason to believe it relates to money laundering or terrorist financing. And insurers issuing variable products funded by separate accounts that meet the mutual fund definition file under section 1024.320 instead. Confidentiality works as in other sectors: the report and any information revealing it may not be disclosed, except to FinCEN, specified law enforcement and regulators, or within the corporate structure for Bank Secrecy Act purposes. The same structure applies to US casinos and money services businesses, though their thresholds differ.

Practical steps

These are our suggestions, not legal requirements.

• List your covered products and keep the reasoning for any product you treat as outside the definition.
• Document how each of your agents and brokers is brought into the program, including how you check that their training happened.
• Record the date of first detection on every case so the 30-day and 60-day limits are provable.
• Write down your triage for fraud-only cases, because the fraud exception depends on whether there is reason to suspect money laundering or terrorist financing.
• Make sure whoever performs independent testing is not the compliance officer.

For continuing professional development in this area, see the Learnsignal CPD courses.

What we could not confirm

We did not read 31 CFR 1010.100, so we cannot say how every insurance line is treated beyond the covered product definition above. We used the 2020 CFR edition for the definitions and did not check for later amendments. We did not confirm whether FinCEN's 2026 proposed rule on AML and countering the financing of terrorism programs would change Part 1025, so check the current Federal Register before relying on the program text above.

Frequently asked questions

Does every insurer need a US AML program?

The duty attaches to insurance companies issuing covered products, meaning permanent life insurance, annuities and other products with cash value or investment features, with group policies and group annuities excluded.

Are agents and brokers insurance companies for these rules?

No. The definition of insurance company excludes them, but the insurer must integrate them into its program and remains responsible for reporting transactions conducted through them.

What is the SAR threshold for an insurer?

$5,000 in funds or other assets, involved or aggregated in the transaction, under section 1025.320.

Is a fraudulent claim always reportable?

No. Reporting false or fraudulent information submitted to obtain a policy or make a claim is excepted unless the insurer has reason to believe it relates to money laundering or terrorist financing.

Learnsignal publishes this guide for general education only. It is not legal advice.