The Question at Hand
Your team collects a bank statement from a high-risk customer, checks the source-of-funds box, and moves on. But what does that statement actually prove? It shows money moved from Account A to Account B. What it doesn't prove is whether that money is clean.
This issue divides AML compliance teams. One side argues that bank statements are sufficient for meeting regulatory expectations for source of funds verification. The other side insists that relying solely on statements creates a facade that doesn't prevent money laundering.
The stakes are high. Your institution's approach to this question determines whether your enhanced due diligence program detects illicit funds or just generates defensible paperwork.
The Case for Accepting Bank Statements
Some compliance officers argue that bank statements are adequate documentation for several reasons.
First, regulatory guidance references bank statements as acceptable evidence. The FATF Recommendations don't specify exact documentation types for verifying wealth or funds. When regulators review your files, they look for reasonable documentation supporting your risk assessment. A bank statement from a regulated financial institution provides that trail.
Second, alternatives can be impossible to obtain. Consider a customer whose funds come from a real estate sale in another jurisdiction. You can request the sale contract, but verifying the buyer's funds requires documentation you may never access. At some point, the verification chain must end. Bank statements from established institutions offer a reasonable stopping point.
Third, demanding more documentation than bank statements can drive customers to competitors. If your process requires layered verification that takes weeks, you're not just thorough, you're losing business to institutions that accept standard documentation.
The procedural argument is also strong. Your program needs consistent, repeatable standards. Bank statements provide that consistency. Every analyst knows what to request, review, and document. This standardization reduces errors and creates audit trails that satisfy examiners.
The Case for Going Beyond Statements
The opposing view is clear: bank statements prove movement, not legitimacy.
If a customer presents statements showing £500,000 transferred from another account, you've confirmed the transfer. You haven't confirmed whether those funds came from legitimate business activity, criminal proceeds, or corruption payments. The statement documents the last step in a potentially illicit chain.
Enhanced due diligence exists to assess money laundering risk, not just create paperwork. When reviewing a Politically Exposed Person's source of wealth, the Bank Secrecy Act and your risk-based program require understanding whether the funds pose a threat. A statement showing funds came from another bank account doesn't answer that question.
The verification gap is evident with layered transactions. Consider funds from bribery, moved through correspondent accounts, held in a foreign trust, then transferred to the account your customer documents. The bank statement shows the final transfer but reveals nothing about the origin.
Technology advocates argue that modern tools can go deeper without bottlenecks. Transaction monitoring systems can flag inconsistencies between stated income sources and actual transaction patterns. Adverse media screening can reveal connections to corruption or criminal activity that bank statements miss. Public records databases can verify claimed business ownership or employment that supposedly generated the funds.
Relying solely on statements also poses regulatory risks. If law enforcement investigates and finds your institution accepted bank statements as adequate verification despite red flags, your program may appear as a checkbox exercise. This exposes you to enforcement actions arguing your risk-based approach wasn't truly risk-based.
Where Practitioners Actually Land
Most compliance teams don't choose one side absolutely. Instead, they adjust their approach based on risk indicators.
For lower-risk cases, bank statements serve as baseline documentation. A domestic customer with straightforward employment and no adverse media hits gets standard verification. The statement confirms the funds exist and moved through regulated channels.
For higher-risk profiles, statements are the starting point, not the endpoint. Politically Exposed Persons trigger additional verification: employment contracts, business registration documents, tax returns, or third-party attestations. Geographic risk factors do the same. Funds from high-risk jurisdictions require more than just statements showing the transfer occurred.
Transaction patterns also influence the decision. When a customer's stated source of funds doesn't match their transaction behavior, compliance teams dig deeper regardless of what the bank statement shows. If someone claims employment income but makes cash deposits exceeding their stated salary, the statement raises questions rather than closes them.
Our Take
Bank statements alone aren't enough for source of funds verification in enhanced due diligence cases, but the alternative isn't demanding impossible documentation for every customer.
The real issue is treating source of funds verification as a risk assessment process, not just documentation collection. When your analyst's job is to obtain a bank statement and check a box, you've built a program that generates files but doesn't detect risk. When their job is to assess whether the customer's funds pose a money laundering threat, the bank statement becomes one input among several.
Operationally, your procedure should require bank statements as baseline documentation, then layer additional verification based on specific risk factors. Politically Exposed Person status, high-risk jurisdiction connections, adverse media hits, transaction pattern inconsistencies, or significant wealth with unclear origins all trigger expanded verification.
Expanded verification doesn't mean demanding perfect documentation of every transaction. It means using available tools to assess legitimacy: adverse media screening, sanctions list checks, public records verification, and transaction monitoring analysis. When those tools raise concerns the bank statement doesn't address, you either obtain additional documentation or exit the relationship.
The regulatory expectation isn't perfection. It's reasonable risk-based diligence. A bank statement showing funds moved through regulated channels meets that standard for straightforward cases. For cases with elevated risk indicators, it doesn't. Your program needs to distinguish between the two.
