Higher-risk customer profilesoften include businesses that:
Regularly handle large volumes of cash
Operate in sectors withhistorical vulnerabilities to money laundering
Are involved invirtual assets or unregulated financial activities
Option C - A local used car sale lot that allows cash payments:
This business type is consideredcash-intensive, and accepting monthly payments in cash raises concerns about the source of funds, potential structuring, or placement of illicit proceeds.
Option D - A Virtual Asset Service Provider (VASP):
VASPs involved inpeer-to-peer crypto transactionspresent elevated AML risks due to theanonymity, speed, and borderless natureof virtual assets. These institutions are often subject toenhanced due diligence requirements.

Risk assessment is the foundation of an effective AML compliance program. It enables an organization to identify, understand, and prioritize its exposure to money laundering and terrorist financing risks, which in turn informs the development of appropriate controls, including policies, procedures, and customer due diligence measures.

The Bank Secrecy Act (BSA) is the foundational Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) law in the United States. Enacted in 1970, the BSA requires financial institutions to establish and maintain effective AML programs designed to detect and prevent money laundering and terrorist financing.
Under the BSA and its implementing regulations, financial institutions must implement key controls such as Customer Identification Programs (CIP), customer due diligence (CDD), enhanced due diligence (EDD) for higher-risk customers, transaction monitoring, record-keeping, and the filing of Suspicious Activity Reports (SARs) and Currency Transaction Reports (CTRs) with FinCEN.
While the USA PATRIOT Act expanded AML obligations-particularly in relation to terrorist financing-it amended and strengthened the BSA rather than replacing it. The Money Laundering Control Act criminalized money laundering activities but does not establish the operational compliance framework. MiCA is an EU regulation and does not apply in the U.S.
Therefore, the BSA remains the cornerstone of U.S. AML/CFT compliance requirements.

For high-risk customers, including PEPs, the bank should have gathered adequate information on the source of funds and wealth, assessed the money laundering risk of each customer, and ensured compliance and AML resources scaled with business growth to maintain effective systems and controls.