Plain-English guide

AML risk assessment for jewelry stores

Updated October 2026 · Based on 31 CFR 1027.210 and FinCEN guidance

Every covered dealer's AML program starts with a risk assessment. It's where you look honestly at your own business and ask where money laundering could slip through. The rule tells you what to consider. It doesn't give you a form. This guide walks through the required factors, the red flags your controls must address, and a simple scoring method you can adapt.

1. What the rule requires

A covered dealer's policies, procedures and internal controls must be based on its risk assessment of its line or lines of business (31 CFR 1027.210(b)(1)). The whole program must be written and approved by senior management (31 CFR 1027.210(a)(1)).

The risk assessment drives the rest of the program:

• The compliance officer must update the program as needed for changes in the risk assessment (31 CFR 1027.210(b)(2)(ii)).
• Independent testing must match its scope and frequency to the risk assessment (31 CFR 1027.210(b)(4)).
• A retailer that's covered only because of its purchases from the public can limit its program to those purchases (31 CFR 1027.210(a)(2)). Its risk assessment can focus there too.

Putting the assessment itself in writing, dated and signed, is recommended practice. It shows how you reached your program's choices.

2. The three risk factors

The rule names three groups of factors your assessment must consider (31 CFR 1027.210(b)(1)(i)).

Factor A: products, customers, suppliers, channels and locations

Consider the type of products you buy and sell, and the nature of your customers, suppliers, distribution channels and geographic locations (31 CFR 1027.210(b)(1)(i)(A)). Questions to ask:

• Products: Do you deal in items that are easy to resell and move, such as bullion, loose diamonds or scrap gold?
• Customers: Mostly local repeat buyers, or many one-time and out-of-area customers?
• Suppliers: Established wholesalers, or walk-in sellers and private parties?
• Channels: In-store only, or also online, by phone order or by shipping?
• Locations: Where are your stores, and where do your customers and suppliers come from?

Factor B: dealings outside your established relationships

Consider how much of your business is with people other than established customers, established sources of supply, or other dealers covered by the rule (31 CFR 1027.210(b)(1)(i)(B)). A cash-for-gold counter that buys from strangers all day has a different profile than a store selling to long-time clients.

Factor C: high-risk jurisdictions

Consider whether payments or account reconciliations go to or from accounts in jurisdictions that are (31 CFR 1027.210(b)(1)(i)(C)):

• identified by the State Department as state sponsors of terrorism;
• designated as non-cooperative by an intergovernmental body the US belongs to, such as FATF; or
• designated by Treasury for special measures under 31 U.S.C. 5318A.

Most small stores rarely touch these. Note in your assessment how you would spot one, for example a wire from overseas or a request to pay a foreign third party.

3. Turning risk into controls: the red flags

Your procedures must help you identify transactions that may involve money laundering or terrorist financing. That includes making reasonable inquiries and refusing, withdrawing from or ending a transaction when needed (31 CFR 1027.210(b)(1)(ii)). The rule names five red flags:

1. Unusual payment methods: large amounts of cash; multiple or sequentially numbered money orders, traveler's checks or cashier's checks; or third-party payments (31 CFR 1027.210(b)(1)(ii)(A)). Example: a buyer pays with five money orders in a row.
2. Unwillingness to give information: a customer or supplier won't give complete or accurate contact information, financial references or business affiliations (31 CFR 1027.210(b)(1)(ii)(B)).
3. Unusual secrecy: for example, asking that normal business records not be kept (31 CFR 1027.210(b)(1)(ii)(C)). FinCEN guidance says normal security precautions customary in the jewelry trade aren't "unusual secrecy" (FinCEN preamble, 2005 interim final rule).
4. Unusual for that customer or supplier: purchases or sales that don't fit the person, or that type of person (31 CFR 1027.210(b)(1)(ii)(D)). Example: a first-time seller with a bag of identical new chains.
5. Not standard industry practice: purchases or sales that don't conform to normal practice (31 CFR 1027.210(b)(1)(ii)(E)). Example: a buyer who doesn't care about price, quality or certificates.

FinCEN guidance adds useful context. Reasonable inquiry can be scaled: more scrutiny for new customers and suppliers, less for established ones unless something looks unusual. And a red flag isn't an automatic refusal. You decide based on the facts (FinCEN preamble, 2005 interim final rule).

What about ID? Identity checks are required when you file a Form 8300 cash report (31 CFR 1010.330(e)(2)). Part 1027 has no separate customer ID rule for dealers. Outside Form 8300, checking ID is recommended practice and part of reasonable inquiry. See our Form 8300 guide.

4. A simple scoring example

This scoring method is recommended practice, not a regulatory requirement. The rule doesn't prescribe any scoring system. A score simply helps you rank your risks and explain your choices.

Rate each area 1 (lower), 2 (medium) or 3 (higher). Here's a made-up store with a busy scrap-gold counter:

With seven areas, totals run from 7 to 21. One way to read them (recommended practice):

• 7 to 10, lower: standard procedures, training and testing.
• 11 to 15, moderate: add targeted controls where you scored 3.
• 16 to 21, higher: tighter controls across the board, and more frequent review and testing.

The total matters less than the 3s. In this example, the controls should focus on the scrap-gold counter and one-time sellers: written seller procedures, ID checks, a short red-flag script for staff, and escalation to the compliance officer (recommended practice). If the store is a retailer covered only through public purchases, that's also where its limited program applies (31 CFR 1027.210(a)(2)). Our guide to buying gold from the public covers that path.

5. Keeping it current

The compliance officer must update the program as needed for changes in the risk assessment, regulatory requirements and Treasury guidance (31 CFR 1027.210(b)(2)(ii)). In practice, review the assessment at least once a year, and again when something changes: a new location, online sales, a new buy counter or a new product line (recommended practice).

Your independent tester should check that the assessment is current and that your controls match it (31 CFR 1027.210(b)(4)). See our independent testing guide. Not sure you're covered yet? Start with Do jewelers need an AML program?

More guides

• AML requirements for jewelers: the full overview
• Do jewelers need an AML program?
• Form 8300 for jewelers: cash over $10,000
• Buying gold from the public: the $50,000 rule
• Independent testing for jewelers

Sources

• 31 CFR 1027.210: Anti-money laundering programs for dealers in precious metals, precious stones, or jewels (eCFR)
• 31 CFR Part 1027: Rules for Dealers in Precious Metals, Precious Stones, or Jewels (eCFR)
• 31 CFR 1010.330: Reports relating to currency in excess of $10,000 (eCFR)
• FinCEN: Anti-Money Laundering Programs for Dealers in Precious Metals, Stones, or Jewels, interim final rule (2005)
• Office of Foreign Assets Control (OFAC)

This guide summarizes federal rules as of the date above. State law and your own facts may add requirements. It isn't legal advice, so talk to a qualified attorney about your situation.