FinCEN Proposes Rule to Fundamentally Reform Financial Institution AML/CFT Programs

If your institution is a bank, credit union, money services business, casino, loan or finance company, or other BSA-regulated entity, your approach to AML/CFT compliance is about to change fundamentally. On April 7, 2026, FinCEN issued a Notice of Proposed Rulemaking (NPRM) proposing the most significant overhaul of Bank Secrecy Act program requirements in decades. The same day, the OCC, FDIC, and NCUA issued a joint proposal to implement these changes for the institutions they supervise. The public comment period closes June 9, 2026. As proposed, institutions would be required to comply 12 months after a final rule is issued.

NETBankAudit experts have over 25 years of experience in BSA/AML program design, audit, and regulatory response. If you have questions about the proposed rule or how to prepare, please contact our team.

Why This Reform Is Happening: The Policy Shift

This proposal marks a fundamental philosophical shift in how regulators view AML/CFT compliance: away from check-the-box, process-driven compliance and toward program effectiveness and institutional judgment. The reform is consistent with the direction from Treasury and banking agency leadership to focus on material risk, deprioritize technical and procedural requirements, and allow financial institutions to define,  based on their own risk assessment,  what "good" looks like and allocate resources accordingly.

FDIC Chairman Travis Hill, in a statement specifically supporting the BSA program reform proposal, stated that the proposal "embraces a risk-based approach to supervision and would affirmatively encourage banks to allocate resources away from lower risk activities and toward higher risk activities." He emphasized that the proposal seeks to avoid penalizing banks for "foot faults" or approaching examinations as "box checking" exercises, and focuses instead on better aligning regulation with risk. The proposal has broad interagency alignment,  FinCEN, OCC, FDIC, and NCUA are all behind it.

This proposal is also directly connected to the concurrent stablecoin AML/CFT rule. The program requirements being proposed for stablecoin issuers are intentionally designed to mirror this broader BSA reform, creating a unified compliance framework across traditional and digital asset financial institutions. Both NPRMs were published in the same Federal Register edition on the same day,  together representing the most sweeping restructuring of the U.S. AML/CFT regulatory architecture in a generation.

Who Is Affected?

This is not a narrow or sector-specific rule. It applies to virtually the full universe of BSA-regulated entities:

• Banks (all OCC-supervised national banks and FDIC-supervised state banks)
• Credit unions (NCUA-supervised)
• Money services businesses (MSBs)
• Credit card issuers
• Casinos
• Loan and finance companies
• Certain insurance companies

For more information, read FinCEN’s Fact Sheet on the Rule. OCC-supervised institutions should also review OCC Bulletin 2026-11 and the accompanying joint agency news release (nr-ia-2026-25a) for institution-specific implementing guidance.

The Core Changes: What Is Actually Changing?

‍

1. Compliance Focus Shifts from Adequacy to Effectiveness

The most significant change in this proposal is the replacement of the prior "adequate program" standard with a focus on program effectiveness. As proposed:

• Financial institutions would still be required to maintain AML programs with the core existing elements,  the program structure is not abolished.
• Examiners would focus on whether programs are operating effectively, not whether every procedural box is checked.
• Significant enforcement actions would be tied to "material" or "systemic" failures, not isolated or technical violations. Minor, technical, or isolated program gaps would no longer trigger the same regulatory consequences they previously could.

2. Risk Assessments Become the Foundation of Everything

Under the proposal, the risk assessment is no longer primarily a documentation exercise. It becomes the foundation for decisions on monitoring, staffing, governance, and escalation. As proposed, institutions would be required to have risk assessment processes that:

1. Comprehensively evaluate AML risks across all relevant products and services
2. Review and incorporate FinCEN's AML/CFT National Priorities
3. Be updated whenever material changes occur that impact risk

Compared to FinCEN's 2024 proposal,  which was prescriptive about risk assessment design, frequency, and scope,  the 2026 proposal grants institutions substantially more discretion over all three. Institutions can determine the design, frequency, and scope themselves, provided those decisions are reasonable and tied to demonstrable risk. Institutions should also ensure their risk assessments integrate feedback sourced from law enforcement and courts, and that this feedback informs how tools and controls are designed.

3. Greater Flexibility in Program Design and Resource Allocation

The proposal's deference to institutional judgment creates an explicit opportunity to shift resources away from lower-value, process-driven activities and toward the highest-risk areas. Practical reallocation opportunities include AI and machine learning tools, blockchain analytics, advanced data integration, automated alert triage, case management automation, and lower-risk SAR filing automation.

4. New Coordination Requirement Before Significant Enforcement Actions

As proposed, before taking a significant AML-related supervisory action, banking regulators,  OCC, FDIC, NCUA, and others,  would be required to notify FinCEN at least 30 days in advance and provide an opportunity for FinCEN input. This mechanism did not previously exist. It centralizes AML enforcement coordination through FinCEN and reduces the risk of inconsistent supervisory actions across agencies.

5. Clarified and Limited Role for Independent Testing

Internal audit or external testing functions would be expected to assess whether the AML program is established and maintained using objective criteria. The proposal explicitly states that auditors should not substitute their subjective judgment in place of the financial institution's own risk-based decisions, and should not challenge underlying risk or program design decisions. This is a meaningful protection: audit findings that question risk strategy rather than program execution will carry weaker regulatory weight.

6. Responsible Innovation Explicitly Encouraged

As proposed, FinCEN would encourage financial institutions to use innovative technologies,  including AI, machine learning, and blockchain analytics,  as part of their AML programs. Firms that responsibly experiment with innovation would not incur additional enforcement risk. This is a direct green light for technology investment in compliance programs.

What Does Not Change

• The core AML program elements remain required, the program structure is not abolished
• SAR filing obligations and existing suspicious activity identification and reporting requirements remain
• BSA recordkeeping and Travel Rule requirements remain in effect
• FinCEN's AML/CFT National Priorities must still be reviewed and incorporated into risk assessments
• Fraud detection obligations are unchanged

What Compliance Professionals Should Do: A Planning Framework

Because the compliance deadline is tied to final rule issuance,  which has not yet occurred,  a precise three-date action plan is not possible. The planning framework below uses the comment deadline and final rule milestone as anchors.

Before June 9, 2026 (Comment Period)

• Review the proposed rule and the OCC's implementing bulletin (OCC Bulletin 2026-11) in detail. Assess how the proposed changes would affect your institution's current AML program, risk assessment process, staffing, and technology.
• Identify areas where the proposal creates operational opportunity,  specifically where lower-value, high-burden activities could be deprioritized,  and areas where program gaps would need to be addressed.
• Submit comments to FinCEN highlighting any ambiguities, implementation challenges, or areas where further clarity is needed, particularly around the effectiveness standard, the audit independence provisions, and the coordination requirement.
  

While Awaiting the Final Rule

• Begin gap analysis of your current AML program against the proposed effectiveness standard. Map your existing risk assessment framework against the proposed requirements: Does it comprehensively cover all products and services? Does it incorporate the National Priorities? Is it updated when risk changes materially?
• Engage second-line functions and internal audit early. The proposal shifts more responsibility to institutional judgment,  your second line needs to be capable of overseeing and defending those judgments, and your audit function needs to understand the new boundaries of its role.
• Evaluate technology investment opportunities. The proposal's deference to institutional decisions makes tool investment more defensible than ever. Assess AI/ML monitoring, blockchain analytics, and alert automation against your risk profile.
  

12 Months After Final Rule Issuance (Compliance Deadline)

• Finalize a risk assessment framework that is documented, governed, and demonstrably tied to program design decisions.
• Ensure your independent testing function is operating within the new boundaries,  assessing program execution against objective criteria, not substituting judgment on risk strategy.
• Deemphasize and formally document the deprioritization of high-burden, low-value activities, replacing them with risk-justified resource allocation that can be defended to examiners.
• Confirm board engagement,  risk-based decisions made under the new flexibility standard must be credible, documented, and defensible to oversight functions.

Key Takeaways for Compliance Professionals

• The proposal replaces the "adequate program" standard with an effectiveness standard,  the most important conceptual shift compliance professionals need to internalize.
• Risk assessments become the operational backbone of every AML program decision: monitoring design, staffing, governance, escalation, and technology investment all flow from them.
• The 2026 proposal is significantly more flexible than FinCEN's 2024 proposal on risk assessment design, frequency, and scope; institutions that built programs anticipating the 2024 version should reassess.
• Internal audit's role is being narrowed: auditors should evaluate program execution against objective criteria, not challenge risk strategy or program design decisions.
• Before June 9, 2026, use the comment period to flag ambiguities,  this is a proposed rule, and the final version will be shaped by what regulated institutions say now.

Building a modern, risk-based AML/CFT program under this new framework requires deep expertise in risk assessment design, governance structure, technology evaluation, and audit readiness. NETBankAudit's team is equipped to help your institution conduct gap analysis against the proposed effectiveness standard, validate your risk assessment framework, strengthen second-line oversight, and prepare for the new era of AML/CFT supervision. Contact NETBankAudit to discuss your institution's needs.