meta_id 3041479

On April 7, 2026, the Financial Crimes Enforcement Network (FinCEN) issued a notice of proposed rulemaking (NPRM) intended to reform financial institutions’ anti-money laundering and countering the financing of terrorism (AML/CFT) programs under the Bank Secrecy Act (BSA). According to FinCEN, the proposed rule introduces a number of key reforms to AML/CFT program compliance and supervision, including, but not limited to: refocuses compliance obligations and expectations on effectiveness by distinguishing between deficiencies stemming from program design and implementation; empowers financial institutions to devote more attention and resources toward higher risks rather than toward lower risks; clarifies expectations related to certain program requirements and functions—including independent testing and audit functions—to ensure that examiners and auditors do not substitute their subjective judgment in place of financial institutions’ risk-based and reasonably designed AML/CFT programs; and affirms FinCEN’s central role in AML/CFT supervision, including through the introduction of a notice and consultation framework between Federal banking supervisors and FinCEN with respect to significant AML/CFT supervisory actions. Key features of the proposed rule include: Establish vs. Maintain Requirement: The proposed rule would require financial institutions to both establish and maintain effective AML/CFT programs, making clear that compliance involves not just creating a program but also implementing it in practice. Risk-Based Program Design: The rule would require institutions to adopt a risk-based approach, meaning they must develop internal policies, procedures, and controls that are tailored to their specific money laundering and terrorist financing risks. These risk assessments must incorporate regulatory priorities and be updated whenever the institution’s risk profile changes. Core Program Components: The AML/CFT program would need to include core components, such as ongoing employee training, independent testing of the program, and the designation of a responsible compliance officer located in the United States who is accessible to regulators. Ongoing Program Updates: The proposal emphasizes that AML/CFT programs must be continuously updated, not treated as one-time efforts. If an institution fails to revise its program in response to significant risk changes, it may be considered noncompliant even if the program was originally adequate. Implementation: A key change in the rule is the explicit distinction between failing to establish a program and failing to implement it properly. This distinction is intended to clarify expectations and guide supervisory and enforcement actions. Higher Threshold for Enforcement: For banks, the rule would raise the threshold for enforcement actions based on implementation issues, so that only significant or systemic failures (rather than minor or technical deficiencies) would trigger major supervisory or enforcement responses. Expanded FinCEN Oversight: The rule would expand FinCEN’s role in supervision by requiring regulatory agencies to consult with FinCEN before taking significant supervisory actions and to provide advance notice, allowing FinCEN to review and offer input. Resource Allocation: Regulators would evaluate whether institutions are allocating resources appropriately based on their risk assessments and whether they are addressing known gaps that could undermine the effectiveness of their AML/CFT programs. According to FinCEN's press release announcing the NPRM, the proposed rule would revise FinCEN’s regulations to reflect statutory changes made by the Anti-Money Laundering Act of 2020 . The proposed revision of AML/CFT programs fully supersedes a prior proposed rule FinCEN published on July 3, 2024, and FinCEN is withdrawing that proposed rule. Public comments on the proposed rule must be received within 60 days after publication of the NPRM in the Federal Register. Comments may be submitted electronically at https://www.regulations.gov/ or mailed to the following address: Regulatory and Strategic Affairs Division, Financial Crimes Enforcement Network, P.O. Box 39, Vienna, VA 22183.  Refer to Docket Number FINCEN-2026-0034 and RIN 1506-AB72.