# Anti-Money Laundering and Countering the Financing of Terrorism Programs

> Briefs, arguments, decisions, and more.

URL: https://www.frixlaw.com/law-library/documents/fr%3A2026-07033

## Record

- **Collection:** Federal Register
- **Document type:** Proposed Rule
- **Published:** April 10, 2026
- **Citation:** 91 FR 18704

## Text

DEPARTMENT OF THE TREASURY
Financial Crimes Enforcement Network
31 CFR Parts 1010, 1020, 1021, 1022, 1023, 1024, 1025, 1026, 1027, 1028, 1029, and 1030
RIN 1506-AB72
Anti-Money Laundering and Countering the Financing of Terrorism Programs

AGENCY:

Financial Crimes Enforcement Network (FinCEN), Treasury.

ACTION:

Proposed rule.

SUMMARY:

Pursuant to the Department of the Treasury (Treasury) and FinCEN's efforts to modernize the Bank Secrecy Act (BSA) and to implement provisions of the Anti-Money Laundering Act of 2020 (AML Act), FinCEN is proposing a rule to fundamentally reform the requirements for financial institutions' anti-money laundering and countering the financing of terrorism (AML/CFT) programs. Among other changes, this proposed rule aims to ensure that financial institutions establish and maintain effective AML/CFT programs that better achieve the purposes of the BSA and lead to more effective outcomes for financial institutions as well as law enforcement and national security agencies. Through this rulemaking, consistent with its statutory authority as the administrator of the BSA, FinCEN is also proposing measures to modernize and reform Federal supervision of AML/CFT programs by enhancing FinCEN's role in AML/CFT supervision and enforcement in coordination with Federal banking regulators. In addition, FinCEN is proposing regulatory amendments to promote clarity and consistency across FinCEN's program rules for different types of financial institutions.

DATES:

Comments must be received by June 9, 2026.

ADDRESSES:

Comments must be submitted in one of the following two ways (please choose only one of the ways listed):

• Electronically at
https://www.regulations.gov.
Follow the “Submit a comment” instructions. If you are reading this document on
federalregister.gov,
you may use the green “SUBMIT A PUBLIC COMMENT” button beneath this rulemaking's title to submit a comment to the
regulations.gov
docket. Refer to Docket Number FINCEN-2026-0034 and RIN 1506-AB72.

•
You may mail written comments to the following address:
Regulatory and Strategic Affairs Division, Financial Crimes Enforcement Network, P.O. Box 39, Vienna, VA 22183. Refer to Docket Number FINCEN-2026-0034 and RIN 1506-AB72. Mailed comments must be received by the close of the comment period.

Do not include any personally identifiable information (such as name, address, or other contact information) or confidential business information that you do not want publicly disclosed. All comments are public records; they are publicly displayed exactly as received, and will not be deleted, modified, or redacted. Comments may be submitted anonymously.

Follow the search instructions on
https://www.regulations.gov
to view public comments. In accordance with 5 U.S.C. 553(b)(4), a summary of this rule may be found at
www.regulations.gov
under Docket FINCEN-2026-0034.

FOR FURTHER INFORMATION CONTACT:

The FinCEN Regulatory Support Section at
www.fincen.gov/contact.

SUPPLEMENTARY INFORMATION:

I. Scope

The proposed rule would amend FinCEN's regulations that prescribe anti-money laundering program requirements for financial institutions (AML program rules)
1

under the BSA.
2

For purposes of the AML program rules and this proposed rule, “financial institutions” are: (1) banks; (2) casinos and card clubs (casinos); (3) money services businesses (MSBs); (4) brokers or dealers in securities (broker-dealers); (5) mutual funds; (6) insurance companies; (7) futures commission merchants (FCMs) and introducing brokers in commodities (IBCs); (8) dealers in precious metals, precious stones, or jewels (DPMSJs); (9) operators of credit card systems; (10) loan or finance companies; and (11) housing government sponsored enterprises (housing GSEs).

1
When referring to the existing program rules, the term “AML program rules” is used; when referring to the requirements that this NPRM is proposing, the term “AML/CFT program rules” is used.

2
Certain parts of the Currency and Foreign Transactions Reporting Act, its amendments, and the other statutes relating to the subject matter of that Act, have come to be referred to as the BSA. These statutes are codified at 12 U.S.C. 1829b, 12 U.S.C. 1951-1960, and 31 U.S.C. 5311-5314 and 5316-5336 and notes thereto, with implementing regulations at 31 CFR chapter X. Certain criminal statutes—namely, 18 U.S.C. 1956, 1957, and 1960—are included in the BSA definition at 31 CFR 1010.100(e). Section 6003 of the AML Act, however, does not include these provisions in its BSA definition, and thus FinCEN is not considering them part of the BSA for the purposes of this proposed rule. The AML program rules are located at 31 CFR 1020.210 (banks), 1021.210 (casinos), 1022.210 (MSBs), 1023.210 (broker-dealers), 1024.210 (mutual funds), 1025.210 (insurance companies), 1026.210 (FCMs and IBCs), 1027.210 (DPMSJs), 1028.210 (operators of credit card systems), 1029.210 (loan or finance companies), and 1030.210 (housing GSEs). FinCEN notes this proposed rule does not propose any amendments to the final rule establishing AML/CFT and suspicious activity report (SAR) filing requirements for registered investment advisers and exempt reporting advisers, which has been delayed until January 1, 2028.
See
FinCEN,
Delaying the Effective Date of the Anti-Money Laundering/Countering the Financing of Terrorism Program and Suspicious Activity Report Filing Requirements for Registered Investment Advisers and Exempt Reporting Advisers Final Rule,
91 FR 36 (Jan. 2, 2026).

II. Background

A. Anti-Money Laundering Programs Under the Bank Secrecy Act

Enacted in 1970 and amended several times since, the BSA is designed to combat money laundering, the financing of terrorism, and other illicit finance activity risks
3

(collectively, ML/TF risks).
4

Congress has authorized the Secretary of the Treasury (Secretary) to administer the BSA. The Secretary has in turn delegated the authority to implement, administer, and enforce compliance with the BSA and its associated regulations to the Director of FinCEN (Director).
5

3
As defined in section 281(5) of the Countering America's Adversaries Through Sanctions Act, the term “illicit finance” means “the financing of terrorism, narcotics trafficking, or proliferation, money laundering, or other forms of illicit financing domestically or internationally, as defined by the President.” Public Law 115-44 (Aug. 2, 2017).

4
31 U.S.C. 5311.

5
Treasury Order 180-01 (Jan. 14, 2020), para. 3,
https://home.treasury.gov/about/general-information/orders-and-directives/treasury-order-180-01; see also
31 U.S.C. 310(b)(2)(I) (providing that the Director of FinCEN shall “[a]dminister the requirements of subchapter II of chapter 53 of this title, chapter 2 of title I of Public Law 91-508, and section 21 of the Federal Deposit Insurance Act, to the extent delegated such authority by the Secretary.”).

Since its original enactment, Congress has continued to address various aspects of AML/CFT compliance, including through expansion of the BSA.
6

In 1992, the Annunzio-Wylie Anti-Money Laundering Act
7

gave the Secretary authority to prescribe minimum standards for AML programs, including: “(A) the development of

internal policies, procedures, and controls, (B) the designation of a compliance officer, (C) an ongoing employee training program, and (D) an independent audit function to test programs”—what are often called the “four pillars” of AML programs.
8

Later, the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act) further amended the BSA to include, among other things, customer identification program (CIP) requirements and the expansion of AML program rules to cover certain other financial industry participants (
e.g.,
credit unions and FCMs).
9

The USA PATRIOT Act also made it mandatory for financial institutions to maintain AML programs that meet minimum prescribed standards.
10

Through the exercise of its delegated authority, FinCEN is authorized to require each financial institution to establish an AML program to ensure compliance with the BSA and guard against ML/TF risks.
11

Over time, FinCEN incorporated these standards into the AML program rules and implemented additional requirements for certain covered financial institutions, such as customer due diligence (CDD) requirements (sometimes referred to as the “fifth pillar” of AML programs).
12

6
Most recently, Congress enacted the Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act on July 18, 2025. Public Law 119-27,
codified at
12 U.S.C. 5901
et seq.
The GENIUS Act requires that permitted payment stablecoin issuers be treated as financial institutions for purposes of the BSA including being required to maintain “an effective anti-money laundering program.”
See
12 U.S.C. 5903(a)(5)(A)(i). The GENIUS Act also requires the Agencies to issue regulations relating to PPSIs, including regulations pertaining to BSA compliance standards. 12 U.S.C. 5903(a)(4)(iv). These AML/CFT requirements and standards for PPSIs are addressed separately from this rulemaking.

7
Section 1517 of the Annunzio-Wylie Anti-Money Laundering Act, Public Law 102-550, 106 Stat. 3672 (Oct. 28, 1992).

8
31 U.S.C. 5318(h)(1), as added by section 1517(b) of the Annunzio-Wylie Anti-Money Laundering Act, Public Law 102-550 (Oct. 28, 1992). FinCEN notes the proposed rule sequences these AML/CFT program components—the four pillars—in the order of the existing AML program rule for banks, rather than the order used in 31 U.S.C. 5318(h)(1): namely, (i) a system of internal controls to assure ongoing compliance; (ii) independent testing for compliance to be conducted by bank personnel or by an outside party; (iii) designation of an individual or individuals responsible for coordinating and monitoring day-to-day compliance; and (iv) training for appropriate personnel.
See
31 CFR 1020.210(a)(2). FinCEN, however, does not intend the change in sequencing to modify or signify changes in any substantive requirements.

9
31 U.S.C. 5312(a)(2)(E) and 31 U.S.C. 5312(c), as added by section 321 of the USA PATRIOT Act, Public Law 107-56, 115 Stat. 272 (Oct. 26, 2001).

10
31 U.S.C. 5318(h), as added by section 352 of the USA PATRIOT Act, Public Law 107-56, 115 Stat. 272 (Oct. 26, 2001).

11
31 U.S.C. 5318(a)(2), (h)(1), (h)(2);
supra
note 5

12

See
FinCEN,
Customer Due Diligence Requirements for Financial Institutions,
81 FR 29398 (May 11, 2016).

On January 1, 2021, Congress enacted the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 (FY21 NDAA), of which the AML Act was a component.
13

With the passage of the AML Act, Congress stated that it was seeking to modernize and strengthen the AML/CFT regulatory framework, which “had not seen comprehensive reform or modernization” since the BSA was enacted in the 1970s.
14

Among other objectives, Congress intended for the AML Act to require “more routine and systemic coordination, communication, and feedback among financial institutions, regulators, and law enforcement to identify suspicious financial activities, better focusing bank resources to the AML task, which will increase the likelihood for better law enforcement outcomes.”
15

13
William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, Public Law 116-283, 134 Stat. 3388 (Jan. 1, 2021).

14
Congress noted in its Joint Explanatory Statement of the Committee of Conference accompanying the FY21 NDAA that: “the current [AML/CFT] regulatory framework is an amalgamation of statutes and regulations that are grounded in the [BSA], which the Congress enacted in 1970. This decades-old regime, which has not seen comprehensive reform and modernization since its inception, is generally built on individual reporting mechanisms (
i.e.,
currency transaction reports (CTRs) and SARs) and contemplates aging, decades-old technology, rather than the current, sophisticated AML compliance systems now managed by most financial institutions.” Congress further stated that the AML Act “comprehensively update[s] the BSA for the first time in decades and provide[s] for the establishment of a coherent set of risk-based priorities.” Among other objectives, Congress intended for the AML Act to require “more routine and systemic coordination, communication, and feedback among financial institutions, regulators, and law enforcement to identify suspicious financial activities, better focusing bank resources to the AML task, which will increase the likelihood for better law enforcement outcomes.” H.R. Rep. No. 6395 (2020) at pp. 731-732 (Joint Explanatory Statement of the Committee of Conference).

15
H.R. Rep. No. 6395 (2020) at pp. 731-732 (Joint Explanatory Statement of the Committee of Conference).

Section 6101(b) of the AML Act made several changes to the BSA's AML/CFT program requirements.

First, section 6101(b) amended the BSA at 31 U.S.C. 5318(h)(2)(B) to state that, “[i]n prescribing the minimum standards [for AML/CFT programs], and in supervising and examining compliance with those standards, the Secretary of the Treasury, and the appropriate Federal functional regulator (as defined in section 509 of the Gramm-Leach-Bliley Act)
16

shall take into account” certain factors, which are further described in section IV.A.

16
15 U.S.C. 6809(2).

Second, section 6101(b) requires the Secretary, in consultation with the Attorney General, appropriate Federal functional regulators, relevant State financial regulators, and relevant national security agencies, to establish and make public government-wide AML/CFT priorities (AML/CFT Priorities). After consultation with the Federal functional regulators and relevant State financial regulators, the Secretary must promulgate regulations, as appropriate, to incorporate those priorities into revised program rules, and incorporation of the priorities must be included as a measure on which financial institutions are supervised and examined. FinCEN issued the first AML/CFT Priorities on June 30, 2021.
17

17

See
FinCEN, AML/CFT Priorities (June 30, 2021). As required by 31 U.S.C. 5318(h)(4)(C), the AML/CFT Priorities are consistent with Treasury's National Strategy for Combating Terrorist and Other Illicit Financing (May 16, 2024) and supported by Treasury's National Risk Assessments on Money Laundering, Terrorist Financing, and Proliferation Financing.
See
U.S. Department of the Treasury, 2026 National Money Laundering Risk Assessment (March 2026),
https://home.treasury.gov/system/files/246/2026-NMLRA.pdf;
2026 National Terrorist Financing Risk Assessment (March 2026),
https://home.treasury.gov/system/files/246/2026-NTFRA.pdf;
2026 National Proliferation Financing Risk Assessment (March 2026),
https://home.treasury.gov/system/files/246/2026-NPFRA.pdf.
As also required by 31 U.S.C. 5318(h)(4)(B), the Secretary, in consultation with the Attorney General, Federal functional regulators, relevant State financial regulators, and relevant national security agencies, must update the AML/CFT Priorities not less frequently than once every four years.

Third, section 6101(b) expands the BSA's program rule requirement to formally include an express reference to CFT in addition to AML.

Fourth, section 6101(b) provides that the duty to establish, maintain, and enforce an AML/CFT program shall remain the responsibility of, and be performed by, persons in the United States who are accessible to, and subject to, oversight and supervision by, the Secretary and the appropriate Federal functional regulator.

B. FinCEN's Effectiveness Advance Notice of Proposed Rulemaking (ANPRM)

Prior to the enactment of the AML Act, and as informed by the recommendations of the AML Effectiveness Bank Secrecy Act Advisory Group working group, FinCEN published an ANPRM seeking public comment on potential regulatory amendments to increase the effectiveness of the current program rules (Effectiveness ANPRM).
18

The Effectiveness ANPRM sought public comment on a number of issues, including whether FinCEN should define an effective and reasonably designed AML program as one that: (1) identifies, assesses, and reasonably mitigates the risks resulting from illicit financial activity, including terrorist financing, money laundering, and other related financial crimes, consistent with both the institution's risk profile and the risks communicated by relevant government authorities as national AML

priorities; (2) assures and monitors compliance with the recordkeeping and reporting requirements of the BSA; and (3) provides information with a high degree of usefulness to government authorities consistent with both the financial institution's risk assessment and the risks communicated by relevant government authorities as national AML priorities.
19

18
FinCEN,
Anti-Money Laundering Program Effectiveness,
85 FR 58023 (Sept. 17, 2020).

19
85 FR 58026.

Additionally, the Effectiveness ANPRM sought comment on whether FinCEN should amend its regulations to explicitly require financial institutions to implement risk assessment processes and whether FinCEN should publish AML priorities that financial institutions would incorporate into their risk assessments.
20

Congress enacted the AML Act shortly after FinCEN received comments on the Effectiveness ANPRM. As a result, many of the Effectiveness ANPRM's proposals have been superseded by statutory amendments.

20

Id.

FinCEN received 111 comments in response to the Effectiveness ANPRM, many of which generally supported the goals underlying the ANPRM. Some comments covered specific topics that would later be addressed in section 6101 of the AML Act and that are related to the proposed rule. For example, many commenters supported the Effectiveness ANPRM's concepts of effective and reasonably designed AML programs. Commenters further noted that prioritizing and allocating resources can be challenging if there is regulatory ambiguity or if examiner expectations are unclear or inconsistent, and that requirements for effective and reasonably designed programs should be tailored based on a financial institution's size, activities, or other characteristics. Finally, commenters expressed widespread concern about added burden on financial institutions, especially burden related to updating AML programs to incorporate national AML priorities.

C. The 2024 Notice of Proposed Rulemaking Revising AML Programs

1. Summary of 2024 Program Notice of Proposed Rulemaking (NPRM)

On July 3, 2024, FinCEN published an NPRM proposing revisions to AML/CFT program requirements (2024 Program NPRM).
21

In issuing that proposed rule, FinCEN consulted with the Federal functional regulators, the Internal Revenue Service (IRS), and relevant State financial regulators, as required under section 6101(b) of the AML Act. Additionally, on August 9, 2024, the Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System (FRB), the Federal Deposit Insurance Corporation (FDIC), and the National Credit Union Administration (NCUA) (collectively, the “Agencies”)
22

issued an NPRM proposing amendments to their respective AML program rules applicable to the financial institutions they regulate.
23

21
FinCEN,
Anti-Money Laundering and Countering the Financing of Terrorism Programs,
89 FR 55428 (July 3, 2024).

22
As discussed below, these Federal agencies are also known as the Federal Financial Institutions Regulatory Agencies (FFIRAs) and proposed 1010.100(ooo) defines these agencies using this term. However, this preamble uses the term “Agencies” to refer to the FFIRAs.

23
FRB, FDIC, NCUA, and OCC,
Anti-Money Laundering and Countering the Financing of Terrorism Program Requirements,
89 FR 65242 (Aug. 9, 2024).

The 2024 Program NPRM proposed that financial institutions establish AML/CFT programs that would include, at minimum, the following components: (1) a risk assessment process; (2) reasonable management and mitigation of illicit finance risks through internal policies, procedures, and controls; (3) a qualified AML/CFT officer; (4) an ongoing employee training program; (5) independent, periodic testing conducted by qualified personnel of the financial institution or by a qualified outside party; and (6) other requirements (such as customer due diligence) depending on the type of financial institution.

The 2024 Program NPRM further proposed that financial institutions would be expected to base their AML/CFT program on the results of a risk assessment process. The risk assessment process would identify, evaluate, and document a financial institution's ML/TF risks, taking into account the following considerations: (1) the AML/CFT Priorities issued by FinCEN, as appropriate; (2) the ML/TF risks of the financial institution based on the institution's business activities, including products, services, distribution channels, customers, intermediaries, and geographic locations; and (3) reports filed by the financial institution pursuant to FinCEN's regulations at 31 CFR chapter X. Additionally, the 2024 Program NPRM provided that financial institutions would have to review and update their risk assessments on a periodic basis, including, at a minimum, when there are material changes to a financial institution's illicit finance risks.

The 2024 Program NPRM would have also required a financial institution's AML/CFT program to be approved and overseen by the financial institution's board of directors (board) or equivalent governing body and would have made AML/CFT program approval and oversight requirements consistent across financial institution types. Furthermore, the 2024 Program NPRM reflected the requirement in the BSA, as amended by the AML Act, that the duty to establish, maintain, and enforce a financial institution's AML/CFT program shall remain the responsibility of, and be performed by, persons in the United States who are accessible to, and subject to oversight and supervision by, the Secretary and the appropriate Federal functional regulator.

FinCEN does not intend to finalize the 2024 Program NPRM, and it should be considered withdrawn and superseded by this proposed rule.

2. Comments FinCEN Received on the 2024 Program NPRM

In response to the 2024 Program NPRM, FinCEN received 86 comments from the public. Submissions came from a broad array of individuals and organizations, including members of Congress, the financial industry and related trade associations, groups representing small business interests, corporate transparency advocacy groups, regulatory associations, legal associations, and other interested groups and individuals.

A small number of commenters expressed support for the 2024 Program NPRM's effort to modernize and strengthen AML/CFT programs in line with the reform goals of the AML Act. Some supporters of the 2024 Program NPRM agreed with its emphasis on “effective, risk-based, and reasonably designed” AML/CFT programs that would promote “effectiveness, efficiency, innovation, and flexibility.”
24

Others commended FinCEN's efforts to emphasize the risk-based nature of AML/CFT programs and provide financial institutions with the flexibility to provide financial services based on their risk profile and capacity to manage customer relationships.

24
89 FR 55430.

Commenters also expressed concerns with the 2024 Program NPRM, such as the proposed program requirements being excessively prescriptive and even redundant in light of the view that existing AML/CFT compliance programs were already intended to be risk-based. A number of commenters found the proposal to be an additive regulatory imposition that would increase costs and burdens, particularly to smaller financial institutions, without

any increase in program effectiveness, efficiency, or innovation.

On behalf of FinCEN, Treasury's Office of Tribal and Native Affairs (OTNA) also solicited comments and conducted Tribal consultations and coordination with Tribal Nations. OTNA received six comments from Tribal representatives during this process.

Taken together, the comments submitted to the Effectiveness ANPRM and 2024 Program NPRM provide helpful context that FinCEN has considered in developing the current NPRM.

i. Risk-Based Resource Allocation

The 2024 Program NPRM proposed a formulation of risk-based resource allocation as follows: “an effective, risk-based, and reasonably designed AML/CFT program focuses attention and resources in a manner consistent with the bank's risk profile that takes into account higher risk and lower-risk customers and activities.”
25

Commenters criticized this formulation of risk-based resource allocation in the NPRM and generally stated that this framing would not sufficiently enable financial institutions to reallocate resources in the manner intended by the AML Act by allowing financial institutions to direct more resources toward higher-risk customers and activity rather than lower-risk customers and activity, leaving open the concern that examiners may penalize financial institutions for doing so. Commenters strongly recommended that FinCEN adopt the statutory language from the AML Act concerning risk-based resource allocation. No commenters expressed support for the 2024 Program NPRM formulation.

25
89 FR 55436.

ii. The Risk Assessment Process

Commenters to the 2024 Program NPRM were critical of the proposed risk assessment process. Commenters generally supported the idea of a risk assessment process requirement in the NPRM, as many financial institutions already conduct risk assessments. Commenters argued, however, that the proposal was insufficiently deferential to existing risk assessment practices and would impose new compliance costs by creating an additive “check-the-box” exercise for financial institutions that already conduct risk assessments. Commenters also stated that financial institutions should not be required to consider BSA reports, including SARs and CTRs, as part of their risk assessment process, noting language in the AML Act stating that BSA filings should be guided by risk-based compliance programs, rather than the opposite.
26

Commenters also argued that even the idea of making the risk assessment process serve as the basis of the AML/CFT program would be too prescriptive and not correspond to the various ways financial institutions incorporate these assessments into their programs. Finally, commenters objected to the description of a risk assessment process as a singular process that implied a one-time, annual exercise whereas financial institutions conduct numerous and often continuous risk assessments throughout the year.

26
“Reports filed under this subsection shall be guided by the compliance program of a covered financial institution with respect to the Bank Secrecy Act, including the risk assessment processes of the covered institution that should include a consideration of priorities established by the Secretary of the Treasury under section 5318.” 31 U.S.C. 5318(g)(5)(C), as added by section 6202 of the AML Act.

iii. “Effective, Risk-Based, and Reasonably Designed” AML/CFT Programs

Commenters generally appreciated FinCEN's inclusion of the concept of “effective, risk-based, and reasonably designed” AML/CFT programs, but sought additional guidance on the meaning of these terms. Some commenters requested that FinCEN adopt specific regulatory definitions of these terms, while others requested principles or examples to clarify how FinCEN understands them. Several commenters urged that the final rule clarify that an “effective, risk-based, and reasonably designed” program does not mean one that is “perfect” and completely prevents financial crime.

iv. Other Provisions of the 2024 NPRM

Proposed § 1020.210(c) of the 2024 Program NPRM provided that “[t]he duty to establish, maintain, and enforce the AML/CFT program must remain the responsibility of, and be performed by, persons in the United States who are accessible to, and subject to oversight and supervision by, FinCEN and the appropriate Federal functional regulator,”
27

pursuant to the statutory requirement set forth in section 6101 of the AML Act.
28

Many commenters discussed this provision. They generally stated that an appropriate interpretation of this provision is critical for many financial institutions since many have AML/CFT staff and operations overseas, and it would be extremely costly and disruptive to require relocation to the United States. Many commenters requested that FinCEN interpret this provision to allow financial institutions to maintain staff and operations in non-U.S. jurisdictions so long as the person with the “duty to establish, maintain, and enforce the AML/CFT program” is located in the United States. Some commenters also requested clarification on how this provision would apply to financial institutions with third-party service providers located outside the United States.

27
89 FR 55485.

28
31 U.S.C. 5318(h)(5).

The 2024 Program NPRM also proposed requiring that a financial institution's board or an equivalent governing body approve and provide oversight of AML/CFT programs.
29

Commenters generally expressed reservations about the board approval and oversight provision of the NPRM. Some credit union commenters expressed concern that the requirement would impose significant new burdens on boards and noted that many credit union boards are volunteers. Commenters representing Native Tribes were most critical of the board oversight and approval requirement because of the potential impact on Tribal casinos and Tribal Councils. Several of these commenters stated that many Tribal gaming entities are not operated under the authority of a business board. Commenters expressed concern that the proposed rule may require Tribal Councils to approve and provide oversight of the AML/CFT program adopted by the casino, detracting from other responsibilities of the Tribal Council.

29
89 FR 55444.

v. Effective Date

The 2024 Program NPRM proposed that financial institutions would have six months from the date of issuance of the final rule to comply with its requirements. A large number of commenters reacted negatively to the six-month implementation period in the 2024 Program NPRM, and they were nearly unanimous in requesting additional time. Some commenters asked for at least one year after issuance of the final rule to implement the rule, and other commenters requested two or more years. Some commenters representing larger financial institutions cited the need for additional time to review the final rule, make technological changes or other changes to existing processes, incorporate the AML/CFT Priorities into their risk assessment processes, reallocate resources from lower- to higher-risk areas, and provide training.

III. BSA Modernization

The Secretary has identified BSA reform and modernization as one of Treasury's top priorities. In an April 2025 speech, the Secretary noted that Treasury “will advocate for changes to the AML/CFT framework to truly focus on national security priorities and higher-risk areas and explicitly permit financial institutions to de-prioritize lower risks.”
30

Additionally, the Secretary has noted that supervision of AML/CFT programs has too often involved a “zero-tolerance focus on process and documentation and wide latitude for supervisory expectations and judgments that are not always consistent with the law or our national security priorities.”
31

The Secretary noted that this proposed rule would ensure that financial institutions' AML/CFT programs are focused “on higher value activities [that] will also better serve our law enforcement and national security objectives.”
32

30
U.S. Department of the Treasury, Press Release, “Treasury Secretary Scott Bessent Remarks before the American Bankers Association” (Apr. 9, 2025),
https://home.treasury.gov/news/press-releases/sb0078.

31
U.S. Department of the Treasury, Press Release, “Remarks by Secretary of the Treasury Scott Bessent Before the Fed Community Bank Conference” (Oct. 9, 2025),
https://home.treasury.gov/news/press-releases/sb0276.

32

Id.

In June 2025, Treasury identified its guiding principles for BSA reform, recognizing the urgent need to modernize the implementation of the AML/CFT regime in the United States so that it is effective, risk-based, and focused on the greatest threats to financial institutions and national security.
33

Treasury's vision of a modernized BSA regulatory and supervisory regime is one where financial institutions:

33
U.S. Department of the Treasury, Press Release, “Deputy Secretary Faulkender Lays Out Guiding Principles for Bank Secrecy Act Modernization” (June 18, 2025),
https://home.treasury.gov/news/press-releases/sb0173.

• comply with AML/CFT laws and regulations;

• are examined for the risk-based and reasonably designed nature of their AML/CFT programs and set of internal policies, procedures, and controls;

• direct more resources to higher-risk areas rather than to lower-risk areas; and

• generate highly useful information for law enforcement and national security agencies in priority areas defined by Treasury.

Treasury and FinCEN, in coordination with the Agencies, have taken a number of steps to implement this vision of a modernized BSA regulatory and supervisory regime. In June and July 2025, the Agencies, with FinCEN's concurrence, issued an order permitting banks, as part of their CIP obligations, to collect Taxpayer Identification Number information from a third party rather than from the bank's customer.
34

In October 2025, FinCEN and the Agencies issued Frequently Asked Questions to clarify certain SAR obligations to help ensure financial institutions are not needlessly expending resources on efforts that do not provide law enforcement and national security agencies with the critical information they need to detect, combat, and deter criminal activity.
35

In February 2026, FinCEN issued an order granting exceptive relief to covered financial institutions from certain requirements under FinCEN's CDD Rule, supporting a more efficient, risk-based approach to customer due diligence and reducing unnecessary regulatory burden without weakening the foundational requirements that protect the U.S. financial system.
36

34
FinCEN,
FinCEN Permits Banks to Use Alternative Collection Method for Obtaining TIN Information
(June 27, 2025),
https://www.fincen.gov/news/news-releases/fincen-permits-banks-use-alternative-collection-method-obtaining-tin-information.

35
FinCEN,
FinCEN Issues Frequently Asked Questions to Clarify Suspicious Activity Reporting Requirements
(Oct. 9, 2025),
https://www.fincen.gov/news/news-releases/fincen-issues-frequently-asked-questions-clarify-suspicious-activity-reporting.

36
FinCEN,
FinCEN Issues Exceptive Relief to Streamline Customer Due Diligence Requirements
(Feb. 13, 2026),
https://www.fincen.gov/system/files/2026-02/FinCEN-Order-CCDExceptiveRelief.pdf.

In addition to advancing the goals of a modernized BSA regulatory and supervisory regime, Treasury and FinCEN have played a leading role in supporting Executive Order (E.O.) 14192,
Unleashing Prosperity Through Deregulation.
37

The E.O. announced an Administration policy to “significantly reduce the private expenditures required to comply with Federal regulations to secure America's economic prosperity and national security and the highest possible quality of life for each citizen” and “alleviate unnecessary regulatory burdens placed on the American people.”
38

Consistent with E.O. 14192, FinCEN is issuing this proposed rule to ensure that financial institutions' AML/CFT programs are appropriately risk-based, such that compliance with their program obligations is focused on the goals of the BSA, including combatting and preventing ML/TF, rather than mere technical compliance. Furthermore, the proposed rule for banks would help ensure that supervisory and enforcement actions related to AML/CFT programs are focused on significant or systemic failures to implement an effective AML/CFT program (
i.e.,
deficiencies or issues that arise from failing to implement, in all material respects, a properly established AML/CFT program). The proposal would also reflect FinCEN's key role, in accordance with its statutory authority as the administrator of the BSA, in ensuring a consistent and holistic approach to enforcement and supervision of banks' AML/CFT programs that focuses on program effectiveness rather than mere technical compliance. The Agencies have a long history of coordination with FinCEN in exercising its delegated supervisory authority, and FinCEN views this proposed rule as a way to further strengthen that relationship to promote more consistent supervision. FinCEN believes this enhanced coordination in AML/CFT supervision and enforcement will support the goals of E.O. 14192.

37
E.O. 14192,
Unleashing Prosperity Through Deregulation,
90 FR 9065 (issued Jan. 31, 2025; published Feb. 6, 2025).

38

Id.

Fulfilling the AML Act's goals of BSA modernization and reform is a priority for Treasury and FinCEN, and this proposed rule is a major part of that effort.

IV. Overview of the Proposed Rule

A central objective of Treasury and FinCEN's BSA modernization efforts is to create an AML/CFT supervisory and regulatory regime that is more effective in achieving the purposes of the BSA and promoting better outcomes for law enforcement and national security agencies.
39

This proposed rule would further that objective by explicitly defining the requirements for a financial institution to establish and maintain an effective AML/CFT program. It would also adopt into regulations the AML Act's expectation that AML/CFT programs should be risk-based, including ensuring that financial institutions direct more attention and resources toward higher-risk customers and activities, consistent with the risk profile of the financial institution, rather than toward lower-risk customers and activities.
40

39
31 U.S.C. 5311.

40
31 U.S.C. 5318(h)(2)(B)(iv)(II).

As noted in the previous section, the proposed rule would also revise the AML/CFT supervisory and examination process for banks by enhancing FinCEN's role in the supervision and enforcement process. In support of this objective, the proposed rule would establish a mechanism in which

FinCEN—as the statutory administrator of the BSA—has an opportunity to review and provide feedback to the Agencies prior to a significant supervisory action. This change will promote consistent approaches to AML/CFT supervision and better outcomes for both banks and the law enforcement and national security agencies that depend upon those financial institutions' critical BSA reporting.

A. Factors Rhat FinCEN Considered Pursuant to Section 6101(b)(2)(B) of the AML Act (31 U.S.C. 5318(h)(2)(B))

Section 6101(b)(2)(B)(ii) of the AML Act (codified at 31 U.S.C. 5318(h)(2)(B)) requires FinCEN to take into account certain factors when prescribing minimum AML/CFT program standards:

(i) Financial institutions are spending private compliance funds for a public and private benefit, including protecting the United States financial system from illicit finance risks.

(ii) The extension of financial services to the underbanked and the facilitation of financial transactions, including remittances, coming from the United States and abroad in ways that simultaneously prevent criminal persons from abusing formal or informal financial services networks are key policy goals of the United States.

(iii) Effective anti-money laundering and countering the financing of terrorism programs safeguard national security and generate significant public benefits by preventing the flow of illicit funds in the financial system and by assisting law enforcement and national security agencies with the identification and prosecution of persons attempting to launder money and undertake other illicit activity through the financial system.

(iv) Anti-money laundering and countering the financing of terrorism programs . . . should be—

(I) reasonably designed to assure and monitor compliance with the requirements of this subchapter and regulations promulgated under this subchapter; and

(II) risk-based, including ensuring that more attention and resources of financial institutions should be directed toward higher-risk customers and activities, consistent with the risk profile of a financial institution, rather than toward lower-risk customers and activities.

FinCEN has considered all of these factors in developing this proposed rule.

First, as required by 31 U.S.C. 5318(h)(2)(B)(i), FinCEN has considered that, through their AML/CFT programs, financial institutions are spending private compliance funds for a public and private benefit. The proposed rule reflects this in several ways—especially in how it endeavors to avoid imposing unnecessary regulatory burdens and ensuring that financial institutions are able to tailor their AML/CFT programs to their risk profiles. In this way, FinCEN seeks to ensure that financial institutions are not required to expend private compliance funds without meaningful benefit to both the public and their own operations.

Second, section 5318(h)(2)(B)(ii) requires FinCEN to consider the extension of financial services to the underbanked and the facilitation of financial transactions, including remittances, while preventing criminal persons from abusing formal or informal financial services networks. Through its emphasis on risk-based AML/CFT programs, the proposed rule seeks to provide financial institutions with the flexibility to serve a broad range of customers and avoid one-size-fits-all approaches to customer risk that can lead to financial institutions declining to provide financial services to entire categories of customers. The proposed rule would help ensure that decisions taken by financial institutions with respect to closing customer accounts are based on legitimate ML/TF risks and informed by relevant facts and circumstances. The proposed rule is intended to mitigate the risks of financial institutions potentially being inappropriately pressured into closing customer accounts by emphasizing the risk-based nature of AML/CFT programs. In doing so, the proposed rule also furthers the objectives of E.O. 14331,
Guaranteeing Fair Banking for All Americans,
which seeks to combat “politicized or unlawful debanking.”
41

41
E.O. 14331,
Guaranteeing Fair Banking for All Americans,
90 FR 38925 (issued Aug. 7, 2025; published Aug. 12, 2025).

Moreover, by establishing a risk-based AML/CFT program that takes into account a financial institution's specific business activities, the proposed rule will enable financial institutions to avoid debanking customers and extend financial services based on a financial institution's evaluation of the ML/TF risks and the financial institution's ability to manage those risks and customer relationships, among other considerations. This flexibility would allow such financial institutions to respond to changing circumstances and evolving risk profiles, including through the use of emerging technologies that support transparency and preserve privacy, which may deter debanking and enable financial institutions to reach underbanked individuals and facilitate financial transactions that simultaneously prevent criminal persons from abusing formal or informal financial services networks.

The proposed rule would also provide financial institutions with the ability to modernize their AML/CFT programs and to responsibly innovate while still managing ML/TF risks, as the financial services industry continues to innovate over time. Consistent with previous guidance,
42

FinCEN encourages financial institutions to manage customer relationships on a case-by-case basis, and the proposed rule would provide financial institutions with the framework to make such evaluations and provide financial services accordingly, without broad de-risking that can result in debanking that may increase the use of financial services that exist outside of the regulated financial system and complicate efforts to detect and deter illicit finance. FinCEN believes that effective AML/CFT programs are an important component in mitigating the effects of de-banking to national security and law enforcement interests.

42

See
FRB, FDIC, FinCEN, NCUA, and OCC,
Joint Statement on the Risk-Based Approach to Assessing Customer Relationships and Conducting Customer Due Diligence
(July 6, 2022),
https://www.fincen.gov/news/news-releases/joint-statement-risk-based-approach-assessing-customer-relationships-and.

Third, as stated in 31 U.S.C. 5318(h)(2)(B)(iii), effective AML/CFT programs safeguard national security and generate significant public benefits by preventing the flow of illicit funds in the financial system and by assisting law enforcement and national security agencies with the identification and prosecution of persons attempting to launder money or undertake other illicit activity through the financial system.
43

The proposed rule would advance the BSA modernization and reform goals of the AML Act by providing financial institutions and their regulators with clarity about the requirements to have effective AML/CFT programs.

43
31 U.S.C. 5318(h)(2)(B)(iii).

Likewise, 31 U.S.C. 5318(h)(2)(B)(iv)(I) provides that AML/CFT programs should be “reasonably designed to assure and monitor compliance” with the BSA and its implementing regulations and be risk-based. As described in more detail in section IV, the proposed rule advances these objectives by explicitly requiring financial institutions to have effective AML/CFT programs and by describing the minimum components for an AML/CFT program to be effective. Specifically, as part of an effective AML/CFT program, the proposed rule

requires that a financial institution establish and maintain a risk-based set of internal policies, procedures, and controls that is reasonably designed to ensure compliance with the BSA and FinCEN's regulations.

The internal policies, procedures, and controls requirement in the proposed rule also demonstrates FinCEN's consideration of 31 U.S.C. 5318(h)(2)(B)(iv)(II), which states that AML/CFT programs should be risk-based, including ensuring that more attention and resources of financial institutions should be directed toward higher-risk customers and activities, consistent with a financial institution's risk profile, rather than toward lower-risk customers and activities. While FinCEN has previously expected financial institutions to adopt risk-based AML/CFT programs, the proposed rule incorporates this directive by explicitly requiring, as part of an institution's risk-based set of internal policies, procedures, and controls, that an institution identify, assess, and document its ML/TF risks through risk assessment processes. These risk assessment processes require a financial institution to evaluate ML/TF risks and review and, as appropriate, incorporate the AML/CFT Priorities, with updates to risk assessment processes promptly upon any change that the financial institution knows or has reason to know significantly changes the financial institution's ML/TF risks. These risk assessment processes are designed to help financial institutions mitigate ML/TF risks and ensure that they are allocating resources commensurate with their documented ML/TF risks, directing more attention and resources toward higher-risk customers rather than toward lower-risk customers and activities.

B. Proposed Rule

As noted above, the proposed rule would require financial institutions to establish and maintain effective AML/CFT programs and define the requirements for doing so. In order for an AML/CFT program to be effective, the proposed rule would require a financial institution to
establish
an AML/CFT program and then
maintain
the AML/CFT program by implementing, in all material respects, the established AML/CFT program.

As described in more detail in section V.D., a financial institution would be required to establish a risk-based set of internal policies, procedures, and controls that is reasonably designed to ensure compliance with the BSA and 31 CFR chapter X. The risk-based set of internal policies, procedures, and controls must also be reasonably designed to: (1) identify, assess, and document the financial institution's ML/TF risks through risk assessment processes that evaluate the risks of the institution's business activities, review and, as appropriate, incorporate the AML/CFT Priorities, and are updated promptly upon any change that the financial institution knows or has reason to know significantly changes the institution's ML/TF risks; (2) mitigate the financial institution's ML/TF risks, consistent with the financial institution's risk assessment processes; and, for certain financial institutions, (3) conduct ongoing customer due diligence.

The proposed rule would also require a financial institution to establish an ongoing employee training program and independent AML/CFT program testing as part of its AML/CFT program. Finally, the proposed rule would require a financial institution to designate an individual responsible for establishing and implementing the AML/CFT program and coordinating and monitoring day-to-day compliance; that individual would be required to be located in the United States and accessible to, and subject to oversight and supervision by, FinCEN and its designee, including the appropriate Federal functional regulator.

Under the proposed rule, in addition to establishing an AML/CFT program, the financial institution would be required to maintain that program by
implementing,
in all material respects, its established AML/CFT program. By structuring the requirement to have an effective AML/CFT program as distinct obligations to establish and maintain (via implementation) an AML/CFT program, the proposed rule is intended to clarify and reinforce the distinction between failures to establish an AML/CFT program and failures to implement a properly established program.

The distinction between establishing a program and implementing a program is particularly important under the proposed rule for potential supervisory and enforcement actions. The proposed rule would not limit enforcement or supervisory actions for failures to
establish
an AML/CFT program. However, with respect to banks, once a bank has properly established an AML/CFT program, the proposed rule would raise the threshold for significant actions based solely on
implementation
deficiencies so only significant or systemic failures by a bank to implement an effective AML/CFT program (
i.e.,
deficiencies or issues that arise from failing to implement, in all material respects, a properly established AML/CFT program) would warrant an “AML/CFT enforcement action” or a “significant AML/CFT supervisory action,” as these terms are defined in the proposed rule. In this way, the proposed rule is intended to clarify and reinforce a supervisory and enforcement focus on addressing significant or systemic failures to implement an effective AML/CFT program, rather than on isolated, technical, or immaterial implementation issues.
44

44
FinCEN,
FinCEN Statement on Enforcement of the Bank Secrecy Act
(Aug. 18, 2020),
https://www.fincen.gov/news/news-releases/fincen-statement-enforcement-bank-secrecy-act.

Importantly, under the proposed regulations, having an effective AML/CFT program would be more than a one-time adoption of a risk-based set of internal policies, procedures, and controls. Rather, a financial institution would be required to keep its risk-based set of internal policies, procedures, and controls—and the risk assessment processes that inform them—current as the financial institution's risk profile changes. For example, while a financial institution's risk-based set of internal policies, procedures, and controls may, at one time, have been reasonably designed, they may no longer be reasonably designed given changes to the financial institution's risk profile. Similarly, an effective AML/CFT program would involve more than a one-time creation of an employee training program or initiation of an independent testing mechanism: the financial institution would also be required to keep such aspects of the AML/CFT program current as the financial institution's risk profile changes. Thus, even where a financial institution has previously established an AML/CFT program in accordance with the proposed rule, a failure to update the program to reflect significant changes to the institution's risk profile may result in the program no longer meeting the program establishment requirements, and the financial institution may accordingly be subject to supervisory or enforcement action for a failure to establish an effective AML/CFT program.

The proposed rule would provide FinCEN with a greater role in the supervisory process with respect to banks and the relevant Agency. To better ensure that bank examiners are performing “risk focused” supervision, the proposed rule would require that the Agencies, when acting under supervisory authority delegated by FinCEN, consult with FinCEN prior to taking a significant AML/CFT

supervisory action.
45

FinCEN would require the Agencies, when acting pursuant to FinCEN's delegated authority, to provide FinCEN written notice at least 30 days prior to taking such an action. FinCEN would have an opportunity to review the action and the underlying information giving rise to it, and the Agencies would be required to consider any input offered by FinCEN concerning the effectiveness of the bank's AML/CFT program.
46

45
Because FinCEN has not delegated any enforcement authority to the Agencies, the Agencies have no authority to take an enforcement action under 31 CFR chapter X. As a result, there is no corresponding rule text related to enforcement actions by the Agencies acting under authority provided by FinCEN.

46
FinCEN anticipates the Agencies imposing a similar consultation requirement on themselves when the Agencies act under other laws, including 12 U.S.C. 1786 or 1818.

By explicitly defining the requirements for an institution to establish and maintain an effective AML/CFT program, and by standardizing the AML/CFT supervision and enforcement process for banks and the Agencies, the proposed rule is expected to better achieve the purposes of the BSA and lead to better outcomes for financial institutions, law enforcement, and national security agencies. Treasury and FinCEN do not intend, however, for the proposed rule to provide permission for financial institutions to establish “paper programs” that might be interpreted as meeting the proposed rule's technical requirements on their face but do not achieve the desired outcomes of more effectively and efficiently detecting and preventing ML/TF activity. To establish a compliant AML/CFT program under the proposed rule, a financial institution must, among other things, establish a risk-based set of internal policies, procedures, and controls that is reasonably designed to ensure compliance with the BSA and 31 CFR chapter X, including through the adoption of risk assessment processes. A critical element of this requirement is that the financial institution's internal policies, procedures, and controls be “reasonably designed.” For example, if a financial institution's program testing reveals that a new customer type or new activity is high risk, but the financial institution does not take any action to revise the design of its internal policies, procedures, and controls and therefore treats the customer or activity as presenting low risk, then its program should not be considered reasonably designed. Treasury and FinCEN believe that financial institutions know their customer base, businesses, and risks better than their regulators and the government; thus, financial institutions are best positioned to identify and evaluate their ML/TF risks. Financial institutions should therefore, and would under this proposed rule, have significant flexibility and discretion in their decisions and determinations related to risk identification and resource allocation. However, examiners would be expected to assess whether: (1) a financial institution's resource allocation decisions are informed by, and consistent with, reasonably designed risk assessment processes; and (2) with respect to implementation, specifically, whether the financial institution knows or should know of resource-related issues involving its internal policies, procedures, and controls that may result in the financial institution failing to implement its AML/CFT program in all material respects and failing to address such issues.

Similarly, Treasury and FinCEN expect a financial institution to be examined for its implementation of the established AML/CFT program in all material respects. Merely designating an individual responsible for establishing and implementing the AML/CFT program, and having that individual establish internal policies, procedures, and controls, an employee training program, and an independent testing program, are not sufficient to satisfy the proposed rule's obligations for a financial institution to have an effective AML/CFT program. Rather, a financial institution would be examined for whether it has implemented, in all material respects, its established AML/CFT program, including whether the financial institution is, in fact, allocating resources as contemplated in its established AML/CFT program, which the proposed rule would require to be consistent with its reasonably designed risk assessment processes. Banks with significant or systemic failures to implement an effective AML/CFT program may be subject to a significant supervisory action or enforcement action, whereas isolated, technical, or immaterial implementation deficiencies would not be cause for such actions.

V. Section-by-Section Analysis

This section-by-section analysis describes the specific proposed changes to the program rules. Section V.A addresses the proposed incorporation of CFT into the program rules. Section V.B discusses the requirements for an “effective” AML/CFT program to comply with the requirements of 31 U.S.C. 5318(h)(1) and the proposed rule. Section V.C explains what it means to “establish,” “maintain,” and “implement” an effective AML/CFT program. Section V.D describes the components of program establishment, including: (1) internal policies, procedures, and controls (including risk assessment processes); (2) independent program testing; (3) an individual, located in the United States and accessible to FinCEN and the appropriate Federal functional regulator, responsible for establishing and maintaining the program, and coordinating and monitoring day-to-day compliance; and (4) ongoing employee training. Section V.E discusses the requirements that the AML/CFT program be written, accessible, and approved by financial institution leadership. Section V.F addresses the supervision and enforcement section of the proposed rule for banks, and Section V.G describes several technical changes that the proposal makes to existing AML program rules.

A. Inserting the Term “CFT” Into the AML Program Rules

Section 6101(b)(2)(A) of the AML Act amends 31 U.S.C. 5318(h)(1) to reference “countering the financing of terrorism”
47

in addition to “anti-money laundering” when describing the requirement to establish an AML/CFT program. FinCEN proposes to update its regulations in 31 CFR chapter X to reflect this new statutory language. For example, the proposed rule would change the title of 31 CFR 1020.210 from “Anti-money laundering program requirements for banks” to “Anti-money laundering/countering the financing of terrorism program requirements for banks.” Similar changes would apply to the titles of the other program rules in chapter X.

47
Countering the financing of terrorism (CFT) includes laws, rules, regulations, or other measures intended to detect and disrupt the solicitation, collection, or provision of funds to support terrorist acts or terrorist organizations, or other violent extremist groups.

The inclusion of “CFT” in the program rules would not create new obligations for financial institutions, insofar as the USA PATRIOT Act already requires them to account for risks related to terrorist financing. Accordingly, FinCEN expects any changes to existing AML/CFT programs from the amendments described in this subsection to be technical and therefore not have any substantive impact on financial institutions' BSA compliance obligations.

B. An “Effective” AML/CFT Program

As discussed above in section IV.A, in prescribing the minimum standards for

an AML/CFT program and in supervising and examining compliance with those standards, the AML Act requires the Secretary and the appropriate Federal functional regulator to take into account that effective AML/CFT programs safeguard national security and help law enforcement prevent the flow of illicit funds in the financial system.
48

Further, the AML Act instructs FinCEN to focus on achieving effective outcomes rather than dictating the processes used to reach those outcomes, an orientation reflected in the proposed rule. Consistent with FinCEN and the Agencies' longstanding expectations regarding what effective outcomes entail, FinCEN believes that, as a practical matter, it is not possible for a financial institution to detect and report all potentially illicit transactions that flow through the institution.
49

Similarly, a financial institution's AML/CFT program can be effective without preventing every minor instance of a financial institution falling prey to illicit finance misuse. Accordingly, the proposed rule would set out that an AML/CFT program is “effective” and complies with the requirements of 31 U.S.C. 5318(h)(1) so long as it is established and maintained in accordance with applicable requirements.

48

See
31 U.S.C. 5318(h)(2)(B)(iii).

49
Federal Financial Institutions Examination Council (FFIEC),
FFIEC BSA/AML Examination Manual, Assessing Compliance with BSA Regulatory Requirements
—
Suspicious Activity Reporting, https://bsaaml.ffiec.gov/manual/AssessingComplianceWithBSARegulatoryRequirements/04.

As noted in section II.B and section II.C, FinCEN has introduced the concept of an “effective” AML/CFT program in prior rulemakings, and the public has provided valuable feedback on this concept. For example, the Effectiveness ANPRM considered proposing a definition of an effective and reasonably designed program as one that: (1) identifies, assesses, and reasonably mitigates the risks resulting from illicit financial activity—including terrorist financing, money laundering, and other related financial crimes—consistent with both the institution's risk profile and the risks communicated by relevant government authorities as national AML priorities; (2) assures and monitors compliance with the recordkeeping and reporting requirements of the BSA; and (3) provides information with a high degree of usefulness to government authorities consistent with both the institution's risk assessment and the risks communicated by relevant government authorities as national AML priorities.
50

50
85 FR 58026.

The proposed rule would provide that a financial institution has an “effective” program if it (1) is established in accordance with the proposed rule's establishment requirements; and (2) is maintained, meaning that a properly established program is implemented in all material respects.

One of the AML Act's key purposes is to “encourage technological innovation and the adoption of new technology by financial institutions to more effectively counter money laundering and financing of terrorism.”
51

Consistent with this purpose and pursuant to the Executive order on
Removing Barriers to American Leadership in Artificial Intelligence,
the
Winning the Race America's AI Action Plan,
and the Executive order on
Ensuring a National Policy Framework for Artificial Intelligence,
Treasury has undertaken various efforts to research, promote, and take actions that reflect its commitment to the role of innovation as part of a modernized AML/CFT framework.
52

51
AML Act, section 6002(3) (Purposes).

52
E.O. 14179,
Removing Barriers to American Leadership in Artificial Intelligence,
90 FR 8741 (issued Jan. 23, 2025; published Jan. 31, 2025); White House,
Winning the Race America's AI Action Plan
(July 2025),
https://www.whitehouse.gov/wp-content/uploads/2025/07/Americas-AI-Action-Plan.pdf;
E.O. 14179,
Ensuring a National Policy Framework for Artificial Intelligence,
90 FR 58499 (issued Dec. 11, 2025; published Dec. 16, 2025).

Treasury has highlighted the potential for innovative technologies to strengthen AML/CFT programs in various strategies and public engagements. The 2024 National Illicit Finance Strategy highlighted how innovative technologies like machine learning and large language models have potential to strengthen financial institutions' AML/CFT programs, enabling financial institutions to more rapidly and effectively analyze data to identify patterns, risks, trends, and typologies.
53

In addition to discussion of specific types of and applications for technology, Treasury has expressed broad support for exploring areas where AI, blockchain analysis, digital identity, and other tools can produce a more efficient and more effective AML/CFT framework.
54

53
U.S. Department of the Treasury,
2024 National Strategy for Combating Terrorist and Other Illicit Financing
(May 2024),
https://home.treasury.gov/system/files/136/2024-Illicit-Finance-Strategy.pdf.

54
U.S. Department of the Treasury, Press Release, “Remarks by Under Secretary for Terrorism and Financial Intelligence John K. Hurley at the Association of Certified Anti-Money Laundering Specialists Assembly Conference” (Sept. 17, 2025),
https://home.treasury.gov/news/press-releases/sb0251.

FinCEN encourages financial institutions to evaluate whether new technology or innovative approaches might help to more effectively combat financial crime. Innovative approaches could involve machine learning, generative artificial intelligence (GenAI), digital identity, blockchain monitoring and analytics, or application programming interfaces (APIs). These technologies may be especially useful in countering illicit finance activity involving digital assets, an effort for which FinCEN supports financial institutions' responsible use of novel models, techniques, or strategies. To that end, FinCEN encourages financial institutions to review the White House report on
Strengthening American Leadership in Digital Financial Technology
as well as Treasury's report on
Innovative Technologies to Counter Illicit Finance Involving Digital Assets.
55

This report explores how financial institutions can employ innovative and novel methods to detect and stop financial crime involving digital assets, and encourages the responsible use of novel tools and techniques that can improve the effectiveness of the U.S. AML/CFT regime.

55
White House,
Strengthening American Leadership in Digital Financial Technology
(July 30, 2025),
https://www.whitehouse.gov/wp-content/uploads/2025/07/Digital-Assets-Report-EO14178.pdf;
U.S. Department of the Treasury,
Report to Congress from the Secretary of the Treasury on Innovative Technologies to Counter Illicit Finance Involving Digital Assets
(Mar. 2026),
https://home.treasury.gov/system/files/246/GENIUS-Act-Illicit-Finance-Innovation-Congressional-Report-March-2026.pdf.

FinCEN recognizes that adopting new technologies for BSA compliance may not be suitable for every financial institution, particularly smaller ones, and the proposed rule therefore does not reference or require the use of any particular technology. A financial institution may find it beneficial to consider whether its AML/CFT program appropriately uses the financial institution's existing resources, including technology and data. However, building on longstanding guidance, FinCEN encourages institutions to engage in responsible AML/CFT innovation.
56

Institutions that responsibly experiment with innovative technologies in their AML/CFT programs will not incur any additional risk of being subject to a significant supervisory AML/CFT action or AML/CFT enforcement action solely

based on the use of innovative technologies. To the contrary, FinCEN recognizes that fostering the use of innovative technologies is vital to improving financial crime compliance and fighting illicit finance and strongly encourages their responsible use.

56
FRB, FDIC, FinCEN, NCUA, and OCC,
Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist Financing
(Dec. 3, 2018),
https://www.fincen.gov/system/files/2018-12/Joint%20Statement%20on%20Innovation%20Statement%20%28Final%2011-30-18%29_508.pdf.

In addition to new technology, FinCEN is aware of concerns surrounding model risk management at financial institutions. FinCEN has considered comments submitted in response to the 2021
Request for Information and Comment: Extent to Which Model Risk Management Principles Support Compliance With Bank Secrecy Act/Anti-Money Laundering and Office of Foreign Assets Control Requirements
(RFI).
57

FinCEN received comments including concerns that supervisors may expect financial institutions to apply the Supervisory Guidance on Model Risk Management (MRMG) to AML/CFT and OFAC-related policies, procedures, and controls.
58

57
OCC, FRB, FDIC, NCUA, and FinCEN,
Request for Information and Comment: Extent to Which Model Risk Management Principles Support Compliance With Bank Secrecy Act/Anti-Money Laundering and Office of Foreign Assets Control Requirements,
86 FR 18978 (Apr. 12, 2021).

58
FRB and OCC,
Supervisory Guidance on Model Risk Management,
(Apr. 4, 2011),
https://www.federalreserve.gov/supervisionreg/srletters/sr1107a1.pdf.

While FinCEN has not issued or been party to any prior MRMG guidance, FinCEN shares certain concerns articulated in the comments to the RFI that these models, which are designed to assess different types of risks with different information input, processing, and reporting components may be overly burdensome and ill-fitted to address illicit finance risks. FinCEN welcomes comment on this position and intends to work with the Agencies to address these concerns.

C. Establishing and Maintaining an AML/CFT Program

The requirement that financial institutions establish and maintain an AML/CFT program is not new, although over time various formulations of this requirement have developed in statutes and regulations.
59

The proposed rule would set out uniform terms for an AML/CFT program across FinCEN's regulations for all types of financial institutions regulated under the BSA and delineate the requirements that must be met for financial institutions to have an effective AML/CFT program. That is, the proposed rule would create a two-pronged framework under which a financial institution's AML/CFT program would be deemed to be effective if the financial institution
establishes
and
maintains
their program. Under the proposed rule, a financial institution maintains its properly established AML/CFT program by
implementing
it in all material respects.

59
For instance, the provision of the BSA which requires financial institutions to have AML/CFT program rules states that “each financial institution shall
establish
”(emphasis added) such programs, including certain requirements as specified.
See
31 U.S.C. 5318(h)(1). The corresponding Federal statute requiring banks regulated by the Federal banking agencies to have BSA compliance programs states that these banks must “establish and maintain procedures reasonably designed to assure and monitor the compliance” with the requirements of the BSA. 12 U.S.C. 1818(s)(1). In addition, the current program rules regulating financial institutions use inconsistent terms to describe establishing, implementing, and maintaining AML/CFT programs. For example, some programs rules use the terms “implements and maintains”—31 CFR 1020.210 (banks); 1021.210 (casinos); 1023.210 (broker-dealers); 1026.210 (FCMs and IBCs) while others use the terms “develop, implement, and maintain,” 1022.210 (MSBs) and others use “develop and implement” 1024.210 (mutual funds); 1025.210 (insurance companies); 1027.210 (DPMSJs); 1028.210 (operators of credit card systems); 1029.210 (loan or finance companies); and 1030.210 (housing GSEs)—with respect to the general AML program requirement.

1. Proposed 31 CFR 10XX.210(b)—Establishing Versus Maintaining an AML/CFT Program

For a financial institution to have an effective AML/CFT program, the proposed 31 CFR 10XX.210(b) (“31 CFR 10XX” refers to proposed changes to the AML program rules of all eleven financial institution types) would require a financial institution to
establish
an AML/CFT program and then
maintain
the AML/CFT program by implementing, in all material respects, the established AML/CFT program. The proposed rule describes the requirements for a financial institution to establish and maintain an effective AML/CFT program that complies with the requirements of 31 U.S.C. 5318(h)(1). The AML/CFT program minimum components constituting program establishment, and described in further detail in section V.D below, are: (1) internal policies, procedures, and controls (including risk assessment processes); (2) independent program testing; (3) an individual, located in the United States and accessible to FinCEN and the Agencies, responsible for establishing and maintaining the program, and coordinating and monitoring day-to-day compliance; and (4) ongoing employee training. “Establishing” an AML/CFT program involves designing an AML/CFT program that incorporates all of the required components. “Implementation,” by contrast, addresses whether the financial institution is executing that program in practice. This distinction matters, particularly for banks, because proposed 31 CFR 1020.221(b) ties the availability of AML/CFT enforcement and significant supervisory actions based on the program rule for an established bank program to a significant or systemic failure to implement an effective AML/CFT program. The distinction between establishing and implementing an AML/CFT program is intended to make transparent how the individual elements of 31 CFR 1020.210 work together to satisfy 31 U.S.C. 5318(h)(1).

The concepts of program establishment and program maintenance are closely related to the supervision and enforcement provisions of the proposed program rule for banks. In particular, as explained in more detail in section V.F, a bank that has properly established an AML/CFT program (
i.e.,
satisfied the proposed rule's requirements regarding establishment) will not be subject to an AML/CFT enforcement action or a significant supervisory action based on the program rule except with respect to a significant or systemic failure to implement an effective AML/CFT program (
i.e.,
a failure to implement, in all material respects, a properly established AML/CFT program).
60

60
The proposed rule would clarify that this limitation on AML/CFT enforcement actions and significant AML/CFT supervisory actions does not apply with respect to a failure to properly
establish
an AML/CFT program.

Separating program establishment from program maintenance therefore provides needed clarity regarding whether a supervisory concern relates to deficiencies stemming from the program's design, on the one hand, or failures in the program's operation, on the other. This two-prong framework would help promote consistent articulation of supervisory expectations and prevent conflating criticisms of program design—the remediation of which would likely be different in kind—with criticisms of day-to-day implementation. The proposed distinction does not change the substantive obligations of 31 U.S.C. 5318(h)(1); rather, it clarifies how those obligations map onto the two statutory requirements at the core of section 5318(h)(1): having a risk-based and reasonably designed program and adhering to it in operation.

As noted previously, FinCEN intends for the requirements of this proposed rule to not be limited to a one-time adoption of the elements required for program establishment, such as internal policies, procedures, and controls. Rather, FinCEN intends a financial

institution's establishment of its AML/CFT program to require the financial institution's risk-based set of internal policies, procedures, and controls—and the risk assessment processes that inform them—to remain current as the financial institution's risk profile changes. For example, if a financial institution begins providing a new product or service—or changes how it provides an existing product or services, such as operating in a new geographic location—under this proposed rule, a financial institution would need to incorporate its new product or service as part of its risk assessment processes. The proposed rule would require a financial institution to make a risk determination and, as appropriate, redesign its internal policies, procedures, and controls to account for the risks that it did not previously encounter prior to offering the new product or service, or operating in the new geographic location. Thus, under the proposed rule, even where a financial institution has previously established an AML/CFT program in accordance with the proposed rule, a failure to update the program to reflect significant changes in the institution's risk profile may result in the program no longer satisfying the proposed rule's requirements regarding establishment.

2. Proposed 31 CFR 10XX.210(c)—Implementation of an AML/CFT Program

Once a financial institution has properly “established” an AML/CFT program, the institution must “maintain” the program by implementing it, in all material respects. Minor deficiencies of an AML/CFT program would not necessarily mean that a financial institution has failed to implement the program.

Although there are a variety of ways that a financial institution may not be implementing its program “in all material respects,” in FinCEN's experience, commonly observed examples may include, but would not be limited to: (1) internal policies, procedures, and controls are not being performed or not being performed on a consistent, regular, and timely basis (
e.g.,
consistently ignored warnings or red flags that a program was seriously deficient) due to the nature or extent of required resources becoming inadequate; (2) gaps in the risk assessment processes that result in the financial institution's program missing or inadequately covering higher ML/TF risks (
e.g.,
systems used to monitor for potentially suspicious activity failing to capture material volumes or types of transactions); or (3) deficiencies or weaknesses in the risk assessment processes that have a material impact on the financial institution's mitigation of ML/TF risks through its internal policies, procedures, and controls, including due to data-related issues involving relevant processes and systems.

Similarly, FinCEN expects that a financial institution could become aware of such implementation-related concerns through a variety of mechanisms, including, but not limited to: (1) independent testing of the AML/CFT program; (2) examiner observations, suggestions, or other informal comments about the AML/CFT program from FinCEN (or its designee, such as a Federal functional regulator); (3) management information systems and related reports or other outputs (
e.g.,
key performance indicators or key risk indicators, such as monitoring for potentially material backlogs in relevant AML/CFT processes); and (4) issues identified by personnel involved in the operation of the financial institution's AML/CFT program. A bank that fails to reasonably address such warnings that its program is not being implemented would be at risk of being subject to a significant AML/CFT supervisory action, an AML/CFT enforcement action, or both.

D. Program Establishment

As noted earlier, pursuant to 31 U.S.C. 5318(h), the AML/CFT program requirements for financial institutions must have certain minimum elements comprised of: (1) internal policies, procedures, and controls; (2) an independent audit function to test programs; (3) a designated compliance officer; (4) an ongoing employee training program; and (5) other components, depending on the type of financial institution. The majority of the proposed rule's AML/CFT program components are substantially similar to the existing statutory and regulatory requirements for financial institutions. However, FinCEN is proposing certain additions and modifications to modernize and strengthen financial institutions' AML/CFT programs to enable financial institutions to better mitigate illicit finance risks.

1. Proposed 31 CFR 10XX.210(b)(1)—Internal Policies, Procedures, and Controls

The BSA requires financial institutions to develop “internal policies, procedures, and controls” as part of their AML/CFT programs.
61

Existing AML program rules already impose internal policies, procedures, and controls requirements to ensure compliance, but with differing formulations. The proposed rule would standardize these requirements for financial institutions required to comply with FinCEN's program rules to establish a risk-based set of internal policies, procedures, and controls in their AML/CFT programs.

61
31 U.S.C. 5318(h)(1)(A).

Proposed 31 CFR 10XX.210(b)(1) provides that a financial institution's risk-based set of internal policies, procedures, and controls must be reasonably designed to: (1) identify, assess, and document ML/TF risks through risk assessment processes; (2) mitigate ML/TF risks consistent with the risk assessment processes, including by allocating more attention and resources toward higher-risk customers and activities rather than toward lower-risk customers and activities; and, for certain financial institutions (3) conduct ongoing CDD. The preamble addresses each of these features below.

Under this proposal, a financial institution's risk-based set of internal policies, procedures, and controls should be based upon, informed by, and consistent with the financial institution's risk assessment processes. The level of sophistication of the internal policies, procedures, and controls should be commensurate with the size, structure, risk profile, and complexity of the financial institution.

The requirement that a financial institution's risk-based set of internal policies, procedures, and controls be “reasonably designed” gives financial institutions flexibility in how they achieve compliance with the BSA and the proposed rule's other requirements. As part of having risk-based set of internal policies, procedures, and controls reasonably designed to ensure compliance with the BSA and FinCEN's regulations, financial institutions may choose to responsibly adopt new technologies or innovative approaches to comply with BSA requirements. Consistent with this purpose, FinCEN encourages financial institutions to evaluate whether new technology or innovative approaches in other resources might help to more effectively combat financial crime. Innovative approaches could involve machine learning, GenAI, digital identity, blockchain monitoring and analytics, or APIs. These technologies may be especially useful in countering illicit finance activity involving digital assets, an effort for which FinCEN supports the responsible use of novel models, techniques, or strategies.

i. Proposed 31 CFR 10XX.210(b)(1)(i)—Risk Assessment Processes

FinCEN is proposing in 31 CFR 10XX.210(b)(1)(i) that, as part of a financial institution's risk-based set of internal policies, procedures, and controls, the financial institution establish and maintain risk assessment processes to: (1) evaluate the ML/TF risks of the financial institution's business activities, including products, services, distribution channels, customers, and geographic locations; (2) review and, as appropriate, incorporate the AML/CFT Priorities; and (3) be updated promptly upon any change that the financial institution knows or has reason to know significantly changes the institution's ML/TF risks.

While it is common practice among many financial institutions to maintain a risk assessment process or processes, the requirement that financial institutions have risk assessment processes when developing their AML/CFT programs is not stated in a uniform manner for all financial institutions under the current AML program rules. Under some program rules, certain financial institutions—such as insurance companies and loan and finance companies—are explicitly required to “[i]ncorporate policies, procedures, and internal controls based upon . . . [an] assessment of the . . . risks associated with its products and services.”
62

Under other program rules, some financial institutions—such as casinos and MSBs—must develop internal policies, procedures, and controls, and independent testing “commensurate with the risks” posed by their products.
63

This latter requirement implicitly requires risk assessment processes, as an institution cannot develop a risk-based set of internal policies, procedures, and controls without first identifying the institution's risks by way of some process. Thus, the proposed rule would standardize the requirement for risk assessment processes across different types of financial institutions subject to program rules, thereby clarifying existing expectations and practices.

62

See
31 CFR 1029.210 (loan or finance companies); 1030.210 (housing GSEs);
see also
31 CFR 1025.210 (insurance companies); 1028.210 (operators of credit card systems).

63

See
31 CFR 1022.210 (MSBs); 1025.210 (insurance companies);
see also
31 CFR 1021.210 (casinos) (“commensurate with the money laundering and terrorist financing risks posed by the products and services”).

Importantly, the proposed rule requires, as part of a financial institution's risk-based set of internal policies, procedures and controls, that it identify, assess, and document its ML/TF risks using risk assessment processes. FinCEN understands that many financial institutions currently maintain a single, or standalone, risk assessment process either voluntarily or as required or expected by Federal regulators. This risk assessment process, generally conducted on an annual basis, results in a documented ML/TF risk assessment. While such a risk assessment process may be appropriate under the proposal, the use of the term “risk assessment processes” is intended to reflect that a financial institution may rely on multiple processes—applied as appropriate within its AML/CFT program—to identify, assess, and document its ML/TF risks and will be examined based on the totality of these processes rather than the sufficiency of a single, standalone risk assessment process.

FinCEN believes financial institutions are best positioned to identify and evaluate their ML/TF risks and is therefore not prescribing any particular risk assessment processes or methodologies other than the critical elements described in this proposed rule. Under the proposed rule, financial institutions will be examined for whether they have established and implemented, in all material respects, reasonably designed risk assessment processes—which need not be in the form of a singular risk assessment process. Furthermore, as discussed further below, FinCEN is not prescribing any particular timeframe for institutions to update their risk assessment processes.

The explicit requirement to have risk assessment processes will be new for banks, casinos, MSBs, broker-dealers, mutual funds, and FCMs and IBCs.
64

64
The current program rules without explicit risk assessment requirements are located at 31 CFR 1020.210 (banks); 1021.210 (casinos); 1022.210 (MSBs); 1023.210 (broker-dealers); 1024.210 (mutual funds); and 1026.210 (FCMs and IBCs).

a. Proposed 31 CFR 10XX.210(b)(1)(i)(A)—ML/TF Risks

Proposed 31 CFR 10XX.210(b)(1)(i)(A) would require a financial institution's risk assessment processes to evaluate the ML/TF risks of its business activities, including products, services, distribution channels, customers, and geographic locations. These factors are generally well known and often incorporated into current risk assessment processes of some financial institutions. FinCEN considers “distribution channels” to refer to the methods and tools through which a financial institution opens accounts and provides products or services, including, for example, through remote or other non-face-to-face means.

Financial institutions may use a variety of sources to inform their risk assessment processes. Such sources may include information obtained from other financial institutions, such as emerging risks and typologies identified through section 314(b) information sharing or payment transactions that other financial institutions returned or flagged due to ML/TF risks.
65

Information a financial institution generates or maintains could be another source. Such internal information may include, for example, customer internet protocol (IP) addresses or device logins and related geolocation information.

65

See
FinCEN,
Section 314(b) Fact Sheet,
(Dec. 2020),
https://www.fincen.gov/system/files/shared/314bfactsheet.pdf.

Feedback from FinCEN, law enforcement, and financial regulators may also inform risk assessment processes. For example, if a financial institution receives feedback from law enforcement about a report it has filed or potential risks at the financial institution, the financial institution may incorporate that information into its risk assessment processes. Similarly, a financial institution may consider information identified from responding to section 314(a) requests.

In addition to feedback, reports, and analyses published by Treasury and FinCEN, the Federal functional regulators, or self-regulatory organizations (SROs) may be particularly relevant to a financial institution's business activities, thereby warranting consideration when evaluating ML/TF risks. Treasury describes changes in the illicit finance risk environment in its biennial
National Money Laundering Risk Assessment, National Terrorist Financing Risk Assessment,
and
National Proliferation Financing Risk Assessment,
which highlight significant illicit finance threats, vulnerabilities, and risks.
66

FinCEN also publishes advisories and analyses on emerging risks and typologies, including Financial Trend Analyses issued pursuant to section 6206 of the AML Act. These reports contain threat pattern and trend information derived from BSA filings and may help inform financial institutions' understanding of

risks associated with different threats and vulnerabilities as they evolve.
67

Regardless of the source, financial institutions should take measures in their risk assessment processes to ensure this information is reasonably current, complete, and accurate.

66

See
U.S. Department of the Treasury,
2026 National Money Laundering Risk Assessment
(March 2026),
https://home.treasury.gov/system/files/246/2026-NMLRA.pdf; 2026 National Terrorist Financing Risk Assessment
(March 2026),
https://home.treasury.gov/system/files/246/2026-NTFRA.pdf; 2026 National Proliferation Financing Risk Assessment
(March 2026),
https://home.treasury.gov/system/files/246/2026-NPFRA.pdf.

67

See, e.g.,
FinCEN,
Financial Trend Analyses, https://www.fincen.gov/resources/financial-trend-analyses.

b. Proposed 31 CFR 10XX.210(b)(1)(i)(B)—AML/CFT Priorities

Proposed 31 CFR 10XX.210(b)(1)(i)(B) would require financial institutions to review and incorporate the AML/CFT Priorities. The AML/CFT Priorities set out the priorities for the U.S. government's AML/CFT policy as required by the AML Act and are designed to ensure that financial institutions' AML/CFT programs are aligned with those priorities. Recognizing the diverse nature of ML/TF threats facing the U.S. financial system and national security, and that financial institution AML/CFT programs benefit U.S. national security by safeguarding the financial system from ML/TF risks, the AML/CFT Priorities are intended to ensure that financial institutions are focusing on the greatest threats to U.S. national security, as defined by Treasury.

Section 6101 of the AML Act requires that a financial institution's review and appropriate incorporation of the AML/CFT Priorities into its AML/CFT program be subject to supervision and examination for compliance with the BSA and other AML/CFT laws and regulations.
68

FinCEN is implementing this statutory requirement by proposing that, as part of their risk assessment processes, financial institutions must review and, as appropriate, incorporate the AML/CFT Priorities. The inclusion of the AML/CFT Priorities in risk assessment processes is meant to help ensure that financial institutions understand their exposure to risks in areas that are of particular importance nationally, which may help financial institutions develop risk-based and reasonably designed AML/CFT programs.

68
31 U.S.C. 5318(h)(4)(E).

FinCEN understands that the AML/CFT Priorities may not always be applicable to a financial institution's risk profile and activities. Therefore, FinCEN requires the incorporation of the AML/CFT Priorities in financial institution's risk assessment processes
as appropriate.
This means that, having reviewed the AML/CFT Priorities, a financial institution may determine the extent to which a particular priority is applicable and whether and how a particular AML/CFT Priority should be incorporated into its risk assessment processes.

Further, a financial institution may use its judgment and apply a reasonable, risk-based determination on whether to focus on a specific aspect of an AML/CFT Priority (
e.g.,
cyber-enabled fraud), rather than addressing all aspects of a AML/CFT Priority that may either not be applicable (
e.g.,
digital assets cybercrime for a financial institution that does not offer any digital asset products or services, or have any digital asset customers) or pose lower risks to the financial institution (
e.g.,
proliferation financing risks for a financial institution with no cross-border operations, customers, transactions, or activities). However, FinCEN cautions that a surface-level, perfunctory review of an AML/CFT Priority by a financial institution and the foreseeable ways in which it may manifest itself within the financial institution's customers, products and services, geographies, and distribution channels would not satisfy this requirement. For example, patterns of transactions that may be consistent with potential structuring should not automatically be dismissed as lower value to law enforcement and untethered to an AML/CFT Priority without determining whether there is a potential connection to various types of other illicit finance activity (
e.g.,
structuring or similar patterns involving transactions in narcotics trafficking proceeds).

Under the AML Act, FinCEN is required to update the AML/CFT Priorities not less than once every four years.
69

Whenever the AML/CFT Priorities are updated, financial institutions would no longer be required to incorporate prior versions of the AML/CFT Priorities. Financial institutions would only be required to incorporate the most recent AML/CFT Priorities into their risk assessment processes.

69
31 U.S.C. 5318(h)(4)(B).

FinCEN anticipates that some financial institutions may ultimately determine that their business models and risk profiles have limited exposure to some of the threats addressed in the AML/CFT Priorities but instead have greater exposure to other ML/TF risks not addressed in the AML/CFT Priorities. Additionally, some financial institutions' risk assessment processes may determine that their AML/CFT programs already sufficiently take into account some, or all, of the AML/CFT Priorities. In either case, any changes to financial institutions' AML/CFT programs, such as internal policies, procedures, or controls, would be based on the results of risk assessment processes and their impact on the AML/CFT program, including how to review and, as appropriate, incorporate the AML/CFT Priorities before making these determinations.

FinCEN recognizes that some AML/CFT Priorities describe threats at a high level, or at a point in time, and that financial institutions may lack the context or information necessary on which specific threats, or what time frames, to consider or focus on when conducting their risk assessments. For instance, the AML/CFT Priorities that FinCEN issued in June 2021 describes “fraud” as one of the eight priorities and discusses specific examples of fraud that were especially salient in 2021. However, the government's priorities may have changed since the publication of the AML/CFT Priorities due to emergent ML/TF typologies (
e.g.,
sanctions evasions by Russian oligarchs) or ML/TF threats (
e.g.,
pig butchering) not addressed specifically in the AML/CFT Priorities. For example, FinCEN's support to Treasury's efforts to combat rampant government benefits fraud is just one example of how the government's focus on specific types of fraud evolves over time.
70

This type of fraud may not have been a concern for a financial institution in prior risk assessment processes, but a financial institution may decide to conduct and apply risk assessment processes to identify whether such a risk is significant for a financial institution, and that determination may necessitate changes to a financial institution's AML/CFT program.

70
U.S. Department of the Treasury, Press Release, “Secretary Bessent Announces Initiatives to Combat Rampant Fraud in Minnesota” (Jan. 9, 2026),
https://home.treasury.gov/news/press-releases/sb0354.

To assist financial institutions with their risk assessment processes, and to better identify activity related to the AML/CFT Priorities, FinCEN issues products under its Financial Institution Advisory Program (Advisory Program).
71

FinCEN's Advisory Program communicates priority ML/TF threats and vulnerabilities to the U.S. financial system. Financial institutions may use this information to support effective, risk-based, and reasonably designed AML/CFT programs and suspicious activity monitoring systems to help generate highly useful information for

law enforcement and national security agencies.

71
FinCEN,
Alerts/Advisories/Notices/Bulletins/Fact Sheets, https://www.fincen.gov/resources/advisoriesbulletinsfact-sheets.

Relatedly, since 2021, FinCEN has published Financial Trends Analyses (FTA) highlighting threat pattern and trend information derived from BSA data on additional fraud-related topics, including an FTA on fraud schemes targeting digital identities, mail theft-related check fraud, and elder financial exploitation.
72

More recently, FinCEN issued an Alert on Fraud Rings and their Exploitation of Federal Child Nutrition programs in Minnesota given the rampant financial fraud and improper payments in Minnesota.
73

As noted in the alert, ongoing investigations into fraudsters in Minnesota by the U.S. Department of Justice have identified potentially billions of dollars stolen from the Federal child nutrition programs and other Federal and State government benefits programs, including Medicaid.

72
FinCEN,
Financial Trend Analyses, https://www.fincen.gov/resources/financial-trend-analyses.

73
FinCEN,
FinCEN Alert on Fraud Rings and their Exploitation of Federal Child Nutrition programs in Minnesota,
(Jan. 9, 2026),
https://www.fincen.gov/system/files/2026-01/FinCEN-Alert-Federal-Child-Nutrition-Programs.pdf.

FinCEN requests comment from the public on whether additional guidance related to the consideration of the AML/CFT Priorities as part of an institution's risk assessment processes would be warranted.

c. Proposed 31 CFR 10XX.210(b)(1)(i)(C)—Updates to Risk Assessment Processes

Proposed 31 CFR 10XX.210(b)(1)(i)(C) would require financial institutions to update their risk assessment processes promptly upon any change that the financial institution knows or has reason to know significantly changes their ML/TF risk profiles. For example, a financial institution may need to update its risk assessment when new products, services, and customer types are introduced; if existing products, services, and customer types undergo significant changes; when the financial institution adopts new risk mitigation technology; or if the financial institution as a whole expands or contracts through mergers, acquisitions, divestitures, dissolutions, and liquidations. Financial institutions may also need to update their risk assessment processes based on factors external to their operations that they know or have reason to know significantly change their ML/TF risk profiles. FinCEN welcomes comments on whether it should further clarify when financial institutions must review or update their risk assessment processes.

ii. Proposed 31 CFR 10XX.210(b)(1)(ii)—Mitigate ML/TF Risks Through Risk-Based Allocation of Attention and Resources

Section 6101(b) of the AML Act states that the AML/CFT programs of financial institutions should be “risk-based, including ensuring that more attention and resources of financial institutions should be directed toward higher-risk customers and activities, consistent with the risk profile of a financial institution, rather than toward lower-risk customers and activities.”
74

Proposed 31 CFR 10XX.210(b)(1)(ii) would adopt this formulation as part of a financial institution's obligation to establish a risk-based set of internal policies, procedures, and controls. Under the proposed rule, a financial institution's efforts to mitigate its ML/TF risks would involve “directing more attention and resources toward higher-risk customers and activities, consistent with the risk profile of the [financial institution], rather than toward lower-risk customers and activities.”

74
31 U.S.C. 5318(h)(2)(B)(iv)(II).

FinCEN views risk-based allocation of resources as a critical step in realizing the AML Act's BSA modernization and reform ambitions, and an important departure from the status quo of AML/CFT compliance and supervision. The proposed rule envisions financial institutions exercising more flexibility in deploying attention and resources in accordance with the proposed rule without fear of supervisory criticism or action from examiners for directing more attention and resources on higher risk customers and activities rather than toward lower risk customers and activities.

The goal of risk-based resource allocation is for financial institutions to spend less time, energy, and resources on lower priority activities that may result in fewer resources devoted to, and potentially distract from, more serious threats. The proposed rule would thus enable financial institutions to focus more on higher risk customers and activities, which FinCEN has determined should result in financial institutions being more effective at detecting, reporting, and preventing the flow of illicit funds and providing law enforcement with more valuable BSA reporting.

As noted above, Treasury and FinCEN believe that financial institutions are best positioned to identify and evaluate their ML/TF risks and to make decisions related to risk identification and resource allocation in accordance with risk identification. The proposed rule, therefore, does not contemplate regulatory second-guessing of a financial institution's reasonable determinations regarding appropriate resource allocation or conclusions regarding specific risks. However, while Treasury and FinCEN do not believe that an examiner should substitute his or her own subjective judgment in place of the financial institution, examiners will be expected to assess whether: (1) a financial institution's resource allocation decisions are informed by, and consistent with, reasonably designed risk assessment processes; and (2) with respect to implementation, specifically, whether the financial institution knows or should know of resource-related issues involving its internal policies, procedures, and controls and other mandatory elements that may result in the financial institution failing to implement its AML/CFT program in all material respects and failing to address such issues.

iii. Proposed 31 CFR 1020.210(b)(1)(iii), 1023.210(b)(1)(iii), 1024.210(b)(1)(iii), 1026.210(b)(1)(iii), and 1028.210(b)(1)(iii)—Conduct Ongoing Customer Due Diligence

The existing program rules for certain financial institutions, referred to here as covered financial institutions, contain CDD requirements that have commonly been referred to as the “fifth pillar” of AML program rules for those types of financial institutions.
75

Under these requirements, covered financial institutions must establish and maintain a written AML program that includes: “appropriate risk-based procedures for conducting ongoing customer due diligence, to include, but not be limited to: understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile; and conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.”

75

See
applicable program rules with CDD requirements for covered financial institutions located at 31 CFR 1020.210(a)(2)(v) and (b)(2)(v) (banks); 1023.210(b)(5) (broker-dealers); 1024.210(b)(5) (mutual funds); and 1026.210(b)(5) (FCMs and IBCs).

Proposed 31 CFR 1020.210(b)(1)(iii), 1023.210(b)(1)(iii), 1024.210(b)(1)(iii), 1026.210(b)(1)(iii), and 1028.210(b)(1)(iii) would retain these ongoing CDD obligations without alteration but would make them part of the requirement that covered financial institutions establish a risk-based set of internal policies, procedures, and controls that is reasonably designed.

FinCEN proposes this organizational change because the activities required by the CDD pillar are, in practice, subsumed by the obligation for a covered financial institution to have a risk-based set of internal policies, procedures, and controls that is reasonably designed. The organizational change more accurately reflects how covered financial institutions operationalize such ongoing customer due diligence as part of their overall AML programs. This organizational change, however, is not intended to have any substantive effect on existing obligations under 31 CFR 1010.230.

iv. Application to Community Banks

FinCEN recognizes that financial institutions vary significantly in size, structure, complexity, and risk profile. Under the proposed rule, the level of sophistication of a financial institution's internal policies, procedures, and controls—including its risk assessment processes—should be commensurate with the financial institution's size, structure, risk profile, and complexity. Accordingly, financial institutions with broader product offerings, more complex corporate structures, or greater exposure to higher-risk customers, products, services, or geographic locations would be expected to establish correspondingly more formalized or analytically complex internal policies, procedures, and controls—including risk assessment processes. By contrast, many community banks operate with more limited business activities, traditional lending and deposit services, a narrower geographic footprint, and customer bases concentrated within defined local communities. For such banks, risk assessment processes may appropriately be more streamlined or qualitative in nature, and a risk-based set of internal policies, procedures, and controls that is reasonably designed for a large, complex financial organization would not necessarily be required or appropriate for a community bank with a more limited risk profile.

The proposed rule does not prescribe any specific methodology for identifying, assessing, and documenting ML/TF risks. Community banks may use risk assessment processes that are tailored to their business model and operational scale, including processes that rely on direct knowledge of products, services, customers, and geographic locations rather than highly parameterized or model-driven approaches. Many community banks maintain longstanding customer relationships and operate within defined local markets, which may provide bank personnel with meaningful information relevant to identifying, assessing, and mitigating ML/TF risks. Familiarity with local businesses, direct interaction between bank staff and customers, and an understanding of ordinary patterns of activity within the bank's community may appropriately inform the bank's risk assessment processes and the design of reasonably designed internal policies, procedures, and controls. While such characteristics do not reduce a community bank's obligation to establish and maintain an effective AML/CFT program in accordance with the proposed rule, they may influence how a community bank documents its ML/TF risks and allocates attention and resources consistent with those risks.

Further, under the proposed rule's requirement that a financial institution review and, as appropriate, incorporate the AML/CFT Priorities, a community bank may determine, based on its risk assessment processes, that certain AML/CFT Priorities may not be applicable to its business activities. In such cases, the community bank would not be required to allocate attention or resources to risks for which it has no identified exposure. Rather, the bank would be expected to direct its attention and resources in a manner consistent with its documented ML/TF risks.

2. Proposed 31 CFR 10XX.210(b)(2)—Independent Testing

The AML Act did not change the BSA requirement that each financial institution include “an independent audit function to test programs,”
76

which is already reflected in AML/CFT program rule requirements,
77

and proposed 31 CFR 10XX.210(b)(2). The purpose of independent testing is to assess the financial institution's compliance with AML/CFT statutory and regulatory requirements, relative to its risk profile. The independent AML/CFT program testing should be focused on whether the AML/CFT program is effective, and it should identify issues and areas for remediation accordingly. Similar to the expectations outlined above for examiners, Treasury and FinCEN do not believe that an auditor should substitute his or her own subjective judgment in place of the financial institution. To support the effective implementation of an AML/CFT program, independent testing should be based on objective criteria designed to assess whether a financial institution has established and maintained an effective AML/CFT program and allocated resources consistent with its risk assessment processes. These criteria should also assess whether related program governance is sufficient to manage risks and apply compensating controls where necessary, particularly in areas where remediation is underway. This evaluation helps to inform the financial institution's senior management of weaknesses or areas in need of enhancement or stronger controls. Typically, this evaluation includes a conclusion about the financial institution's overall compliance with AML/CFT statutory and regulatory requirements and sufficient information for the reviewer (
e.g.,
board of directors, senior management, AML/CFT officer, outside auditor, or an examiner) to reach a conclusion about whether the risk-based set of internal policies, procedures, and controls is reasonably designed and resources are well-allocated consistent with the institution's risk assessment processes.

76
31 U.S.C. 5318(h)(1)(D).

77

See
31 CFR 1020.210(a)(2)(ii), (b)(2)(ii) (banks); 1021.210(b)(2)(ii) (casinos); 1022.210(d)(4) (MSBs); 1023.210(b)(2) (broker-dealers); 1024.210(b)(2) (mutual funds); 1025.210(b)(4) (insurance companies); 1026.210(b)(2) (FCMs and IBCs); 1027.210(b)(4) (DPMSJs); 1028.210(b)(4) (operators of a credit card system); 1029.210(b)(4) (loan or finance companies); 1030.210(b)(4) (housing GSEs).

Additionally, while financial institutions retain some flexibility regarding who conducts the audit or testing, the proposed rule would continue to require that testing be independent. Financial institutions that do not employ outside auditors or consultants or that do not have internal audit departments may comply with this requirement by using internal staff who are not involved in the function being tested. For these financial institutions and financial institutions with other types of arrangements for independent testing, the AML/CFT officer or any party who directly, and in some cases, indirectly reports to the AML/CFT officer, or an equivalent role, would generally not be considered sufficiently independent.
78

Any

individual conducting the testing, whether internal or external, would be required to be independent of other parts of the financial institution's AML/CFT program, including its oversight. For financial institutions that engage outside auditors or consultants, the financial institution would be required to ensure that the outside parties conducting the independent testing are not involved in functions related to the AML/CFT program at the financial institution that may present a conflict of interest or lack of independence, such as AML/CFT training or the development or enhancement of internal policies, procedures, and controls. Additionally, for the purposes of the independent testing component, outside parties would not include government agencies, entities, or instrumentalities, such as a financial institution's Federal or State functional regulators. Financial institutions with less complex operations, and lower risk profiles may consider utilizing a shared resource as part of a collaborative arrangement to conduct testing, as long as the testing is independent.
79

78
This is consistent with current 31 CFR 1022.210, which provides that independent testing review may be conducted by an officer or employee of the MSB so long as the tester is not the AML/CFT officer. Similarly, current 31 CFR 1025.210, 1029.210, and 1030.210 provide that independent testing at insurance companies, loan or finance companies, and housing GSEs, respectively, may be conducted by a third party or by any officer or employee of the financial institution, other than the AML/CFT officer. Likewise, 31 CFR 1027.210(b)(4) and 1028.210(b)(4) provide that independent testing of a DPMSJ or an operator of a credit card system, respectively, can be conducted by an officer or employee of the institution, so long as the tester is not the AML/CFT officer or a person involved in the operation of the AML/CFT program. Determining whether testing at U.S. operations of foreign financial institutions is adequately “independent” may include a review of the reporting arrangements between the party

conducting the independent testing and the AML/CFT officer, or equivalent management function such as a head of business line or a general manager, to assess any conflicts of interests and the level of independence with the party conducting the independent testing.

79

See
FRB, FDIC, NCUA, OCC and FinCEN,
Interagency Statement on Sharing Bank Secrecy Act Resources
(Oct. 3, 2018),
https://www.fincen.gov/news/news-releases/interagency-statement-sharing-bank-secrecy-act-resources.

While all financial institutions are required under existing regulations to establish independent testing, FinCEN is standardizing this requirement across all financial institution types. For example, the current rules for broker-dealers, mutual funds, and FCMs and IBCs require outside parties conducting the independent testing to be qualified;
80

however, FinCEN does not find it necessary to add this “qualified” description as it does not establish a new substantive requirement. FinCEN would generally expect, as with the AML/CFT officer component, independent testers to have the expertise and experience necessary to perform such testing effectively, including having sufficient knowledge of the financial institution's risk profile and AML/CFT laws and regulations.

80

See
applicable program rules located at 31 CFR 1023.210(b)(2) (broker-dealers); 1024.210(b)(2) (mutual funds); and 1026.210(b)(2) (FCMs and IBCs).

3. Proposed 31 CFR 10XX.210(b)(3)—Designate an AML/CFT Officer Located in the United States

i. Duties of the AML/CFT Officer

The BSA requires that financial institutions with AML/CFT program obligations must have a designated compliance officer. While FinCEN has adopted this obligation—commonly referred to as the BSA/AML officer—in existing guidance and regulations, the program rules use slight variations in the specific language to describe this requirement for different types of financial institutions. The proposed rule provides technical changes to promote clarity and consistency.

As in the current program rules, proposed 31 CFR 10XX.210(b)(3) would provide that an AML/CFT program must designate an individual (referred to as an AML/CFT officer) responsible for establishing and implementing the AML/CFT program and coordinating and monitoring day-to-day compliance with the requirements and prohibitions of the BSA and FinCEN's implementing regulations. FinCEN's view is that the individual serving as the AML/CFT officer must be qualified for that role and not overburdened with other responsibilities at the institution.

The proposed rule is not intended to be primarily concerned with the formal title of the individual responsible for establishing and implementing the AML/CFT program and coordinating and monitoring day-to-day compliance; instead, the proposed rule focuses on the AML/CFT officer's position in the financial institution's organizational structure that enables the AML/CFT officer to effectively establish and implement the financial institution's AML/CFT program. The AML/CFT officer's authority, independence, and access to resources within the financial institution are critical. An AML/CFT officer should have decision-making capability regarding the AML/CFT program and sufficient functional stature within the organization to ensure that the program meets BSA requirements.

The AML/CFT officer's access to resources may include the following: adequate compliance funds and staffing with the skills and expertise appropriate to the financial institution's risk profile, size, and complexity; an organizational structure that supports compliance and effectiveness; and sufficient technology and systems to support the timely identification, measurement, monitoring, reporting, and management of the financial institution's ML/TF risks. An AML/CFT officer with conflicting responsibilities that adversely impact the officer's ability to effectively coordinate and monitor day-to-day AML/CFT compliance generally would not fulfill this requirement. The addition of the explicit requirement that the AML/CFT officer be responsible for “establishing and implementing the AML/CFT program” in the proposed rule would make explicit a long-standing supervisory expectation, rather than changing current supervisory or regulatory requirements or expectations.

To promote consistency and reduce redundancy, the proposed rule would remove some examples of what it means to coordinate and monitor day-to-day compliance with AML/CFT requirements that are currently listed in the AML program rules for MSBs; insurance companies; DPMSJs; operators of credit card systems; loan or finance companies; and housing GSEs.
81

For example, those AML program rules currently provide that an AML/CFT officer is

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2026-07033. Public record. Not legal advice.