Issuance of a new Anti-Money Laundering (AML)/Countering the Financing of Terrorism (CFT) Program Requirements Notice of Proposed Rulemaking

This section of the FEDERAL REGISTER

contains notices to the public of the proposed

issuance of rules and regulations. The

purpose of these notices is to give interested

persons an opportunity to participate in the

rule making prior to the adoption of the final

rules.

Proposed Rules

Federal Register

18304

Vol. 91, No. 69

Friday, April 10, 2026

DEPARTMENT OF THE TREASURY

Office of the Comptroller of the

Currency

12 CFR Part 21

[Docket ID OCC–2024–0005]

RIN 1557–AF14

FEDERAL DEPOSIT INSURANCE

CORPORATION

12 CFR Part 326

RIN 3064–AF34

NATIONAL CREDIT UNION

ADMINISTRATION

12 CFR Part 748

[Docket ID NCUA–2024–0033]

RIN 3133–AG08

Anti-Money Laundering and

Countering the Financing of Terrorism

Programs

AGENCY: Office of the Comptroller of the

Currency, Treasury; Federal Deposit

Insurance Corporation; and the National

Credit Union Administration.

ACTION: Notice of proposed rulemaking.

SUMMARY: The Office of the Comptroller

of the Currency (OCC), Federal Deposit

Insurance Corporation (FDIC), and the

National Credit Union Administration

(NCUA) (collectively, ‘‘the Agencies’’ or

‘‘Agency’’ when referencing the

singular) are inviting comment on a

proposed rule that would require banks

to establish and maintain effective anti-

money laundering and countering the

financing of terrorism (AML/CFT)

programs reasonably designed to

identify, assess, and mitigate risks of

illicit finance. The amendments are

intended to align with changes that are

being concurrently proposed by the

Financial Crimes Enforcement Network

(FinCEN) to implement provisions of

the Anti-Money Laundering Act of 2020

(AML Act). Among other changes, this

proposed rule would ensure that

institutions establish and maintain

effective AML/CFT programs that are

intended to better achieve the purposes

of the Bank Secrecy Act (BSA),

culminating in the development of

highly useful information related to

illicit financial transactions for law

enforcement and national security

agencies

y Laundering Act of 2020

(AML Act). Among other changes, this

proposed rule would ensure that

institutions establish and maintain

effective AML/CFT programs that are

intended to better achieve the purposes

of the Bank Secrecy Act (BSA),

culminating in the development of

highly useful information related to

illicit financial transactions for law

enforcement and national security

agencies. Through this rulemaking, the

Agencies also intend to modernize and

reform Federal supervision of AML/CFT

programs by enhancing FinCEN’s role in

AML/CFT supervision and enforcement.

DATES: Written comments may be

submitted on or before June 9, 2026.

ADDRESSES: Comments should be

directed to:

OCC: Commenters are encouraged to

submit comments through the Federal

eRulemaking Portal. Please use the title

‘‘Anti-Money Laundering and

Countering the Financing of Terrorism

Programs’’ to facilitate the organization

and distribution of the comments. You

may submit comments by any of the

following methods:

• Federal eRulemaking Portal—

Regulations.gov:

Go to https://regulations.gov/. Enter

Docket ID ‘‘OCC–2024–0005’’ in the

Search Box and click ‘‘Search.’’ Public

comments can be submitted via the

‘‘Comment’’ box below the displayed

document information or by clicking on

the document title and then clicking the

‘‘Comment’’ box on the top-left side of

the screen. For help with submitting

effective comments, please click on

‘‘Commenter’s Checklist.’’ For

assistance with the Regulations.gov site,

please call 1–866–498–2945 (toll free)

Monday–Friday, 9 a.m.–5 p.m. EST, or

email regulationshelpdesk@gsa.gov.

• Mail: Chief Counsel’s Office,

Attention: Comment Processing, Office

of the Comptroller of the Currency, 400

7th Street SW, Suite 3E–218,

Washington, DC 20219.

• Hand Delivery/Courier: 400 7th

Street SW, Suite 3E–218, Washington,

DC 20219.

Instructions: You must include

‘‘OCC’’ as the agency name and Docket

ID ‘‘OCC–2024–0005’’ in your comment

ST, or

email regulationshelpdesk@gsa.gov.

• Mail: Chief Counsel’s Office,

Attention: Comment Processing, Office

of the Comptroller of the Currency, 400

7th Street SW, Suite 3E–218,

Washington, DC 20219.

• Hand Delivery/Courier: 400 7th

Street SW, Suite 3E–218, Washington,

DC 20219.

Instructions: You must include

‘‘OCC’’ as the agency name and Docket

ID ‘‘OCC–2024–0005’’ in your comment.

In general, the OCC will enter all

comments received into the docket and

publish the comments on the

Regulations.gov website without

change, including any business or

personal information provided such as

name and address information, email

addresses, or phone numbers.

Comments received, including

attachments and other supporting

materials, are part of the public record

and subject to public disclosure. Do not

include any information in your

comment or supporting materials that

you consider confidential or

inappropriate for public disclosure.

You may review comments and other

related materials that pertain to this

action by the following method:

• Viewing Comments Electronically—

Regulations.gov:

Go to https://regulations.gov/. Enter

Docket ID ‘‘OCC–2024–0005’’ in the

Search Box and click ‘‘Search.’’ Click on

the ‘‘Dockets’’ tab and then the

document’s title. After clicking the

document’s title, click the ‘‘Browse All

Comments’’ tab. Comments can be

viewed and filtered by clicking on the

‘‘Sort By’’ drop-down on the right side

of the screen or the ‘‘Refine Comments

Results’’ options on the left side of the

screen. Supporting materials can be

viewed by clicking on the ‘‘Browse

Documents’’ tab. Click on the ‘‘Sort By’’

drop-down on the right side of the

screen or the ‘‘Refine Results’’ options

on the left side of the screen checking

the ‘‘Supporting & Related Material’’

checkbox. For assistance with the

Regulations.gov site, please call 1–866–

498–2945 (toll free) Monday–Friday, 9

a.m.–5 p.m. EST, or email

regulationshelpdesk@gsa.gov

by clicking on the ‘‘Browse

Documents’’ tab. Click on the ‘‘Sort By’’

drop-down on the right side of the

screen or the ‘‘Refine Results’’ options

on the left side of the screen checking

the ‘‘Supporting & Related Material’’

checkbox. For assistance with the

Regulations.gov site, please call 1–866–

498–2945 (toll free) Monday–Friday, 9

a.m.–5 p.m. EST, or email

regulationshelpdesk@gsa.gov.

The docket may be viewed after the

close of the comment period in the same

manner as during the comment period.

FDIC: The FDIC encourages interested

parties to submit written comments.

Please include your name, affiliation,

address, email address, and telephone

number(s) in your comment. You may

submit comments to the FDIC,

identified by RIN 3064–AF34, by any of

the following methods:

• Agency Website: https://

www.fdic.gov/resources/regulations/

federal-register-publications. Follow

instructions for submitting comments

on the FDIC’s website.

• Mail: Jennifer M. Jones, Deputy

Executive Secretary, Attention:

Comments/Legal OES (RIN 3064–AF34),

Federal Deposit Insurance Corporation,

550 17th Street NW, Washington, DC

20429.

• Hand Delivered/Courier: Comments

may be hand-delivered to the guard

station at the rear of the 550 17th Street

NW, building (located on F Street NW)

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00001

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

4),

Federal Deposit Insurance Corporation,

550 17th Street NW, Washington, DC

20429.

• Hand Delivered/Courier: Comments

may be hand-delivered to the guard

station at the rear of the 550 17th Street

NW, building (located on F Street NW)

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00001

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

18305

Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules

1 In Section V.A., the Agencies describe the

express incorporation of the countering the

financing of terrorism (CFT) requirements as part of

a bank’s anti-money laundering (AML) program

requirements. For consistency throughout this

proposed rule, AML program requirements will be

described as AML/CFT program requirements.

2 The term ‘‘bank’’ is defined in regulations

implementing the BSA, 31 CFR 1010.100(d), and

includes each agent, agency, branch, or office

within the United States of banks, savings

associations, credit unions, and foreign banks. For

purposes of this proposed rule, the term bank solely

refers to institutions whose primary regulator is one

of the Agencies. The proposed rule would remove

language in 12 CFR 21.21, which contains the

OCC’s program rule requirements, applicable to

state savings associations. This language was

adopted as part of the transfer of authorities from

the Office of Thrift Supervision. In 2020, the FDIC

issued a final rule making 12 CFR part 326

applicable to State savings associations, meaning it

is no longer necessary to cover State savings

associations in 12 CFR 21.21.

3 FinCEN is requesting comment on proposed

amendments to its AML/CFT program rule for

banks at the same time as this proposed rule from

the Agencies. FinCEN’s bank program rule is

located at 31 CFR 1020.210, while each Agency has

its own implementing regulation. See 12 CFR 21.21

(OCC); 12 CFR 326.8 (FDIC); and 12 CFR 748.2

(NCUA).

4 FinCEN currently defines this term in 31 CFR

1010.100(e)

3 FinCEN is requesting comment on proposed

amendments to its AML/CFT program rule for

banks at the same time as this proposed rule from

the Agencies. FinCEN’s bank program rule is

located at 31 CFR 1020.210, while each Agency has

its own implementing regulation. See 12 CFR 21.21

(OCC); 12 CFR 326.8 (FDIC); and 12 CFR 748.2

(NCUA).

4 FinCEN currently defines this term in 31 CFR

1010.100(e). However, FinCEN notes in the

preamble to its concurrently issued rule that the

proposed rule also would make minor changes to

the definitions in FinCEN regulations. These

changes include the definition of ‘‘Bank Secrecy

Act’’ at 31 CFR 1010.100(e), adding statutory

references to the Anti-Money Laundering Act of

2020 (AML Act) and the Corporate Transparency

Act, and removing the reference to ‘‘collection of

statutes commonly referred to as . . . .’’ Certain

criminal statutes—namely, 18 U.S.C. 1956, 1957,

and 1960—are currently included in the BSA

definition at 31 CFR 1010.100(e). Section 6003 of

the AML Act, however, does not include these

provisions in its BSA definition, and thus FinCEN

is not considering them part of the BSA for the

purposes of its proposed rule.

5 31 U.S.C. 5311(1).

on business days between 7 a.m. and 5

p.m., eastern time.

• Email: comments@fdic.gov. Include

the RIN 3064–AF34 on the subject line

of the message.

• Public Inspection: Comments

received, including any personal

information provided, may be posted

without change to https://www.fdic.gov/

resources/regulations/federal-register

publications. Commenters should

submit only information that the

commenter wishes to make available

publicly. The FDIC may review, redact,

or refrain from posting all or any portion

of any comment that it may deem to be

inappropriate for publication, such as

irrelevant or obscene material

ovided, may be posted

without change to https://www.fdic.gov/

resources/regulations/federal-register

publications. Commenters should

submit only information that the

commenter wishes to make available

publicly. The FDIC may review, redact,

or refrain from posting all or any portion

of any comment that it may deem to be

inappropriate for publication, such as

irrelevant or obscene material. The FDIC

may post only a single representative

example of identical or substantially

identical comments, and in such cases

will generally identify the number of

identical or substantially identical

comments represented by the posted

example. All comments that have been

redacted, as well as those that have not

been posted, that contain comments on

the merits of this document will be

retained in the public comment file and

will be considered as required under all

applicable laws. All comments may be

accessible under the Freedom of

Information Act.

NCUA: You may submit comments,

identified by RIN 3133–AG08, by any of

the following methods (please send

comments by one method only):

• Federal eRulemaking Portal:

https://www.regulations.gov. The docket

number for this proposed rule is NCUA–

2024–0033. Follow the instructions for

submitting comments. A plain language

summary of the proposed rule is also

available on the docket website.

• Mail: Address to Melane Conyers-

Ausbrooks, Secretary of the Board,

National Credit Union Administration,

1775 Duke Street, Alexandria, Virginia

22314–3428.

• Hand Delivery/Courier: Same as

mailing address.

• Public Inspection: You may view all

public comments on the Federal

eRulemaking Portal at https://

www.regulations.gov, as submitted,

except for those we cannot post for

technical reasons. The NCUA will not

edit or remove any identifying or

contact information from the public

comments submitted

e Street, Alexandria, Virginia

22314–3428.

• Hand Delivery/Courier: Same as

mailing address.

• Public Inspection: You may view all

public comments on the Federal

eRulemaking Portal at https://

www.regulations.gov, as submitted,

except for those we cannot post for

technical reasons. The NCUA will not

edit or remove any identifying or

contact information from the public

comments submitted. If you are unable

to access public comments on the

internet, you may contact the NCUA for

alternative access by calling (703) 518–

6540 or emailing OGCMail@ncua.gov.

FOR FURTHER INFORMATION CONTACT:

OCC: Kenneth Kohrs, BSA/AML Lead

Expert, Office of the Chief National

Bank Examiner; Jina Cheon, Assistant

Director, Melissa Lisenbee, Counsel,

Scott Burnett, Counsel, or Henry

Barkhausen, Counsel, Bank Advisory

Group, Chief Counsel’s Office, (202)

649–5490, Office of the Comptroller of

the Currency, 400 7th Street SW,

Washington, DC 20219. If you are deaf,

hard of hearing, or have a speech

disability, please dial 7–1–1 to access

telecommunications relay services.

FDIC: Patricia Colohan, Deputy

Director, (202) 898–7283, pcolohan@

fdic.gov, Division of Risk Management

Supervision; Chase Lubbock, Associate

Director, (703) 254–0802, clubbock@

fdic.gov, Division of Risk Management

Supervision; Christy Cornell-Pape,

Acting Chief, Financial Crimes, (415)

808–8090, acornell-pape@fdic.gov,

Division of Risk Management

Supervision; Deborah Tobolowsky,

Counsel, (571) 309–2415, dtobolowsky@

fdic.gov, Legal Division; Thomas Krepp,

Senior Attorney, (678) 916–2265,

tkrepp@fdic.gov, Legal Division; J.

Spencer Culp, Senior Attorney, (816)

234–8049, jaculp@fdic.gov, Legal

Division; Nicholas Kazmerski, Counsel,

Acting Chief, Financial Crimes, (415)

808–8090, acornell-pape@fdic.gov,

Division of Risk Management

Supervision; Deborah Tobolowsky,

Counsel, (571) 309–2415, dtobolowsky@

fdic.gov, Legal Division; Thomas Krepp,

Senior Attorney, (678) 916–2265,

tkrepp@fdic.gov, Legal Division; J.

Spencer Culp, Senior Attorney, (816)

234–8049, jaculp@fdic.gov, Legal

Division; Nicholas Kazmerski, Counsel,

(571) 309–3136, nkazmerski@fdic.gov,

Legal Division.

NCUA: Michael Dondarski, Associate

Director, Office of Examination &

Insurance, (703) 772–4751,

mdondarski@ncua.gov; Janell Portare,

Director, Fraud and Anti-Money

Laundering Division, Office of

Examination & Insurance, (703) 548–

2752, jportare@ncua.gov; Gira Bose,

Senior Staff Attorney, Office of General

Counsel, (703) 518–6540, gbose@

ncua.gov; Damon P. Frank, Senior Trial

Attorney, Office of General Counsel,

(703) 518–6540, dfrank@ncua.gov.

SUPPLEMENTARY INFORMATION:

I. Scope

The proposed rule would amend the

Agencies’ regulations that prescribe

AML/CFT program requirements 1 for

banks 2 supervised by each of the

Agencies in a way that aligns with the

rule concurrently proposed by FinCEN 3

under the BSA.4 While FinCEN has

delegated its authority to examine banks

for compliance with the BSA to the

Agencies, the Agencies also have

independent authority to prescribe

regulations requiring banks to establish

and maintain procedures reasonably

designed to assure and monitor their

compliance with the requirements of

subchapter II of chapter 53 of title 31,

under 12 U.S.C. 1818(s) and 12 U.S.C.

1786(q) (Sections 8(s) of the Federal

Deposit Insurance Act and 206(q) of the

Federal Credit Union Act, respectively).

The Agencies are proposing to amend

their rules concurrently with FinCEN so

that their program requirements for

banks remain consistent with those

imposed by FinCEN

ce with the requirements of

subchapter II of chapter 53 of title 31,

under 12 U.S.C. 1818(s) and 12 U.S.C.

1786(q) (Sections 8(s) of the Federal

Deposit Insurance Act and 206(q) of the

Federal Credit Union Act, respectively).

The Agencies are proposing to amend

their rules concurrently with FinCEN so

that their program requirements for

banks remain consistent with those

imposed by FinCEN. Further, with

consistent regulatory text, banks will

not be subject to any additional burden

or confusion from needing to comply

with differing standards between

FinCEN and the Agencies. The proposed

changes are discussed in more detail

below in the section-by-section analysis.

II. Background

A. Anti-Money Laundering Programs

Under the Bank Secrecy Act and History

of the BSA Compliance Program Rules

for the Agencies

Enacted in 1970 and amended several

times since, the BSA is designed to

combat money laundering, the financing

of terrorism, and other illicit finance

activity risks (collectively, ML/TF

risks).5 Congress has authorized the

Secretary of the Treasury (Secretary) to

administer the BSA. The Secretary has

in turn delegated the authority to

implement, administer, and enforce

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00002

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

18306

Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules

6 Treasury Order 180–01 (Jan. 14, 2020),

paragraph 3; see also 31 U.S.C. 310(b)(2)(I)

(providing that the Director of FinCEN shall

‘‘[a]dminister the requirements of subchapter II of

chapter 53 of this title, chapter 2 of title I of Public

Law 91–508, and section 21 of the Federal Deposit

Insurance Act, to the extent delegated such

authority by the Secretary of the Treasury.’’).

7 Public Law 99–570, section 5318, 100 Stat.

3207, 3207–29 (1986).

8 52 FR 2858 (Jan. 27, 1987).

9 Most recently, Congress enacted the Guiding

and Establishing National Innovation for U.S

I of

chapter 53 of this title, chapter 2 of title I of Public

Law 91–508, and section 21 of the Federal Deposit

Insurance Act, to the extent delegated such

authority by the Secretary of the Treasury.’’).

7 Public Law 99–570, section 5318, 100 Stat.

3207, 3207–29 (1986).

8 52 FR 2858 (Jan. 27, 1987).

9 Most recently, Congress enacted the Guiding

and Establishing National Innovation for U.S.

Stablecoins (GENIUS) Act on July 18, 2025. Public

Law 119–27, codified at 12 U.S.C. 5901 et seq. The

GENIUS Act requires that permitted payment

stablecoin issuers (PPSIs) be treated as financial

institutions under the BSA, including being

required to maintain ‘‘an effective anti-money

laundering program.’’ See 12 U.S.C. 5903(a)(5)(i).

The GENIUS Act also requires the primary Federal

payment stablecoin regulators, which are the

Agencies and the Federal Reserve Board to issue

regulations relating to PPSIs, including Bank

Secrecy Act and sanctions compliance standards.

These AML/CFT standards for PPSIs will be

addressed separately from this rulemaking.

10 Section 1517 of the Annunzio-Wylie Anti-

Money Laundering Act, Public Law 102–550, 106

Stat. 3672 (Oct. 28, 1992) (Annunzio-Wylie).

11 31 U.S.C. 5318(h)(1), as added by section

1517(b) of Annunzio-Wylie. The Agencies note the

proposed rule modifies the current sequencing of

AML/CFT program components; however, the

Agencies do not intend the change in sequencing

to modify or signify changes in any substantive

requirements.

12 31 U.S.C. 5312(a)(2)(E) and 31 U.S.C. 5312(c),

as added by section 321 of the USA PATRIOT Act,

Public Law 107–56, 115 Stat. 272 (Oct. 26, 2001)

(USA PATRIOT Act).

13 31 U.S.C. 5318(h), as added by section 352 of

the USA PATRIOT Act.

14 31 U.S.C. 5318(a)(2), (h)(1), and (h)(2).

15 See FinCEN, Customer Due Diligence

Requirements for Financial Institutions, 81 FR

29398 (May 11, 2016).

16 68 FR 25090 (May 9, 2003).

17 31 U.S.C. 5318(l), as added by section 326 of

the USA PATRIOT Act.

18 81 FR 29398 (May 11, 2016)

72 (Oct. 26, 2001)

(USA PATRIOT Act).

13 31 U.S.C. 5318(h), as added by section 352 of

the USA PATRIOT Act.

14 31 U.S.C. 5318(a)(2), (h)(1), and (h)(2).

15 See FinCEN, Customer Due Diligence

Requirements for Financial Institutions, 81 FR

29398 (May 11, 2016).

16 68 FR 25090 (May 9, 2003).

17 31 U.S.C. 5318(l), as added by section 326 of

the USA PATRIOT Act.

18 81 FR 29398 (May 11, 2016).

19 Press Release, Joint Statement on Enforcement

of Bank Secrecy Act/Anti-Money Laundering

Requirements (Aug. 13, 2020), https://www.occ.gov/

news-issuances/bulletins/2020/bulletin-2020-

75.html and https://www.fdic.gov/news/press-

releases/2020/pr20091a.pdf.

20 William M. (Mac) Thornberry National Defense

Authorization Act for Fiscal Year 2021, Public Law

116–283, 134 Stat. 3388 (Jan. 1, 2021).

21 Congress noted in its Joint Explanatory

Statement (JES) of the Committee of Conference

accompanying the FY21 NDAA that: ‘‘the current

[AML/CFT] regulatory framework is an

amalgamation of statutes and regulations that are

grounded in the [BSA], which the Congress enacted

in 1970. This decades-old regime, which has not

seen comprehensive reform and modernization

since its inception, is generally built on individual

reporting mechanisms (i.e., currency transaction

reports (CTRs) and suspicious activity reports

(SARs)) and contemplates aging, decades-old

compliance with the BSA and its

associated regulations to the Director of

FinCEN (FinCEN Director).6

The Money Laundering Control Act of

1986 (MLCA) 7 amended 12 U.S.C.

1818(s) and 12 U.S.C. 1786(q) (sections

8(s) of the Federal Deposit Insurance

Act and 206(q) of the Federal Credit

Union Act, respectively) to require the

Agencies and the Board of Governors of

the Federal Reserve System (Federal

Reserve Board) to issue regulations

requiring their supervised banks to

‘‘establish and maintain procedures

reasonably designed to assure and

monitor their compliance’’ with the

requirements of the BSA

(s) of the Federal Deposit Insurance

Act and 206(q) of the Federal Credit

Union Act, respectively) to require the

Agencies and the Board of Governors of

the Federal Reserve System (Federal

Reserve Board) to issue regulations

requiring their supervised banks to

‘‘establish and maintain procedures

reasonably designed to assure and

monitor their compliance’’ with the

requirements of the BSA. Consistent

with the MLCA, on January 27, 1987, all

the then-Federal bank regulatory

agencies issued substantially similar

regulations requiring their supervised

banks to develop procedures for BSA

compliance.8

Since its original enactment, Congress

has continued to address various

aspects of AML/CFT compliance,

including through expansion of the

BSA.9 In 1992, the Annunzio-Wylie

Anti-Money Laundering Act 10 gave the

Secretary authority to prescribe

minimum standards for AML programs,

including: ‘‘(A) the development of

internal policies, procedures, and

controls, (B) the designation of a

compliance officer, (C) an ongoing

employee training program, and (D) an

independent audit function to test

programs’’—what are often called the

‘‘four pillars’’ of AML/CFT programs.11

Later, the Uniting and Strengthening

America by Providing Appropriate

Tools Required to Intercept and

Obstruct Terrorism Act of 2001 (USA

PATRIOT Act) further amended the

BSA to include, among other things,

customer identification program (CIP)

requirements and the expansion of AML

program rules to cover certain other

financial industry participants (e.g.,

credit unions and futures commission

merchants).12 The USA PATRIOT Act

also made it mandatory for financial

institutions to maintain AML programs

that meet minimum prescribed

standards.13 Through the exercise of its

delegated authority, FinCEN is

authorized to require each financial

institution to establish an AML/CFT

program to ensure compliance with the

BSA and guard against ML/TF risks.14

Over time, FinCEN, the Agencies, and

the Federal Reserve Board inco

lso made it mandatory for financial

institutions to maintain AML programs

that meet minimum prescribed

standards.13 Through the exercise of its

delegated authority, FinCEN is

authorized to require each financial

institution to establish an AML/CFT

program to ensure compliance with the

BSA and guard against ML/TF risks.14

Over time, FinCEN, the Agencies, and

the Federal Reserve Board incorporated

many of these standards into their

respective program rules, and FinCEN

implemented additional requirements

for certain covered financial institutions

into their respective program rules.15

Although in practice the FinCEN

AML program rule and the Agencies’

compliance program rules for banks

they supervise operate together, since

the USA PATRIOT Act, banks under the

Agencies’ supervision have been

required to maintain compliance

programs under separate legal

authorities administered by (i) FinCEN

under Title 31 and (ii) the Agencies

under sections 8(s) and 206(q). Because

the authority for each Agency’s BSA

compliance program rule derives from

and is required by sections 8(s) and

206(q), each Agency prescribes

regulations requiring the banks they

supervise to establish and maintain

procedures reasonably designed to

assure and monitor the compliance of

such banks with the requirements of the

BSA.

In 2003, FinCEN, the Agencies, the

Federal Reserve Board, the Securities

and Exchange Commission, and the

Commodity Futures Trading

Commission jointly issued final rules on

CIP requirements,16 which were

mandated by amendments to the BSA

under the USA PATRIOT Act requiring

financial institutions to implement a

CIP as part of their BSA compliance

program.17 The CIP requirements

became part of the separate AML

program rules for banks administered by

FinCEN and each of the Agencies as

well as the Federal Reserve Board,

although the rules continued to function

together by allowing banks to satisfy

FinCEN’s rule by complying with their

Agency’s rule or, as appropriate, the

Federal

to implement a

CIP as part of their BSA compliance

program.17 The CIP requirements

became part of the separate AML

program rules for banks administered by

FinCEN and each of the Agencies as

well as the Federal Reserve Board,

although the rules continued to function

together by allowing banks to satisfy

FinCEN’s rule by complying with their

Agency’s rule or, as appropriate, the

Federal Reserve Board’s rule.

In 2016, FinCEN amended its AML

compliance program rules to

incorporate customer due diligence

(CDD) requirements, including

beneficial ownership information

collection requirements for certain

covered financial institutions, including

banks.18 Although the Agencies did not

promulgate CDD requirements at that

time, the Agencies examined supervised

banks for compliance with those

requirements under the authority of

sections 8(s) and 206(q).19 With the

exception of the CDD requirement,

FinCEN’s rule was substantially similar

to the rules of the Agencies and the

Federal Reserve Board’s rules, and

banks must currently comply with both

FinCEN’s AML bank program rule and

the BSA compliance rules of the

Agencies and, as appropriate, the

Federal Reserve Board.

B. The Anti-Money Laundering Act of

2020

On January 1, 2021, Congress enacted

the William M. (Mac) Thornberry

National Defense Authorization Act for

Fiscal Year 2021, of which the AML Act

was a component.20 With the passage of

the AML Act, Congress stated that it was

seeking to modernize and strengthen the

AML/CFT regulatory framework, which

‘‘had not seen comprehensive reform or

modernization’’ since the BSA was

enacted in the 1970s.21 Among other

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00003

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

passage of

the AML Act, Congress stated that it was

seeking to modernize and strengthen the

AML/CFT regulatory framework, which

‘‘had not seen comprehensive reform or

modernization’’ since the BSA was

enacted in the 1970s.21 Among other

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00003

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

18307

Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules

technology, rather than the current, sophisticated

AML compliance systems now managed by most

financial institutions.’’ Congress further stated that

the AML Act ‘‘comprehensively update[s] the BSA

for the first time in decades and provide[s] for the

establishment of a coherent set of risk-based

priorities.’’ Among other objectives, Congress

intended for the AML Act to require ‘‘more routine

and systemic coordination, communication, and

feedback among financial institutions, regulators,

and law enforcement to identify suspicious

financial activities, better focusing bank resources

to the AML task, which will increase the likelihood

for better law enforcement outcomes.’’ H.R. Rep.

No. 6395 (2020) at pp. 731–732 (Joint Explanatory

Statement of the Committee of Conference).

22 H.R. Rep. No. 6395 (2020) at 732 (Joint

Explanatory Statement of the Committee of

Conference), https://docs.house.gov/billsthisweek/

20201207/116hrpt617-

JointExplanatoryStatement.pdf.

23 See AML/CFT Priorities (June 30, 2021). As

required by 31 U.S.C. 5318(h)(4)(C), the AML/CFT

Priorities are consistent with Treasury’s National

Strategy for Combating Terrorist and Other Illicit

Financing (May 16, 2024). The AML/CFT Priorities

are supported by Treasury’s National Risk

Assessments on Money Laundering, Terrorist

Financing, and Proliferation Financing (Mar. 2026).

Additionally, Treasury is required to consult with

the Agencies on the National Illicit Finance

Strategy, which must include a risk assessment

y’s National

Strategy for Combating Terrorist and Other Illicit

Financing (May 16, 2024). The AML/CFT Priorities

are supported by Treasury’s National Risk

Assessments on Money Laundering, Terrorist

Financing, and Proliferation Financing (Mar. 2026).

Additionally, Treasury is required to consult with

the Agencies on the National Illicit Finance

Strategy, which must include a risk assessment. See

Combating Terrorism and Illicit Financing, Public

Law 115–44, 131 Stat. 934 (2017). As also required

by 31 U.S.C. 5318(h)(4)(B), the Secretary, in

consultation with the Attorney General, Federal

functional regulators, relevant State financial

regulators, and relevant national security agencies,

must update the AML/CFT Priorities not less

frequently than once every four years.

24 See OCC Bulletin 23019–33, Bank Secrecy Act/

Anti-Money Laundering: Joint Statement on the

Risk-Focused Approach to BSA/AML Supervision

(July 22, 2019).

25 See, e.g., Joint Statement on the Risk-Based

Approach to Assessing Customer Relationships and

Conducting Customer Due Diligence (July 6, 2022)

(‘‘Customer relationships present varying levels of

money laundering, terrorist financing, and other

illicit financial activity risks. The potential risk to

a bank depends on the presence or absence of

numerous factors, including facts and

circumstances specific to the customer relationship.

The Agencies continue to encourage banks to

manage customer relationships and mitigate risks

based on customer relationships, rather than

decline to provide banking services to entire

categories of customers.’’)

26 OCC, FDIC, NCUA, FinCEN, Agencies Issue

Exemption Order to Customer Identification

Program Requirements, (Jun. 27, 2025), https://

www.occ.gov/news-issuances/news-releases/2025/

nr-ia-2025-60.html.

27 FinCEN et. al, Answers to Frequently Asked

Questions Regarding Suspicious Activity Reporting

and Other Anti-Money Laundering Considerations

(Jan

ices to entire

categories of customers.’’)

26 OCC, FDIC, NCUA, FinCEN, Agencies Issue

Exemption Order to Customer Identification

Program Requirements, (Jun. 27, 2025), https://

www.occ.gov/news-issuances/news-releases/2025/

nr-ia-2025-60.html.

27 FinCEN et. al, Answers to Frequently Asked

Questions Regarding Suspicious Activity Reporting

and Other Anti-Money Laundering Considerations

(Jan. 19, 2021) (clarifying, among other things, that

there is no BSA regulatory requirement to terminate

a customer relationship after the filing of a SAR or

any specific number of SARs). See also FinCEN et.

al, Frequently Asked Questions Regarding

Suspicious Activity Reporting Requirements (Oct.

9, 2025), https://www.fincen.gov/system/files/2025-

10/SAR-FAQs-October-2025.pdf (clarifying filing

requirements related to potential structuring-related

activity, documentation requirements related to not

filing a SAR on potentially suspicious activity, and

certain aspects of continuing activity reporting).

28 FinCEN, Anti-Money Laundering Program

Effectiveness, 85 FR 58023 (Sept. 17, 2020).

objectives, Congress intended for the

AML Act to require ‘‘more routine and

systemic coordination, communication,

and feedback among financial

institutions, regulators, and law

enforcement to identify suspicious

financial activities, better focusing bank

resources to the AML task, which will

increase the likelihood for better law

enforcement outcomes.’’ 22

Section 6101(b) of the AML Act made

several changes to the BSA’s AML/CFT

program requirements.

First, section 6101(b) amended the

BSA at 31 U.S.C. 5318(h)(2)(B) to state

that, ‘‘[i]n prescribing the minimum

standards for [AML/CFT programs], and

in supervising and examining

compliance with those standards, the

Secretary of the Treasury, and the

appropriate Federal functional regulator

(as defined in section 509 of the Gramm-

Leach-Bliley Act (15 U.S.C. 6809)) shall

take into account’’ certain factors

(b) amended the

BSA at 31 U.S.C. 5318(h)(2)(B) to state

that, ‘‘[i]n prescribing the minimum

standards for [AML/CFT programs], and

in supervising and examining

compliance with those standards, the

Secretary of the Treasury, and the

appropriate Federal functional regulator

(as defined in section 509 of the Gramm-

Leach-Bliley Act (15 U.S.C. 6809)) shall

take into account’’ certain factors.

Second, section 6101(b) requires the

Secretary, in consultation with the

Attorney General, appropriate Federal

functional regulators, relevant State

financial regulators, and relevant

national security agencies, to establish

and make public government-wide

AML/CFT priorities (AML/CFT

Priorities). After consultation with the

Federal functional regulators and

relevant State financial regulators, the

Secretary must promulgate regulations,

as appropriate, to incorporate those

priorities into revised program rules,

and incorporation of the priorities must

be included as a measure on which

financial institutions are supervised and

examined. FinCEN issued the first

AML/CFT Priorities on June 30, 2021.23

Third, section 6101(b) expands the

BSA’s program rule requirement to

formally include an express reference to

CFT in addition to AML.

Fourth, section 6101(b) provides that

the duty to establish, maintain, and

enforce an AML/CFT program shall

remain the responsibility of, and be

performed by, persons in the United

States who are accessible to, and subject

to oversight and supervision by, the

Secretary and the appropriate Federal

functional regulator.

C. Prior BSA Modernization Efforts

The proposed rule also builds upon

other recent efforts by FinCEN, the

Agencies, and the Federal Reserve

Board to modernize AML/CFT

compliance program requirements for

banks, both before and after the passage

of the AML Act

ho are accessible to, and subject

to oversight and supervision by, the

Secretary and the appropriate Federal

functional regulator.

C. Prior BSA Modernization Efforts

The proposed rule also builds upon

other recent efforts by FinCEN, the

Agencies, and the Federal Reserve

Board to modernize AML/CFT

compliance program requirements for

banks, both before and after the passage

of the AML Act. These efforts include

actions taken to revise the BSA

regulatory regime through rulemakings,

providing exemptive relief from

regulatory requirements consistent with

the purposes of the BSA, and clarifying

regulatory requirements and supervisory

standards through policy documents.

For example, on July 22, 2019,

FinCEN, the Agencies, and the Federal

Reserve Board issued a joint statement

to clarify and explain their existing risk-

focused approach to examinations of

banks’ BSA/AML compliance program.

This statement was intended to increase

transparency into the risk-focused

approach used by the Agencies and the

Federal Reserve Board for planning and

performing BSA/AML examinations,

which included clarifying that the

Agencies and the Federal Reserve Board

‘‘generally allocate more resources to

higher-risk areas, and fewer resources to

lower-risk areas’’ based on the bank’s

unique risk profile.24 FinCEN, the

Agencies, and the Federal Reserve

Board have also taken steps to highlight

that customer relationships present

varying levels of ML/TF risk and, in

turn, to encourage banks to manage

customer relationships and mitigate

risks based on customer relationships,

rather than decline to provide banking

services to entire categories of

customers.25 More recently, the

Agencies and the Federal Reserve Board

have, with FinCEN’s concurrence,

issued an order permitting banks, as

part of their CIP obligations, to collect

Taxpayer Identification Number

information from a third party rather

than directly from the bank’s customer,

subject to certain conditions.26 FinCEN,

the Agencies, and the

services to entire categories of

customers.25 More recently, the

Agencies and the Federal Reserve Board

have, with FinCEN’s concurrence,

issued an order permitting banks, as

part of their CIP obligations, to collect

Taxpayer Identification Number

information from a third party rather

than directly from the bank’s customer,

subject to certain conditions.26 FinCEN,

the Agencies, and the Federal Reserve

Board have also issued Frequently

Asked Questions to clarify certain

obligations related to filing a suspicious

activity report (SAR) to help ensure

banks are not needlessly expending

resources on efforts that do not provide

law enforcement and national security

agencies with the critical information

they need to detect, combat, and deter

criminal activity, as well as to combat

misconceptions that banks are required

to terminate customer relationships

based on the filing of a SAR.27

With respect to prior rulemaking

efforts, prior to the enactment of the

AML Act, FinCEN published an

ANPRM seeking public comment on

potential regulatory amendments

intended to increase the effectiveness of

program rule requirements

(Effectiveness ANPRM), which was

informed by recommendations of the

AML Effectiveness Bank Secrecy Act

Advisory Group working group.28 While

the Effectiveness ANPRM was issued by

FinCEN on a standalone basis, the

Agencies and Federal Reserve Board

were consultative partners with FinCEN

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00004

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

mendations of the

AML Effectiveness Bank Secrecy Act

Advisory Group working group.28 While

the Effectiveness ANPRM was issued by

FinCEN on a standalone basis, the

Agencies and Federal Reserve Board

were consultative partners with FinCEN

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00004

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

18308

Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules

29 FinCEN, Anti-Money Laundering and

Countering the Financing of Terrorism

Requirements, 89 FR 55428 (Jul. 3, 2024).

30 OCC, Federal Reserve Board, FDIC and the

NCUA, Anti-Money Laundering and Countering the

Financing of Terrorism Requirements, 89 FR 65242

(Aug. 9, 2024).

31 For an overview of the content of the

Effectiveness ANPRM and the 2024 Program NPRM,

and for an overview of comments received on both,

refer to FinCEN’s proposed revisions to its AML/

CFT program requirements, issued concurrently

with this NPRM.

32 31 U.S.C. 5311.

33 31 U.S.C. 5318(h)(2).

34 Federal Reserve Board, FDIC, NCUA, OCC,

Joint Statement on Enforcement of Bank Secrecy

Act/Anti-Money Laundering Requirements, (Aug.

13, 2020), https://www.federalreserve.gov/frrs/

regulations/statement-on-bank-secrecy-act-anti-

money-laundering-enforcement.htm.

when developing the proposal. More

recently, on July 3, 2024, FinCEN

published an NPRM proposing revisions

to its AML/CFT program requirements

for all financial institutions, including

those applicable to banks,29 and on

August 9, 2024, the Agencies, along

with the Federal Reserve Board, issued

an NPRM proposing substantially

similar amendments to their respective

AML program rules applicable to banks

they supervise (the 2024 Program

NPRM).30

In proposing this rule in coordination

with FinCEN, the Agencies considered

applicable statutory requirements and

prior feedback on these recent BSA

modernization efforts, including

comments provided on FinCEN’s

Effectiveness ANPRM and those

PRM proposing substantially

similar amendments to their respective

AML program rules applicable to banks

they supervise (the 2024 Program

NPRM).30

In proposing this rule in coordination

with FinCEN, the Agencies considered

applicable statutory requirements and

prior feedback on these recent BSA

modernization efforts, including

comments provided on FinCEN’s

Effectiveness ANPRM and those

received on the 2024 Program NPRMs.

While building upon these prior

modernization efforts, the proposed rule

is distinct and separate from prior BSA

modernization rulemaking efforts.31

III. Overview of the Proposed Rule

A central objective of the Agencies’

BSA modernization efforts is to create

an AML/CFT supervisory and regulatory

regime that is more effective in

achieving the purposes of the BSA and

culminating in the development of

highly useful information related to

illicit financial transactions for law

enforcement and national security

agencies.32 The proposed rule would

further that objective by explicitly

defining the requirements for a bank to

establish and maintain an effective

AML/CFT program. It would also adopt

into regulations the AML Act’s

expectation that AML/CFT programs

should be risk-based, including

ensuring that banks direct more

attention and resources toward higher-

risk customers and activities, consistent

with the risk profile of the bank, rather

than toward lower-risk customers and

activities.33

The proposed rule would also revise

the AML/CFT supervisory and

examination process for banks by

enhancing FinCEN’s role in the

Agencies’ AML/CFT-related supervision

and enforcement process. In support of

this objective, the proposed rule would

establish a mechanism in which

FinCEN—as the statutory administrator

of the BSA—has an opportunity to

review and provide feedback to the

Agencies prior to certain AML/CFT-

related enforcement and supervisory

actions

tion process for banks by

enhancing FinCEN’s role in the

Agencies’ AML/CFT-related supervision

and enforcement process. In support of

this objective, the proposed rule would

establish a mechanism in which

FinCEN—as the statutory administrator

of the BSA—has an opportunity to

review and provide feedback to the

Agencies prior to certain AML/CFT-

related enforcement and supervisory

actions. This change will promote

consistent approaches to AML/CFT

supervision, culminating in the

development of highly useful

information related to illicit financial

transactions for both banks and the law

enforcement and national security

agencies that depend upon those banks’

critical BSA reporting. The enforcement

requirements only apply to actions by

the Agencies.

Proposed Rule

As noted above, the proposed rule

would require banks to establish and

maintain effective AML/CFT programs

and define the requirements for doing

so. In order for an AML/CFT program to

be effective, the proposed rule would

require a bank to establish an AML/CFT

program and then maintain the AML/

CFT program by implementing, in all

material respects, the established AML/

CFT program.

As described in more detail in section

IV.D a bank would be required to

establish a risk-based set of internal

policies, procedures, and controls that is

reasonably designed to ensure

compliance with the BSA and its

implementing regulations, 31 CFR

chapter X

L/CFT

program and then maintain the AML/

CFT program by implementing, in all

material respects, the established AML/

CFT program.

As described in more detail in section

IV.D a bank would be required to

establish a risk-based set of internal

policies, procedures, and controls that is

reasonably designed to ensure

compliance with the BSA and its

implementing regulations, 31 CFR

chapter X. The risk-based set of internal

policies, procedures, and controls must

also be reasonably designed to (1)

identify, assess, and document the

bank’s ML/TF risks through risk

assessment processes that evaluate the

risks of the bank’s business activities,

review and, as appropriate, incorporate

the AML/CFT Priorities, and are

updated promptly upon any change that

the bank knows or has reason to know

significantly changes the bank’s ML/TF

risks; (2) mitigate the bank’s ML/TF

risks consistent with the bank’s risk

assessment processes including by

directing more attention and resources

toward higher-risk customers and

activities, rather than toward lower-risk

customers and activities; and (3)

conduct ongoing customer due

diligence.

The proposed rule would also require

a bank to establish an ongoing employee

training program and independent

AML/CFT program testing as part of its

AML/CFT program. Finally, the

proposed rule would require a bank to

designate an individual responsible for

establishing and implementing the

AML/CFT program and coordinating

and monitoring day-to-day compliance;

that individual would be required to be

located in the United States and

accessible to, and subject to oversight

and supervision by, FinCEN or its

designee and the appropriate Agency.

Under the proposed rule, in addition

to establishing an AML/CFT program,

the bank would be required to maintain

that program by implementing, in all

material respects, its established AML/

CFT program

nce;

that individual would be required to be

located in the United States and

accessible to, and subject to oversight

and supervision by, FinCEN or its

designee and the appropriate Agency.

Under the proposed rule, in addition

to establishing an AML/CFT program,

the bank would be required to maintain

that program by implementing, in all

material respects, its established AML/

CFT program. By structuring the

requirement to have an effective AML/

CFT program as distinct obligations to

establish and maintain (via

implementation) an AML/CFT program,

the proposed rule is intended to clarify

and reinforce the distinction between

failures to establish an AML/CFT

program and failures to implement a

properly established program.

The distinction between establishing

a program and maintaining a program

by implementing it in all material

respects is particularly important under

the proposed rule for potential

supervisory and enforcement actions.

The proposed rule would not limit

enforcement or supervisory actions for

failures to establish an AML/CFT

program. However, once a bank has

properly established an AML/CFT

program, the proposed rule would raise

the threshold for significant supervisory

or enforcement actions based solely on

implementation deficiencies. Only

significant or systemic failures by a

bank to implement in all material

respects an established program would

warrant an ‘‘AML/CFT enforcement

action’’ or a ‘‘significant AML/CFT

supervisory action,’’ as these terms are

defined in the proposed rule

proposed rule would raise

the threshold for significant supervisory

or enforcement actions based solely on

implementation deficiencies. Only

significant or systemic failures by a

bank to implement in all material

respects an established program would

warrant an ‘‘AML/CFT enforcement

action’’ or a ‘‘significant AML/CFT

supervisory action,’’ as these terms are

defined in the proposed rule. In this

way, the proposed rule is intended to

clarify and reinforce a supervisory and

enforcement focus on addressing

significant or systemic failures to

implement a properly established AML/

CFT program, rather than on isolated,

technical, or immaterial implementation

issues.34

Importantly, under the proposed

regulations, having an effective AML/

CFT program would be more than a one-

time adoption of a risk-based set of

internal policies, procedures, and

controls. Rather, a bank would be

required to keep its risk-based set of

internal policies, procedures, and

controls—and the risk assessment

processes that inform them—current as

the bank’s risk profile changes. For

example, while a bank’s risk-based set

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00005

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

18309

Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules

35 Countering the financing of terrorism (CFT)

includes laws, rules, regulations, or other measures

intended to detect and disrupt the solicitation,

collection, or provision of funds to support terrorist

acts or terrorist organizations, or other violent

extremist groups.

of internal policies, procedures, and

controls may, at one time, have been

reasonably designed, they may no

longer be reasonably designed given

changes to the bank’s risk profile

s, rules, regulations, or other measures

intended to detect and disrupt the solicitation,

collection, or provision of funds to support terrorist

acts or terrorist organizations, or other violent

extremist groups.

of internal policies, procedures, and

controls may, at one time, have been

reasonably designed, they may no

longer be reasonably designed given

changes to the bank’s risk profile.

Similarly, an AML/CFT program would

be more than a one-time creation of an

employee training program or initiation

of an independent testing mechanism:

the bank would be required to keep

such aspects of the AML/CFT program

current as the bank’s risk profile

changes. Thus, even where a bank has

previously established an AML/CFT

program in accordance with the

proposed rule, a failure to update the

program to reflect significant changes in

the bank’s risk profile may result in the

program no longer meeting the program

establishment requirements, and the

bank may accordingly be subject to

supervisory or enforcement action for a

failure to establish an effective AML/

CFT program.

The proposed rule would also provide

FinCEN with a greater role in the

Agencies’ supervisory process. To better

ensure that the Agencies are performing

‘‘risk-focused’’ BSA supervision, the

proposed rule would require that the

Agencies consult with FinCEN prior to

taking an AML/CFT enforcement action

or a significant AML/CFT supervisory

action. The Agencies would be required

to give FinCEN written notice at least 30

days prior to taking such an action.

FinCEN would have an opportunity to

review the action and the relevant

underlying information giving rise to it,

and the Agencies would be required to

consider any input offered by FinCEN

concerning the effectiveness of the

bank’s AML/CFT program

icant AML/CFT supervisory

action. The Agencies would be required

to give FinCEN written notice at least 30

days prior to taking such an action.

FinCEN would have an opportunity to

review the action and the relevant

underlying information giving rise to it,

and the Agencies would be required to

consider any input offered by FinCEN

concerning the effectiveness of the

bank’s AML/CFT program.

By explicitly defining the

requirements for a bank to establish and

maintain an effective AML/CFT

program, and by standardizing the

AML/CFT supervision and enforcement

process for banks and across the

Agencies, the proposed rule is expected

to better achieve the purposes of the

BSA, culminating in the development of

highly useful information related to

illicit financial transactions for banks

and law enforcement and national

security agencies. However, the

Agencies do not intend for the proposed

rule to provide banks permission to

establish an AML/CFT program that

might be interpreted as meeting the

proposed rule’s technical requirements

on their face, but do not effectively

detect and prevent ML/TF activity. To

establish a compliant AML/CFT

program under the proposed rule, a

bank must, among other things,

establish a risk-based set of internal

policies, procedures, and controls that is

reasonably designed to ensure

compliance with the BSA and 31 CFR

chapter X, including through the

adoption of risk assessment processes. A

critical element of this requirement is

that the bank’s s risk-based set of

internal policies, procedures, and

controls be ‘‘reasonably designed.’’ For

example, if a bank’s program testing

reveals that a new customer type or new

activity is high risk, but the bank does

not take any action to revise the design

of its risk-based set of internal policies,

procedures, and controls and therefore

treats the customer or activity as

presenting low risk, then its program

should not be considered reasonably

designed

e ‘‘reasonably designed.’’ For

example, if a bank’s program testing

reveals that a new customer type or new

activity is high risk, but the bank does

not take any action to revise the design

of its risk-based set of internal policies,

procedures, and controls and therefore

treats the customer or activity as

presenting low risk, then its program

should not be considered reasonably

designed. The Agencies believe that

banks have a better understanding of

their customer bases and businesses and

are best positioned to identify and

evaluate their ML/TF risks. Therefore,

under this proposed rule banks will

continue to have significant flexibility

and discretion in their decisions and

determinations related to risk

identification and resource allocation.

The Agencies will assess whether: (1) a

bank’s resource allocation decisions are

consistent with a reasonably designed

risk assessment processes; and (2) with

respect to implementation, specifically,

whether the bank knows or should

know of resource-related issues

involving its risk-based set of internal

policies, procedures, and controls that

may result in the bank failing to

implement its AML/CFT program in all

material respects and has failed to

address such issues.

Similarly, the Agencies expect a bank

to be examined for its implementation

of the established AML/CFT program in

all material respects. Merely designating

an individual responsible for

establishing and implementing the

AML/CFT program and having that

individual establish risk-based internal

policies, procedures, and controls, an

ongoing employee training program, and

an independent AML/CFT program

testing program, are not sufficient to

satisfy the proposed rule’s obligations

for a bank to have an effective AML/CFT

program

rely designating

an individual responsible for

establishing and implementing the

AML/CFT program and having that

individual establish risk-based internal

policies, procedures, and controls, an

ongoing employee training program, and

an independent AML/CFT program

testing program, are not sufficient to

satisfy the proposed rule’s obligations

for a bank to have an effective AML/CFT

program. Rather, a bank would be

examined for the implementation, in all

material aspects, of its established AML/

CFT program, including the

determination that the bank is, in fact,

allocating resources commensurate with

its established AML/CFT program,

which the proposed rule would require

to be consistent with and its reasonably

designed risk assessment processes.

IV. Section-by-Section Analysis

This section-by-section analysis

describes the specific proposed changes

to the Agencies’ BSA compliance

program rules. Section IV.A addresses

the proposed incorporation of CFT into

the program rules. Section IV.B

discusses the requirements for an

‘‘effective’’ AML/CFT program to

comply with the requirements of the

proposed rule. Section IV.C explains

what it means to ‘‘establish’’ and

‘‘maintain’’ an effective AML/CFT

program. Section IV.D describes the

components of program establishment,

including (1) a risk-based set of internal

policies, procedures, and controls

(including risk assessment processes);

the requirements for an

‘‘effective’’ AML/CFT program to

comply with the requirements of the

proposed rule. Section IV.C explains

what it means to ‘‘establish’’ and

‘‘maintain’’ an effective AML/CFT

program. Section IV.D describes the

components of program establishment,

including (1) a risk-based set of internal

policies, procedures, and controls

(including risk assessment processes);

(2) independent program testing; (3) an

individual, located in the United States

and accessible to FinCEN and the

Agencies, responsible for establishing

and maintaining the program, and

coordinating and monitoring day-to-day

compliance; and (4) ongoing employee

training. Section IV.E discusses the

requirements that the AML/CFT

program be written, accessible, and

approved by a bank’s Board of Directors,

an equivalent governing body within the

bank, or appropriate senior

management. Section IV.F addresses the

Customer Identification Program,

Section IV.G addresses the supervision

and enforcement section of the

proposed rule, and Section IV.H

discusses technical changes that the

proposal makes to the existing rules to

improve clarity and consistency across

the program rules. Lastly, Section IV.I

discusses disclosure of supervisory

information.

A. Inserting the Term ‘‘CFT’’ Into the

Program Rules

Section 6101(b)(2)(A) of the AML Act

amends 31 U.S.C. 5318(h)(1) to

reference ‘‘countering the financing of

terrorism’’ 35 in addition to ‘‘anti-money

laundering’’ when describing the

requirement to establish an AML/CFT

program. The Agencies propose to

update the AML/CFT program rules to

reflect this new statutory language. For

example, the proposed rule would

change the title of the Agencies’

program rules from ‘‘Bank Secrecy Act

compliance’’ to ‘‘Anti-Money

Laundering/Countering the Financing of

Terrorism Compliance, Supervision,

and Enforcement.’’ Similar changes

would apply to the titles of relevant

parts and subparts

s propose to

update the AML/CFT program rules to

reflect this new statutory language. For

example, the proposed rule would

change the title of the Agencies’

program rules from ‘‘Bank Secrecy Act

compliance’’ to ‘‘Anti-Money

Laundering/Countering the Financing of

Terrorism Compliance, Supervision,

and Enforcement.’’ Similar changes

would apply to the titles of relevant

parts and subparts.

The inclusion of ‘‘CFT’’ in the BSA

compliance program rule would not

create new obligations for banks, insofar

as the USA PATRIOT Act already

requires them to account for risks

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00006

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

18310

Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules

36 See 31 U.S.C. 5318(h)(2)(B)(iii).

37 Federal Financial Institution Examination

Council, BSA/AML Assessing Compliance with

BSA Regulatory Requirements — Suspicious

Activity Reporting, https://bsaaml.ffiec.gov/

manual/AssessingComplianceWithBSARegulatory

Requirements/04.

38 William M. (Mac) Thornberry National Defense

Authorization Act for Fiscal Year 2021, Public Law

116–283, 134 Stat. 4547 at section 6002(3) (Jan. 1,

2021).

39 Federal Reserve Board, FDIC, FinCEN, NCUA,

OCC, Joint Statement on Innovative Efforts to

Combat Money Laundering and Terrorist Financing,

(Dec. 3, 2018), https://www.fincen.gov/system/files/

2018-12/Joint%20Statement%20

on%20Innovation%20Statement%20

%28Final%2011-30-18%29_508.pdf.

40 For instance, the provision of the BSA which

requires financial institutions to have AML/CFT

program rules states that ‘‘each financial institution

shall establish’’ (emphasis added) such programs,

including certain requirements as specified. See 31

U.S.C. 5318(h)(1)

//www.fincen.gov/system/files/

2018-12/Joint%20Statement%20

on%20Innovation%20Statement%20

%28Final%2011-30-18%29_508.pdf.

40 For instance, the provision of the BSA which

requires financial institutions to have AML/CFT

program rules states that ‘‘each financial institution

shall establish’’ (emphasis added) such programs,

including certain requirements as specified. See 31

U.S.C. 5318(h)(1). The corresponding Federal

statute requiring each appropriate Federal banking

agency to prescribe regulations requiring their

supervised institutions to have BSA compliance

programs states that these banks must ‘‘establish

and maintain procedures reasonably designed to

assure and monitor the compliance’’ with the

requirements of the BSA. 12 U.S.C. 1818(s)(1).

related to terrorist financing.

Accordingly, the Agencies expect any

changes to existing AML/CFT programs

from the amendments described in this

subsection to be technical and therefore

not have any substantive impact on

banks’ compliance obligations.

B. An ‘‘Effective’’ AML/CFT Program

In prescribing the minimum standards

for an AML/CFT program and in

supervising and examining compliance

with those standards, the AML Act

requires the Secretary and the

appropriate Federal functional regulator

to take into account that effective AML/

CFT programs safeguard national

security and help law enforcement

prevent the flow of illicit funds in the

financial system.36 Further, the AML

Act contemplates AML/CFT

requirements focusing on achieving

effective outcomes rather than dictating

the processes used to reach those

outcomes, an orientation the Agencies

intend to reflect in the proposed rule

e into account that effective AML/

CFT programs safeguard national

security and help law enforcement

prevent the flow of illicit funds in the

financial system.36 Further, the AML

Act contemplates AML/CFT

requirements focusing on achieving

effective outcomes rather than dictating

the processes used to reach those

outcomes, an orientation the Agencies

intend to reflect in the proposed rule.

Consistent with the Agencies’ long-

standing expectations regarding what

effective outcomes entail, the Agencies

believe that, as a practical matter, it is

not possible for a bank’s AML/CFT

program to detect and report all

potentially illicit transactions that flow

through the institution.37 Similarly, a

bank’s AML/CFT program can be

effective without preventing every

minor instance of a bank falling prey to

illicit finance misuse. Accordingly, the

proposed rule would set out that, from

a supervisory and enforcement

perspective, an AML/CFT program is

‘‘effective’’ and complies with the

Agencies’ regulatory requirements

promulgated under 12 U.S.C. 1818(s) or

12 U.S.C. 1786(q), as applicable, so long

as it is established and maintained in

accordance with applicable

requirements.

The proposed rule would provide that

a bank has an ‘‘effective’’ program if it

(1) is established in accordance with the

proposed rule’s establishment

requirements; and (2) is maintained,

meaning that a properly established

AML/CFT program is implemented in

all material respects.

One of the AML Act’s key purposes is

to ‘‘encourage technological innovation

and the adoption of new technology by

financial institutions to more effectively

counter money laundering and

financing of terrorism.’’ 38 Consistent

with this purpose, the Agencies

encourage banks to evaluate whether

new technology or innovative

approaches in other resources might

help to combat financial crime more

effectively

’s key purposes is

to ‘‘encourage technological innovation

and the adoption of new technology by

financial institutions to more effectively

counter money laundering and

financing of terrorism.’’ 38 Consistent

with this purpose, the Agencies

encourage banks to evaluate whether

new technology or innovative

approaches in other resources might

help to combat financial crime more

effectively. Innovative approaches could

involve machine learning, generative

artificial intelligence (GenAI), digital

identity, blockchain monitoring and

analytics, or application programming

interfaces (APIs).

The Agencies recognize that adopting

new technologies for BSA compliance

may not be suitable for all banks,

particularly smaller ones, and the

proposed rule therefore does not

reference or require the use of any

particular technology. A bank may find

it beneficial to consider whether its

AML/CFT program appropriately uses

the bank’s existing resources, including

technology and data. However,

consistent with longstanding guidance,

the Agencies encourage banks to engage

in responsible AML/CFT innovation.39

Banks that responsibly incorporate

innovative technologies into their AML/

CFT programs will not incur on that

basis any additional risk of being subject

to a significant supervisory action or

enforcement action solely based on the

use of innovative technologies.

C. Establishing and Maintaining an

AML/CFT Program

The requirement that a bank establish

and maintain an AML/CFT program is

not new, although over time various

formulations of this requirement have

developed in statutes and regulations.40

The proposed rule would harmonize

and delineate the regulatory

requirements that must be met for banks

to have an effective AML/CFT program.

That is, the proposed rule would create

a two-pronged framework under which

a bank’s AML/CFT program would be

deemed to be effective if the bank

establishes and maintains its program

of this requirement have

developed in statutes and regulations.40

The proposed rule would harmonize

and delineate the regulatory

requirements that must be met for banks

to have an effective AML/CFT program.

That is, the proposed rule would create

a two-pronged framework under which

a bank’s AML/CFT program would be

deemed to be effective if the bank

establishes and maintains its program.

Under the proposed rule, a bank

maintains its properly established AML/

CFT program by implementing it in all

material respects.

1. Establishing Versus Maintaining an

AML/CFT Program

For a bank to have an effective AML/

CFT program, the proposed rule would

require a bank to establish an AML/CFT

program and then maintain the AML/

CFT program by implementing, in all

material respects, the established AML/

CFT program. The proposed rule

describes the requirements for an

effective AML/CFT program to be

established and maintained. The AML/

CFT program minimum components

constituting program establishment, and

described in further detail in Section

V.D below, are: (1) a risk-based set of

internal policies, procedures, and

controls (including risk assessment

processes); (2) independent program

testing; (3) an individual, located in the

United States and accessible to FinCEN

and the appropriate Agency, responsible

for establishing and maintaining the

program, and coordinating and

monitoring day-to-day compliance; and

tail in Section

V.D below, are: (1) a risk-based set of

internal policies, procedures, and

controls (including risk assessment

processes); (2) independent program

testing; (3) an individual, located in the

United States and accessible to FinCEN

and the appropriate Agency, responsible

for establishing and maintaining the

program, and coordinating and

monitoring day-to-day compliance; and

(4) ongoing employee training.

‘‘Establishing’’ an AML/CFT program

involves designing an AML/CFT

program that incorporates all of the

required components. ‘‘Maintaining,’’

by contrast, addresses whether the bank

is implementing that program in

practice. The regulation uses the term

‘‘implement’’ to describe this second

prong. The distinction between

establishing a program and maintaining

a program by implementation matters

because the proposed rule ties the

availability of AML/CFT enforcement

and significant supervisory actions

based on the program rule for an

established bank program to a

significant or systemic failure to

‘‘implement’’ the properly established

AML/CFT program. The distinction

between establishing and ‘‘maintaining’’

an AML/CFT program is intended to

make transparent how the individual

elements of the proposed rule work

together.

Separating program establishment

from program maintenance therefore

provides needed clarity regarding

whether a supervisory concern relates to

deficiencies stemming from the

program’s design, on the one hand, or

failures in the program’s operation, on

the other. This two-prong framework

would help promote consistent

articulation of supervisory expectations

and prevent conflating criticisms of

program design—the remediation of

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00007

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

n the one hand, or

failures in the program’s operation, on

the other. This two-prong framework

would help promote consistent

articulation of supervisory expectations

and prevent conflating criticisms of

program design—the remediation of

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00007

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

18311

Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules

41 See, 12 CFR 21.21(d)(1) (OCC); 12 CFR

326.8(c)(1) (FDIC); and 12 CFR 748.2(c)(1) (NCUA).

which would likely be different in

kind—with criticisms of day-to-day

implementation. The proposed

distinction does not change the

substantive obligations for the bank.

As noted previously, the Agencies

intend for the requirements of this

proposed rule to not be limited to a one-

time adoption of the elements required

for program establishment, such as a

risk-based set of internal policies,

procedures, and controls. Rather, the

Agencies intend a bank’s establishment

of its AML/CFT program to require the

bank’s risk-based set of internal policies,

procedures, and controls—and the risk

assessment processes that inform

them—to remain current as the bank’s

risk profile changes. For example, if a

bank begins providing a new product or

service—or changes how it provides an

existing product or service, such as

operating in a new geographic

location—under this proposed rule, a

bank would need to incorporate its new

product or service as part of its risk

assessment processes. The proposed

rule would require a bank to make a risk

determination and, as appropriate,

redesign its risk-based set of internal

policies, procedures, and controls to

account for the risks that it did not

previously encounter prior to offering

the new product or service, or operating

in the new geographic location

orate its new

product or service as part of its risk

assessment processes. The proposed

rule would require a bank to make a risk

determination and, as appropriate,

redesign its risk-based set of internal

policies, procedures, and controls to

account for the risks that it did not

previously encounter prior to offering

the new product or service, or operating

in the new geographic location. Thus,

under the proposed rule, even where a

bank has previously established an

AML/CFT program in accordance with

the proposed rule, a failure to update

the program to reflect significant

changes in the bank’s risk profile may

result in the program no longer

satisfying the proposed rule’s

requirements regarding establishment.

2. Implementation of an AML/CFT

Program

Once a bank has properly

‘‘established’’ an AML/CFT program,

the bank must ‘‘maintain’’ the program

by implementing it, in all material

respects. Minor deficiencies of an AML/

CFT program would not necessarily

mean that a bank has failed to

implement the program.

Although there are a variety of ways

that a bank may not be implementing its

program ‘‘in all material respects,’’ in

the Agencies’ experience, commonly

observed examples may include, but

would not be limited to: (1) internal

policies, procedures, and controls are

not being performed or not being

performed on a consistent, regular, and

timely basis (e.g., consistently ignored

warnings or red flags that a program was

seriously deficient) due to the nature or

extent of required resources becoming

inadequate; (2) gaps in the risk

assessment processes that result in the

bank’s program internal policies,

procedures, and controls missing or

inadequately covering higher ML/TF

risks (e.g., systems used to monitor for

potentially suspicious activity failing to

capture material volumes or types of

transactions); or (3) deficiencies or

weaknesses in the risk assessment

processes that have a material impact on

the bank’s mitigation of ML/TF risks

through its risk-bas

program internal policies,

procedures, and controls missing or

inadequately covering higher ML/TF

risks (e.g., systems used to monitor for

potentially suspicious activity failing to

capture material volumes or types of

transactions); or (3) deficiencies or

weaknesses in the risk assessment

processes that have a material impact on

the bank’s mitigation of ML/TF risks

through its risk-based set of internal

policies, procedures, and controls,

including due to data-related issues

involving relevant processes and

systems.

Similarly, the Agencies expect that a

bank could become aware of such

implementation-related concerns

through a variety of mechanisms,

including but not limited to: (1)

independent testing of the AML/CFT

program; (2) examiner observations,

suggestions, or other informal comments

about the AML/CFT program;, (3)

management information systems and

related reports or other outputs (e.g., key

performance indicators or key risk

indicators, such as monitoring for

potentially material backlogs in relevant

AML/CFT processes), and (4) issues

identified by personnel involved in the

operation of the bank’s AML/CFT

program.

D. Program Establishment

As noted earlier, pursuant to 31

U.S.C. 5318(h), the Agencies’ AML/CFT

program requirements for banks

currently require certain minimum

elements, including: (1) a risk-based set

of internal policies, procedures, and

controls; (2) an independent audit

function to test programs; (3) a

designated compliance officer; and (4)

an ongoing employee training program.

The majority of the proposed rule’s

AML/CFT program components are

substantially similar to the existing

regulatory requirements for banks.

However, the Agencies are proposing

certain additions and modifications to

modernize and strengthen banks’ AML/

CFT programs to allow banks to better

mitigate illicit finance risks.

1

compliance officer; and (4)

an ongoing employee training program.

The majority of the proposed rule’s

AML/CFT program components are

substantially similar to the existing

regulatory requirements for banks.

However, the Agencies are proposing

certain additions and modifications to

modernize and strengthen banks’ AML/

CFT programs to allow banks to better

mitigate illicit finance risks.

1. Internal Policies, Procedures, and

Controls

The Agencies’ rules currently require

banks to develop ‘‘a system of internal

controls to assure ongoing compliance’’

with the requirements of the BSA as

part of their AML/CFT programs.41 The

Agencies’ existing program rules,

however, do not clearly articulate what

it means to establish such a system of

internal policies, procedures, and

controls to ensure compliance.

Under the proposal, the Agencies are

amending and clarifying the current

internal control pillar requirements.

Specifically, the proposal provides that

banks must establish a risk-based set of

internal policies, procedures, and

controls that is reasonably designed to:

(1) identify, assess, and document ML/

TF risks through risk assessment

processes; (2) mitigate ML/TF risks

consistent with the risk assessment

processes, including by directing more

attention and resources toward higher-

risk customers and activities rather than

toward lower-risk customers and

activities; and, (3) conduct ongoing

CDD. The preamble addresses each of

these features below.

Under this proposal, a bank’s risk-

based set of internal policies,

procedures, and controls should be

based upon, informed by, and consistent

with a bank’s risk assessment processes.

The internal policies, procedures, and

controls should be commensurate with

the size, structure, risk profile, and

complexity of the bank

t ongoing

CDD. The preamble addresses each of

these features below.

Under this proposal, a bank’s risk-

based set of internal policies,

procedures, and controls should be

based upon, informed by, and consistent

with a bank’s risk assessment processes.

The internal policies, procedures, and

controls should be commensurate with

the size, structure, risk profile, and

complexity of the bank. The

requirement that a bank’s risk-based set

of internal policies, procedures, and

controls be ‘‘reasonably designed’’ gives

banks flexibility in how they achieve

compliance with the BSA and the

proposed rule’s other requirements. As

part of having a risk-based set of

internal policies, procedures, and

controls, reasonably designed to ensure

compliance, banks may choose to

responsibly adopt new technologies or

innovative approaches to comply with

BSA requirements. Consistent with this

purpose, the Agencies encourage banks

to evaluate whether new technology or

innovative approaches in other

resources might help to more effectively

combat financial crime. Innovative

approaches could involve machine

learning, GenAI, digital identity,

blockchain monitoring and analytics, or

APIs.

i. Risk Assessment Processes

The Agencies are proposing that, as

part of a bank’s risk-based set of internal

policies, procedures, and controls, the

bank identify, assess, and document the

bank’s ML/TF risk through risk

assessment processes that: (1) evaluate

the ML/TF risks of the bank’s business

activities, including products, services,

distribution channels, customers, and

geographic locations; (2) review and, as

appropriate, incorporate the AML/CFT

Priorities; and (3) update promptly upon

any change that the bank knows or has

reason to know significantly changes the

bank’s ML/TF risks.

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00008

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

ls, customers, and

geographic locations; (2) review and, as

appropriate, incorporate the AML/CFT

Priorities; and (3) update promptly upon

any change that the bank knows or has

reason to know significantly changes the

bank’s ML/TF risks.

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00008

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

18312

Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules

42 Joint Statement on Risk-Focused Bank Secrecy

Act/Anti-Money Laundering Supervision (July 22,

2019), https://www.fdic.gov/sites/default/files/2024-

03/pr19065a.pdf. The Joint Statement on Risk

Focused BSA/AML Supervision, July 22, 2019,

clarifies the Agencies’ and the Federal Reserve

Board’s long-standing supervisory approach to

examining for compliance with the BSA considers

a financial institution’s risk profile and notes that

‘‘[a] risk-based [AML] compliance program enables

a bank to allocate compliance resources

commensurate with its risk.’’ It further clarifies that

a well-developed risk assessment process assists

examiners in understanding a bank’s risk profile

and evaluating the adequacy of its AML program.

The statement also explains that, as part of their

risk-focused approach, examiners review a bank’s

risk management practices to evaluate whether a

bank has developed and implemented a reasonable

and effective process to identify, measure, monitor,

and control risks.

43 See FinCEN, Section 314(b) Fact Sheet, (Dec.

2020), www.fincen.gov/system/files/shared/

314bfactsheet.pdf.

44 See U.S. Dep’t of Treasury, 2026 Nat. Money

Laundering Risk Assess. (Mar. 2026), https://

home.treasury.gov/system/files/246/2026-

NMLRA.pdf; U.S. Dep’t of Treasury, 2026 Nat.

Terrorist Financing Risk Assess. (Mar. 2026),

https://home.treasury.gov/system/files/246/2026-

NTFRA.pdf; U.S. Dep’t of Treasury, 2026 Nat.

Proliferation Financing Risk Assess. (Mar

iles/shared/

314bfactsheet.pdf.

44 See U.S. Dep’t of Treasury, 2026 Nat. Money

Laundering Risk Assess. (Mar. 2026), https://

home.treasury.gov/system/files/246/2026-

NMLRA.pdf; U.S. Dep’t of Treasury, 2026 Nat.

Terrorist Financing Risk Assess. (Mar. 2026),

https://home.treasury.gov/system/files/246/2026-

NTFRA.pdf; U.S. Dep’t of Treasury, 2026 Nat.

Proliferation Financing Risk Assess. (Mar. 2026),

https://home.treasury.gov/system/files/246/2026-

NPFRA.pdf.

The Agencies have traditionally

viewed risk assessment processes as a

critical tool of a reasonably designed

BSA compliance program; a bank

cannot implement a reasonably

designed program to achieve

compliance with the BSA unless it

understands its risk profile.42 Most

banks already use risk assessments or

risk assessment processes to structure

their risk-based compliance programs.

Despite being viewed as a critical tool,

the Agencies’ regulations do not

currently explicitly require such risk

assessment processes nor outline

mandatory considerations for such

processes. Thus, the proposed rule

would codify into regulations the

requirement for banks to establish risk

assessment processes, thereby clarifying

existing expectations and practices, as

well as require specific factors for

consideration that are responsive to the

AML Act.

Importantly, the proposed rule

requires, as a part of a bank’s risk-based

set of internal policies, procedures and

controls, that it identify, assess, and

document its ML/TF risks using risk

assessment processes. A bank would

retain flexibility in how it would

document the results of its risk

assessment processes. As proposed,

banks would not be required to establish

a single, consolidated risk assessment

document solely to comply with the

proposed rule

based

set of internal policies, procedures and

controls, that it identify, assess, and

document its ML/TF risks using risk

assessment processes. A bank would

retain flexibility in how it would

document the results of its risk

assessment processes. As proposed,

banks would not be required to establish

a single, consolidated risk assessment

document solely to comply with the

proposed rule. While such a document

may be appropriate under the proposal,

the use of the term ‘‘risk assessment

processes’’ is intended to reflect that a

financial institution may rely on

multiple processes—applied as

appropriate within its AML/CFT

program—to identify, assess, and

document its ML/TF risks and will be

examined based on the totality of these

processes rather than the sufficiency of

a single, standalone risk assessment

document.

The Agencies believe banks are best

positioned to identify and evaluate their

ML/TF risk and are therefore not

prescribing any particular risk

assessment processes or methodologies

other than the critical elements

described in this proposed rule. Under

the proposed rule, banks would be

examined for whether they have

established and maintained, in all

material respects, reasonably designed

risk assessment processes—which need

not be in the form of a singular risk

assessment process. Furthermore, the

Agencies are not prescribing any

particular time frame for banks to

update their risk assessment processes.

The Agencies recognize that banks

vary significantly in size, structure,

complexity, and risk profile. Under the

proposed rule, bank’s risk-based set of

internal policies, procedures, and

controls—including its risk assessment

processes—should be commensurate

with the bank’s size, structure, risk

profile, and complexity

ular time frame for banks to

update their risk assessment processes.

The Agencies recognize that banks

vary significantly in size, structure,

complexity, and risk profile. Under the

proposed rule, bank’s risk-based set of

internal policies, procedures, and

controls—including its risk assessment

processes—should be commensurate

with the bank’s size, structure, risk

profile, and complexity. Accordingly,

banks with broader product offerings,

more complex corporate structures, or

greater exposure to higher-risk

customers, products, services, or

geographic locations would be expected

to establish correspondingly more

formalized or analytically complex

internal policies, procedures, and

controls—including risk assessment

processes. By contrast, many

community banks operate with more

limited business activities, traditional

lending and deposit services, a narrower

geographic footprint, and customer

bases concentrated within defined local

communities. For such banks, risk

assessment processes may appropriately

be more streamlined or qualitative in

nature, and a risk-based set of internal

policies, procedures, and controls that is

reasonably designed for a large, complex

financial organization would not

necessarily be required or appropriate

for a community bank with a more

limited risk profile.

As noted previously, most banks

already design their BSA compliance

programs based on their assessment of

ML/TF risks under existing risk

assessment processes. The Agencies

expect that most banks will be able to

leverage their existing risk assessment

processes to satisfy the proposed

requirement without making significant

changes.

a. ML/TF Risks

The proposed rule would require

banks’ risk assessment processes to

evaluate the ML/TF risks of the bank’s

business activities, including products,

services, distribution channels,

customers, and geographic locations.

These factors are generally well known

and often incorporated into current risk

assessment processes of banks

equirement without making significant

changes.

a. ML/TF Risks

The proposed rule would require

banks’ risk assessment processes to

evaluate the ML/TF risks of the bank’s

business activities, including products,

services, distribution channels,

customers, and geographic locations.

These factors are generally well known

and often incorporated into current risk

assessment processes of banks. While

most banks are generally familiar with

these concepts, ‘‘distribution channels’’

may be a newer term for some banks.

For purposes of this rule, the Agencies

consider ‘‘distribution channels’’ to

refer to the methods and tools through

which a bank opens accounts and

provides products or services,

including, for example, through remote

or other non-face-to-face means.

Banks may use a variety of sources to

inform their risk assessment processes.

Such sources may include information

obtained from other financial

institutions, such as emerging risks and

typologies identified through section

314(b) information sharing or payment

transactions that other financial

institutions returned or flagged due to

ML/TF risks.43 Information a bank

generates or maintains could be another

source. Internal information may

include, for example, customer internet

protocol addresses or device logins and

related geolocation information.

Feedback from FinCEN, law

enforcement, and financial regulators

may also inform risk assessment

processes. For example, if a bank

receives feedback from law enforcement

about a report it has filed or potential

risks at the bank, the bank may

incorporate that information into its risk

assessment processes. Similarly, banks

may consider information identified

from responding to section 314(a)

requests.

In addition to feedback, reports and

analyses published by Treasury and

FinCEN may be particularly relevant to

a bank’s business activities, thereby

warranting consideration when

evaluating ML/TF risks

at the bank, the bank may

incorporate that information into its risk

assessment processes. Similarly, banks

may consider information identified

from responding to section 314(a)

requests.

In addition to feedback, reports and

analyses published by Treasury and

FinCEN may be particularly relevant to

a bank’s business activities, thereby

warranting consideration when

evaluating ML/TF risks. For example,

Treasury describes changes in the illicit

finance risk environment in its biennial

National Money Laundering Risk

Assessment, National Terrorist

Financing Risk Assessment, and

National Proliferation Financing Risk

Assessment, which highlight significant

illicit finance threats, vulnerabilities,

and risks.44 Regardless of the source,

banks should take measures in their risk

assessment processes to ensure this

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00009

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

18313

Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules

45 31 U.S.C. 5318(h)(4)(E).

46 FinCEN’s concurrently issued proposal

provides additional clarity on how FinCEN

anticipates addressing the AML/CFT Priorities.

47 31 U.S.C. 5318(h)(2)(B)(iv)(II).

information is reasonably current,

complete, and accurate.

b. AML/CFT Priorities

The AML/CFT Priorities set out the

priorities for the U.S. government’s

AML/CFT policy as required by the

AML Act and are designed to ensure

that banks’ AML/CFT programs are

aligned with those priorities.

Recognizing the diverse nature of ML/

TF threats facing the U.S. financial

system and national security, and that

bank AML/CFT programs benefit U.S.

national security by safeguarding the

financial system from ML/TF risk, the

AML/CFT Priorities are intended to

ensure that banks are focusing on the

greatest threats to U.S. national security,

as defined by Treasury

ed with those priorities.

Recognizing the diverse nature of ML/

TF threats facing the U.S. financial

system and national security, and that

bank AML/CFT programs benefit U.S.

national security by safeguarding the

financial system from ML/TF risk, the

AML/CFT Priorities are intended to

ensure that banks are focusing on the

greatest threats to U.S. national security,

as defined by Treasury.

Section 6101 of the AML Act requires

that a financial institution’s review and

appropriate incorporation of the AML/

CFT Priorities into its AML/CFT

program be subject to supervision and

examination for compliance with the

BSA and other AML/CFT laws and

regulations.45 The Agencies are

implementing this statutory requirement

by proposing that, as part of their risk

assessment processes, banks must

review and, as appropriate, incorporate

the AML/CFT Priorities. The inclusion

of the AML/CFT Priorities in risk

assessment processes is meant to help

ensure that banks understand their

exposure to risks in areas that are of

particular importance nationally, which

may help banks develop risk-based and

reasonably designed AML/CFT

programs.

The Agencies understand that the

AML/CFT Priorities may not always be

applicable to a bank’s risk profile and

activities. Therefore, the Agencies

require the incorporation of the AML/

CFT Priorities in a bank’s risk

assessment processes, as appropriate.

This means that, having reviewed the

AML/CFT Priorities, a bank may

determine the extent to which a

particular Priority is applicable and

whether and how a particular AML/CFT

Priority should be appropriately

incorporated into its risk assessment

processes.

Further, a bank may use its judgment

and apply a reasonable, risk-based

determination on whether to focus on a

specific aspect of an AML/CFT Priority,

rather than addressing all aspects of a

Priority that may either not be

applicable or pose lower risks to the

bank

and

whether and how a particular AML/CFT

Priority should be appropriately

incorporated into its risk assessment

processes.

Further, a bank may use its judgment

and apply a reasonable, risk-based

determination on whether to focus on a

specific aspect of an AML/CFT Priority,

rather than addressing all aspects of a

Priority that may either not be

applicable or pose lower risks to the

bank. However, the Agencies caution

that a surface-level, perfunctory review

of an AML/CFT Priority by a bank and

of the foreseeable ways in which it may

manifest itself within the bank’s

customers, products and services,

geographies, and distribution channels

would not satisfy this requirement. For

example, patterns of transactions that

may be consistent with potential

structuring should not automatically be

dismissed as lower value to law

enforcement and untethered to an AML/

CFT Priority without determining

whether there is a potential connection

to various types of other illicit finance

activity (e.g., structuring or similar

patterns involving transactions in

narcotics trafficking proceeds).

Whenever the AML/CFT Priorities are

updated, banks would no longer be

required to incorporate prior versions of

the AML/CFT Priorities. Banks would

only be required, as appropriate, to

incorporate the most recent AML/CFT

Priorities into their risk-based AML/CFT

programs.

The Agencies anticipate that some

banks, such as community banks, may

ultimately determine that their business

models and risk profiles have limited

exposure to some of the threats

addressed in the AML/CFT Priorities

but instead have greater exposure to

other ML/TF risks. Additionally, some

banks’ risk assessment processes may

determine that their AML/CFT programs

already sufficiently incorporate to some

extent, the AML/CFT Priorities

community banks, may

ultimately determine that their business

models and risk profiles have limited

exposure to some of the threats

addressed in the AML/CFT Priorities

but instead have greater exposure to

other ML/TF risks. Additionally, some

banks’ risk assessment processes may

determine that their AML/CFT programs

already sufficiently incorporate to some

extent, the AML/CFT Priorities. In

either case, any changes to banks’ AML/

CFT program, such as internal policies,

procedures, or controls would be based

on the results of risk assessment

processes and their impact on the AML/

CFT program, including how to review

and, as appropriate, incorporate the

AML/CFT Priorities before making these

determinations.46 The Agencies request

comment from the public on whether

additional guidance related to the

consideration of the AML/CFT Priorities

as part of an institution’s risk

assessment processes would be

warranted.

c. Updates to Risk Assessment Processes

The proposed rule would require

banks to update their risk assessment

processes promptly upon any change

that the bank would know or have

reason to know would significantly

change their ML/TF risk profile. For

example, a bank may need to update its

risk assessment when new products,

services, and customer types are

introduced; existing products, services,

and customer types undergo significant

changes; when the bank adopts new risk

mitigation technology; or the bank as a

whole expands or contracts through

mergers, acquisitions, and divestitures.

Banks may also need to update their risk

assessment processes based on factors

external to their operations that they

know or have reason to know

significantly change their ML/TF risk

profiles. The Agencies welcome

comments on whether it should further

clarify when banks must review or

update their risk assessment processes.

ii

contracts through

mergers, acquisitions, and divestitures.

Banks may also need to update their risk

assessment processes based on factors

external to their operations that they

know or have reason to know

significantly change their ML/TF risk

profiles. The Agencies welcome

comments on whether it should further

clarify when banks must review or

update their risk assessment processes.

ii. Mitigate ML/TF Risks Through Risk-

Based Allocation of Attention and

Resources

Section 6101(b) of the AML Act states

that the AML/CFT programs of financial

institutions should be ‘‘risk-based,

including ensuring that more attention

and resources of financial institutions

should be directed toward higher-risk

customers and activities, consistent

with the risk profile of a financial

institution, rather than toward lower-

risk customers and activities.’’ 47 The

proposed rule would adopt this

formulation as part of a bank’s

obligation to establish a risk-based set of

internal policies, procedures, and

controls. Under the proposed rule, a

bank’s efforts to mitigate its ML/TF risks

would involve ‘‘directing more attention

and resources toward higher-risk

customers and activities, consistent

with the risk profile of [a bank], rather

than toward lower-risk customers and

activities.’’

The Agencies view risk-based

allocation of resources as a critical step

in realizing the AML Act’s BSA

modernization and reform ambitions,

and consistent with the Agencies’

ongoing efforts to modernize AML/CFT

compliance and supervision. The

proposed rule envisions banks

exercising more flexibility in deploying

attention and resources in accordance

with the proposed rule without fear of

supervisory criticism or action from

examiners for directing more attention

and resources on higher risk customers

and activities, rather than toward lower

risk customers and activities

rts to modernize AML/CFT

compliance and supervision. The

proposed rule envisions banks

exercising more flexibility in deploying

attention and resources in accordance

with the proposed rule without fear of

supervisory criticism or action from

examiners for directing more attention

and resources on higher risk customers

and activities, rather than toward lower

risk customers and activities.

The goal of risk-based resource

allocation is for banks to spend less

time, energy, and resources on lower

priority activities that may result in less

resources devoted to and potentially

distract from more serious threats. The

proposed rule would enable banks to

focus more on higher risk customers and

activities, which the Agencies have

determined should result in banks being

more effective at detecting, reporting,

and preventing the flow of illicit funds

and providing law enforcement with

more valuable BSA reporting.

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00010

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

18314

Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules

48 See 31 CFR 1020.210(a)(2)(v) and (b)(2)(v).

49 31 U.S.C. 5318(h)(1)(D).

50 See Federal Reserve Board, FDIC, NCUA, OCC,

and FinCEN, Interagency Statement on Sharing

Bank Secrecy Act Resources (Oct. 3, 2018), https://

www.fincen.gov/news/news-releases/interagency-

statement-sharing-bank-secrecy-act-resources.

As noted above, the Agencies believe

that banks are best positioned to

identify and evaluate their ML/TF risk

and to make decisions related to risk

identification and resource allocation in

accordance with risk identification. The

proposed rule, therefore, does not

contemplate second-guessing of a bank’s

reasonable determinations regarding

appropriate resource allocation or

conclusions regarding specific risks

ncies believe

that banks are best positioned to

identify and evaluate their ML/TF risk

and to make decisions related to risk

identification and resource allocation in

accordance with risk identification. The

proposed rule, therefore, does not

contemplate second-guessing of a bank’s

reasonable determinations regarding

appropriate resource allocation or

conclusions regarding specific risks.

However, while the Agencies do not

believe that an examiner should

substitute his or her own subjective

judgment in place of the bank’s,

examiners will be expected to assess

whether (1) a bank’s resource allocation

decisions are informed by, and

consistent with, reasonably designed

risk assessment processes; and (2) with

respect to implementation, specifically,

whether the bank knows or should

know of resource-related issues

involving its internal policies,

procedures, and controls and other

mandatory elements that may result in

the bank failing to implement its AML/

CFT program in all material respects

and has failed to address such issues.

iii. Conduct Ongoing Customer Due

Diligence

The proposed rule would add CDD as

a required component of the Agencies’

AML/CFT program rule. Appropriate

risk-based procedures for conducting

ongoing CDD—in the form of

understanding the nature and purpose

of customer relationships and

conducting ongoing monitoring—is

currently a required component in

FinCEN’s AML program rule,48 and,

therefore, banks are already required to

comply with these ongoing CDD

requirements under FinCEN’s rule. The

inclusion of risk-based procedures for

conducting ongoing CDD in the

Agencies’ proposed rules would mirror

FinCEN’s existing rule and reflect the

Agencies’ long-standing supervisory

expectations

ing monitoring—is

currently a required component in

FinCEN’s AML program rule,48 and,

therefore, banks are already required to

comply with these ongoing CDD

requirements under FinCEN’s rule. The

inclusion of risk-based procedures for

conducting ongoing CDD in the

Agencies’ proposed rules would mirror

FinCEN’s existing rule and reflect the

Agencies’ long-standing supervisory

expectations. Long before FinCEN

amended its AML program rule to

expressly include the CDD component

requirement, the Agencies had

considered CDD an integral component

of a risk-based program, enabling the

bank to understand its customers and its

customers’ activity to better identify

suspicious activity. Adding the CDD

component to the Agencies’ AML/CFT

program rule will eliminate confusion

for banks concerning the current

differences with FinCEN’s rule. Because

banks must already comply with

FinCEN’s CDD component requirement,

the proposed change should not alter

current compliance practices.

The proposed rule would incorporate

CDD requirements not as a standalone

pillar, but instead by making them part

of the requirement that banks establish

a risk-based and reasonably designed set

of internal policies, procedures, and

controls. As noted previously, the

activities required to conduct ongoing

CDD, such as monitoring customer

relationships, maintaining and updating

customer information on a risk basis,

and identifying and reporting

suspicious transactions are, in practice,

subsumed by the obligation for a bank

to have a risk-based and reasonably

designed set of internal policies,

procedures, and controls and have long

been viewed by the Agencies as integral

to component of a bank’s internal

controls. Accordingly, establishing these

requirements within this pillar more

accurately reflects how banks

operationalize ongoing customer due

diligence as part of their overall AML

programs.

2

r a bank

to have a risk-based and reasonably

designed set of internal policies,

procedures, and controls and have long

been viewed by the Agencies as integral

to component of a bank’s internal

controls. Accordingly, establishing these

requirements within this pillar more

accurately reflects how banks

operationalize ongoing customer due

diligence as part of their overall AML

programs.

2. Independent Testing

The Agencies have required banks to

perform independent testing since the

original adoption of their BSA

compliance program rules. The AML

Act did not change the BSA’s separate

requirement that each bank must

independently test its AML/CFT

program.49 The proposed rule therefore

retains the existing requirement for

banks to establish independent AML/

CFT program testing to be conducted by

bank personnel or an outside party with

minor, non-substantive clarifications

that are not intended to change

regulatory requirements.

The purpose of independent testing is

to assess the bank’s compliance with

AML/CFT statutory and regulatory

requirements, relative to its risk profile.

The independent AML/CFT program

testing should be focused on whether

the AML/CFT program is effective, and

it should identify issues and areas for

remediation accordingly.

To support the effective

implementations of an AML/CFT

program, independent testing should be

based on objective criteria designed to

assess whether a bank has established

and implemented an effective AML/CFT

program and allocated resources

consistent with its risk assessment

processes. These criteria should also

assess whether related project

governance is sufficient to manage risks

and apply compensating controls where

necessary, particularly in areas where

remediation is underway. This

evaluation helps to inform the bank’s

board of directors and senior

management of weaknesses or areas in

need of enhancement or stronger

controls

t with its risk assessment

processes. These criteria should also

assess whether related project

governance is sufficient to manage risks

and apply compensating controls where

necessary, particularly in areas where

remediation is underway. This

evaluation helps to inform the bank’s

board of directors and senior

management of weaknesses or areas in

need of enhancement or stronger

controls. Typically, this evaluation

includes a conclusion about the bank’s

overall compliance with AML/CFT

statutory and regulatory requirements

and sufficient information for the

reviewer (e.g., board of directors, senior

management, AML/CFT officer, outside

auditor, or an examiner) to reach a

conclusion about whether the set of

internal policies, procedures, and

controls is reasonably-designed, and

resources are well-allocated consistent

with the bank’s risk assessment

processes.

Additionally, while banks retain some

flexibility regarding who conducts the

audit or testing, the proposed rule

would continue to require that testing

be independent. Banks that do not

employ outside auditors or consultants

or that do not have internal audit

departments may comply with this

requirement by using internal staff who

are not involved in the function being

tested. For these banks and banks with

other types of arrangements for

independent testing, the AML/CFT

officer or any party who directly, and in

some cases indirectly, reports to the

AML/CFT officer, or an equivalent role,

would generally not be considered

sufficiently independent. Any

individual conducting the testing,

whether internal or external, would be

required to be independent of other

parts of the bank’s AML/CFT program,

including its oversight

r

independent testing, the AML/CFT

officer or any party who directly, and in

some cases indirectly, reports to the

AML/CFT officer, or an equivalent role,

would generally not be considered

sufficiently independent. Any

individual conducting the testing,

whether internal or external, would be

required to be independent of other

parts of the bank’s AML/CFT program,

including its oversight. For banks that

engage outside auditors or consultants,

the bank would be required to ensure

that the outside parties conducting the

independent testing are not involved in

functions related to the AML/CFT

program at the bank that may present a

conflict of interest or lack of

independence, such as AML/CFT

training or the development or

enhancement of internal policies,

procedures, and controls. Additionally,

for the purposes of the independent

testing component, outside parties

would not include government agencies,

entities, or instrumentalities, such as a

bank’s Federal or state functional

regulators. Banks with less complex

operations and lower risk profiles may

consider utilizing a shared resource as

part of a collaborative arrangement to

conduct testing, as long as the testing is

independent.50

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00011

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

18315

Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules

51 31 U.S.C. 5318(h)(5).

52 See, e.g., FinCEN, Financial Crimes

Enforcement Network; Confidentiality of

Suspicious Activity Reports, 75 FR 75593 (Dec. 3,

2010); see also FinCEN, Interagency Guidance on

Sharing Suspicious Activity Reports with Head

Offices and Controlling Companies (Jan. 20, 2006),

https://www.fincen.gov/system/files/guidance/

sarsharingguidance01122006.pdf.

53 31 U.S.C. 5318(h)(1)(C).

54 12 CFR 21.21(d) (OCC); 12 CFR 326.8 (FDIC);

and 12 CFR 748.2 (NCUA)

Confidentiality of

Suspicious Activity Reports, 75 FR 75593 (Dec. 3,

2010); see also FinCEN, Interagency Guidance on

Sharing Suspicious Activity Reports with Head

Offices and Controlling Companies (Jan. 20, 2006),

https://www.fincen.gov/system/files/guidance/

sarsharingguidance01122006.pdf.

53 31 U.S.C. 5318(h)(1)(C).

54 12 CFR 21.21(d) (OCC); 12 CFR 326.8 (FDIC);

and 12 CFR 748.2 (NCUA).

55 Other financial regulators with stakeholders

subject to the BSA currently utilize their own

versions of this requirement. See 31 CFR

1020.210(a)(2)(iv), (b)(2)(iv) (banks);

1021.210(b)(2)(iii) (casinos); 1022.210(d)(3) (MSBs);

1023.210(b)(4) (broker-dealers); 1024.210(b)(4)

(mutual funds); 1025.210(b)(3) (insurance

companies); 1026.210(b)(4) (FCMs and IBCs);

1027.210(b)(3) (DPMSJs); 1028.210(b)(3) (operators

of credit card systems); 1029.210(b)(3) (loan or

finance companies); 1030.210(b)(3) (housing GSEs).

3. Designate an AML/CFT Officer

Located in the United States

i. Duties of the AML/CFT Officer

The Agencies have required banks to

‘‘designate an individual or individuals

responsible for coordinating and

monitoring day-to-day compliance’’

since the inception of their program

requirements. The BSA separately

requires that banks with AML/CFT

program obligations must have a

designated compliance officer, which

was not altered by the AML Act. As in

the Agencies’ current BSA compliance

program rules, the proposed rule would

provide that an AML/CFT program must

designate an individual(s) (referred to as

an AML/CFT officer) responsible for

establishing and implementing the

AML/CFT program and coordinating

and monitoring day-to-day compliance

with the requirements and prohibitions

of the BSA and FinCEN’s implementing

regulations. The Agencies’ view is that

the individual serving as the AML/CFT

officer must be qualified for that role

and not overburdened with other

responsibilities at the institution

officer) responsible for

establishing and implementing the

AML/CFT program and coordinating

and monitoring day-to-day compliance

with the requirements and prohibitions

of the BSA and FinCEN’s implementing

regulations. The Agencies’ view is that

the individual serving as the AML/CFT

officer must be qualified for that role

and not overburdened with other

responsibilities at the institution. The

Agencies are proposing clarifying and

technical changes to the AML/CFT

officer requirement, as well as changes

to incorporate to FinCEN’s

interpretation of 31 U.S.C. 5318(h)(5), as

discussed below. These changes are

generally not expected to impose new

obligations on banks.

Consistent with current requirements,

the proposed rule is not intended to be

primarily concerned about the formal

title of the individual(s) responsible for

establishing and implementing the

AML/CFT program and coordinating

and monitoring day-to-day compliance;

instead, the proposed rule focuses on

the AML/CFT officer’s position in the

bank’s organizational structure that

enables the AML/CFT officer to

effectively establish and implement the

bank’s AML/CFT program. The AML/

CFT officer’s authority, independence,

and access to resources within the bank

are critical. An AML/CFT officer should

have decision-making capability

regarding the AML/CFT program and

sufficient functional stature within the

organization to ensure that the program

meets BSA requirements.

The AML/CFT officer’s access to

resources may include: adequate

compliance funds and staffing with the

skills and expertise appropriate to the

bank’s risk profile, size, and complexity;

an organizational structure that supports

compliance and effectiveness; and

sufficient technology and systems to

support the timely identification,

measurement, monitoring, reporting,

and management of the bank’s ML/TF

risks

access to

resources may include: adequate

compliance funds and staffing with the

skills and expertise appropriate to the

bank’s risk profile, size, and complexity;

an organizational structure that supports

compliance and effectiveness; and

sufficient technology and systems to

support the timely identification,

measurement, monitoring, reporting,

and management of the bank’s ML/TF

risks. An AML/CFT officer with

conflicting responsibilities that

adversely impact the officer’s ability to

effectively coordinate and monitor day-

to-day AML/CFT compliance generally

would not fulfill this requirement. The

addition of the explicit requirement that

the AML/CFT officer be responsible for

‘‘establishing and implementing the

AML/CFT program’’ in the proposed

rule would make explicit a long-

standing supervisory expectation, rather

than changing current supervisory

expectations.

ii. The AML/CFT Officer Must Be

Located in the United States and

Accessible to Regulators

The AML Act provides that the duty

to establish, maintain, and enforce a

bank’s AML/CFT program shall remain

the responsibility of, and be performed

by, persons in the United States who are

accessible to, and subject to oversight

and supervision by, the Secretary and

the appropriate Federal functional

regulator.51 Because this is a new

requirement under the AML Act, it is

not currently reflected in the Agencies’

program rule requirements. FinCEN’s

concurrently proposed revisions to its

AML/CFT program rules interpret this

requirement as applying to the AML/

CFT officer, so the Agencies’ proposed

rule would amend the existing

compliance officer requirements to align

with FinCEN’s proposal.

The Agencies recognize banks may

currently have AML/CFT staff and

operations outside of the United States,

or they may contract out or delegate

parts of their AML/CFT operations to

third-party providers located outside of

the United States

ing to the AML/

CFT officer, so the Agencies’ proposed

rule would amend the existing

compliance officer requirements to align

with FinCEN’s proposal.

The Agencies recognize banks may

currently have AML/CFT staff and

operations outside of the United States,

or they may contract out or delegate

parts of their AML/CFT operations to

third-party providers located outside of

the United States. These arrangements

may serve to improve cost efficiencies;

to enhance coordination, particularly

with respect to cross-border operations;

or serve other purposes not in conflict

with goals underlying the BSA.

Consequently, under the proposed rule,

while the AML/CFT officer must be

located in the United States, personnel

located outside of the United States

would still be permitted to perform

certain AML/CFT functions. This

language does not alter existing

regulations and guidance that generally

prohibit the sharing of SARs with

personnel located outside of the United

States, other than in limited

circumstances such as a bank’s foreign

head office or controlling company.52

The Agencies request comment on

whether any further clarifications on

this point would be useful.

4. Ongoing Employee Training Program

The BSA requires AML/CFT programs

to include an ‘‘ongoing employee

training program.’’ 53 This statutory

requirement is reflected in all current

Agency program rules employing

different wording.54 The proposed rule

would harmonize the Agencies’ program

rules with that of other financial

regulators by adopting the BSA’s

‘‘ongoing employee training program’’

language uniformly.55 This change is

clarifying, not substantive.

The Agencies would generally expect

training to cover a bank’s internal

policies, procedures, and controls,

which should in turn reflect the results

of the bank’s risk assessment processes,

the latest AML/CFT regulatory

requirements, and other relevant

information

y adopting the BSA’s

‘‘ongoing employee training program’’

language uniformly.55 This change is

clarifying, not substantive.

The Agencies would generally expect

training to cover a bank’s internal

policies, procedures, and controls,

which should in turn reflect the results

of the bank’s risk assessment processes,

the latest AML/CFT regulatory

requirements, and other relevant

information. The frequency with which

the training would occur, and the

content of the training, would depend

on the bank’s ML/TF risk profile and the

roles and responsibilities of the persons

receiving the training. The Agencies

welcome comment on whether any

further clarifications of the proposed

training requirement are needed and

recognize that banks may have

employees and non-employees who may

have a variety of roles and

responsibilities in relation to the AML/

CFT program. The risk-based nature of

an AML/CFT program provides

flexibility for financial institutions to

identify both employees and non-

employees who must be trained on an

ongoing basis.

E. Access to and Approval of a Written

AML/CFT Program

1. Written AML/CFT Programs Must Be

Made Available Upon Request

The Agencies’ current BSA

compliance program rule generally

requires a bank to have a written AML/

CFT program that is approved by the

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00012

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

pproval of a Written

AML/CFT Program

1. Written AML/CFT Programs Must Be

Made Available Upon Request

The Agencies’ current BSA

compliance program rule generally

requires a bank to have a written AML/

CFT program that is approved by the

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00012

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

18316

Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules

56 See 12 CFR 21.21(c)(1) (OCC), 326.8(b)(1)

(FDIC), and 748.2(b)(1) (NCUA).

57 See 12 CFR 1020.210(b)(3).

58 The proposal would not be intended to affect

or restrict criminal enforcement under the BSA or

the authority of the Department of Justice to pursue

such actions.

bank’s board of directors.56 The

proposed rule would modify these

requirements and move them to a

separate subsection and add clarifying

text to harmonize the language with

FinCEN’s proposed rule. The Agencies

request comment on whether further

clarification on this point would be

useful.

2. Bank Approval of a Written AML/

CFT Program

Banks subject to Agency supervision

currently must have board approval for

their AML/CFT programs under the

Agencies’ rules. The proposed rule

would continue to require that a bank’s

written AML/CFT program be approved,

though the proposal will expand the

options available for a bank to obtain

such approval. Specifically, the

proposed rule will require that the

AML/CFT program be approved by the

bank’s board of directors or an

equivalent governing body within the

bank, or appropriate senior

management. The proposed rule

specifies that approval encompasses

each of the components of the AML/

CFT program

though the proposal will expand the

options available for a bank to obtain

such approval. Specifically, the

proposed rule will require that the

AML/CFT program be approved by the

bank’s board of directors or an

equivalent governing body within the

bank, or appropriate senior

management. The proposed rule

specifies that approval encompasses

each of the components of the AML/

CFT program.

With respect to the new ‘‘equivalent

governing body’’ language, FinCEN’s

current rule requires a bank lacking a

Federal functional regulator to obtain

approval of the bank’s written AML

program from either the bank’s board or

an equivalent governing body.57 The

Agencies’ proposed rule would also add

a reference to an ‘‘equivalent governing

body’’ to clarify that a bank can satisfy

the requirement by having an equivalent

governing body approve the program.

The equivalent governing body can take

different forms. For example, for the

U.S. branch of a foreign bank, the

equivalent governing body may be the

foreign banking organization’s board of

directors or delegates acting under the

board’s express authority. Similarly,

banks that do have a board of directors

might instead reasonably delegate the

approval requirement to a board

committee exercising targeted oversight,

such as a compliance committee, which

would similarly qualify as an

‘‘equivalent governing body’’ under the

proposal.

Finally, the rule would also permit a

bank’s senior management to approve

the AML/CFT program. Such

individuals may include Chief

Executive Officer, Chief Financial

Officer, Chief Operations Officer, Chief

Legal Officer, Chief Compliance Officer,

Director, and individuals with similar

status or functions. Also, banks may

establish or utilize existing senior

committees of appropriate senior

management officials to perform these

functions

management to approve

the AML/CFT program. Such

individuals may include Chief

Executive Officer, Chief Financial

Officer, Chief Operations Officer, Chief

Legal Officer, Chief Compliance Officer,

Director, and individuals with similar

status or functions. Also, banks may

establish or utilize existing senior

committees of appropriate senior

management officials to perform these

functions. The Agencies propose

permitting approval by senior

management to reflect the division of

roles and responsibilities between a

bank’s board of directors and senior

management with respect to

establishing and implementing an AML/

CFT program, as a bank’s senior

management is charged with the actual

role of establishing and implementing

the AML/CFT program.

While the proposed rule will no

longer require the bank’s board to

approve the AML/CFT program, this

would not alter the Agencies’

expectations regarding the

responsibilities of a bank’s board of

directors for providing appropriate

oversight of the bank’s AML/CFT

compliance. The Agencies have always

expected bank boards, both as a whole

or through appropriate committees, to

provide appropriate oversight of senior

management to maintain the bank’s

operations in a safe and sound manner,

oversee compliance with applicable

laws and regulations, and establish

appropriate risk governance

frameworks. A bank’s board might

reasonably permit appropriate senior

management to have AML/CFT program

approval authority to provide more

effective, timely oversight on a day-to-

day basis, while still fulfilling the

board’s obligations through other

appropriate means.

F. Customer Identification Program

The proposed rule would maintain

the current Customer Identification

Program requirements but would move

them to a separate section

t appropriate senior

management to have AML/CFT program

approval authority to provide more

effective, timely oversight on a day-to-

day basis, while still fulfilling the

board’s obligations through other

appropriate means.

F. Customer Identification Program

The proposed rule would maintain

the current Customer Identification

Program requirements but would move

them to a separate section. The Agencies

propose minor, non-substantive updates

to reference the ‘‘AML/CFT’’

terminology and harmonize the

language between the Agencies to

‘‘require a customer identification

program to be implemented as part of

the AML/CFT program.’’ These

technical changes are not anticipated to

establish new obligations.

G. Supervision and Enforcement

The proposed rule would add new

supervision and enforcement

frameworks for banks’ AML/CFT

programs that are aligned with the AML

Act’s emphasis on effectiveness and

risk-based supervision. The proposed

rule defines key terms, describes the

Agencies’ enforcement and supervision

policy with respect to AML/CFT

program implementation failures, and

establishes a consultation process

between FinCEN and the Agencies

relating to AML/CFT enforcement

actions or significant AML/CFT

supervisory actions. The enforcement

requirements only apply to actions by

the Agencies.

1. Definitions

Proposed section (a) would define

several terms used throughout the

section. The term ‘‘AML/CFT

requirement’’ would mean a

requirement of the Bank Secrecy Act (as

that term is defined in 31 CFR 1010.100)

or of the regulations in title 31, chapter

X, or a requirement prescribed under

the proposed definition.

The term ‘‘AML/CFT enforcement

action’’ would mean any formal or

informal action taken by one of the

Agencies under authority of 12 U.S.C.

1818, 1786, or other applicable law that

seeks to penalize, remedy, prevent, or

respond to noncompliance with past or

ongoing violations of, or past or ongoing

deficiencies relating to, an AML/CFT

requirement

prescribed under

the proposed definition.

The term ‘‘AML/CFT enforcement

action’’ would mean any formal or

informal action taken by one of the

Agencies under authority of 12 U.S.C.

1818, 1786, or other applicable law that

seeks to penalize, remedy, prevent, or

respond to noncompliance with past or

ongoing violations of, or past or ongoing

deficiencies relating to, an AML/CFT

requirement. The term includes a cease-

and-desist order, written agreement,

consent order, or memorandum of

understanding, or the assessment of a

civil money penalty.

The term ‘‘significant AML/CFT

supervisory action’’ would mean any

written communication or other formal

supervisory determination issued by

one of the Agencies that identifies one

or more alleged deficiencies,

weaknesses, violations of law, or unsafe

or unsound practices or conditions

relating to an AML/CFT requirement;

communicates supervisory expectations

to a bank regarding actions or remedial

measures required to correct the

deficiency, weakness, violation, or

practice or condition; and contemplates

significant or programmatic actions or

remedial measures to be taken by the

bank. The term does not include

examiner observations, suggestions, or

other informal comments.

The FDIC is also adding a definition

that is currently in 12 CFR 326.1.

Previously, the FDIC’s text referred to

the definitions section in Subpart A of

Part 326. This proposal would include

a definitions section within Subpart B,

and so FDIC is adding one definition

needed from the section in Subpart A.

This is not a substantive change.

2. Enforcement and Supervision Policy

The proposed rule would articulate

the Agencies’ enforcement and

supervision policy as it relates to AML/

CFT requirements.58 Except with

respect to a significant or systemic

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00013

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

t a substantive change.

2. Enforcement and Supervision Policy

The proposed rule would articulate

the Agencies’ enforcement and

supervision policy as it relates to AML/

CFT requirements.58 Except with

respect to a significant or systemic

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00013

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

18317

Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules

59 12 CFR part 4, subpart C (OCC); 12 CFR 309.6

(FDIC); and 12 CFR part 792, subpart C (NCUA).

failure to implement in all material

respects an established AML/CFT

program in accordance with the

proposed rule, a bank that has properly

established an AML/CFT program

would not be subject to an AML/CFT

enforcement action or to a significant

AML/CFT supervisory action based on

the program rule. At the same time, the

proposed rule would clarify that

nothing in this policy would restrict an

AML/CFT enforcement action or a

significant AML/CFT supervisory action

with respect to a failure to establish an

AML/CFT program. The proposal is

only intended to affect actions by the

Agencies.

3. FinCEN Consultation

The proposed rule would establish a

notice and consultation framework

applicable when one of the Agencies

intends to initiate an AML/CFT

enforcement action or a significant

AML/CFT supervisory action, as those

terms are defined in the proposed

regulation. Before initiating such an

action, the Agency would provide the

Director of FinCEN with an opportunity

to review the action and would consider

any input offered by the Director of

FinCEN, which may include any view

as to the effectiveness of the bank’s

AML/CFT program

FT

enforcement action or a significant

AML/CFT supervisory action, as those

terms are defined in the proposed

regulation. Before initiating such an

action, the Agency would provide the

Director of FinCEN with an opportunity

to review the action and would consider

any input offered by the Director of

FinCEN, which may include any view

as to the effectiveness of the bank’s

AML/CFT program. To facilitate that

review, the Agency would be required

to provide written notice to the Director

of FinCEN of the Agency’s intent to take

the action at least 30 days in advance of

the proposed action, unless a shorter

period is necessary, at the sole

discretion of the Agency, to remedy,

prevent, or respond to an unsafe or

unsound practice or condition.

The notice would be accompanied by

the relevant AML/CFT information

underlying the proposed action.

Relevant AML/CFT information may

include, but is not limited to, relevant

portions of draft report of examination;

relevant portions of a draft enforcement

action; examination workpapers

supporting the proposed action; and the

relevant AML/CFT information

submitted by the bank to the Agency.

The Agency would not be obligated to

provide information over which the

bank may claim privilege under Federal

or State law. The Agency would also

respond, to the extent reasonably

practicable, to requests for additional

AML/CFT information from the Director

of FinCEN regarding the proposed

action.

H. Other Changes for Modernization,

Clarification, and Consistency

In addition to the previously

described changes, the proposed rule

would make other revisions to increase

clarity and consistency in the program

rules. Most of these changes are

technical, such as renumbering

provisions, amending cross-references,

and updating statutory references based

on changes to the BSA by the AML Act.

For example, along with FinCEN,

references to ‘‘BSA/AML programs’’ are

being updated to ‘‘AML/CFT programs’’

for financial institutions

d make other revisions to increase

clarity and consistency in the program

rules. Most of these changes are

technical, such as renumbering

provisions, amending cross-references,

and updating statutory references based

on changes to the BSA by the AML Act.

For example, along with FinCEN,

references to ‘‘BSA/AML programs’’ are

being updated to ‘‘AML/CFT programs’’

for financial institutions. This technical

change is not anticipated to establish

new obligations.

I. Disclosure of Supervisory Information

Each Agency has issued regulations

that generally prohibit the disclosure of

the Agency’s non-public information,

except as provided under such

regulations.59 This prohibition generally

applies to disclosure of any portion of

a report of examination, supervisory

correspondence, and any

representations concerning such reports

or supervisory correspondence, or their

findings, including conclusions

regarding compliance with AML/CFT

compliance program requirements.

Consistent with the proposed rule’s

goal of enhancing FinCEN’s role in the

AML/CFT enforcement and supervisory

process, the proposed rule would clarify

that banks may share any information

with the FinCEN Director that relates to

an existing or potential AML/CFT

enforcement action or significant AML/

CFT supervisory action. This proposed

rule specifically provides that this

authorization to share information

includes information that would

ordinarily be considered non-public

information under the Agencies’

respective rules. To qualify for this

information sharing, the information at

issue must have an appropriate nexus to

an existing or potential AML/CFT

enforcement action or significant AML/

CFT supervisory action. The Agencies

are proposing this clarification to ensure

that banks can share appropriate

information with the FinCEN Director,

including in the context of actions

subject to the newly established

consultation requirement

ation sharing, the information at

issue must have an appropriate nexus to

an existing or potential AML/CFT

enforcement action or significant AML/

CFT supervisory action. The Agencies

are proposing this clarification to ensure

that banks can share appropriate

information with the FinCEN Director,

including in the context of actions

subject to the newly established

consultation requirement. Otherwise,

banks may be unable to provide

thorough information to the FinCEN

Director, whether proactively or in

response to the Director’s requests.

While the proposed rule intends to

permit such sharing, the Agencies are

proposing two alternative methods for

permitting such information sharing

with the FinCEN Director. Under the

first approach, referred to as Option 1 in

the amendatory text below, the Agency

would authorize the disclosure of

covered information on the Agency’s

behalf to the FinCEN Director and

separately permit the FinCEN Director

to use such information. This phrasing

is intended to mirror the permissible

scope of information sharing by the

Agencies under 12 U.S.C. 1821(t), which

provides that a ‘‘covered agency, in any

capacity, shall not be deemed to have

waived any privilege applicable to any

information by transferring that

information to or permitting that

information to be used by’’ another

Federal agency.

Under the alternative approach,

referred to as Option 2 in the

amendatory text below, the Agency

would similarly authorize the disclosure

of covered information on the Agency’s

behalf, as well as similarly authorize the

use of such information by the FinCEN

Director. The Agencies, however, would

expressly require that any such

information shared on the Agency’s

behalf be contemporaneously disclosed

by the bank to the Agency. While the

Agency will necessarily already have

access to its own non-public

information, this additional requirement

is potentially more consistent with the

retention of privilege contemplated

under 12 U.S.C

the FinCEN

Director. The Agencies, however, would

expressly require that any such

information shared on the Agency’s

behalf be contemporaneously disclosed

by the bank to the Agency. While the

Agency will necessarily already have

access to its own non-public

information, this additional requirement

is potentially more consistent with the

retention of privilege contemplated

under 12 U.S.C. 1821(t) and, therefore,

potentially provides a greater safeguard

against the unintended destruction of

privilege. The Agencies also recognize

that banks’ willingness to share timely,

thorough information with the FinCEN

Director is essential to the success of the

consultation framework; and requiring

banks to contemporaneously disclose to

an Agency the same non-public

information they provide to FinCEN

may discourage proactive reporting and

thereby undermine the rule’s objective

of enhancing FinCEN’s role.

Importantly, both of the options

outlined above only permit the FinCEN

Director to use the Agencies’ non-public

information. This authorization to use

the information does not include an

authorization by the Agencies to further

disclose the received non-public

information. Any dissemination by a

bank to a party other than the FinCEN

Director or by the FinCEN Director to

any party would be subject to the

Agencies’ respective rules governing

disclosure of non-public information.

Regardless, the proposed rule would

include additional clarifying text

intended to preserve all applicable

privileges. The destruction of privilege

over non-public supervisory

information could prove harmful both to

the Agency and the bank, so the

additional language is intended to

prevent such consequences.

The Agencies invite comment on

these options for permitting greater

information sharing with the FinCEN

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00014

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

nformation could prove harmful both to

the Agency and the bank, so the

additional language is intended to

prevent such consequences.

The Agencies invite comment on

these options for permitting greater

information sharing with the FinCEN

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00014

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

18318

Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules

Director regarding existing or potential

AML/CFT enforcement actions or

significant AML/CFT supervisory

actions, including possible alternative

methods of accomplishing the rule’s

objectives without unintentionally

impeding applicable privileges.

IV. Severability

The Agencies propose that if one

portion of the proposed rule, if

finalized, is found to be invalid, the

invalidated portion of the regulation

should be severed with the other

portions of the proposed rule remaining

in full force and effect. The Agencies’

position is that invalidation of any one

provision, or application thereof to any

one person or circumstance, does not,

and should not, affect any other

provision in this proposed regulation or

other existing regulations. Each

provision serves an important, related,

but distinct purpose and application,

designed to benefit the public by

protecting the U.S. financial system

from illicit financial activity. The

Agencies accordingly propose

incorporating this into their respective

rules, such that invalidating one

provision would not undermine the

operability or usefulness of the other

provisions.

V. Final Rule Effective Date

The Agencies are proposing an

effective date of 12 months from the

date of issuance of the final rule to

allow sufficient time for banks to review

and implement the requirements of the

proposed rule. The Agencies solicit

comment on the proposed effective date.

VI

dating one

provision would not undermine the

operability or usefulness of the other

provisions.

V. Final Rule Effective Date

The Agencies are proposing an

effective date of 12 months from the

date of issuance of the final rule to

allow sufficient time for banks to review

and implement the requirements of the

proposed rule. The Agencies solicit

comment on the proposed effective date.

VI. Request for Comment

The Agencies welcome comment on

all aspects of the proposed amendments

but specifically seek comment on the

questions below. The Agencies

encourage commenters to reference

specific question numbers when

responding.

An ‘‘Effective’’ AML/CFT Program (IV.B)

1. The proposed rule sets forth the

conditions for an effective AML/CFT

program. Is the description of an

effective program sufficiently clear or is

there anything further that the Agencies

should consider in the final rule adding

to clarify program effectiveness?

2. The proposed rule reflects a

determination by the Agencies that

banks are best placed to identify risks

and allocate resources, and that

providing them with greater discretion

in these areas will improve the quality

of AML/CFT compliance and reporting

to law enforcement. Is this correct or

should the Agencies consider adding

more requirements regarding allocation

of resources? How might banks assess

changes in the total allocation of

resources devoted to an AML/CFT

program in a changing risk and cost

environment?

Establishing and Maintaining an AML/

CFT Program (IV.C)

3. Do banks distinguish between

establishing a program and maintaining

a program by implementing the

program? Do banks distinguish between

establishing a program and maintaining

a program by implementing the

program? If so, how? Should the

Agencies add anything to further define

these terms in the final rule?

4

cost

environment?

Establishing and Maintaining an AML/

CFT Program (IV.C)

3. Do banks distinguish between

establishing a program and maintaining

a program by implementing the

program? Do banks distinguish between

establishing a program and maintaining

a program by implementing the

program? If so, how? Should the

Agencies add anything to further define

these terms in the final rule?

4. Should the proposed rule’s

distinction between ‘‘establishing’’ and

‘‘maintaining’’ a program be modified?

Is the distinction between

‘‘establishing’’ and ‘‘maintaining’’ a

compliance program useful for banks?

5. Should the proposed rule

distinguish between ‘‘establishing’’ and

‘‘maintaining’’ at the program level and

‘‘establishing’’ and ‘‘maintaining’’ each

individual element? For example,

should the final rule more clearly

differentiate between a failure to

establish the program, as a whole,

versus a failure to establish an

individual mandatory component of the

program?

6. Is clarification needed for banks to

determine what constitutes a

‘‘significant or systemic failure’’ to

implement in all material respects a

properly established AML/CFT

program?

7. Is clarification needed for banks to

determine what constitutes a ‘‘failure to

establish an AML/CFT program’’?

8. How should the proposed rule

ensure that the regulations issued by

FinCEN and the appropriate Agencies

function harmoniously? How should the

proposed rule differentiate between the

Secretary of the Treasury’s

responsibility for regulations on

establishing AML/CFT programs and

the Agencies’ responsibilities for

regulations on establishing and

maintaining programs?

Internal Policies, Procedures, and

Controls (IV.D.1)

9

ure that the regulations issued by

FinCEN and the appropriate Agencies

function harmoniously? How should the

proposed rule differentiate between the

Secretary of the Treasury’s

responsibility for regulations on

establishing AML/CFT programs and

the Agencies’ responsibilities for

regulations on establishing and

maintaining programs?

Internal Policies, Procedures, and

Controls (IV.D.1)

9. Do banks expect any changes to

their existing internal policies,

procedures, and controls under the

proposed rule, which requires that

internal policies, procedures, and

controls be ‘‘risk-based’’ and

‘‘reasonably designed’’ to ensure

compliance with the BSA?

Risk Assessment Processes (Generally)

(IV.D.1.i)

10. The proposed rule refers to risk

assessment processes rather than a risk

assessment process. This leaves banks

free to use findings from one or more

processes to assess their ML/TF risk.

Does this description of how banks

assess their ML/TF risk provide

sufficient flexibility? How should the

Agencies describe ‘‘risk assessment

processes’’ to better reflect how banks

assess ML/TF risks?

11. Should risk assessment processes

be required to take into account

additional or different criteria or risks

than those listed in the proposed rule?

If so, what additional factors should the

Agencies consider requiring?

12. How long does it generally take a

bank to incorporate the results of a risk

assessment into its AML/CFT program?

What factors determine this time frame?

Risk Assessment Processes (AML/CFT

Priorities) (IV.D.1.i.b)

13. What, if any, difficulties do banks

anticipate when incorporating the AML/

CFT Priorities as part of their risk

assessment processes?

14. What additional guidance on how

to incorporate the AML/CFT Priorities

into a bank’s risk assessment processes

would it be useful for the Agencies to

provide?

Risk Assessment Processes (Updates)

(IV.D.1.i.c)

15

s (AML/CFT

Priorities) (IV.D.1.i.b)

13. What, if any, difficulties do banks

anticipate when incorporating the AML/

CFT Priorities as part of their risk

assessment processes?

14. What additional guidance on how

to incorporate the AML/CFT Priorities

into a bank’s risk assessment processes

would it be useful for the Agencies to

provide?

Risk Assessment Processes (Updates)

(IV.D.1.i.c)

15. The proposed rule requires that

risk assessment processes are updated

promptly upon any change that the bank

knows or has reason to know

significantly changes the bank’s money

laundering, terrorist financing, and

other illicit finance activity risks. Would

the proposed update requirement

change the way banks currently update

their risk assessment processes, and if

so how? Is additional explanation

needed concerning when a financial

institution would be required to update

its risk assessment? In particular, how

might the Agencies clarify how risk

assessment processes would be updated

‘‘promptly’’? Would an alternative

approach, such as periodic updates or a

set schedule for updates, be preferable?

Would an alternative standard, such as

‘‘materially changes,’’ be clearer than

‘‘significantly changes’’?

16. How do a bank’s ML/TF risks and

its risk assessment processes affect one

another? Put differently, if there is a

feedback loop between the two, please

describe it, including the typical

amount of time between discovering

new risks and incorporating those

findings into risk assessment processes.

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00015

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

es affect one

another? Put differently, if there is a

feedback loop between the two, please

describe it, including the typical

amount of time between discovering

new risks and incorporating those

findings into risk assessment processes.

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00015

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

18319

Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules

60 12 CFR 21.21(d)(2) (OCC); 12 CFR 326.8(c)(2)

(FDIC); and 12 CFR 748.2(c)(2) (NCUA).

Independent AML/CFT Program Testing

To Be Conducted by Bank Personnel or

by an Outside Party (IV.D.2)

17. Under the proposed rule, a bank

is required to conduct independent

AML/CFT program testing. This

requirement is already reflected in

existing AML program rule

requirements as is the requirement to

include ‘‘an independent audit function

to test programs.’’ 60 The Agencies

solicit comment on how financial

institutions may interpret and carry out

this requirement, based on the proposed

rule’s description of an effective AML/

CFT program. Are further clarifications

on the independent AML/CFT program

testing requirement necessary to ensure

that audits carried out by bank

personnel or outside third parties are

well-tailored, risk-based, and focused on

effectiveness?

AML/CFT Officer Located in the United

States (IV.D.3.ii)

18. Under the proposed rule, while

the AML/CFT officer must be located in

the United States, personnel located

outside of the United States would still

be permitted to perform certain AML/

CFT functions. This language does not

alter existing regulations and guidance

that generally prohibit the sharing of

SARs with personnel located outside of

the United States other than limited

circumstances such as a bank’s foreign

head office or controlling company. Are

any further clarifications on this issue

needed?

Written AML/CFT Program and

Approval (IV.E)

19

perform certain AML/

CFT functions. This language does not

alter existing regulations and guidance

that generally prohibit the sharing of

SARs with personnel located outside of

the United States other than limited

circumstances such as a bank’s foreign

head office or controlling company. Are

any further clarifications on this issue

needed?

Written AML/CFT Program and

Approval (IV.E)

19. The proposed rule standardizes

the long-standing requirement that an

AML/CFT program be written. Should

the Agencies further clarify which

specific elements of an institution’s

AML/CFT program must be written, or

is this requirement generally understood

in its current form? In particular: (a)

which program components—such as

risk assessment processes; internal

policies, procedures, and controls;

transaction monitoring rules and

parameters; escalation and reporting

protocols; independent testing results;

training materials; and documentation

of designated personnel—should be

required in writing; (b) what form (e.g.,

narrative descriptions, checklists,

system configurations, or electronic

records) such documentation should

take; and (c) what level of detail is

appropriate for each component?

Should the Agencies instead alter the

requirement that an AML/CFT program

be expressly required to be ‘‘written’’?

What would be the benefits or

drawbacks of any such alterations to

this requirement?

20. The proposed rule would require

that a bank’s written AML/CFT program

be approved by its board of directors, an

equivalent governing body within the

bank, or appropriate senior

management

ould the Agencies instead alter the

requirement that an AML/CFT program

be expressly required to be ‘‘written’’?

What would be the benefits or

drawbacks of any such alterations to

this requirement?

20. The proposed rule would require

that a bank’s written AML/CFT program

be approved by its board of directors, an

equivalent governing body within the

bank, or appropriate senior

management. Should the Agencies

further clarify which aspects of the

AML/CFT program must be subject to

such approval? In particular: (a) should

approval be required for each of the core

program components (e.g., the risk

assessment processes framework;

internal policies, procedures, and

controls; transaction-monitoring and

escalation frameworks; independent

testing structure; training program; and

designation of responsible personnel),

or would approval of the overall

program framework be sufficient; (b)

should material revisions to particular

components (such as significant changes

to the institution’s risk assessment

methodology, monitoring architecture,

or governance structure) require re-

approval at the same level; and, (c) what

level of specificity should the approving

body be required to review and approve

(e.g., high-level program architecture

versus detailed procedures or

parameter-level settings)? Should the

Agencies instead eliminate the specified

approval requirement, allowing banks

flexibility in determining how

leadership oversight of the AML/CFT

program is structured? What would be

the benefits or drawbacks of not

prescribing a mandatory approval

requirement in the regulation? If the

Agencies do not eliminate the specified

approval requirement, should the

Agencies consider amending the

requirement? Are there alternatives to

board of directors or an equivalent

governing body, such as ‘‘appropriate

senior management’’ that would be

more appropriate?

Supervision and Enforcement (IV.G)

21

cks of not

prescribing a mandatory approval

requirement in the regulation? If the

Agencies do not eliminate the specified

approval requirement, should the

Agencies consider amending the

requirement? Are there alternatives to

board of directors or an equivalent

governing body, such as ‘‘appropriate

senior management’’ that would be

more appropriate?

Supervision and Enforcement (IV.G)

21. Is clarification needed for banks to

determine what constitutes a

‘‘significant or systemic failure’’ to

implement an established AML/CFT

program?

22. Is clarification needed for banks to

determine what constitutes a ‘‘failure to

establish an AML/CFT program’’?

23. The proposed rule would add a

requirement for an agency to notify and

consider information provided by

FinCEN before initiating a significant

AML/CFT supervisory action when

acting pursuant to authority delegated

under this chapter. Should the proposed

consultation process include an asset

threshold—e.g., consultation is required

for any significant AML/CFT

supervisory actions involving banks

with $10 billion or more in assets? In

addition, or as an alternative, should the

proposed rule not require but instead

provide the option for banks to request

their agency consult with FinCEN prior

to initiating a significant AML/CFT

supervisory action?

24. The definition of significant AML/

CFT supervisory action includes the

term ‘‘any written communication.’’ Is

the term ‘‘any written communication’’

too broad? Are there downsides and

negative consequences to including the

term ‘‘any written communication’’ in

the proposed regulatory text? If so,

please describe. Should the term ‘‘any

written communication’’ be more

clearly defined or removed altogether?

25. As described above, the purpose

of the FinCEN consultation requirement

is to ensure consistency in BSA/AML

enforcement and supervision across

banks, and for FinCEN to provide

relevant information on the

effectiveness and impact of an

institution’s AML/CFT program

ext? If so,

please describe. Should the term ‘‘any

written communication’’ be more

clearly defined or removed altogether?

25. As described above, the purpose

of the FinCEN consultation requirement

is to ensure consistency in BSA/AML

enforcement and supervision across

banks, and for FinCEN to provide

relevant information on the

effectiveness and impact of an

institution’s AML/CFT program. While

Treasury, FinCEN, and the Agencies

believe the benefits of a required

consultation process outweigh the costs,

the parties recognize this adds

additional layers of review for banks

and the Agencies during an

examination. Are there any avenues,

communication channels, or methods in

which FinCEN and the Agencies can

streamline the consultation process and

prevent logistical burdens for banks or

delays in exam report issuance?

26. Is the definition of the term

‘‘significant AML/CFT supervisory

action’’ sufficiently clear? Does the

inclusion of ‘‘unsafe or unsound

practices or conditions’’ introduce

confusion about what types of

supervisory actions would be subject to

the FinCEN consultation requirement,

since those terms are not found in the

BSA?

Disclosure of Supervisory Information

(IV.I)

27. The Agencies invite comment on

the two options for permitting greater

information sharing with the FinCEN

Director regarding AML/CFT

enforcement actions or significant AML/

CFT supervisory actions. In particular,

would the disclosure of confidential

supervisory information to FinCEN

compromise attorney-client privilege,

other applicable privileges, or otherwise

undermine the preservation of privilege

in 12 U.S.C. 1821(t)?

Other Topics

28. Should the rule be revised to tailor

program requirements or

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00016

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

ation to FinCEN

compromise attorney-client privilege,

other applicable privileges, or otherwise

undermine the preservation of privilege

in 12 U.S.C. 1821(t)?

Other Topics

28. Should the rule be revised to tailor

program requirements or

VerDate Sep<11>2014

16:45 Apr 09, 2026

Jkt 268001

PO 00000

Frm 00016

Fmt 4702

Sfmt 4702

E:\FR\FM\10APP1.SGM

10APP1

lotter on DSK8BHNXB4PROD with PROPOSALS1

18320

Federal Register / Vol. 91, No. 69 / Friday, April 10, 2026 / Proposed Rules

61 31 U.S.C. 5311–5336.

62 Consolidated Reports of Condition and Income

(September 30, 2025).

63 For example, there is at least some anecdotal

evidence that otherwise normal (low risk)

customers could have reduced access as a result of

BSA compliance. See https://

www.banking.senate.gov/imo/media/doc/klein_

testimony_2-5-25.pdf at 4.

64 See Citizens Rulemaking Alliance comment

letter (Nov. 17, 2025), p. 2, submitted in context of

the recent proposed rulemaking 90 FR 48835:

Unsafe or Unsound Practices; Matters Requiring

Attention. The letter provided conservative

estimates for general burden to community banks to

address matters sufficiently deficient to warrant a

supervisory action of a Matters Requiring Attention.

Their provided estimates suggested 120 internal

staff hours per MRA to scope, draft, implement, and

document a written remediation plan; 20 board/

committee hours for oversight and attestation; and

$15,000 in external advisory/legal services for

complex MRAs. Agency staff expect that costs

would be even greater for larger, more c

This text is long and has been trimmed here. Open the source document for the complete record.