The AML/CFT Program Rule, Current vs. Proposed: A Side-by-Side

Last reviewed: October 2026

On April 10, 2026, FinCEN (opens in a new tab) and the OCC, FDIC, and NCUA (opens in a new tab) proposed rewriting the AML/CFT program rules that banks, credit unions, and money services businesses operate under. The Federal Reserve released its own version (opens in a new tab) on July 7, 2026. The comment periods have closed. As of October 2026, there is no final rule.

FinCEN proposes that the final rule take effect 12 months after it is issued. That sounds like time. For the parts of a program that take a year to build, it isn’t much.

This reference compares current and proposed requirements for each program element. It sorts them into three groups: what to start now, what to check now, and what can wait for the final text. It’s for BSA Officers and CCOs at banks and credit unions, and for fintech BSA/AML leads whose sponsor banks will expect them to keep pace.

The standard itself changes

Under the current bank rule (opens in a new tab), a program has to include a set of minimum elements. The proposal defines an effective program in two parts. The institution establishes a program with every required component. It then maintains the program by “implementing, in all material respects, the established AML/CFT program.”

For banks, the proposal would rule out an enforcement action or significant supervisory action over implementation unless the failure is “significant or systemic.” A design failure stays actionable. The OCC, FDIC, and NCUA proposal would also require 30 days’ written notice to FinCEN before those actions. The Federal Reserve’s proposal leaves that out and asks for comment on it.

We covered what that shift means for program design in FinCEN’s AML Rewrite Puts Your Risk Assessment on Trial. This piece is the element-by-element view.

Element by element

The table compares the current bank rules with the proposals. Paragraph numbers differ between FinCEN’s rule and the agencies’ rules, but the content lines up unless noted.

Element	Current rule	Proposed rule	Readiness call
Risk assessment	No express requirement in the program rules; examiners expect one	Identify, assess, and document risks across products, services, distribution channels, customers, and geographies	Start now
AML/CFT Priorities	Not yet required; FinCEN said to incorporate them once regulations take effect	Review and, as appropriate, incorporate; document why a priority doesn’t apply	Start now
Updates	No rule; most programs update annually	Update promptly when a change significantly alters risk; no fixed timeframe	Start now
Resource allocation	Statutory direction only	Direct more attention and resources to higher-risk customers and activities	Start now
Independent testing	Testing by bank personnel or an outside party	Same, with preamble emphasis on effectiveness and stricter independence	Check now
AML/CFT officer	One or more designated individuals	One individual, located in the U.S. and accessible to FinCEN and the regulator	Check now
Ongoing CDD	A separate program element	Moved inside internal controls; FinCEN says obligations don’t change	Wait
Training	Training for appropriate personnel	Ongoing, risk-based training that reflects risk assessment results	Wait
Program approval	Board approval under the agency rules	Board, equivalent body, or appropriate senior management	Wait
Terminology	“BSA program,” “BSA officer”	“AML/CFT program” throughout	Wait

Current: 31 CFR 1020.210 and 12 CFR 21.21, 326.8, 748.2, and 208.63. Proposed: 91 FR 18704, 91 FR 18304, and Federal Reserve Docket R-1835. The readiness call is our recommendation, not a requirement.

Start now: the risk assessment pieces

Four of the changes sit in the risk assessment. They take the longest to build because they need data, judgment, and committee time.

The proposal names distribution channels as a required risk factor. FinCEN reads the term as “the methods and tools through which a financial institution opens accounts” and delivers products, including remote onboarding. Many assessments fold channels into products. Any program built on app-based onboarding should rate channels on their own.

The AML/CFT Priorities (opens in a new tab) review is the second piece. FinCEN warns that “a surface-level, perfunctory review” of a priority won’t satisfy the requirement. An institution can conclude that a priority doesn’t apply, but it has to document why. A one-paragraph nod to the 2021 list won’t meet that bar.

The preamble also lists information sources an assessment can draw on, including 314(a) and 314(b) results, Treasury’s national risk assessments, and FinCEN advisories. An assessment built only on internal data will look thin against that list. Smaller institutions get some room: the preamble says community banks may use streamlined, qualitative processes that rely on direct knowledge of their customers and markets. Streamlined still means written down.

The third is prompt updates. The proposal sets no timeframe, so the burden is on you to define a significant change and how fast you act on one. That takes a written trigger list, a log, and someone accountable for both.

The fourth is resource allocation. If your assessment says your highest risks sit in one product line, examiners would look for staffing, monitoring, and testing to follow. Writing down where you’ve deliberately applied less effort, and why, protects that decision.

Check now: testing independence and the officer

Two changes look small in the rule text and can take months to fix.

Independent testing keeps its basic shape. The preamble, though, says the AML/CFT officer and staff who report to the officer would generally not be independent. It also says an outside tester shouldn’t be involved in conflicting work, such as training your staff or developing the policies and procedures it tests. If the firm that drafted your BSA procedures also performs your independent test, line up a different provider before the next cycle.

The officer must be an individual located in the United States and accessible to FinCEN and the institution’s regulator. Staff outside the U.S. can still perform AML/CFT functions. Programs with an offshore compliance team, or an officer role held at a foreign parent, should map who holds which responsibility now.

The preamble also expects the officer to have authority, independence, and resources, without conflicting duties. A BSA Officer who also runs operations or product should expect questions.

What can wait for the final text?

Some changes are mostly wording. The proposal moves ongoing customer due diligence inside internal controls, and FinCEN says the move isn’t meant to change obligations under 31 CFR 1010.230. It replaces “BSA program” with “AML/CFT program.” It widens who can approve the written program to include appropriate senior management.

Rewriting the policy now means rewriting it twice if the final rule moves, and board and committee time is limited. Hold policy wording and training content until the final text. Keep a list of every document that will need a terminology update, so the work goes fast when it comes.

Training is the closest call. The proposal ties training content to risk assessment results, so refresh it after the new assessment is approved rather than before.

The exception is a request from your sponsor bank or examiner. If either wants your program mapped to the proposal, give them the comparison, not a rewritten policy.

How to put it in place

1. Run the comparison once against your own program. Take each element in the table and record where your program stands: already meets the proposal, needs work, or waits for the final text. The BSA Officer owns it. The evidence is a dated gap list presented to the BSA or compliance committee and noted in the minutes.
2. Build the risk assessment pieces now. Write the methodology, including a distribution channel factor. Complete a documented Priorities review, and set up a trigger log with named owners. The BSA Officer drafts and the committee approves the methodology. The evidence is the approved methodology, the Priorities review record, and at least one logged trigger with its decision. The AML/CFT Rule Readiness Kit includes a rule comparison workbook and a risk assessment methodology built for the proposals.
3. Write the final-rule plan before the final rule. Decide who reads the final text, how fast the gap list gets updated, and which documents change in what order. If FinCEN keeps the 12-month period, a plan agreed in advance turns that year into execution instead of planning. The CCO owns it, and the evidence is a one-page plan in the committee minutes.

Waiting for the final rule is reasonable for policy language. The risk assessment is different. Under the proposal it’s the main evidence of design, and it can’t be rebuilt in a quarter.

Institutions that start there will spend the implementation year adjusting a working process instead of building one.

Sources

• Anti-Money Laundering and Countering the Financing of Terrorism Programs, Proposed Rule | FinCEN, 91 FR 18704 (Apr. 10, 2026) (opens in a new tab)
• Anti-Money Laundering and Countering the Financing of Terrorism Programs, Proposed Rule | OCC, FDIC, NCUA, 91 FR 18304 (Apr. 10, 2026) (opens in a new tab)
• Anti-Money Laundering and Countering the Financing of Terrorism Programs, Proposed Rule, Docket R-1835 | Federal Reserve Board (July 7, 2026) (opens in a new tab)
• 31 CFR 1020.210, Anti-money laundering program requirements for banks | eCFR (current) (opens in a new tab)
• Anti-Money Laundering and Countering the Financing of Terrorism National Priorities | FinCEN (June 30, 2021) (opens in a new tab)