FinCEN’s AML Rewrite Puts Your Risk Assessment on Trial

Every BSA officer has lived some version of this exam. The program looks fine on paper. Then the examiners pull a sample of alerts, find a backlog and a few weak closures, and the finding reads like the whole program failed.

On April 10, FinCEN published a proposed rule to rewrite the AML/CFT program requirements (91 FR 18704). Its central change goes right at that experience. It draws a hard line between designing a program and running it, and it raises the bar for enforcement over day-to-day execution problems.

That’s good news for BSA officers. It also moves a lot of weight onto one document: your risk assessment.

Design Versus Execution

The proposal defines an effective program in one line. A program is effective if it is “established and maintained in accordance with applicable requirements.”

Then it splits the two. Establishing a program means designing one that has all the required pieces. Maintaining it means “implementing, in all material respects, the established AML/CFT program.”

The supervisory consequence is the part bankers will notice. For banks, significant supervisory and enforcement actions over implementation would be reserved for “significant or systemic failures.” The proposal says “isolated, technical, or immaterial implementation deficiencies” would not be cause for those actions. It would also require the banking agencies to give FinCEN written notice at least 30 days before taking a significant AML/CFT supervisory action.

So a missed alert, or a handful of late reviews, shouldn’t turn into a consent order. A program that was never designed right still can.

Why the Risk Assessment Becomes the Hinge

If design failures carry the bigger risk, the next question is what proves your design is sound. Under this proposal, the answer is mostly your risk assessment.

The proposal would require a risk assessment process that evaluates your money laundering and terrorist financing risks across “products, services, distribution channels, customers, and geographic locations.” The process would review and, as appropriate, incorporate FinCEN’s AML/CFT Priorities. And it would be “updated promptly upon any change that the financial institution knows or has reason to know” significantly changes your risk.

The proposal also leans hard on the AML Act’s direction that programs put “more attention and resources toward higher-risk customers and activities,” rather than toward lower-risk ones.

Put those together. If your risk assessment says your highest risks are cash-intensive businesses and a fintech deposit program, examiners will expect your staffing, monitoring rules, and testing to point there. If your monitoring still runs on a vendor’s default scenarios and your analysts spend the week clearing low-risk alerts, your design doesn’t match your own analysis. That’s a design problem, and design problems keep their teeth under this proposal.

We’ve written before about why most risk assessments don’t do what institutions think they do (“Your Risk Assessment Is Probably Not Doing What You Think It Is”). Two of the failures covered there, a static assessment and one disconnected from the controls, stop being best-practice gaps under this proposal. They start to look like design deficiencies.

What’s New for Your Risk Assessment

Three parts of the proposal ask for things most community bank risk assessments don’t show today.

The AML/CFT Priorities. FinCEN first published its AML/CFT Priorities in June 2021, and many risk assessments still give them a single paragraph. The proposal asks you to review them and incorporate them “as appropriate.” That means showing how you weighed each one against your own customer base, including the ones you decided don’t apply and why.

The lower-risk side. The proposal openly supports moving resources away from low-risk activity. Few banks have written down which activities they treat as lower risk and what they do differently because of it. Without that record, scaling back looks like neglect rather than judgment.

“Promptly.” The proposal doesn’t set a fixed review cycle. It ties updates to significant changes in risk. Many community banks update the BSA risk assessment once a year on the audit calendar. If you launch a product, sign a fintech partner, or enter a new market in March, an update in December may not count as prompt.

Three Things to Do Before June 9

First, write down the line from risk to control. For each higher-risk area, list the specific monitoring rules, EDD steps, and staffing that address it. Do the same for your lowest-risk areas, and record where you’ve deliberately applied less effort and why. If a risk has no controls tied to it, or your effort sits where the risk is low, fix the design now.

Second, put BSA in the change approval path. New products and partners usually go through credit and legal review, while the BSA officer hears about them at launch. Add the BSA officer to the approval process for new products, partners, and markets. Define what counts as a significant change, and require a documented risk assessment update before launch.

Third, comment. The comment period closes June 9, 2026. FinCEN’s fact sheet says the federal banking agencies will issue their own program proposals in substantive alignment with FinCEN’s. If you have a view on how “significant or systemic” should be measured, or how the Priorities should fit into a community bank’s risk assessment, now is the time to say so.

This proposal could take some of the fear out of execution findings. It does that by putting more weight on design. For most banks, the risk assessment is the clearest evidence of design, and it’s also the document least connected to anything else in the program.

The banks that benefit will be the ones whose risk assessment actually runs their program. Getting there rarely means starting over. It means tying the analysis you already have to the controls you already run, and writing the connection down where an examiner can follow it. That work is worth finishing before a final rule turns it into the standard.