An intentional focus on risk-based programs
The AML Act of 2020, which amended the Bank Secrecy Act, directed FinCEN to reevaluate and update AML/CFT requirements to enhance program effectiveness, efficiency, and flexibility. It also required that FinCEN integrate its AML/CFT policy priorities into financial institutions’ risk assessments.
The FinCEN proposed AML rule would amend existing regulations and supersede the 2024 Program NPRM, with an effective date of 12 months after the final rule is issued.
At its core, the new AML/CFT program rule reinforces something many institutions already strive for but have struggled to operationalize consistently. Programs must be risk-based, dynamic, and aligned with FinCEN’s national priorities.
FinCEN makes it clear that financial institutions are expected to focus more attention and resources on higher-risk customers and activities while de-emphasizing lower-risk areas. This is a philosophical and structural shift that places the risk assessment process at the center of the entire program.
The risk-based approach gives institutions flexibility, but it also raises expectations. A program that is not clearly tied to identified risks or that cannot demonstrate how resources align with those risks may face increased scrutiny.
Required AML risk assessment processes
One of the most significant elements of the new AML/CFT program rule is the formalization of risk assessment processes as a required and ongoing component of the program.
Rather than relying on a static annual risk assessment, institutions are expected to use multiple processes to identify, assess, and document money laundering and terrorist financing risks across:
- products
- services
- customers
- geographies
- distribution channels.
These risk assessment processes must also incorporate evolving inputs such as:
- FinCEN advisories
- national risk assessments
- law enforcement feedback
- internal data.
Best practices suggest updates every 12-18 months or when risk changes, not only on a fixed schedule.
For many institutions, this will require a more integrated approach to data, analytics, and internal communication. It may also require revisiting how risk assessment outputs are documented and used to drive decisions across the program.
Redefining program effectiveness
The proposed rule introduces an important distinction between establishing a program and maintaining it. Financial institutions must first establish an AML/CFT program that includes required components. Required components of an AML/CFT program include internal controls, independent testing, a designated compliance officer, and training. Once a program is established, the supervisory focus shifts to how financial institutions maintain and implement that program in all material respects.
This distinction matters because it changes how regulators may approach supervisory and enforcement actions. Under the new AML/CFT program rule, significant compliance actions are more likely to focus on systemic or material failures rather than isolated implementation issues, assuming the program is fundamentally sound.
At the same time, institutions are expected to identify and address warning signs such as:
- backlogs
- monitoring gaps
- data issues.
Ignoring these indicators could still lead to supervisory action.
