Modernizing BSA/AML Compliance: FinCEN’s Proposed Program Rule And Coordinated Federal Rulemakings

There is an ongoing effort to modernize the Bank Secrecy Act (“BSA”), spanning multiple agencies. This alert is the first in a series discussing these efforts. This alert focuses on FinCEN’s April 2026 proposed program rule and its implications for financial institutions. Subsequent alerts will address the agency-specific rulemakings and related developments.

What to Know About the Proposed Rule

FinCEN’s proposed program rule places the onus on financial institutions to understand their money laundering and terrorism financing risks and tailor their compliance programs accordingly. The rule notes that the government will give deference to adequately risk-based determinations. At the same time, the Proposed Rule outlines enhancements that FinCEN expects financial institutions to implement as appropriate.

Introduction

Recent federal administrations have prioritized modernizing the BSA, building on the AML Act of 2020, which sought to strengthen and modernize the BSA’s anti-money laundering and countering the financing of terrorism (“AML/CFT”) framework.¹ Treasury Secretary Scott Bessent has stated that the Administration’s approach “restores common sense with a focus on keeping bad actors out of the financial system, not burying America’s banks in more red tape.”²

On April 7, 2026, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) published a Notice of Proposed Rulemaking (“NPRM” or “Proposed Rule”) intended to “fundamentally reform” financial institutions’ AML/CFT programs under the BSA and “ultimately reduce compliance burden.” The Proposed Rule has five “key reforms” to AML/CFT program compliance and supervision: (i) “refocuses compliance obligations and expectations on effectiveness by distinguishing between deficiencies stemming from program design and implementation;” (ii) “reinforces Treasury’s belief that financial institutions are best positioned to identify and evaluate their illicit finance risks;” (iii) “empowers financial institutions to devote more attention and resources toward higher risks rather than toward lower risks;” (iv) “clarifies expectations related to certain program requirements and functions—including independent testing and audit functions—to ensure that examiners and auditors do not substitute their subjective judgment in place of financial institutions’ risk-based and reasonably designed AML/CFT programs;” and (v) “affirms FinCEN’s central role in AML/CFT supervision, including through the introduction of a notice and consultation framework between Federal banking supervisors and FinCEN with respect to significant AML/CFT supervisory actions.” 

Overview of BSA Modernization Efforts

In 2021, the AML Act of 2020 (“AML Act”) was enacted, seeking to “comprehensively reform and modernize” the BSA. Among other things, the AML Act directed FinCEN to update program rules for financial institutions, establish AML/CFT Priorities, require a risk-based approach to compliance, and codify a requirement for a U.S.-based compliance officer.³ In June 2025, Deputy Secretary of the Treasury Michael Faulkender laid out the administration’s four guiding principles for BSA modernization: (1) regulation should derive from a clear statutory mandate; (2) regulation should be efficient, striking an appropriate balance between costs and benefits; (3) regulation should be fair and objective, with clarity and consistency across entities; and (4) regulators themselves should be efficient in mitigating risk and transparent in their actions.⁴ An additional purpose of the Proposed Rule is to more closely align the BSA program rule requirements that apply to all covered financial institutions, such as banks, money service businesses (“MSBs”), broker-dealers, and depository institutions. ⁵

For purposes of the AML program rules and this Proposed Rule, the term “financial institutions” include: (1) banks; (2) casinos and card clubs (“casinos”); (3) MSBs; (4) brokers or dealers in securities (“broker-dealers”); (5) mutual funds; (6) insurance companies; (7) futures commission merchants (“FCMs”) and introducing brokers in commodities (“IBCs”); (8) dealers in precious metals, precious stones, or jewels (“DPMSJs”); (9) operators of credit card systems; (10) loan or finance companies; and (11) housing government sponsored enterprises (“housing GSEs”).” 

However, certain investment advisers will likely be included under the definition of “financial institution” in the near future. Under the AML/CFT Program and SAR Filing Requirements for Registered Investment Advisers and Exempt Reporting Advisers (“IA AML Rule”) registered investment advisers (“RIAs”) and exempt reporting advisers (“ERAs”) will be a “financial institution” under the BSA.⁶ The rule requires RIAs and ERAs to: (a) implement a risk-based and reasonably designed AML/CFT program; (b) file certain reports, such as Suspicious Activity Reports (“SARs”), with FinCEN; (c) keep certain records, such as those relating to the transmittal of funds (i.e., comply with the Recordkeeping and Travel Rules); and (d) fulfill certain other obligations applicable to financial institutions subject to the BSA and FinCEN’s implementing regulations, such as special information sharing procedures. These investment advisors must meet these standards by January 1, 2028.

Moreover, as part of this modernization effort, FinCEN also issued an interim final rule in March 2025 that removed the requirement for U.S. companies and U.S. persons to report beneficial ownership information (“BOI”) to FinCEN under the Corporate Transparency Act.⁷ FinCEN revised the definition of “reporting company” in its implementing regulations to mean only those entities formed under the law of a foreign country and registered to do business in any U.S. State or Tribal jurisdiction by the filing of a document with a secretary of state or similar office (formerly known as “foreign reporting companies”).⁸ FinCEN also exempts entities previously known as “domestic reporting companies” from BOI reporting requirements. Foreign entities that meet the new definition of a “reporting company” and do not qualify for an exemption from the reporting requirements must report their BOI to FinCEN within 30 calendar days after receiving notice that their registration is effective. These foreign entities, however, will not be required to report any U.S. persons as beneficial owners, and U.S. persons will not be required to report BOI with respect to any such entity for which they are a beneficial owner.

The Proposed Rule’s Framework for Effective AML/CFT Programs

Under the Proposed Rule, a financial institution would have an “effective” AML/CFT program if it both “establishes” and “maintains” a program that satisfies the rule’s requirements.⁹ The “establishment” prong incorporates the BSA’s four pillars: (1) internal policies, procedures, and controls; (2) a designated compliance officer; (3) employee training programs; and (4) independent audit functions; with several notable modifications and clarifications:

• Risk-Based Internal Policies, Procedures, and Controls. Financial institutions must include “a risk-based set of internal policies, procedures, and controls that is reasonably designed to ensure compliance with the Bank Secrecy Act.” Although many financial institutions already conduct risk assessments, the Proposed Rule makes conducting risk assessments an explicit regulatory requirement and requires these risk assessments to be updated promptly upon any change that the financial institution knows or has reason to know significantly changes their money laundering/terrorist financing risk profiles.¹⁰ Assessments must also incorporate FinCEN’s AML/CFT Priorities “as appropriate.” Risk assessments should evaluate the money laundering/terrorism financing risks of its business activities, including products, services, distribution channels,¹¹ customers, and geographic locations.
• Risk-Based Resource Allocation. Financial institutions must devote “more attention and resources toward higher risk customers and activities.” The proposed rule envisions financial institutions exercising more flexibility in deploying attention and resources. FinCEN characterized this as an “important departure from the status quo” as it “explicitly permits financial institutions to de-prioritize lower risks.” 
• (U.S. Based) Designated Compliance Officer. Financial institutions must designate a U.S.-based AML/CFT officer responsible for establishing and maintaining the program. This NPRM would implement the AML Act’s requirement (31 U.S.C. § 5318(h)(5)) that program responsibilities be performed by persons in the United States who are accessible to, and subject to oversight by, the Secretary of the Treasury and the appropriate Federal functional regulator.¹² But, FinCEN acknowledged that institutions may delegate certain AML/CFT functions to personnel or third-party providers located outside the United States.
• Customer Due Diligence. The Proposed Rule does not alter existing customer due diligence (“CDD”) obligations but places the requirement within the internal controls pillar. This organizational change aims to more accurately reflect how covered financial institutions operationalize ongoing CDD as part of their overall AML programs. 
• Independent Program Testing. The BSA continues to require that financial institutions have an independent audit function to test their AML/CFT programs. The Proposed Rule does not alter this obligation but emphasizes the importance of having objective criteria and unconflicted auditors. It also standardizes the language for covered financial institutions.
• Ongoing Employee Training. The NPRM adopts “the BSA’s ‘ongoing employee training program’ language uniformly” without substantively changing obligations under the existing rule. The frequency and scope of training depend on the institutions’ risk assessments.
• Board Approval of AML/CFT Policy. The Proposed Rule requires that a financial institution’s written AML/CFT program be approved by the financial institution’s board of directors or an equivalent governing body within the financial institution, or appropriate senior management. Although generally required, this change standardizes the language across financial institutions and provides flexibility to approval method based on the financial institutions size and structure.

The “maintenance” of an effective AML/CFT program means “implementing” it “in all material respects.” FinCEN stated that “minor deficiencies” would not constitute a failure to maintain, and that only “significant or systemic” failures would trigger enforcement or significant supervisory action. Examples of actionable failures include: consistently ignoring red flags of serious deficiencies, gaps in risk-assessment processes causing the institution to miss material risks, and data-related issues materially impacting risk mitigation. FinCEN expects that under the Proposed Rule, a financial institution could become aware of such implementation-related concerns through a variety of mechanisms, including, but not limited to: (1) independent testing of the AML/CFT program; (2) examiner observations, suggestions, or other informal comments about the AML/CFT program from FinCEN (or its designee, such as a Federal functional regulator); (3) management information systems and related reports or other outputs (e.g., key performance indicators or key risk indicators, such as monitoring for potentially material backlogs in relevant AML/CFT processes); and (4) issues identified by personnel involved in the operation of the financial institution’s AML/CFT program. Financial institutions should meaningfully evaluate concerns and address risks as they are raised.

The NPRM states that it “does not contemplate regulatory second-guessing of a financial institution’s reasonable determinations regarding appropriate resource allocation or conclusions regarding specific risks.”

FinCEN’s Elevated Role and the Notice/Consultation Framework

The Proposed Rule elevates FinCEN’s role in the federal supervision of AML/CFT programs, establishing “a notice and consultation framework” between FinCEN and the federal banking agencies. Where “acting under supervisory authority delegated by FinCEN,” before an agency may initiate a significant AML/CFT supervisory action against a bank, the agency must first send written notice to the FinCEN Director and “consider any input offered.” The Proposed Rule is intended to “position FinCEN as a gatekeeper for AML/CFT enforcement.”¹³

Enforcement Factors

The Proposed Rule sets forth factors that FinCEN would be required to consider in evaluating a potential enforcement action or significant supervisory action against financial institutions, including:

1. that financial institutions are spending private funds for a public and private benefit; 
2. the United States’ policy goals of serving underbanked individuals and facilitating financial transactions in a manner that prevents criminal abuse; 
3. that effective AML/CFT programs safeguard national security and generate public benefits including assisting law enforcement; 
4. that AML/CFT programs should be reasonably designed and risk-based;¹⁴
5. whether the bank, in light of its size, complexity, and risk profile, has “advanced the AML/CFT Priorities,” including by “providing highly useful information to law enforcement or national security officials;”¹⁵ and 
6. whether the bank is “conducting proactive analytics or performing other innovative activities producing demonstrable outputs evincing the effectiveness of the bank’s AML/CFT program (including effective use of artificial intelligence, federated learning, or other advanced monitoring tools).”¹⁶

The Proposed Rule notes multiple avenues for information sharing, such as responding to 314(a) requests and electing to participate in the FinCEN Exchange Program, a voluntary public-private information sharing partnership among FinCEN, law enforcement, national security agencies, and financial institutions. FinCEN provided a general endorsement of the use of artificial intelligence, noting that “[i]nstitutions that responsibly experiment with innovative technologies in their AML/CFT programs will not incur any additional risk of being subject to a significant supervisory AML/CFT action or AML/CFT enforcement action solely based on the use of innovative technologies.”

Key Takeaways 

FinCEN’s April 7, 2026 proposed rule creates significant regulatory expectations for risk-based AML programs. Banks and other financial institutions should consider the following review and, where necessary, enhancements to their AML programs:

• Ensure AML/CFT policies, procedures, and controls are supported by up-to-date risk assessments. These risk assessments should promptly be reevaluated following significant changes to risk profiles, such as the launch of a new product or customer type. 
• Evaluate compliance resource allocation to ensure they are directed toward higher-risk customers and activities, consistent with the institution’s size and risk profile. 
• Enhance reporting pipelines to law enforcement, including by using innovative methods in making decisions, such as AI or other advanced monitoring tools.
• Review processes in place to timely address AML/CFT risks raised both internally and externally. 
• Require written AML/CFT programs be approved by the board of directors, an equivalent governing body, or appropriate senior management. 
• Incorporate ongoing customer due diligence into their established risk-based set of internal policies, procedures, and controls.
• Establish a U.S. based AML/CFT officer who is accessible to, and subject to oversight and supervision by financial regulators.
• Monitor forthcoming rulemakings by the OCC, FDIC, and NCUA, which have issued their own proposed rules aligned with FinCEN’s NPRM.
• Registered Investment Advisers and Exempt Reporting Advisers should also ensure they are on track for compliance with BSA requirements by January 1, 2028.

We will continue to monitor developments related to FinCEN’s rulemaking and the broader Bank Secrecy Act (“BSA”) modernization agenda and provide further updates as warranted.

Footnotes

1. FinCEN, Anti-Money Laundering and Countering the Financing of Terrorism Programs, 89 FR 55428 (July 3, 2024). The AML Act was enacted as Division F, §§ 6001-6511, of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, H.R. 6395, 116th Cong. (2021) (enacted) (available here).

2. FinCEN, “FinCEN Proposes Rule to Fundamentally Reform Financial Institution Programs Designed to Fight Illicit Finance” (Apr. 7, 2026), available here.

3. H.R. Rep. No. 6395 (2020) at pp. 731-32 (Joint Explanatory Statement of the Committee of Conference).

4. U.S. Dept. of Treasury, Deputy Secretary Faulkender Lays Out Guiding Principles for Bank Secrecy Act Modernization (June 18, 2025), available here.

5. FinCEN, “FinCEN Proposes Rule to Fundamentally Reform Financial Institution Programs Designed to Fight Illicit Finance” (Apr. 7, 2026), available here. 

6. Specifically, the regulation defined an “investment adviser” to the definition of “financial institution” as: “investment advisers registered with or required to register with the SEC, also known as registered investment advisers (RIAs)” and “investment advisers that report information to the SEC as exempt reporting advisers (ERAs).”

7. FinCEN, “Beneficial Ownership Information Reporting Requirement Revision and Deadline Extension” 90 FR 13688 (Mar. 26, 2025), available here.

8. Reporting companies registered to do business in the United States on or after the date of publication of the interim final rule have 30 calendar days to file an initial BOI report after receiving notice that their registration is effective.

9. With respect to banks, the NPRM provides that banks will not be subject to enforcement actions or “significant” supervisory actions for failures to maintain their programs, absent “significant or systemic failure[s],” so long as the programs are established according to the NPRM’s requirements.

10. Under certain program rules, some financial institutions—such as casinos and MSBs—were not explicitly required to conduct a risk assessment but rather, were required to develop internal policies, procedures, and controls, and independent testing “commensurate with the risks” posed by their products. The Proposed rule clarifies that MSBs and Casinos are required to conduct risk assessments.

11. The NPRM states that “distribution channels” refer to the methods and tools through which a financial institution opens accounts and provides products or services, including, for example, through remote or other non-face-to-face means.

12. The Proposed Rule also standardizes the requirement that financial institutions, upon request, make available a copy of their written AML/CFT program to FinCEN or its designee.

13. Press Release, Secretary Statements & Remarks, Remarks by Secretary of the Treasury Scott Bessent Before the Fed Community Bank Conference (Oct. 9, 2025), available here. Notably, as drafted, this consultation framework applies only to banks and does not apply to other categories of financial institutions or to state agencies that supervise and take enforcement actions against banks for BSA compliance. FinCEN has requested comments on whether the framework should be optional rather than mandatory, thus “provid[ing] the option for banks to request their Agency consult with FinCEN.” If finalized, it remains to be seen how this consultation framework would be implemented in practice, particularly in future administrations where FinCEN may have a different approach to BSA enforcement. FinCEN, Anti-Money Laundering and Countering the Financing of Terrorism Programs, 89 FR 55428 (July 3, 2024).

14. 31 U.S.C. § 5318(h)(2)(B).

15. FinCEN, Anti-Money Laundering and Countering the Financing of Terrorism Programs, 89 FR 55428 (July 3, 2024).

16. Id.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.