A New AML/CFT Playbook? Fed Proposes Risk-Based Program Overhaul

As anticipated, on July 7, 2026, the Federal Reserve Board requested comment on a proposed rule amending its requirements for banks to maintain anti-money laundering and countering the financing of terrorism (“AML/CFT”) programs. The proposed Regulation H amendments implement provisions of the Anti-Money Laundering Act of 2020 (“AMLA”) and align the Board’s rules with AML/CFT program requirements separately proposed by four other federal agencies.

The proposal reflects the significant shift in regulatory philosophy, from a rules-based, checklist-driven compliance approach toward a risk-based, outcome-oriented framework. If finalized, the rule would give Board-supervised banks greater flexibility to focus AML resources on higher-risk areas, while reserving significant supervisory and enforcement actions for material programmatic failures rather than technical deficiencies.

Background: Interagency AML Reform Efforts

AMLA, enacted as part of the National Defense Authorization Act for Fiscal Year 2021, directed sweeping reforms to the existing AML framework established by the Bank Secrecy Act (“BSA”). Pursuant to AMLA, FinCEN first established national AML/CFT priorities (the “Priorities”) in 2021.¹FinCEN published the first Priorities in June 2021, identifying eight key areas: corruption, cybercrime, terrorist financing, fraud, transnational criminal organization activity, drug trafficking, human trafficking and smuggling, and proliferation financing. See FinCEN, Anti-Money Laundering and Countering the Financing of Terrorism National Priorities (June 30, 2021), available at https://www.fincen.gov/sites/default/files/shared/AML_CFT%20Priorities%20(June%2030%2C%202021).pdf. The Act also emphasized innovation and technology in achieving more effective AML/CFT outcomes and directed FinCEN to promulgate regulations regarding incorporation of the Priorities into financial institutions’ risk-based AML/CFT programs.

FinCEN’s April 2026 NPRM

On April 7, 2026, FinCEN issued a Notice of Proposed Rulemaking (“NPRM”) to reform financial institutions’ AML/CFT programs under the BSA. The FinCEN proposal, which supersedes a proposed rule dated July 3, 2024, introduces several key reforms:

• Refocusing on effectiveness by distinguishing between program design (“establishment”) and ongoing implementation (“maintenance”);
• Reinforcing that financial institutions are best positioned to identify and assess their own risks;
• Empowering institutions to devote more resources to higher-risk areas and less to lower-risk activities;
• Clarifying expectations for independent testing and auditing; and
• Affirming FinCEN’s central role in the supervisory framework, including a notice and consultation framework between federal banking supervisors and FinCEN.

Treasury Secretary Scott Bessent characterized the proposal as one that “restores common sense with a focus on keeping bad actors out of the financial system, not burying America’s banks in more red tape.” Comments on FinCEN’s proposal closed on June 9, 2026.

The OCC, FDIC, and NCUA Parallel Proposal

Concurrently with FinCEN’s April 7, 2026 NPRM, the Office of the Comptroller of the Currency (“OCC”), the Federal Deposit Insurance Corporation (“FDIC”), and the National Credit Union Administration (“NCUA”) issued a parallel NPRM to conform their AML/CFT program rules to the revised framework. Notably, the Federal Reserve did not join that April proposal. The Board’s separate July 7, 2026 NPRM closes that gap, bringing the Fed’s supervisory framework into alignment with the other federal banking agencies.

Key Provisions of the Federal Reserve’s Proposed Rule

The Board’s proposed amendments to Regulation H would implement the following key changes:

• Risk-Based Program Design
  • Board-supervised banks would be required to establish and maintain effective AML/CFT programs “reasonably designed” to identify, assess, and mitigate money laundering, terrorist financing, and other illicit finance risks. This moves away from prescriptive requirements toward a framework acknowledging the diversity of risk profiles across the banking sector.
  • Banks must adopt policies, procedures, and controls that assess risks across products, services, distribution channels, customers, intermediaries, and geographic locations, incorporating FinCEN’s AML/CFT Priorities into their risk assessment processes.
    
    
• Prioritization of Higher-Risk Areas
  • The proposal explicitly requires banks to allocate greater attention and resources to higher-risk customers and activities. Banks must also promptly update risk assessments when significant changes affect their risk profile-including new products, expansion into new markets, or material changes in customer mix.
    
    
• Preserved Core Program Requirements
  • The proposal preserves certain longstanding program requirements, including:
    • Ongoing customer due diligence (“CDD”);
    • Independent testing of the AML/CFT program;
    • Employee training; and
    • Designation of an AML/CFT officer located in the United States.

Notably, the proposal integrates CDD requirements within the broader internal controls framework rather than maintaining CDD as a separate, standalone “pillar” of the AML/CFT program. The board of directors, equivalent governing body, or appropriate senior management may approve the written AML/CFT program.

Supervisory and Enforcement Focus on Material Failures

In a notable departure from current practice, once a bank has properly established its AML/CFT program, the Board generally would reserve enforcement or significant supervisory actions for significant or systemic implementation failures—rather than isolated or technical deficiencies. This distinction between program “establishment” and “maintenance” is consistent with FinCEN’s parallel proposal and appears to be intended to encourage banks to focus on building robust programs and taking a systemic view to managing risk.

Potential Implications

If finalized substantially as proposed, the Board’s amendments, together with FinCEN’s broader reforms and the parallel OCC/FDIC/NCUA proposal, would represent the most significant overhaul of the AML/CFT regulatory framework in decades. Although uncertainty with the implementation by an individual examiner-in-charge will remain a concern, Board-supervised institutions may wish to consider the following potential implications:

• Banks may wish to evaluate whether current risk assessment methodologies adequately reflect the proposal’s emphasis on incorporating FinCEN’s AML/CFT Priorities and dynamically updating assessments in response to material changes. Institutions may also consider mapping their products, services, and customer base against the Priorities.
• The explicit requirement to devote greater attention to higher-risk areas validates what many institutions have already sought to do in practice. Banks may wish to ensure they can demonstrate a defensible rationale for resource allocation decisions, including those that result in a risk-based de-prioritization of lower-risk areas.
• The proposal’s flexibility regarding program approval (permitting the board of directors, an equivalent governing body, or appropriate senior management to approve the written AML/CFT program) may provide for operational efficiencies, particularly for larger organizations. Banks may wish to consider whether their governance structures align with this approach.
• The proposal’s focus on significant or systemic failures represents an intended recalibration of supervisory expectations and places a premium on getting program design right at the outset. Institutions may wish to carefully document program design decisions to reflect this recalibration and ensure that they can demonstrate the reasonableness of their design decisions.
• The risk-based framework aligns with ongoing regulatory efforts to encourage the use of advanced technologies, including artificial intelligence, machine learning, federated learning, and other innovative monitoring tools, to achieve more effective AML/CFT outcomes. Banks may wish to evaluate how they are deploying these technologies and whether technology investments can strengthen compliance programs while achieving efficiencies.
• The proposed framework is consistent with broader regulatory efforts to address de-risking concerns and promote more transparent, risk-based account access decisions. Institutions that have faced pressure to de-risk entire customer segments may wish to monitor whether the final rule provides additional clarity or safe harbors.
• Although the Fed’s proposal arises under separate statutory authority, it is expressly intended to create a consistent, risk-based framework across federal banking agencies. Board-supervised institutions with subsidiaries or affiliates overseen by other regulators may wish to assess any differences in timing or requirements across the parallel proposals.

Next Steps

Comments on the Federal Reserve’s proposed rule are due September 8, 2026 (60 days after publication in the Federal Register on July 9, 2026). We will continue to monitor developments as the comment period progresses and as FinCEN finalizes its broader AML/CFT program rule. Please contact a member of our Financial Institutions group with any questions or for assistance with developing comments or implementation planning.