For decades, the legal test for an anti-money laundering program under the Bank Secrecy Act has been, in practice, a test of completeness. Did the institution have written policies? A designated compliance officer? Independent testing? Training? Examiners checked for the pillars, and an institution with all of them in place could reasonably feel it had met its obligation, even if no one could say whether the program was catching anything. In April 2026, the Treasury Department’s Financial Crimes Enforcement Network proposed to change the question. This post, the first of two on the subject, explains what FinCEN proposed and why it matters. The second post looks at a skeptical view of how the proposal may operate in today’s enforcement environment.

What FinCEN Proposed

On April 7, 2026, FinCEN issued a notice of proposed rulemaking that it described as a fundamental reform of AML and countering-the-financing-of-terrorism program requirements. It would apply across a broad range of covered institutions: banks, casinos, money services businesses, broker-dealers, mutual funds, certain insurers, futures commission merchants, dealers in precious metals, and others. Investment advisers are being handled separately, following a delay of their rule until January 1, 2028. Comments were due June 9, 2026, and FinCEN proposed a 12-month implementation period after any final rule. The proposal withdraws and supersedes FinCEN’s July 2024 program proposal, which had taken a different approach, including adding risk assessment as a standalone sixth pillar.

The foundation is a new, formal definition of what makes a program “effective.” The test has two prongs. The first is establishment: the institution must set up a risk-based program built on four core elements, namely internal policies, procedures, and controls, including risk assessment processes; independent testing; a designated AML/CFT officer located in the United States; and ongoing employee training. Establishment also requires keeping the program current as the institution’s risk profile changes. The second prong is maintenance: the program must be implemented in all material respects. In other words, a well-designed program that exists only on paper does not satisfy the second prong.

What Changes Inside the Program

Several features of the proposal deserve attention from compliance leaders.

Risk assessment moves inside internal controls. Instead of a sixth pillar, the proposal requires that every covered institution’s internal controls include risk assessment processes that evaluate risks from its products, services, distribution channels, customers, and geography, take account of FinCEN’s published AML/CFT priorities, and are updated promptly when the institution knows or has reason to know that its risk profile has significantly changed. Ongoing customer due diligence, where it applies, also sits within internal controls rather than as a separate pillar.

Resources follow risk. The proposal says plainly that mitigation should direct more attention and resources toward higher-risk customers and activities, rather than toward lower-risk ones. FinCEN intends this to give institutions comfort that reallocating effort away from low-risk areas will not, by itself, be held against them, as long as the allocation rests on a reasonably designed risk assessment. For institutions that have long applied uniform procedures to every customer to be safe, this is a meaningful signal.

Testing focuses on effectiveness. Independent testing, whether by independent internal staff or an external party, would be risk-based and directed at whether the program works, not simply whether it is complete. The proposal also states that neither examiners nor testers should substitute their own subjective judgment for an institution’s reasonable, risk-based determinations.

Governance is standardized. The written program must be approved by the board, an equivalent body, or appropriate senior management, and made available to FinCEN on request.

The Enforcement Piece Is the Real Shift

The most consequential change for banks is on the supervisory side. Under the proposal, a bank that has properly established its program would not face an AML/CFT enforcement action or a significant supervisory action based on the program rule unless there is a significant or systemic failure to implement it. That limit would not protect a bank that failed to establish a proper program in the first place, and it would not constrain criminal referrals or prosecutions for willful Bank Secrecy Act violations, which remain governed by separate standards.

When deciding whether to take or review a significant action, FinCEN’s Director would consider the statutory factors under the Anti-Money Laundering Act of 2020 and also whether the bank has advanced national AML/CFT priorities by providing highly useful information to law enforcement, conducting proactive analytics, or undertaking other innovative activities that produce demonstrable evidence of effectiveness, expressly including effective use of artificial intelligence, federated learning, or other advanced monitoring tools. The proposal also says that responsible experimentation with innovative technologies would not, on its own, increase an institution’s risk of significant supervisory or enforcement action. Finally, federal banking agencies exercising delegated authority would have to notify FinCEN’s Director and consider the Director’s input before beginning a significant AML/CFT supervisory action, which elevates FinCEN’s role in supervision.

Is This Really a Replacement of the Old Approach?

Here I want to be careful, because the commentary is divided and the difference matters for how you plan. Some firms describe the proposal as the most significant overhaul of AML program requirements in decades. Others note that it primarily restructures and streamlines existing obligations rather than creating many new substantive requirements, and that the new enforcement threshold, “significant or systemic failure,” is undefined and may not differ much in practice from today’s supervisory approach until FinCEN clarifies it. Both observations can be true. The proposal changes the organizing principle of the rule from completeness to effectiveness, and it changes the structure of supervision. Whether it changes outcomes will depend on the final text and on how examiners and FinCEN apply it.

What Compliance Leaders Should Do Now

The comment period has closed, and a final rule has not yet issued, but there is useful work to do in advance.

First, test your program against the two-prong framework. Could you show, with evidence, that your program is established, meaning risk-based and current, and maintained, meaning implemented in all material respects?

Second, review your risk assessment. If it is a once-a-year document, ask whether it would be updated promptly when your products, markets, or customer base change, as the proposal would require, and whether it incorporates FinCEN’s priorities. Those priorities, first published in 2021, are overdue for a statutory update, so watch for it.

Third, build measures of outcomes, not only activity. An effectiveness standard invites questions about whether your alerts lead to useful reports, whether your investigations are timely, and whether your resources are concentrated where your risk is. Counting trainings completed will not answer those questions.

Fourth, prepare to document risk-based decisions to reallocate resources. The proposal’s comfort for reallocation depends on a reasonably designed assessment behind it. Finally, if you plan to rely on AI tools, treat governance as part of the program. That is the subject of the second post in this series, which considers a pointed critique of how the effectiveness standard may work in practice.