The Fed joins the AML/CFT program rewrite

On 10 April 2026 FinCEN, the OCC, the FDIC and the NCUA proposed new rules for anti-money laundering programs. On 9 July 2026 the Federal Reserve published its own proposal (91 FR 42363, amending 12 CFR part 208, Regulation H), which it says is meant to align with the others. The Board calls the banks it covers "Board-supervised banks."

Comments are due on or before 8 September 2026.

What would change in the program rule

Much of it is wording and structure. The rule would add "countering the financing of terrorism" to the name, which the Board treats mainly as a terminology update. Customer identification program provisions would move to their own section without substantive change. Training would use the statutory phrase "ongoing employee training program." Independent testing stays, with minor clarifications.

Five changes carry more weight. A program would count as effective when it is established and maintained, and maintaining it means it is "implemented in all material respects." Banks would have to keep their risk assessment current and update it "promptly upon any change that the bank knows or has reason to know significantly changes" their money laundering and terrorist financing risks. They would also have to "review and, as appropriate, incorporate the AML/CFT Priorities." Ongoing customer due diligence would sit inside the internal controls requirement. And the AML/CFT officer "would be required to be located in the United States," accessible to and overseen by FinCEN or its designee and the Board.

Approval of the program could come from the board of directors, an "equivalent governing body," or "appropriate senior management."

The enforcement line

The section most banks will read twice is about what happens when something goes wrong. The Board says "Minor deficiencies of an AML/CFT program would not necessarily mean that a bank has failed to implement the program." And it draws a line: "Only significant or systemic failures by a bank to implement in all material respects an established program would warrant" an enforcement action or significant supervisory action. The Board describes a focus on "isolated, technical, or immaterial implementation issues" as something to move away from.

That line has a limit. It applies to failures to implement an established program. A bank that fails to establish a program at all remains fully exposed.

What it could mean

We think the enforcement standard is the real news for a Fed-supervised bank, and it could change the tone of BSA exams more than any of the wording changes. Today a run of small findings (a late CTR here, a missed CDD refresh there) can add up to a program-level criticism. Under the proposal, the question becomes whether the failures are significant or systemic. That's a better question. It's also a vaguer one, and we'd expect the first few exam cycles under a final rule to set the practical meaning more than the rule text does.

The risk assessment change is the one with homework. "Promptly" after a significant change is a different discipline from refreshing the document every year or two. In our view a bank should decide now what counts as a significant change for it: a new product, a new branch market, a correspondent relationship, a jump in a particular kind of wire activity. Then it should write down who triggers the refresh. A short list that the BSA officer actually uses beats a long one that sits in a binder.

The AML/CFT Priorities piece is easy to underrate. "Review and, as appropriate, incorporate" sounds soft, but it means an examiner can ask how your program reflects each priority. A one-page mapping, priority by priority, with a sentence on why each one is or isn't material for your customer base, is cheap to produce and answers that question in advance.

If your bank has views, especially on how "significant or systemic" should be applied to a small institution with a two-person BSA team, the comment window is open until 8 September.