AML/CFT Program Reform in 2026: Three Proposals, Three Rulemaking Tracks

TL;DR

• FinCEN issued an AML/CFT program NPRM on April 10, 2026; OCC, FDIC, and NCUA issued a coordinated but separate proposal the same day.
• The Federal Reserve published its own proposal on July 9, 2026 (Docket R-1835); comments closed September 8.
• As of October 22, 2026, none of the three is final. FinCEN proposed a 12-month effective date that only starts once a final rule issues.
• The core idea: split “establish” from “maintain,” and focus bank enforcement on significant or systemic implementation failures. Don’t read that as permission to ignore lesser findings.

October 22, 2026 Status Update

The 2026 AML/CFT reform effort is not one document. It is a set of parallel rulemakings that share policy themes but differ in issuer, authority, coverage, and docket. A Federal Register search on October 22, 2026 shows no final rule on any of the three tracks.

The FinCEN announcement calls its action a proposal. The Federal Reserve announcement does the same. No final-rule implementation clock belongs in policy until an agency publishes final action.

If you’re the person who has to answer “so are we compliant with the new rule yet?” the honest answer is: there is no new rule yet. There is a well-defined direction, and work you can do now that holds up under the current rule and the likely final one.

Track 1: FinCEN’s April NPRM

FinCEN’s NPRM proposes to change AML/CFT program requirements across the categories of financial institutions subject to its program rules. It also withdraws the 2024 version: FinCEN says it does not intend to finalize the July 3, 2024 program NPRM, and that it “should be considered withdrawn and superseded.” If your gap analysis was built on the 2024 text, rebuild it.

Establish versus maintain

The structural change is a split between two obligations:

1. Establish a reasonably designed program. The NPRM describes risk assessment processes that evaluate the institution’s ML/TF risks, review and, as appropriate, incorporate the AML/CFT Priorities, and are updated promptly when the institution knows or has reason to know of a change that significantly changes its risks. The program must mitigate those risks consistent with the risk assessment and, for certain institutions, include ongoing customer due diligence. Training and independent testing remain required elements.
2. Maintain the program by implementing it “in all material respects.” The preamble is explicit that writing policies and naming an officer is not enough. Examiners would look at whether the institution actually allocates resources as its established program says it will.

That second point is the one most teams underweight. A risk assessment that says “higher-risk customers get more attention” now has to be visible in staffing, alert tuning, review depth, and testing scope.

Risk-based resource allocation

Commenters on the 2024 proposal argued that its framing didn’t let institutions move resources away from low-risk activity without examiner criticism. The 2026 NPRM leans on the statutory language instead: direct more attention and resources toward higher-risk customers and activities rather than lower-risk ones. FinCEN’s own economic analysis describes the expected effect as “reallocative.” Read that carefully: the agency is not promising your total compliance spend will drop.

The AML/CFT Priorities

FinCEN issued the first AML/CFT Priorities on June 30, 2021. The proposal would require institutions to review and, as appropriate, incorporate them into risk assessment processes. If your current risk assessment doesn’t reference the Priorities at all, that is a gap under the proposal and a reasonable expectation under current supervisory practice. Our walkthrough of the 2021 AML/CFT Priorities and risk-based program design shows one way to map them.

Governance

Proposed 31 CFR 10XX.210(d) would require the written program to be approved by the board of directors, an equivalent governing body, or appropriate senior management. That standardizes language that already appears, in varying forms, across current program rules. The AML Act requirement that program duties be performed by persons in the United States, accessible to and supervised by FinCEN and the appropriate regulator, also runs through the proposal.

Effective date

FinCEN proposed an effective date of 12 months from issuance of the final rule and asked for comment on it. That is a proposal about a future clock, not a date.

Track 2: The OCC/FDIC/NCUA Proposal

OCC, FDIC, and NCUA published a coordinated proposal the same day as FinCEN. It would amend the agencies’ own program rules for the institutions they supervise, under dockets including OCC-2024-0005 and NCUA-2024-0033.

“Coordinated” does not mean the documents are interchangeable. Maintain separate citations and map:

• agency and supervised population;
• CFR provisions;
• definitions;
• examination and supervisory language;
• comment record; and
• any final action.

A consolidated implementation plan can share controls, but its legal inventory should retain each rulemaking identity.

Track 3: The Federal Reserve Proposal

The Federal Reserve announced its proposal on July 7, and it was published in the Federal Register on July 9 as FR Doc. 2026-13919. The proposal text identifies Docket R-1835. Comments closed September 8, 2026.

For a state member bank, this track requires its own gap analysis. Don’t tell an OCC-supervised national bank that the Fed docket governs it, and don’t tell a state member bank that the April banking-agency document is its only rulemaking.

A useful charter-and-agency inventory includes:

Be Careful With “Significant or Systemic Failure”

Proposal summaries sometimes turn this phrase into a claim that minor or isolated deficiencies can no longer lead to supervisory criticism. The text doesn’t support that.

Here is what the FinCEN NPRM actually says:

• The proposal “would not limit enforcement or supervisory actions for failures to establish an AML/CFT program.”
• For banks, once a program is properly established, only significant or systemic failures to implement it would warrant an “AML/CFT enforcement action” or a “significant AML/CFT supervisory action,” as the proposed rule defines those terms.
• The stated goal is a focus on significant or systemic failures “rather than on isolated, technical, or immaterial implementation issues.”
• Banking agencies acting under FinCEN’s delegated authority would have to consult FinCEN and give it written notice at least 30 days before taking a significant AML/CFT supervisory action. FinCEN could review the action and the agencies would have to consider its input.

At least four distinctions must stay visible:

1. Proposed versus current law. Proposed language does not suspend existing requirements.
2. Design versus implementation. A badly designed program gets no benefit from the higher threshold.
3. Defined actions versus everything else. A threshold for defined “significant” actions doesn’t necessarily eliminate findings, recommendations, ratings effects, monitoring, or other supervisory responses. If your examiner issues a Matter Requiring Attention, the proposal doesn’t make it go away.
4. Facts and accumulation. Repeated, connected, or unremediated deficiencies can become systemic. One missed CTR is not the same as a monitoring system that never covered a product line.

The safe statement: the proposals aim to focus programs and agency response on material, risk-based effectiveness. The unsafe statement: lesser deficiencies no longer matter.

What to Do Before Any Final Rule

Keep the current program operative

Continue current customer due diligence, monitoring, reporting, training, independent testing, officer, governance, and recordkeeping obligations. Don’t replace a current procedure with proposed text.

Build a proposal crosswalk

For each legal entity, compare current text with each applicable proposal. Classify each item as current requirement, proposed requirement, existing practice, gap, or open interpretation.

Strengthen the risk-to-control trail

Document how products, customers, geographies, channels, transactions, and emerging typologies drive controls and resources. That’s the single most useful artifact under both the current rule and the proposal. Our AML risk assessment template guide for banks and fintechs walks through the structure.

Test outcomes without inventing universal metrics

Review alert quality, escalation, SAR decisions, issue recurrence, data quality, model changes, and independent-testing results. Label internal thresholds as institution-calibrated, not regulator-prescribed. The BSA/AML independent testing guide covers scoping testing to risk.

Worked example: a sponsor bank with a new card program

A community bank adds a fintech-partner prepaid card program in Q3. Under the proposal’s language, that’s the kind of change the institution “knows or has reason to know” could significantly change its ML/TF risk. The defensible sequence: update the risk assessment before launch, document why monitoring scenarios and staffing change, route the update through the approval body, and add the program to the next independent test. None of that waits for a final rule. All of it is what an examiner would ask about today.

Watch for final action

Comment periods have closed on all three tracks. Watch the Federal Register for final action from each issuer separately, and expect the final texts and effective dates to differ. When final text appears, re-run the crosswalk against the final language, not the proposal.

So What?

The common direction is risk-based, effective AML/CFT programs with a clearer line between design failures and implementation failures. The legal route is still three proposals, and none is final.

Build one control architecture where that’s efficient, but keep three source records. Preserve current compliance, push back on overconfident readings of the enforcement language, and wait for final text before starting an implementation clock.

The AML/BSA Risk Assessment Template can structure the risk-to-control record. It must be adapted to the institution’s legal entity, regulator, products, data, and current rule.

Primary sources: FinCEN proposal announcement | FinCEN NPRM, FR Doc. 2026-07033 | OCC/FDIC/NCUA NPRM, FR Doc. 2026-06948 | Federal Reserve announcement | Federal Reserve proposal, FR Doc. 2026-13919