FinCEN's AML Program Rewrite Left Comment in June. Here's the Gap Assessment Your Compliance Team Should Be Running Now.

TL;DR

• FinCEN’s April 2026 NPRM would replace the BSA’s five-pillar “existence” standard with a single “effectiveness” standard — the biggest structural change to AML program requirements in decades
• Comment period closed June 9, 2026; final rule expected 2027 with a 12-month implementation window
• The proposed rule creates two distinct tests: “establishment” (does the program exist?) and “implementation” (does it work?)
• Risk assessment becomes explicitly mandatory and must link to FinCEN’s National AML/CFT Priorities — most programs don’t currently document that connection
• Enforcement focus shifts to “significant or systemic failures,” but that standard raises the stakes for programs that aren’t functioning rather than lowering them overall

The comment period closed four months ago, and FinCEN is working through the comment letters. A final rule is coming — probably in 2027, with a 12-month window to implement after publication.

For AML compliance teams, that timeline sounds like it creates breathing room. It doesn’t.

The FinCEN-led April 2026 NPRM isn’t a technical tweak to existing BSA program requirements. It’s a structural overhaul that changes the fundamental question regulators will ask when they examine your AML program. Currently, the question is: do these five components exist? Under the proposed rule, the question becomes: does this program work?

Those are different questions. Answering the second one requires different documentation, different testing, and different governance structures than most institutions have built. The gap assessment you should be running now — before the final rule drops — isn’t about identifying what to add. It’s about understanding how much the foundation needs to change.

Why the NPRM Matters More Than Most Regulatory Proposals

The five-pillar framework for AML/CFT programs has been the regulatory baseline since the Bank Secrecy Act’s implementing rules were first established. Five pillars: internal policies, procedures, and controls; a designated compliance officer; ongoing employee training; independent testing; and (since 2016) customer due diligence. If you could document that each pillar existed, you had a defensible program.

That framework has produced exactly the compliance behavior you’d expect from an “existence” standard: institutions that documented the presence of program components without building programs that actually identified and disrupted money laundering. Compliance teams built policies. They trained employees. They ran independent tests that confirmed the policies existed and the employees had been trained.

The FinCEN April 2026 NPRM is FinCEN’s explicit acknowledgment that this approach hasn’t worked. The preamble to the proposed rule says as much: the current framework has led to “check-the-box” compliance that prioritizes documentation of component existence over program effectiveness.

The proposed rule’s core change: replace the five-pillar structure with a single overarching standard — a “properly established” AML/CFT program is one that is risk-based, reasonably designed, and functioning to identify and report suspected illicit finance activity. How you satisfy that standard is demonstrated through a two-part test.

The Establishment vs. Implementation Test

The NPRM introduces what FinCEN describes as an “establishment versus implementation” framework. This is the core analytical structure that will govern how examiners assess programs under the final rule.

Establishment asks whether the required program components are in place:

• Do written policies and procedures exist?
• Is there a designated compliance officer with appropriate authority, resources, and access?
• Does an employee training program address the institution’s actual AML/CFT risks?
• Is there an independent testing program that covers the program’s key components?
• Is there a documented risk assessment process?

These are the five-pillar questions, restated. Under the proposed rule, they’re still asked — but they’re a threshold, not a conclusion.

Implementation asks whether those components are functioning:

• Are the policies and procedures actually followed in practice?
• Does the compliance officer have the independence and resources to fulfill the role, or is the title nominal?
• Is training content updated to reflect actual risk changes, and can staff demonstrate what they were trained on?
• Does independent testing identify real control weaknesses, or does it consistently produce clean results without explaining why?
• Does the risk assessment actually drive program design decisions — or is it a document that gets produced annually without influencing controls?

The distinction matters for how you build your gap assessment. A program that has all five components documented but hasn’t addressed implementation integrity will fail the second half of the test. A program that has strong implementation on four components but hasn’t formalized risk assessment as a required standalone process will fail the first half.

The Risk Assessment Requirement: The Biggest Structural Gap

The most significant new requirement in the NPRM is the formalization of risk assessment as an explicit, mandatory program element.

Under current rules, risk assessment is embedded in internal controls — you’re expected to have policies and procedures that reflect your institution’s risk, but there’s no standalone requirement to produce, maintain, and document a formal risk assessment that drives all program decisions.

Under the proposed rule, every financial institution must have a formal risk assessment process that:

1. Identifies, assesses, and documents the institution’s AML/CFT risks — products, services, customers, delivery channels, geographies
2. Incorporates FinCEN’s National AML/CFT Priorities — the eight priorities FinCEN published in June 2021 (corruption, cybercrime, terrorist financing, fraud, transnational criminal organizations, drug trafficking, human trafficking, and proliferation financing), which must be included in the risk assessment even if the institution concludes its exposure to a particular priority is low
3. Serves as the foundation for all other program elements — policies, procedures, controls, training content, testing scope, and compliance officer focus must all connect back to documented risk findings

The current AML/CFT National Priorities were published in 2021 under the AML Act requirement. The NPRM makes explicit what has been implied since that publication: every financial institution must assess its exposure to each priority and document how its program addresses that exposure.

Most institutions haven’t done this. They’ve updated their risk assessments to note the priorities exist. They haven’t documented, for each priority, what their institutional exposure looks like, what controls address it, and how they know those controls are working.

That gap is the most consequential one to close before the final rule drops.

The Enforcement Standard Shift: Higher Stakes, Not Lower

On its face, the NPRM’s “significant or systemic failures” enforcement standard sounds like relief. Isolated, technical, immaterial deficiencies won’t warrant enforcement or significant supervisory action. Minor gaps — the training module that wasn’t updated, the policy that’s one revision behind — move out of enforcement territory.

Read more carefully, that standard is a warning, not a safe harbor.

A “significant or systemic failure” is now a defined enforcement category. A program that doesn’t work — not just one with gaps, but one that consistently fails to identify and report suspicious activity, or one where the compliance function doesn’t have the authority to fulfill its role — is explicitly the kind of program the agencies are targeting. The Canaccord Genuity $80 million penalty earlier this year, for a program that generated alerts but didn’t have the resources to review them, is exactly what “systemic failure” looks like in enforcement terms. That case is worth reading carefully.

The proposed rule also changes the supervisory architecture. Federal banking supervisors would be required to give FinCEN’s Director at least 30 days’ advance written notice before initiating a significant AML/CFT supervisory action. This means FinCEN — not any single prudential regulator — sets the tone for AML/CFT supervision going forward. Institutions that have built their AML programs to satisfy their primary prudential regulator without considering how FinCEN views their program design are at risk of finding that gap exposed.

Running the Gap Assessment

The gap assessment you need to run now has four components:

1. Establishment Gap: Does Each Required Element Exist?

Work through the proposed rule’s required program components and verify documentation for each:

2. Implementation Gap: Is Each Component Functioning?

This is harder to assess from documentation alone — it requires looking at program outputs:

• Risk assessment: Does the documented risk assessment explain how specific control choices were made? If you pulled it out today, could you demonstrate that the training content covers the risks identified in the assessment?
• Compliance officer function: Does the compliance officer have documented access to business lines, sufficient staffing, and evidence of escalation authority? Is the role being actively performed rather than nominally assigned?
• Testing: Are test results reviewed by someone with authority to require remediation? Have any significant weaknesses been identified in the last three testing cycles? (If the answer is “nothing significant in three years,” that should prompt a question about whether the testing scope is calibrated correctly.)
• Training: Do training records show that staff who handle high-risk customer types, products, or transactions received risk-specific content — not just general BSA awareness?

3. National Priorities Integration Gap

Go through each of the eight FinCEN AML/CFT National Priorities and document:

• What is the institution’s assessed exposure to each priority?
• What controls address that exposure?
• How is that assessment reflected in training content and testing scope?

Many institutions will find they have documented exposure levels without documented control connections. That’s the gap to close.

4. Program Connection Gap

The proposed rule requires that the risk assessment “serve as the foundation” for all other program elements. This is a documentation and governance question:

• When the risk assessment was last updated, were policies and procedures reviewed against it?
• Does the training plan reference the risk assessment?
• Does the independent testing scope reference the risk assessment findings?

If program elements are developed and updated independently of the risk assessment, that’s a connection gap — and under the effectiveness standard, it’s a finding.

The Timeline to Close Gaps

A final rule in 2027 with a 12-month implementation window means binding compliance requirements arrive sometime in 2028. That sounds distant. It isn’t, given what it takes to close the gaps described above:

Risk assessment redesign: Moving from a risk assessment that describes the institution’s risk profile to one that explicitly incorporates the National Priorities and documents control-to-risk connections takes time — multiple reviews, business line input, testing validation. Plan six to nine months for a complete redesign.

Policy updates: Revising policies and procedures to reflect the effectiveness standard — specifically to document that they are connected to documented risk — is a straightforward but time-intensive edit if the policy library is large.

Training recalibration: If training content doesn’t currently connect to specific risk categories, updating it requires content development, not just delivery scheduling.

Independent testing scope: Testing that currently verifies program component existence needs to be redesigned to test program effectiveness. That’s a different methodology, and most testing providers will need lead time to build it.

Governance changes: If the compliance officer role doesn’t currently have documented authority, resources, and escalation paths, building those governance structures requires board and management engagement.

None of these are quick fixes. Institutions that start the gap assessment in Q4 2026 are in a reasonable position. Those that wait for the final rule are not.

So What?

The FinCEN NPRM is the kind of regulatory proposal that gets treated as future risk until it becomes present reality. The comment period closed. FinCEN is analyzing the letters. A final rule is coming.

What it requires isn’t compliance with new rules — it’s a genuinely effective program, documented in a way that demonstrates effectiveness. The institutions that are well-positioned when the final rule drops are the ones that have built programs that work, not programs that exist.

The gap assessment that matters now isn’t asking “what do we need to add.” It’s asking “does our program actually function, and can we prove it?”

Related reading: FinCEN’s $80 Million Canaccord Genuity Penalty Is the Definition of What the New Effectiveness Standard Is Targeting • Your AML Transaction Monitoring Runs on AI. Your Examiner Is About to Treat It Like a Model Under SR 26-2. • FinCEN Proposed the AML/CFT Program NPRM in April — Here’s What the Rule Actually Changes

If your institution needs a BSA/AML risk assessment that covers the categories the proposed rule names — products and services, customers, geographies, and delivery channels — with inherent-to-residual scoring and a control inventory, the AML/BSA Risk Assessment Template ships pre-populated with 32 fintech-specific risk factors. It gives you a working draft to edit instead of a blank page — $79.