Bank Secrecy Act changes in 2026: what is final and what is proposed

The Bank Secrecy Act changes in 2026 split cleanly in two. What changed for real: the OCC's lighter community bank examination procedures from February 1, the FFIEC manual's removal of reputational risk in February, the revised model risk guidance of April 17 that rescinded the 2021 BSA/AML model risk statement, the OCC and FDIC final rule removing reputation risk from supervision from June 9 (the NCUA's from July 27), and a narrower beneficial ownership reporting rule for companies in August. What did not, yet: FinCEN's rewrite of the AML/CFT program rule and its whistleblower rule are both proposals, with comments closed and no final rule through late October 2026. And the core of a bank's daily BSA work, the $10,000 CTR threshold and the SAR rule, did not change at all. Procedures written before October 2025 may still be behind on the SAR FAQs of that month. Botminds' BSA/AML Manual Search tracks which of an institution's procedures are older than a source they rely on and drafts the update for the BSA officer and the compliance committee.

Status is as of October 26, 2026, checked against the Federal Register and the agencies' own pages. Product examples come from a fictional sample credit union, Norrell Federal Credit Union.

What are the Bank Secrecy Act changes in 2026? The short list

Five changes reach a typical bank or credit union directly: how OCC examiners run community bank exams, what examiners may say about reputation risk, how model risk guidance treats monitoring systems, the FFIEC manual's wording, and, for some, the Minnesota funds transfer order. The two largest items of the year, the program rule and the whistleblower program, are proposals.

A useful rule of thumb for the rest of the year: a proposal changes what a BSA officer should be preparing for, and nothing about what staff should be told today. An answer that relies on a proposed rule alone is wrong until the final rule takes effect.

Is the AML program rule final? Not yet

No. FinCEN issued a proposed new AML/CFT program rule on April 7, 2026, published in the Federal Register on April 10, with companion proposals from the banking agencies, and comments closed on June 9, 2026 (91 FR 18704). The 2024 proposal is gone: FinCEN said it will not finalise it and treats it as withdrawn and replaced. No final rule had been published by late October 2026, and the current rule, 31 CFR 1020.210, has been unchanged since 2020.

The proposal matters because of what it would change. FinCEN's fact sheet lists four pillars, internal policies, procedures and controls "including risk assessment processes and, when applicable, ongoing customer due diligence," independent testing, a U.S.-based compliance officer, and ongoing employee training (FinCEN fact sheet). It would separate failures of program design ("establishment") from failures of implementation ("maintenance"), and tell examiners and auditors not to substitute their judgment for a bank's reasonably designed program. It proposes an effective date 12 months after a final rule.

What changed in BSA exams in 2026?

For OCC-supervised community banks, examinations got lighter from February 1, 2026. The OCC's community bank procedures, for banks of up to $30 billion in assets, apply to examinations beginning that date and emphasize examiner discretion to rely on satisfactory independent testing, to carry forward prior conclusions on the training and BSA officer pillars for one cycle, and to decide "whether and to what extent to perform transaction testing" (OCC Bulletin 2025-37). The OCC also stopped gathering data for its Money Laundering Risk system (OCC Semiannual Risk Perspective, Spring 2026).

For everyone, the FFIEC manual changed on February 27, 2026, when five sections lost their references to reputational risk. The FFIEC said the update establishes no new requirements, and the manual's SAR section still carries a notice that it is to be updated for the October 2025 SAR FAQs. Every release since 2020, and where the manual now lags, is listed in FFIEC manual updates.

Was reputation risk removed from bank exams?

Yes, by final rule. The OCC and FDIC adopted a rule "to codify the elimination of reputation risk from their supervisory programs," which "prohibits the agencies from criticizing or taking adverse action against an institution on the basis of reputation risk" and from requiring, instructing or encouraging an institution to close or refuse an account on that basis (91 FR 18279). It took effect June 9, 2026. The NCUA's final rule took effect July 27, 2026.

For BSA programs the practical effect is on language and rationale. A customer risk rating or exit decision that rests on "reputational risk" now needs a reason the rule still recognizes, such as money laundering or fraud risk. At the sample credit union, the procedure watch flagged a customer risk procedure that still listed reputational risk as a factor.

What is the FinCEN whistleblower rule?

It is a proposal, published April 1, 2026, to implement the whistleblower program the Anti-Money Laundering Act of 2020 created. FinCEN proposed a rule "to establish a whistleblower program that offers incentives and protections to encourage individuals who have information about potential violations of the Bank Secrecy Act (BSA), International Emergency Economic Powers Act (IEEPA), Trading With the Enemy Act of 1917 (TWEA), and Foreign Narcotics Kingpin Designation Act (Kingpin Act) to voluntarily report such information" (91 FR 16328). Comments closed June 1, 2026; no final rule had appeared by late October.

The statute behind it, 31 U.S.C. 5323, is already law. What the rule would add is the procedure for awards and protections. A BSA officer's practical step now is to make sure internal reporting channels work, because an employee who is heard internally has less reason to go elsewhere first.

Model risk guidance replaced, and generative AI left out

On April 17, 2026, the Federal Reserve, OCC and FDIC issued revised model risk management guidance that supersedes the 2011 guidance and rescinds the April 2021 interagency statement on model risk for BSA/AML systems. The new guidance excludes deterministic, rule-based processes and software from the definition of a model, expects to matter most to banking organisations above $30 billion in total assets, and places generative and agentic AI outside its scope (OCC Bulletin 2026-13).

For a community bank's monitoring system, the likely reading is that simple rule-based scenarios are not models under the new guidance, while the FFIEC manual's expectation that monitoring thresholds be documented, tested and validated has not been withdrawn. For AI tools, the institution governs them itself; the frameworks available are set out in AI for compliance in banking.

Orders and special measures that reach banks

Some 2026 actions bind banks directly, but only where their terms apply. The largest for domestic operations is the Minnesota geographic targeting order: banks and money transmitters with an office in Hennepin or Ramsey County must report funds transfers of $3,000 or more that they originate, with some exclusions, for customers who give an address in those counties, when the beneficiary or the beneficiary's institution is outside the United States. It took effect February 12, 2026 and was renewed on August 11, 2026 through February 6, 2027 (91 FR 51588).

Correspondent banking felt the special measures. FinCEN proposed section 311 measures against MBaer Merchant Bank in Switzerland in March and the UAE branches of Banque Misr in September, and in October proposed prohibiting transmittals involving the A7 Network's sub-agents under the Combating Russian Money Laundering Act. On October 6 it withdrew two older crypto proposals, including one that would have required banks to report transactions with unhosted wallets (91 FR 63514). And on August 14, FinCEN finalized the narrowing of the Corporate Transparency Act's company reporting rule, exempting U.S. companies' U.S. owners (91 FR 52508); a bank's own beneficial ownership duty at account opening, 31 CFR 1010.230, did not change.

Enforcement continued alongside the rules. In October 2026 FinCEN assessed a $1.2 billion penalty against Bank of America, with $750 million credited to the OCC's penalty, for failures to mitigate and report priority risks (FinCEN), and the OCC assessed $350 million against American Express National Bank, finding its risk assessment focused on deposit accounts rather than its dominant card products (OCC).

What did not change: the CTR threshold and the SAR FAQs

The core cash and suspicious activity rules for banks did not change in 2025 or 2026. The CTR threshold remains more than $10,000 in a business day, set in regulation in 1972 and never indexed; GAO calculated it would have been about $72,880 in 2023 if adjusted for inflation (GAO-25-106500). No FinCEN proposal to raise it for banks appeared through October 2026.

The SAR FAQs of October 9, 2025 are the change most procedures still have not absorbed. They said near-threshold cash alone does not require a SAR, that no separate post-SAR review of continuing activity is required, that the Day 0 to Day 150 continuing activity timeline is optional, and that no rule requires documenting a decision not to file. A procedure written before them may still require all four.

Updating procedures for 2026: BSA/AML Manual Search

The work a year like 2026 creates is finding which procedures are now behind, and procedures fall behind in predictable places. BSA/AML Manual Search compares each procedure's date with the sources it relies on. At the sample credit union, 3 of 14 procedures were older than a source they rely on: one on unusual activity referrals, written in March 2024, against the SAR FAQs; one still requiring 90-day post-SAR reviews; and one still listing reputational risk.

BSA/AML Manual Search turns a procedure older than the FAQs into a cited redline

The draft is only a start. The BSA officer edits it and sends it to the compliance committee; the committee chair approves it as checker, the maker cannot approve her own update, and only then are the saved answers that relied on the old text re-checked and the branches told. At the sample credit union the approved version took effect on Monday, November 2, 2026, and 37 saved answers were re-checked.

Approved by the committee, then re-checked: the order the changes happen in

Questions people ask

What is the new FinCEN rule in 2026?

The largest is a proposal: the April 2026 rewrite of the AML/CFT program rule, which is not final. FinCEN's final rules of 2026 include the August 14 beneficial ownership reporting revision for companies, geographic targeting orders, and a two-year delay of the investment adviser AML rule to January 1, 2028.

What are the 2026 AML regulations for banks?

The binding rules for banks are those in 31 CFR Chapter X, and their core, the program, CTR, SAR and recordkeeping rules, did not change in 2026. What changed were supervisory rules and guidance: reputation risk, model risk, the OCC's community bank procedures and the FFIEC manual, plus targeted orders.

Did the CTR threshold change in 2026?

No. It remains more than $10,000 in currency in one business day under 31 CFR 1010.311. A 2026 order for money services businesses near the southwest border uses a $1,000 threshold, but it does not apply to banks.

When will the AML program rule be final?

FinCEN has not said. Comments closed June 9, 2026, and the proposal would take effect 12 months after a final rule is published, so even a final rule late in 2026 would not bind banks until late 2027.

Do the 2026 changes affect credit unions?

Yes, mostly through the NCUA. Its reputation risk rule took effect July 27, 2026, the NCUA joined the banking agencies' companion program proposal, and the FFIEC manual changes apply to NCUA examinations. The OCC's community bank procedures and the April model risk guidance were not issued by the NCUA.