The 2026 National Money Laundering Risk Assessment, applied to one bank

The 2026 National Money Laundering Risk Assessment is the U.S. Treasury's fifth national review of how money is laundered in and through the United States, published in March 2026 and covering January 1, 2024 to December 31, 2025 (Treasury, 2026 NMLRA). It finds the top threats unchanged, "fraud, drug trafficking, cybercrime, human trafficking, human smuggling, and corruption," adds illicit trade, reports that the median loss in sentenced money laundering cases has more than doubled in five years, and gives artificial intelligence its own section for the first time. It is not a rule, and it does not tell any bank what to rate. Its use to a BSA officer is as an outside check on the bank's own BSA/AML risk assessment: does each national threat that could reach the bank's products appear somewhere in its rows? Botminds' BSA/AML Risk Assessment runs that check on every draft, alongside FinCEN's national priorities.

The mapping on this page uses a fictional sample bank as it runs through the solution, Tessaly Community Bank, a $3.4 billion sponsor bank. Treasury's and FinCEN's findings are quoted and linked where they appear.

What is the 2026 National Money Laundering Risk Assessment?

It is Treasury's periodic statement of the money laundering threats and vulnerabilities facing the U.S. financial system, prepared under the Countering America's Adversaries Through Sanctions Act and informing the national illicit finance strategy. The 2026 edition says it "aims to inform the understanding of illicit finance risk by public and private sector actors, strengthen the risk mitigation strategies of financial institutions, and enhance policy deliberations." It draws on Justice Department cases, court documents, FinCEN's analysis of suspicious activity reports, enforcement actions and consultations with law enforcement and regulated firms.

Its vocabulary is the one a bank's assessment should use. Threats "are the predicate crimes that are associated with money laundering." Vulnerabilities "are what facilitate or create the opportunity for money laundering." And "risk is a function of threat, vulnerability, and consequence. It represents an overall assessment, considering the effect of mitigating measures, including regulation, supervision, and enforcement." The vulnerabilities section, it says, looks mainly at the residual risk in each sector or service (the guide to inherent and residual risk explains the difference). A bank's product and channel rows are its vulnerabilities; its controls are its mitigating measures.

What changed in the 2026 NMLRA?

The threats stayed; their size and their tools changed. Treasury opens with a number that belongs in any board briefing on money laundering risk: over five years, "the median loss from sentenced money laundering cases has increased by over 150 percent from $208,000 to $526,000," and the share of cases with losses over $1.5 million "nearly doubled to 32 percent." It ties the growth to transnational criminal organizations targeting U.S. citizens, businesses and government programs, and to "the exploitation of emerging technologies, such as encrypted communications and artificial intelligence (AI)."

Three additions matter for a bank's assessment. Illicit trade, "such as tariff evasion or trafficking in stolen, illicit, or regulated goods," is now treated as a threat, not only trade-based laundering as a method. Professional launderers get more weight, with Chinese money laundering networks described as having "become the dominant PMLs" for drug trafficking and other criminal organizations. And artificial intelligence gets a special focus section; the previous edition, published in February 2024 (Treasury, 2024 NMLRA), had no discussion of it.

What the 2026 NMLRA says about banks

Treasury describes banks as well supervised and mostly well defended, with failures concentrated in a few places. Only "one percent of banks are subject to AML/CFT enforcement actions annually," it says, yet since January 1, 2024 the federal regulators have issued 33 cease-and-desist or consent orders, seven formal agreements and five civil money penalties "totaling over $2 billion against five banks." Banks generally catch bulk cash typologies through monitoring and reporting, which "are less frequently cited as parts of banks' remedial actions."

The most common component of a bank's AML/CFT program cited in enforcement actions was deficiencies in internal controls (i.e., insufficient policies, procedures and processes to manage risks), deficiencies related to the BSA Officer, and insufficient customer due diligence (CDD) programs.

Treasury, 2026 National Money Laundering Risk Assessment

Two more findings read like instructions for the risk assessment. Other common deficiencies, it says, are failing to assess the risks of new products and services, and bringing in third-party compliance tools that introduce vulnerabilities. And on bank-fintech arrangements, "layered third-party relationships can blur responsibility for AML/CFT supervision," while "the rapid product iteration and venture-driven growth of fintechs can drive volume beyond the capacity of compliance staffing and controls." Mergers get a warning of their own, because acquired customers come in under someone else's onboarding procedures. Each describes a row that moves faster than an annual assessment, which is why how often a bank updates its BSA/AML risk assessment matters as much as what is in it.

What are the FinCEN national priorities, and have they been updated?

The FinCEN AML/CFT national priorities are eight threats FinCEN issued on June 30, 2021, and they have not been updated since. In FinCEN's words they are, "in no particular order: (1) corruption; (2) cybercrime, including relevant cybersecurity and virtual currency considerations; (3) foreign and domestic terrorist financing; (4) fraud; (5) transnational criminal organization activity; (6) drug trafficking organization activity; (7) human trafficking and human smuggling; and (8) proliferation financing" (FinCEN, June 30, 2021).

The AML Act requires them to be updated "not less frequently than once every 4 years" (AML Act, section 6101), which put the first revision due by mid-2025. FinCEN's April 2026 program proposal still cites the 2021 list as current, and we found no revised list as of October 2026. The 2026 NMLRA overlaps the list closely: its threats are fraud, drug trafficking, cybercrime, human trafficking and smuggling, corruption and illicit trade. A revised list, when it comes, is likely to lean on it.

How should banks use the national risk assessment?

Banks should use the national risk assessment as an outside check on their own: read each threat and vulnerability, decide whether it can reach the bank's products, customers, geographies or channels, and write the answer into the assessment, with data. Nothing requires this today. FinCEN's April 2026 proposal, not yet final, would require risk assessment processes to take the national AML/CFT priorities into account where they apply and to be updated on significant change, including change that comes from outside the bank (91 FR 18704). A new national assessment is such a factor.

The mistake to avoid is copying the national ranking. The FFIEC manual is explicit that "the identification of risk categories is bank-specific" and that no single indicator settles whether a risk is higher or lower (FFIEC, BSA/AML Risk Assessment). A rural bank with no remote account opening does not inherit the national AI-identity risk; a sponsor bank whose partners open thousands of accounts a month does. The mapping table at the top of this page is a way to make that judgement visible, threat by threat, with the data point that supports it.

AI-made identities and the delivery channels row

The 2026 NMLRA's clearest message for a community bank is about how accounts are opened. "FinCEN analysis of BSA data also shows that malicious actors have successfully opened accounts using fraudulent identities suspected to have been produced with generative AI and used those accounts to receive and launder the proceeds of other fraud schemes." FinCEN's November 2024 alert on deepfake media asks banks to use the key term "FIN-2024-DEEPFAKEFRAUD" in related SARs (FinCEN alert, November 2024).

That threat lands on the delivery channels row, not the customer row, because the risk sits in how a customer is verified, not in who the customer turns out to be. At the sample bank, 14,800 accounts were opened online in the year, 31% of new accounts, and 186 were closed for fraud within 90 days. The online account opening control was rated Needs improvement because it lacked a liveness check, and the assessment produced a plan with an owner and a date to add one.

BSA/AML Risk Assessment: the plan the delivery channels rating produced

What a community bank may set aside, and how to show it

A community bank does not have to treat every national threat as its own; it has to show it looked. FinCEN's proposal says a community bank "may determine, based on its risk assessment processes, that certain AML/CFT Priorities may not be applicable to its business activities," and then need not spend attention or resources on risks it has no exposure to. It may also lean on its staff's direct knowledge of its customers and markets rather than on elaborate models.

The showing is the part that is easy to lose. A sentence saying a priority does not apply, written once and copied forward, ages like any other sentence. BSA/AML Risk Assessment's challenger reads each draft against FinCEN's publications and flags claims that have gone stale. In the sample bank's 2026 draft it asked the BSA officer to confirm a sentence about the national priorities; she dismissed the challenge with the reason code "Claim still accurate," because the eight national priorities have not been revised, and the reason is kept with the assessment. Geography deserves the same care: the White House drug policy office counts 33 regional HIDTAs (ONDCP, 2024 report), and the sample bank's narrative notes that 14 of its 41 branches sit in HIDTA-designated counties.

A challenge about the national priorities, answered with a reason

The categories the threats map onto are covered in BSA risk assessment categories, and the rule that would make the priorities part of every program in the FinCEN AML program rule NPRM. See the challenger work on a full draft in BSA/AML Risk Assessment.

Questions people ask

What are the eight FinCEN priorities?

Corruption; cybercrime, including cybersecurity and virtual currency considerations; foreign and domestic terrorist financing; fraud; transnational criminal organization activity; drug trafficking organization activity; human trafficking and human smuggling; and proliferation financing. FinCEN issued them on June 30, 2021, in no particular order.

Are banks required to follow the National Money Laundering Risk Assessment?

No. The NMLRA is Treasury's analysis, not a regulation, and it does not tell any bank how to rate its risk. Banks use it to test their own assessment, and FinCEN's 2026 proposal would treat significant external developments as a reason to update risk assessment processes.

What are the AML/CFT priorities for 2026?

They are still the eight issued in June 2021; no revised list had been published by October 2026, although the AML Act calls for an update at least every four years. FinCEN's April 2026 proposal cites the 2021 priorities and would require banks to review them once a final rule takes effect.

How often does Treasury publish the national risk assessment?

The 2026 edition is the fifth since the first was published over ten years ago; the previous one appeared in February 2024. Treasury publishes it alongside separate national assessments of terrorist financing and proliferation financing risk, which together inform the national illicit finance strategy.

What does the NMLRA say about BaaS and fintech partners?

It says banking-as-a-service brings benefits but that "layered third-party relationships can blur responsibility for AML/CFT supervision," and that fintech growth "can drive volume beyond the capacity of compliance staffing and controls." It restates the 2023 interagency guidance that using third parties does not reduce a bank's own responsibility.

Should the national risk assessment change a bank's ratings?

Only where its threats reach the bank's own products, customers, geographies or channels and the bank's data shows the exposure. The FFIEC manual says risk categories are bank-specific and no single indicator decides a rating, so a national trend is a reason to look, not a rating in itself.