The FinCEN AML program rule NPRM is the notice of proposed rulemaking FinCEN issued on April 7, 2026 and published in the Federal Register on April 10 (91 FR 18704) to rewrite the anti-money laundering and countering the financing of terrorism program requirements for banks and other financial institutions (Federal Register, 2026-07033). For banks it would make "risk assessment processes" an explicit part of the program, require them to review the national AML/CFT priorities and to be "updated promptly" on significant change, split program failures into design ("establishment") and implementation ("maintenance"), and bar examiners and auditors from substituting their judgement for a bank's reasonable one. It replaced a July 2024 proposal that FinCEN withdrew. Comments closed on June 9, 2026, and the rule is not final. Botminds' BSA/AML Risk Assessment already checks each draft assessment against the proposal, because a bank that waits for the final rule will be updating its method under a deadline.
Everything on this page is quoted or summarized from FinCEN's notice and fact sheet and from the banking agencies' companion proposals, linked where they appear. Examples from the solution use a fictional sample bank, Tessaly Community Bank.
From the AML Act to a final program rule, in months
- To the priorities6 mo
- To the 2024 proposal36 mo
- 2024 proposal, withdrawn21 mo
- 2026 proposal6.5 mo+
- Compliance period12 mo
What is the FinCEN AML program rule NPRM?
It is FinCEN's proposed rewrite of the program rules every BSA-covered institution follows, including the bank rule at 31 CFR 1020.210, to implement the AML Act of 2020 and what Treasury calls BSA modernization. FinCEN's fact sheet lists its aims: "refocusing compliance obligations and expectations on effectiveness," "empowering financial institutions to direct more attention and resources toward higher-risk customers and activities," ensuring "examiners and auditors do not substitute their subjective judgment," giving FinCEN a central role in significant supervisory actions, and "incorporating the AML/CFT Priorities" (FinCEN fact sheet, April 7, 2026).
FinCEN's rule has partners. The FDIC, OCC and NCUA approved a joint companion proposal the same day, April 7, 2026, for the banks they supervise (FDIC FIL-12-2026; OCC Bulletin 2026-11), and the Federal Reserve issued its own proposal under Docket R-1835 (Federal Reserve, R-1835). A bank will answer to both FinCEN's rule and its regulator's, which the agencies drafted "in substantive alignment."
The proposal in four numbers
4
program pillars, with customer due diligence moved inside internal controls
3
things risk assessment processes would have to do
30days
notice to FinCEN before a significant supervisory action, absent urgency
12months
from the final rule to the effective date, as proposed
Was the 2024 AML program rule withdrawn?
Yes. The 2024 proposal was never finalized, and the April 2026 notice withdraws it in plain terms: "FinCEN does not intend to finalize the 2024 Program NPRM, and it should be considered withdrawn and superseded by this proposed rule." The 2024 proposal, published July 3, 2024 (89 FR 55428), drew 86 comments, and the new notice summarizes the objections that shaped the replacement.
Three of those objections bear on the risk assessment. Commenters called the 2024 risk assessment requirement an additive "check-the-box" exercise for banks that already assess risk; objected to being required to base the assessment on their own SAR and CTR filings, noting the AML Act says filings should be guided by the program rather than the other way round; and objected to "the description of a risk assessment process as a singular process that implied a one-time, annual exercise whereas financial institutions conduct numerous and often continuous risk assessments throughout the year." The 2026 text answers all three: it drops the filings element, speaks of "processes" in the plural and sets no annual cycle.
What changed in the April 2026 FinCEN proposal?
The structure of the program stays recognizable; what changes is what is written down and how supervisors may judge it. The comparison below sets the current bank rule beside the proposal.
The bank AML program rule today, and as proposed in April 2026
Today (31 CFR 1020.210 and the FFIEC manual): Internal controls, independent testing, a designated individual, training, and customer due diligence as a fifth element.
As proposed (not final): Four pillars: internal policies, procedures and controls (with risk assessment processes and ongoing customer due diligence inside), independent testing, a U.S.-based AML/CFT officer, ongoing training.
Today (31 CFR 1020.210 and the FFIEC manual): "Not a specific legal requirement," though examiners generally start from it and documenting it is "sound practice."
As proposed (not final): Explicit: risk assessment processes that evaluate products, services, distribution channels, customers and geographies, review the priorities and update promptly on significant change.
Today (31 CFR 1020.210 and the FFIEC manual): Issued June 30, 2021; banks are not required to incorporate them.
As proposed (not final): Banks would review them and incorporate them "as appropriate" into risk assessment processes once the final rule takes effect.
Today (31 CFR 1020.210 and the FFIEC manual): Examiners assess whether the program is adequate and reasonably designed.
As proposed (not final): "Establishment" (design) separated from "maintenance" (implementation); no enforcement for an established program absent a significant or systemic failure to maintain it.
Today (31 CFR 1020.210 and the FFIEC manual): Required; no set frequency.
As proposed (not final): Objective criteria; testers and examiners do not substitute their subjective judgement for the bank's.
Today (31 CFR 1020.210 and the FFIEC manual): Written program approved by the board and noted in the minutes.
As proposed (not final): Approved by the board, an equivalent governing body or appropriate senior management.
Today (31 CFR 1020.210 and the FFIEC manual): Not addressed in the rule.
As proposed (not final): No technology required; responsible use of innovative tools such as AI adds no enforcement risk by itself.
Two less visible changes matter to the BSA officer. Customer due diligence would move inside internal controls, which FinCEN says "is not intended to have any effect on the substance of ongoing CDD obligations." And the compliance officer would be described as responsible for "establishing, implementing, and overseeing day-to-day compliance," located in the United States and accessible to FinCEN and the regulators. The BSA officer's responsibilities under today's rule are covered in their own guide.
Does the new AML rule require a risk assessment?
Yes: for banks the proposal would turn the risk assessment from an examiner expectation into a rule. FinCEN says so directly: "The explicit requirement to have risk assessment processes will be new for banks, casinos, MSBs, broker-dealers, mutual funds, and FCMs and IBCs."
Risk assessment processes would have to: (1) evaluate the ML/TF risks of the financial institution's business activities, including products, services, distribution channels, customers, and geographic locations; (2) review and, as appropriate, incorporate the AML/CFT Priorities; and (3) be updated promptly upon any change that the financial institution knows or has reason to know significantly changes the institution's ML/TF risks.
FinCEN fact sheet on the AML/CFT program proposal, April 7, 2026
The preamble fills in how much latitude that leaves. FinCEN is "not prescribing any particular risk assessment processes or methodologies other than the critical elements," is "not prescribing any particular timeframe for institutions to update," and will examine "the totality of these processes rather than the sufficiency of a single, standalone risk assessment process." It defines distribution channels as "the methods and tools through which a financial institution opens accounts and provides products or services, including, for example, through remote or other non-face-to-face means." And it lists events that may need an update: new products, services or customer types; significant changes to existing ones; adopting "new risk mitigation technology"; mergers, acquisitions, divestitures and liquidations; and developments outside the bank itself. Whether an annual assessment still suffices is answered in how often a bank must update its BSA/AML risk assessment.
Community banks get a paragraph of their own. They "may use risk assessment processes that are tailored to their business model and operational scale, including processes that rely on direct knowledge of products, services, customers, and geographic locations rather than highly parameterized or model-driven approaches," and may conclude that some priorities do not apply, in which case the bank "would not be required to allocate attention or resources to risks for which it has no identified exposure."
What is the difference between establish and maintain?
Establishing a program means designing it properly; maintaining it means running it as designed. Under the proposal, establishing requires a risk-based framework with the four pillars and "keeping the program current as a financial institution's risk profile evolves," while maintaining requires implementing the program "in all material respects—in other words, to execute the program in practice."
The split changes what a finding means. FinCEN says that if a bank has established its program, FinCEN "generally would not take an enforcement action," and would generally not take "a significant supervisory action against the bank, unless the bank has a significant or systemic failure to maintain that program." Before a federal banking supervisor starts a significant AML/CFT supervisory action, it would give FinCEN's Director at least 30 days' written notice, absent urgent circumstances. For the risk assessment, the distinction is practical: a missing product line is a design failure; an assessment that was designed well but not refreshed when a new product launched is a maintenance failure. Both can be avoided by an assessment that can show when it last checked each input.
What the proposal says about AI and other technology
The proposal names AI and declines to require any technology. The preamble lists "machine learning, generative artificial intelligence (GenAI), digital identity, blockchain monitoring and analytics, or application programming interfaces (APIs)" as innovative approaches; says the rule "does not reference or require the use of any particular technology," recognizing that new technology "may not be suitable for every financial institution, particularly smaller ones"; and states that institutions that "responsibly experiment with innovative technologies" will not incur added risk of significant supervisory or enforcement action "solely based on the use of innovative technologies" (91 FR 18704).
It goes one step further in the factors FinCEN's Director would weigh before an enforcement or significant supervisory action: whether the bank uses "innovative tools such as artificial intelligence that demonstrate the effectiveness of the bank's AML/CFT program." Model risk guidance moved the same year. The agencies' revised guidance of April 17, 2026 rescinded the 2021 statement on BSA/AML models and placed generative and agentic AI outside its scope (OCC Bulletin 2026-13), and FinCEN's fact sheet says it "shares industry concerns about the appropriateness of applying Model Risk Management Principles to AML/CFT programs."
When will the AML program rule be final?
Nobody outside FinCEN knows. The comment period closed on June 9, 2026, and no final rule had been published by late October 2026. If FinCEN keeps its proposal, the rule would take effect 12 months after the final rule is issued, and banks would not have to incorporate the national priorities until then: "financial institutions will not be required to incorporate the AML/CFT Priorities into their risk-based AML/CFT programs until the final rule comes into effect."
The priorities themselves are a second open question. The AML Act requires an update at least every four years (AML Act, section 6101); the 2021 list (FinCEN, June 30, 2021) is still the one the proposal cites. A bank planning its next assessment should treat both as still open: build to the proposal's three elements, and expect the list of priorities it reviews to change. Treasury's 2026 National Money Laundering Risk Assessment is the best current guide to what a revised list might stress.
BSA/AML Risk Assessment: a narrative sentence changed after the proposal
What to do with your risk assessment before the rule is final
Build the next assessment so it would meet the proposal's three elements without losing anything today's examiners expect. Nothing in the proposal conflicts with the FFIEC manual's current guidance, so the work is additive, and most of it is documentation a bank should have anyway.
Getting a risk assessment ready for the proposed rule
- Add distribution channels as a row or a factor
Remote account opening, instant payments, third-party and fintech channels, scored with their own data.
- Review each of the eight national priorities and write down why it applies or not
The proposal lets a bank set aside a priority to which it has no identified exposure, if it says so.
- Define "significant change" for your bank
Thresholds on named data points, and events such as a new product, partner, merger or technology, that start an update.
- Show that more effort goes where the risk is
The proposal would require mitigation "consistent with" the risk assessment, with more attention to higher risk.
- Separate design from operation in control ratings
So a finding can be read as an establishment or a maintenance issue.
- Decide who approves
The proposal would allow the board, an equivalent body or appropriate senior management to approve the program.
- Keep the trail
Who changed which rating, when and why, with the evidence, so independent testing can apply objective criteria.
BSA/AML Risk Assessment does part of this automatically. Its challenger reads each draft against the April 2026 proposal as well as last year's approved assessment, the FFIEC manual and FinCEN's priorities, and lists every sentence that is out of date. Its change watcher reruns only the categories whose data moved past the bank's threshold, which is one practical answer to "updated promptly." And a new partner program or product can be scored as a what-if before launch, with the controls that must be ready first.
A significant change, scored before it happens
See the challenger, the refresh and the what-if on one assessment in BSA/AML Risk Assessment.
Questions people ask
What is notable about the new AML/CFT program rule?
Three things stand out for banks: an explicit requirement for risk assessment processes, a two-part test that separates program design from implementation, and limits on supervisory and enforcement action against a bank whose program is properly established. It also names AI as an innovative tool and says responsible use adds no enforcement risk by itself.
Is the FinCEN AML program rule in effect?
No. It is a proposed rule; comments closed on June 9, 2026, and no final rule had been published by late October 2026. The current rule, 31 CFR 1020.210, still applies, unchanged since 2020. If finalized as proposed, the new rule would take effect 12 months after issuance.
Who has to follow the proposed rule?
FinCEN's proposal covers every institution type with a BSA program rule, including banks, casinos, money services businesses, broker-dealers, mutual funds and futures commission merchants. Banks would also follow their regulator's companion rule: the FDIC, OCC and NCUA proposed one jointly and the Federal Reserve proposed its own.
Does the proposal change customer due diligence?
It moves ongoing customer due diligence from a separate fifth element into the internal controls pillar. FinCEN says the move "is not intended to have any effect on the substance of ongoing CDD obligations," so the risk profile and ongoing monitoring requirements stay the same.
Would the proposal require an annual risk assessment?
No. FinCEN says it is "not prescribing any particular timeframe" for updates and that a bank may rely on several processes rather than one annual document. What it would require is an update "promptly" when a change significantly alters the bank's money laundering and terrorist financing risks.
What happens to the national priorities under the proposal?
Banks would have to review them and, as appropriate, incorporate them into their risk assessment processes once the final rule takes effect. A community bank could decide a priority does not apply to its business, and would then not have to allocate resources to it. The priorities in force are still the eight issued on June 30, 2021.