D7 AML/CTF Regime
AML/CTF Regime
Continue reading
The most structurally significant AML/CTF development remains at the proposal stage rather than in force: FinCEN, jointly with the FDIC, OCC and NCUA, has proposed replacing the existing process-based BSA/AML compliance standard with a two-prong effectiveness-based standard requiring institutions to both "establish" and "maintain" an AML/CFT programme judged on risk-based outcomes. The comment period on this proposal closed 9 June 2026, and no final rule had been issued as of this cycle. This is an architecture-level reform proposal: it would change the fundamental basis on which BSA/AML programme adequacy is measured, moving away from a documentation-volume standard toward a demonstrable-effectiveness standard, a shift regulators and industry commentators have discussed for years without, to date, a finalized rule.
The practical significance of this remaining unfinished should not be understated. An effectiveness-based standard, once in force, would require institutions to demonstrate that their AML/CFT controls actually detect and prevent the risks they purport to address, rather than simply documenting that a control exists. This is a materially higher bar in some respects and a potentially more flexible one in others, since a risk-based effectiveness standard can in principle permit institutions to deprioritize low-risk documentation requirements in favor of resources directed at higher-risk typologies. Whether the eventual final rule preserves this flexibility, or layers an effectiveness requirement on top of existing process requirements rather than replacing them, remains unresolved pending the final rule text.
This AML/CTF regime development sits in useful counterpoint to the Graham Act's sanctions-specific statutory tightening addressed elsewhere in this cycle's sanctions domain. Where the sanctions architecture moved from executive discretion to mandatory statute this cycle, the broader AML/CFT programme-adequacy standard remains, by contrast, in a multi-year consultation posture with no finalized text. The two tracks illustrate the uneven pace at which different components of the US financial-integrity architecture are hardening: sanctions compliance obligations have just gained statutory durability, while the general AML programme-adequacy standard that would apply across all BSA-covered institutions, irrespective of specific sanctions exposure, remains unsettled.
Outlook
No date has been fixed for a final BSA/AML Program Rule beyond the closed 9 June 2026 comment period, and institutions should not assume a near-term finalization on the strength of the OCC's unrelated end-of-October target for its GENIUS Act stablecoin rule, which proceeds on an entirely separate rulemaking track. The effectiveness-based standard's eventual final form, including whether it replaces or supplements existing process requirements, remains the central open question for this domain going forward.