Modernizing AML/CFT: FinCEN Proposes Fundamental Reforms to Program Requirements

FinCEN's proposed rule applies to financial institutions, including banks. The agencies' joint NPRM applies only to banks. The Federal Reserve Board did not join the joint NPRM. The proposed rules move regulations toward an effectiveness-oriented approach.

Key provisions include:

Two-Tiered Framework. The rules would distinguish a bank's AML/CFT program establishment and implementation. A bank would need to first establish an AML/CFT program. That program would incorporate:

• Risk-based internal policies and controls;
• Independent testing;
• Designation of a U.S.-based AML/CFT officer; and
• An ongoing employee training program.

The bank would then implement that program "in all material respects." Only significant or systemic implementation failures would warrant enforcement or significant supervisory actions.

Risk-Based Approach. The proposed rules would require AML/CFT programs to direct greater attention and resources toward higher-risk customers and activities consistent with each institution's risk profile. Banks would be required to establish risk assessment procedures to evaluate their business activities for money laundering and terrorist financing risks. Banks would evaluate products and services, distribution channels, customers, and geographic locations. Banks would also incorporate Treasury Department AML/CFT priorities. While banks would retain significant flexibility in risk identification and resource allocation, they should develop well-documented and analytically rigorous risk assessment processes. This would ensure their determinations are defensible; it is important because risk-based approaches have led to disagreements between regulators and banks in the past.

Expanded FinCEN Role. The proposed rules would increase FinCEN's supervisory and enforcement role. Under the joint NPRM, agencies would provide the FinCEN director an opportunity to review before initiating enforcement or significant supervisory actions with at least 30 days' notice. The FinCEN director would consider factors, including:

• The four statutory factors required by the AML Act;
• The bank's contributions to AML/CFT priorities;
• The bank's use of innovative compliance tools; and
• Any other factors the FinCEN director may deem appropriate.

Additionally, the proposed rules would clarify that banks may share information with the FinCEN director relating to existing or potential actions, including otherwise nonpublic information. FinCEN will need significant additional resources and staff expertise to fulfill this expanded role on a rolling basis across multiple agencies.

Mitigating Factors. The proposed rules would recognize two notable mitigating factors in enforcement decisions:

• Providing highly useful information to law enforcement; and
• Using innovative technologies, such as artificial intelligence, machine learning, digital identity, blockchain analytics, and application programing interfaces.

Banks responsibly incorporating innovative technologies would not face additional enforcement risk solely for using those tools. However, these factors should be viewed as important considerations that may influence regulator behavior, not as safe harbors. The joint NPRM acknowledges that adopting new technologies may not be suitable for all banks, particularly smaller ones, and does not require the use of any particular technology.