TL;DR: FinCEN's April 2026 proposed rule replaces the BSA's decades-old, process-driven AML/CFT framework with an effectiveness-based standard. Financial institutions would be evaluated on whether their programs actually detect illicit finance — not on the volume of paperwork they produce. The rule introduces a two-pronged framework separating program establishment from implementation, raises the enforcement threshold to "significant or systemic" failures, and proposes a 12-month implementation window after finalization.
What the Rule Actually Says
On April 7, 2026, FinCEN issued a Notice of Proposed Rulemaking that would fundamentally restructure AML/CFT program requirements under the Bank Secrecy Act. The proposal supersedes and withdraws FinCEN's prior July 2024 NPRM, which attempted a narrower modernization of the same rules.
The core shift: AML/CFT programs would be measured by their effectiveness at combating money laundering and terrorist financing, not by their adherence to prescriptive, checkbox compliance processes. Treasury Secretary Scott Bessent framed it directly — "For too long, Washington has asked financial institutions to measure success by the volume of paperwork rather than their ability to stop illicit finance threats."
The proposed rule implements key provisions of the Anti-Money Laundering Act of 2020, which directed FinCEN to modernize the regulatory framework and incorporate government-wide AML/CFT priorities into program requirements. This is the most significant overhaul of BSA program requirements since the Patriot Act.
The Two-Pronged Framework
FinCEN's proposal introduces a formal definition of an "effective" AML/CFT program built on two distinct prongs: establishment and implementation. This separation matters because it changes how regulators evaluate — and enforce against — program deficiencies.
Establishment
A financial institution must build a risk-based AML/CFT program incorporating four core pillars: internal policies, procedures, and controls (including risk assessment processes); independent program testing; designation of a U.S.-based compliance officer; and ongoing employee training. The program must also stay current as the institution's risk profile evolves.
Implementation
Once a program is properly established, regulators evaluate whether the institution implements it "in all material respects." FinCEN explicitly acknowledges that no program can eliminate all illicit activity or catch every suspicious transaction. The standard focuses on whether the program is reasonably designed to identify and mitigate actual illicit finance risks and generate information that is highly useful to law enforcement.
The practical effect of this split: institutions that have properly established their programs face a higher enforcement threshold for implementation shortcomings. Isolated, technical, or immaterial deficiencies in an otherwise well-designed program would not warrant enforcement action. Only "significant or systemic" failures in implementation would trigger supervisory or enforcement consequences.
Why This Shift Matters Now
The current BSA framework has incentivized financial institutions to apply uniform compliance attention across all customer segments and product categories — regardless of actual risk. The result is a system that generates enormous volumes of filings and documentation but often fails to prioritize the activity that matters most to law enforcement and national security agencies.
FinCEN's proposed rule codifies risk-based resource allocation as an explicit expectation. Institutions would be required to direct more attention and resources toward higher-risk customers and activities, consistent with their risk profile, rather than toward lower-risk areas. According to a 2026 Facctum report on the state of AML compliance, global spending on financial crime compliance exceeds $274 billion annually — yet the vast majority of suspicious activity reports filed each year produce no law enforcement action.
The rule also addresses debanking concerns. FinCEN intends the more deferential, risk-based approach to mitigate the risk that financial institutions will be "inappropriately pressured into closing customer accounts." This aligns with broader administration efforts to expand financial access while maintaining effective controls against illicit finance.
For compliance teams already struggling with high false positive rates, the shift is directionally welcome. A framework that rewards risk prioritization over volume gives institutions explicit permission to stop treating every low-risk alert with the same urgency as a high-risk one.
Risk Assessment Becomes Central
Under the proposed rule, risk assessment processes move from an implicit best practice to a codified requirement embedded within the internal controls pillar. Every covered financial institution would need risk assessment processes that evaluate ML/TF risks across products, services, distribution channels, customers, and geographic locations; review and incorporate FinCEN's AML/CFT priorities; and update promptly when the institution knows or has reason to know that its risk profile has significantly changed.
The prior July 2024 NPRM proposed adding risk assessment as a standalone "sixth pillar" of AML compliance. The 2026 proposal takes a different approach, integrating risk assessment directly into internal controls. The practical difference: risk assessment is not a separate compliance artifact. It is the mechanism that drives how the program allocates resources, designs controls, and prioritizes monitoring activity.
This means the quality of a financial institution's risk assessment could become its most important regulatory protection — or its biggest vulnerability. As Sullivan & Cromwell noted in their analysis, "the quality of a bank's risk assessments could become an important protection against regulatory scrutiny. Conversely, if inadequate, the risk assessment could open up the program as a whole to significant criticism."
FinCEN's Expanded Oversight Role
The proposed rule introduces a notice-and-consultation framework that elevates FinCEN's role in AML/CFT supervision. Before federal banking agencies (OCC, FDIC, NCUA) take a "significant AML/CFT supervisory action" against a bank, they would be required to give FinCEN's Director at least 30 days' written notice and consider any input FinCEN provides.
This represents a meaningful structural change. Historically, AML/CFT examination findings and enforcement actions were resolved primarily through the relationship between the bank and its primary federal regulator. The proposed framework inserts FinCEN as a check on that process, with the stated goal of promoting "consistent approaches to AML/CFT supervision" across agencies.
One notable gap: the Federal Reserve Board did not join the concurrent NPRM issued by the OCC, FDIC, and NCUA — despite having joined the prior 2024 proposal. Whether this signals substantive disagreement with FinCEN's expanded role or reflects procedural considerations remains an open question. Any divergence by the Fed could introduce fragmentation into the supervisory framework that the rule is designed to unify.
What Compliance Teams Should Evaluate Now
The comment period closed on June 9, 2026, and FinCEN has proposed a 12-month implementation period following issuance of the final rule. Compliance teams do not need to wait for finalization to start preparing. Several elements of the proposal align with where effective compliance programs are already heading.
Gap-assess your risk assessment process
The proposed rule places significant weight on the quality and currency of risk assessments. Evaluate whether your current process can credibly distinguish higher-risk activity from lower-risk activity and whether your controls allocation reflects that distinction. If your risk assessment is a static annual document rather than an operational input, the gap is real.
Document your resource allocation rationale
The rule explicitly permits reallocating resources away from lower-risk areas toward higher-risk ones — but that reallocation must be grounded in documented risk assessments. Institutions that shift resources without clear documentation could face scrutiny on their establishment prong rather than their implementation.
Evaluate your independent testing approach
The proposal clarifies that neither examiners nor auditors should substitute their subjective judgment for a financial institution's risk-based program decisions. Independent testing should focus on program effectiveness, not technical completeness. Review whether your current testing methodology aligns with that standard.
Consider innovative tools
FinCEN's enforcement factors explicitly reference whether an institution is "employing innovative tools such as artificial intelligence that demonstrate the effectiveness of the bank's AML/CFT program." This is not a mandate to adopt AI, but it signals that regulators view technology adoption as evidence of program effectiveness — particularly tools that produce demonstrable outputs like interpretable, auditable decision-making.
Where Sphinx Fits
Sphinx's approach to compliance automation aligns with the effectiveness-based framework FinCEN is proposing. Rather than adding more process on top of existing workflows, Sphinx deploys AI agents that work inside the same platforms analysts use — reviewing alerts, documenting decisions, and producing audit trails that demonstrate the reasoning behind every disposition. Financial institutions using Sphinx have reduced alert review time by up to 99% while maintaining the interpretability that regulators and auditors require. In a regime that measures program quality by outcomes rather than paperwork volume, the ability to resolve more cases with documented reasoning — not just more filings — becomes a measurable advantage.
Frequently Asked Questions
When does FinCEN's effectiveness-based AML rule take effect?
The rule is currently a proposed rulemaking (NPRM), not a final rule. The public comment period closed on June 9, 2026. FinCEN has proposed a 12-month implementation period following issuance of the final rule, meaning covered institutions would have at least a year to adjust their programs after finalization.
What is the two-pronged framework in FinCEN's proposed AML rule?
FinCEN's proposed rule evaluates AML/CFT programs on two separate dimensions: establishment (whether the institution has built a risk-based program with required pillars like internal controls, independent testing, a U.S.-based compliance officer, and training) and implementation (whether the program is carried out "in all material respects"). This separation raises the enforcement threshold for implementation deficiencies to "significant or systemic" failures only.
Does the proposed rule require financial institutions to use AI?
No. The proposed rule does not mandate AI adoption. However, FinCEN's enforcement factors explicitly reference whether an institution employs "innovative tools such as artificial intelligence" that demonstrate program effectiveness. Using AI-driven compliance tools that produce auditable, demonstrable outputs may serve as favorable evidence during supervisory evaluations.
How does this rule affect SAR filing requirements?
The proposed rule does not directly change SAR filing mechanics. It reframes the overall program standard from process-based compliance toward effectiveness-based outcomes. FinCEN explicitly acknowledges that "it is not possible for a financial institution to detect and report all potentially illicit transactions." The emphasis shifts to generating information that is highly useful to law enforcement, rather than maximizing filing volume.
Which financial institutions are covered by the proposed rule?
The proposed rule applies broadly across financial institution types defined under the BSA: banks, casinos and card clubs, money services businesses, broker-dealers, mutual funds, certain insurance companies, futures commission merchants, dealers in precious metals, loan or finance companies, and housing government-sponsored enterprises. AML/CFT rules for registered investment advisers are being considered separately under a delayed timeline.
.png)
