The New AML/CFT Rule and Credit Unions: What Changes, What Doesn’t, and How to Prepare
Key takeaways
NCUA and the federal banking agencies have proposed rewriting their AML/CFT program rules so that supervision and enforcement turn on whether a credit union's program actually runs as written.
Status and timing: The FDIC, OCC and NCUA jointly proposed the changes in April 2026 (91 FR 18304), and comments closed June 9, 2026. NCUA would revise its AML/CFT program section, 12 CFR 748.2, which covers federally insured credit unions. It is a proposal, not a final rule. The proposed effective date is 12 months after a final rule is issued, and no timetable has been published.
Core change: A credit union must establish a program and then maintain it by implementing it in all material respects. For a credit union with an established program, only significant or systemic implementation failures would draw AML/CFT enforcement or a significant supervisory action.
Mostly clarification: The agencies describe most operational requirements as clarifications. The practical shift is the evidence a credit union needs to show that its program is followed.
Not mandated: The proposal does not require continuous monitoring or any particular technology.
What to do: Update the risk assessment process, define and measure implementation, review beyond a sample where feasible, protect the independence of testing, and close every finding.
Why the AML/CFT program rules are being rewritten
The proposal separates two questions: whether a credit union has designed a reasonable AML/CFT program, and whether it carries that program out.
In April 2026 the FDIC, OCC and NCUA jointly proposed amending their program rules, published in the Federal Register on April 10 (91 FR 18304). NCUA's piece revises 12 CFR 748.2, and the notice lists all federally insured credit unions among those affected. FinCEN issued a companion proposal for the institutions it regulates directly, and the Federal Reserve issued a parallel proposal for state member banks. The agencies frame the changes as making programs more risk-based and more effective.
Filing volumes show the pressure. Banks, savings associations and credit unions filed more than 2.19 million suspicious activity reports in 2025, up 7.66% from 2024, according to a Forvis Mazars summary of FinCEN data. Each filing passes through alerts, investigations and decisions that a program must carry out consistently.
Where the proposal stands
It is a proposal, not a final rule. As of this writing no final rule or timetable has been published, though many practitioners expect one. The agencies propose an effective date 12 months after a final rule is issued.
What the proposed AML/CFT rule would change
The biggest change is the enforcement standard: a program that is properly established would be judged on whether it is implemented in all material respects. The agencies describe most of the other items below as clarifications of existing expectations, not new obligations.
Establish, then maintain. A credit union must first establish a reasonably designed AML/CFT program, then maintain it by implementing it in all material respects.
A higher bar for enforcement. For a credit union with a properly established program, only a significant or systemic failure to implement it would lead to an AML/CFT enforcement action or a significant supervisory action. Isolated or technical issues would not. Failing to establish a program remains fully enforceable.
Risk assessment process. Credit unions would need a process that considers their products, services, distribution channels, members and geographies. They would update it promptly when they know, or have reason to know, of a change that significantly alters their risks. The process would also take the national AML/CFT Priorities into account.
The AML/CFT officer. The officer must be qualified, not overburdened with other duties, and located in the United States. The U.S. location requirement is the new element.
Independent testing continues. Testing should use objective criteria and assess whether the program is established, implemented and resourced consistent with the credit union's risk assessment. The AML/CFT officer, and anyone who reports to that officer, generally would not be sufficiently independent.
Other changes. The board, an equivalent governing body, or senior management could approve the written program. The agencies would give FinCEN advance notice before major AML/CFT actions, and their rules would add the customer due diligence requirement FinCEN's rule already imposes.
What the proposal does not do
The proposal does not add a continuous monitoring mandate, require specific technology, or set SAR narrative standards. Clearing up these points early will save compliance teams from preparing for requirements that are not in the text.
No prescribed monitoring cadence. The risk assessment process is updated when risk changes significantly, not on a fixed calendar.
No required technology. The agencies say institutions may use innovative tools, and that doing so would not by itself add enforcement risk.
No new SAR documentation rule. Under FinCEN's October 2025 SAR FAQs, documenting a decision not to file a SAR is not a regulatory requirement. A credit union's own policy may still require it, and the credit union is expected to follow its policy. America's Credit Unions has summarized the FAQs for members.
No relief for failing to establish a program. The higher enforcement threshold applies only once a program is properly established.
The real challenge: showing the program runs as written
If enforcement turns on systemic implementation failures, a credit union needs a way to see patterns across its decisions, not just a policy that reads well. The notice describes failures of this kind through examples, such as procedures that are not performed consistently and monitoring that misses material volumes or types of activity.
It also lists how institutions can learn of implementation gaps: independent testing, examiner feedback, management reports and key risk indicators such as backlogs, and issues raised by AML staff. Each of these depends on data about how work is actually done.
This is hard for three reasons, and they are our analysis, not rule text.
Sampling shows samples. Many institutions verify alert dispositions and investigations through periodic, sample-based quality assurance. A sample can confirm that reviewed cases were handled well. It is a weak tool for revealing a pattern that appears in cases nobody reviewed.
Handoffs hide gaps. A red flag may start with a member service representative, a branch teller or a fraud analyst before it reaches the BSA team. Consistency across those handoffs is difficult to check by hand.
Teams are lean. The proposal expects the AML/CFT officer not to be overburdened with other duties. In many credit unions the officer also helps run the work they oversee.
What matters most for credit unions
The standard is the same for credit unions and banks, so what differs is the setting: who examines you, how large your team is, and how your program is governed. The points below are our analysis unless noted.
NCUA writes and enforces its own rule. The proposal revises NCUA's 12 CFR 748.2, and NCUA's proposed text defines an AML/CFT enforcement action as a formal or informal action taken by NCUA. Its examiners will judge whether the program is implemented in all material respects.
Scale the program to your size. The notice's scaling language speaks of community banks, but the principle of tailoring a program to size, complexity and risk applies to any institution. The NCUA's small-entity discussion notes that credit unions are typically much smaller than commercial banks.
Decide who approves and who tests. The written program could be approved by the board, an equivalent governing body, or senior management. The AML/CFT officer and anyone who reports to that officer generally would not be independent testers, so credit unions will want to decide who commissions testing. The supervisory committee, which oversees audit activity, is one natural place to make that call.
Own what vendors do for you. Many credit unions rely on core processors, monitoring vendors and shared compliance services. The proposal does not change who is responsible. The credit union still has to show that its program is implemented, including how staff act on vendor-generated alerts.
Watch the member-facing handoffs. Red flags often start with a member service representative, teller or digital channel. Consistent escalation to the BSA team is a common place for implementation gaps.
The size bands below are our own grouping for planning, and the pressure points are our analysis, not rule text.
Credit union size | Likely pressure points | Planning priorities |
|---|---|---|
Smaller (under $100M) | One or two people covering BSA alongside other duties, and little room to separate operating the program from testing it. | Right-size the risk assessment, define update triggers, track a short list of implementation indicators, and arrange outsourced or shared testing. |
Mid-size ($100M to $1B) | A growing mix of products and channels, handoffs between member service, fraud and BSA, and reliance on vendor alerts. | Standardize escalation and disposition procedures, report indicators to senior management and the board, and clarify who tests versus who operates. |
Larger (above $1B) | Higher alert and case volumes, several teams and channels, and automation or AI inside AML workflows. | Produce implementation evidence across teams and hold automated tools to the same standard as human work. |
What credit unions should do now to be ready
The most useful preparation is to turn the written program into something a credit union can measure and show. These steps follow the proposal's own language and are worth starting before a final rule arrives, because the proposed runway after a final rule is 12 months.
Run a gap assessment against the proposal. Compare the program, risk assessment, officer role, independent testing and approvals with the elements described above.
Define what "implemented in all material respects" means for your credit union. List the procedures that matter most, such as alert disposition, escalation, the SAR decision and customer due diligence refresh. For each, state how you will know it is followed.
Make the risk assessment event-driven. Decide what counts as a significant change, for example a new product, member segment, geography, channel, partnership or technology. Assign who triggers an update and how fast.
Build implementation indicators. Track backlog and aging, alert closure rates, consistency of dispositions, quality assurance coverage and error rates, escalation timeliness and training completion. Report them to the AML/CFT officer, senior management and the board on a set schedule.
Review beyond a sample where you can. Start with the highest-volume, highest-consequence decisions, such as first-level alert closures and escalation choices. Where a full review is not feasible, use risk-based sampling and document how the sample is chosen.
Protect the independence of testing. Keep operating the program separate from testing it, record who performs the testing, and consider outsourced or shared testing where in-house independence is hard to achieve.
Settle policy choices, follow them, and close the loop. Decide, for example, whether you will document decisions not to file, then make sure staff and vendor-supported workflows do what the policy says, including any automated or AI tools. Record each finding, track remediation to completion, and retest.
Where technology fits: oversight, intervention and remediation
No technology is required, but producing implementation evidence by hand is difficult at the volumes credit unions now handle. A growing category of tools addresses this by checking whether work follows both the regulatory requirements and the credit union's own policy, then acting on what they find. Palqee calls this approach oversight intelligence.
These tools work in three steps:
Oversight: detecting violations and ambiguity in how decisions and actions are carried out.
Intervention: flagging or stopping an issue while it can still be corrected.
Remediation: feedback and consequences that improve how the work is done, with a record of what was found and fixed.
Palqee Prisma is built for this category. It is a control layer that Palqee delivers as an SDK and, where an institution requires it, through Palqee's own managed cloud and interface. In AML/BSA workflows it checks alert dispositions, investigations and escalations against regulatory requirements and the credit union's own policy, and routes what it detects for remediation. The aim is to give the BSA/AML compliance team ongoing evidence of how the program is carried out across every disposition, not only a sample.
What Prisma is not
Prisma is not a transaction monitoring system, does not file SARs, and is not itself the independent test. The proposal says the AML/CFT officer and anyone reporting to that officer generally would not be sufficiently independent, so whether its output supports independent testing depends on who operates it and how independent they are of the program. The AML/CFT officer can be the buyer and assign another team to run it.
Questions to ask any provider
Does it review every decision in scope, or a sample?
Does it check against both regulatory requirements and the credit union's own written policy, and can the credit union update either one?
Does it keep an audit trail that a tester or examiner can follow from finding to remediation?
Who operates it, and how does that fit your independence requirements?
Does it work alongside your core processor and monitoring vendors, and what are the data handling and deployment options?
Frequently asked questions about the proposed AML/CFT program rule for credit unions
What is the proposed AML/CFT program rule?
It is a joint proposal from the FDIC, OCC and NCUA, published April 10, 2026, to amend their AML/CFT program requirements. It separates establishing a program from maintaining it by implementing it in all material respects. It also sets a higher threshold for enforcement against institutions with an established program.
Does it apply to credit unions?
Yes. NCUA is a co-proposer and would revise 12 CFR 748.2. The notice lists all federally insured credit unions among the institutions affected.
Is the rule final, and when would it take effect?
No. It is a proposal, comments closed June 9, 2026, and no final rule has been published. The proposed effective date is 12 months after a final rule is issued.
Does the proposal require continuous monitoring or new technology?
No. It sets no monitoring cadence and requires no particular technology. The risk assessment process must be updated promptly when risk changes significantly.
Is the standard different for credit unions than for banks?
The core standard is the same. The notice scales expectations to size, complexity and risk, and credit unions are typically much smaller than commercial banks, so the practical focus is on right-sizing the program and showing it is followed.
What counts as a significant or systemic failure?
The agencies describe it through examples, such as procedures that are not performed consistently and monitoring that misses material volumes or types of activity. Credit unions should expect examiners to look for patterns, not isolated errors.
Who can perform independent testing?
Testing can be done by credit union personnel or an outside party. The AML/CFT officer and anyone who reports to that officer generally would not be sufficiently independent.
Next step
Palqee is hosting a webinar later this year on the proposed AML/CFT program rules and what they mean for BSA/AML work. More details will be published soon.
About Palqee
Palqee is a technology provider that also provides embedded human expertise. Its product, Palqee Prisma, is a control layer that applies oversight, intervention and remediation to institutional workflows, including AML/BSA alert dispositions, investigations and escalations.
This article is general information, not legal advice. The proposal may change before a final rule is issued, so credit unions should confirm specifics with counsel.
Sources
As of October 20, 2026.
