The Proposed AML/CFT Program Rule: What Community Banks Need to Know and Do
Key takeaways
The federal banking agencies have proposed rewriting their AML/CFT program rules so that supervision and enforcement turn on whether a bank's program actually runs as written.
Status and timing: The FDIC, OCC and NCUA jointly proposed the changes in April 2026 (91 FR 18304), and comments closed June 9, 2026. It is a proposal, not a final rule. The proposed effective date is 12 months after a final rule is issued, and no timetable has been published.
Core change: Banks must establish a program and then maintain it by implementing it in all material respects. For a bank with an established program, only significant or systemic implementation failures would draw AML/CFT enforcement or a significant supervisory action.
Mostly clarification: The agencies describe most operational requirements as clarifications, and the notice scales expectations to size and risk. The practical shift for community banks is the evidence needed to show the program is followed.
Not mandated: The proposal does not require continuous monitoring or any particular technology.
What to do: Update the risk assessment process, define and measure implementation, review beyond a sample where feasible, protect the independence of testing, and close every finding.
Why the AML/CFT program rules are being rewritten
The proposal separates two questions: whether a bank has designed a reasonable AML/CFT program, and whether it carries that program out.
In April 2026 the FDIC, OCC and NCUA jointly proposed amending their program rules, published in the Federal Register on April 10 (91 FR 18304). FinCEN issued a companion proposal for the institutions it regulates directly, and the Federal Reserve issued a parallel proposal for state member banks in July. The agencies frame the changes as making programs more risk-based and more effective.
Filing volumes show the pressure. Banks, savings associations and credit unions filed more than 2.19 million suspicious activity reports in 2025, up 7.66% from 2024, according to a Forvis Mazars summary of FinCEN data. Each filing passes through alerts, investigations and decisions that a program must carry out consistently.
Where the proposal stands
It is a proposal, not a final rule. As of this writing no final rule or timetable has been published, though many practitioners expect one. The agencies propose an effective date 12 months after a final rule is issued.
What the proposed AML/CFT rule would change
The biggest change is the enforcement standard: a program that is properly established would be judged on whether it is implemented in all material respects. The agencies describe most of the other items below as clarifications of existing expectations, not new obligations.
Establish, then maintain. A bank must first establish a reasonably designed AML/CFT program, then maintain it by implementing it in all material respects.
A higher bar for enforcement. For a bank with a properly established program, only a significant or systemic failure to implement it would lead to an AML/CFT enforcement action or a significant supervisory action. Isolated or technical issues would not. Failing to establish a program remains fully enforceable.
Risk assessment process. Banks would need a process that considers their products, services, distribution channels, customers and geographies. They would update it promptly when the bank knows, or has reason to know, of a change that significantly alters its risks. The process would also take the national AML/CFT Priorities into account.
The AML/CFT officer. The officer must be qualified, not overburdened with other duties, and located in the United States. The U.S. location requirement is the new element.
Independent testing continues. Testing should use objective criteria and assess whether the program is established, implemented and resourced consistent with the bank's risk assessment. The AML/CFT officer, and anyone who reports to that officer, generally would not be sufficiently independent.
Other changes. The board, an equivalent governing body, or senior management could approve the written program. The agencies would give FinCEN advance notice before major AML/CFT actions, and their rules would add the customer due diligence requirement FinCEN's rule already imposes.
What the proposal does not do
The proposal does not add a continuous monitoring mandate, require specific technology, or set SAR narrative standards. Clearing up these points early will save compliance teams from preparing for requirements that are not in the text.
No prescribed monitoring cadence. The risk assessment process is updated when risk changes significantly, not on a fixed calendar.
No required technology. The agencies say banks may use innovative tools, and that doing so would not by itself add enforcement risk.
No new SAR documentation rule. Under FinCEN's October 2025 SAR FAQs, documenting a decision not to file a SAR is not a regulatory requirement. A bank's own policy may still require it, and the bank is expected to follow its policy.
No relief for failing to establish a program. The higher enforcement threshold applies only once a program is properly established.
The real challenge: showing the program runs as written
If enforcement turns on systemic implementation failures, a bank needs a way to see patterns across its decisions, not just a policy that reads well. The notice describes failures of this kind through examples, such as procedures that are not performed consistently and monitoring that misses material volumes or types of activity.
The notice also lists how banks can learn of implementation gaps: independent testing, examiner feedback, management reports and key risk indicators such as backlogs, and issues raised by AML staff. Each of these depends on data about how work is actually done.
This is hard for three reasons, and they are our analysis, not rule text.
Sampling shows samples. Many institutions verify alert dispositions and investigations through periodic, sample-based quality assurance. A sample can confirm that reviewed cases were handled well. It is a weak tool for revealing a pattern that appears in cases nobody reviewed.
Handoffs hide gaps. A red flag may start with a teller, a call center agent or a fraud analyst before it reaches the BSA team. Consistency across those handoffs is difficult to check by hand.
Teams are lean. The proposal expects the AML/CFT officer not to be overburdened with other duties. In many community banks the officer also helps run the work they oversee.
What the proposed rule means for community banks of different sizes
The same standard applies to every bank, but the notice scales expectations to size, complexity and risk. It says many community banks have limited activities and local customer bases, so their risk assessment processes may be more streamlined or qualitative, and that most banks can build on existing processes. Less complex banks may also use internal staff not involved in the function being tested, or share testing resources.
The size bands below are our own grouping for planning, and the pressure points are our analysis, not rule text.
Community bank size | Likely pressure points | Planning priorities |
|---|---|---|
Smaller (under $1B) | Very lean teams, an officer who holds several roles, and little room to separate operating the program from testing it. | Right-size the risk assessment, define update triggers, track a short list of implementation indicators, and arrange shared or outsourced testing. |
Mid-size ($1B to $10B) | More products and channels, handoffs between fraud, BSA and the business, and consistent decisions across teams. | Standardize procedures across units, report indicators to senior management, and make the roles of the second line and internal audit explicit. |
Larger (above $10B) | Higher alert and case volumes, several lines of business, and automation or AI inside AML workflows. | Produce implementation evidence across lines of business and hold automated tools to the same standard as human work. |
For reference, the OCC defines community banks as institutions with up to $30 billion in assets for purposes of its community bank BSA/AML examination procedures.
What banks should do now to be ready
The most useful preparation is to turn the written program into something a bank can measure and show. These steps follow the proposal's own language and are worth starting before a final rule arrives, because the proposed runway after a final rule is 12 months.
Run a gap assessment against the proposal. Compare the program, risk assessment, officer role, independent testing and approvals with the elements described above.
Define what "implemented in all material respects" means for your bank. List the procedures that matter most, such as alert disposition, escalation, the SAR decision and customer due diligence refresh. For each, state how you will know it is followed.
Make the risk assessment event-driven. Decide what counts as a significant change, for example a new product, customer type, geography, channel, partnership or technology. Assign who triggers an update and how fast.
Build implementation indicators. Track backlog and aging, alert closure rates, consistency of dispositions, quality assurance coverage and error rates, escalation timeliness and training completion. Report them to the AML/CFT officer and senior management on a set schedule.
Review beyond a sample where you can. Start with the highest-volume, highest-consequence decisions, such as first-level alert closures and escalation choices. Where a full review is not feasible, use risk-based sampling and document how the sample is chosen.
Protect the independence of testing. Keep operating the program separate from testing it, record who performs the testing, and consider shared or outsourced testing where in-house independence is hard to achieve.
Settle policy choices, follow them, and close the loop. Decide, for example, whether you will document decisions not to file, then make sure staff do what the policy says, including any automated or AI tools. Record each finding, track remediation to completion, and retest.
Where technology fits: oversight, intervention and remediation
No technology is required, but producing implementation evidence by hand is difficult at the volumes banks now handle. A growing category of tools addresses this by checking whether work follows both the regulatory requirements and the bank's own policy, then acting on what they find. Palqee calls this approach oversight intelligence.
These tools work in three steps:
Oversight: detecting violations and ambiguity in how decisions and actions are carried out.
Intervention: flagging or stopping an issue while it can still be corrected.
Remediation: feedback and consequences that improve how the work is done, with a record of what was found and fixed.
Palqee Prisma is built for this category. It is a control layer that Palqee delivers as an SDK and, where a bank requires it, through Palqee's own managed cloud and interface. In AML/BSA workflows it checks alert dispositions, investigations and escalations against regulatory requirements and the bank's own policy, and routes what it detects for remediation. The aim is to give the BSA/AML compliance team ongoing evidence of how the program is carried out across every disposition, not only a sample.
What Prisma is not
Prisma is not a transaction monitoring system, does not file SARs, and is not itself the independent test. The proposal says the AML/CFT officer and anyone reporting to that officer generally would not be sufficiently independent, so whether its output supports independent testing depends on who operates it and how independent they are of the program.
Questions to ask any provider
Does it review every decision in scope, or a sample?
Does it check against both regulatory requirements and the bank's own written policy, and can the bank update either one?
Does it keep an audit trail that a tester or examiner can follow from finding to remediation?
Who operates it, and how does that fit the bank's independence requirements?
How is data handled, where is it processed, and what are the deployment options?
Frequently asked questions about the proposed AML/CFT program rule
What is the proposed AML/CFT program rule?
It is a joint proposal from the FDIC, OCC and NCUA, published April 10, 2026, to amend their AML/CFT program requirements. It separates establishing a program from maintaining it by implementing it in all material respects. It also sets a higher threshold for enforcement against banks with an established program.
Is the rule final, and when would it take effect?
No. It is a proposal, comments closed June 9, 2026, and no final rule has been published. The proposed effective date is 12 months after a final rule is issued.
Who does it apply to?
The joint proposal covers banks supervised by the OCC and FDIC and credit unions supervised by NCUA. The Federal Reserve issued a parallel proposal for state member banks, and FinCEN issued a companion proposal for the institutions it regulates directly.
Does the proposal require continuous monitoring or new technology?
No. It sets no monitoring cadence and requires no particular technology. The risk assessment process must be updated promptly when risk changes significantly.
What changes for community banks?
The same standard applies, but the notice says community banks may use more streamlined or qualitative risk assessment processes, and that most banks can build on existing ones. Less complex banks may also use internal staff not involved in the function being tested, or share testing resources.
What counts as a significant or systemic failure?
The agencies describe it through examples, such as procedures that are not performed consistently and monitoring that misses material volumes or types of activity. Banks should expect examiners to look for patterns, not isolated errors.
Who can perform independent testing?
Testing can be done by bank personnel or an outside party. The AML/CFT officer and anyone who reports to that officer generally would not be sufficiently independent.
Next step
Palqee is hosting a webinar later this year on the proposed AML/CFT program rules and what they mean for BSA/AML work. [Add date, time and registration link.]
About Palqee
Palqee is a technology provider that also provides embedded human expertise. Its product, Palqee Prisma, is a control layer that applies oversight, intervention and remediation to bank workflows, including AML/BSA alert dispositions, investigations and escalations.
This article is general information, not legal advice. The proposal may change before a final rule is issued, so banks should confirm specifics with counsel.
Sources
As of October 20, 2026.
