Federal Reserve Proposes Sweeping AML Rule Overhaul to Strengthen Risk-Based Compliance and Counterterrorism Measures

The Federal Reserve Board has unveiled an extensive notice of proposed rulemaking that would significantly reshape anti-money laundering requirements for financial institutions under its supervision. The proposal marks a major departure from traditional compliance approaches by replacing static regulatory models with dynamic, risk-focused management frameworks. Under the revised approach, countering the financing of terrorism would become an integrated component of existing anti-money laundering obligations, reflecting the increasingly complex nature of modern financial crime. Reporting institutions would be required to redesign their internal compliance programs to align with nationally established priorities, while the proposal would formally amend Regulation H, affecting every state member bank supervised by the Federal Reserve.

Through the proposed framework, the central bank seeks to modernize the systems financial institutions use to identify and prevent illicit financial activity. State member banks would be required to establish comprehensive anti-money laundering and countering the financing of terrorism programs that move beyond traditional compliance checklists. Instead of relying on routine procedural exercises, financial institutions would be expected to perform continuous assessments of their operations to identify vulnerabilities across customer segments, products, services, and geographic markets. The proposal raises the standard for institutional accountability by updating regulatory expectations that have remained largely unchanged for decades. Bank executives would be expected to demonstrate that their internal control systems can respond effectively as criminal organizations adapt their methods over time.

The proposed shift toward a more analytical compliance model means that standardized templates will no longer be sufficient to satisfy supervisory expectations. Each institution will be expected to develop a customized compliance methodology that reflects its own business model and risk profile. For example, a bank serving international commercial clients would need to incorporate geopolitical and cross-border financial crime risks into its monitoring systems. By contrast, an institution focused primarily on domestic retail banking would be expected to tailor its transaction monitoring capabilities to detect suspicious consumer behavior, localized structuring schemes, and unusual cash movement within domestic markets. According to the Federal Reserve's proposal, regulatory effectiveness will be evaluated based on how accurately an institution understands and manages its actual risk environment rather than on the sheer volume of suspicious activity reports it files.

Supervisors will also examine whether compliance functions are fully integrated into day-to-day business operations rather than operating independently as isolated back-office departments. This expectation requires ongoing collaboration among frontline personnel, including lending officers, product development teams, and compliance professionals. Whenever a financial institution introduces a new digital banking platform or mobile payment service, compliance personnel would be expected to participate from the earliest stages of development to identify and address potential financial crime risks before products are launched. Embedding these safeguards during the design phase is intended to ensure that risk controls become an integral component of new technologies rather than reactive measures implemented only after regulatory deficiencies have been identified.

Another significant feature of the proposed rule requires supervised institutions to incorporate national illicit finance priorities directly into their enterprise-wide risk assessment processes. Rather than relying solely on historical customer activity and internal transaction data, banks would be expected to compare their customer base, business activities, and transaction flows with priorities established by the Financial Crimes Enforcement Network (FinCEN). These national priorities encompass threats such as professional money laundering organizations, cybercrime, proliferation financing, and transnational fraud. Financial institutions operating in areas connected to any of these identified risks would be required to dedicate compliance resources specifically to addressing those exposures. Through this approach, regulators intend to ensure that private-sector compliance efforts directly support broader federal law enforcement and national security objectives.

The proposal also seeks to strengthen cooperation between the banking sector and government agencies by closely aligning institutional monitoring programs with evolving national security concerns. If FinCEN identifies emerging financial crime trends—such as the increasing use of decentralized money mule networks operating through particular online platforms—banks would be expected to promptly update their transaction monitoring systems to identify those specific patterns. This process is designed to eliminate longstanding gaps between government intelligence gathering and private-sector compliance activities by transforming financial institutions into active contributors to national financial crime detection efforts. Under the proposal, transaction monitoring would increasingly generate actionable intelligence capable of assisting ongoing law enforcement investigations.

To support these evolving expectations, compliance departments would also be required to broaden their understanding of global financial crime trends beyond their own historical data. Financial institutions would need to provide continuous education and training covering emerging money laundering techniques, including trade-based money laundering, evolving shell company structures, and the misuse of virtual asset service providers. A deeper understanding of how criminal organizations transfer illicit funds across international borders would allow banks to identify and address emerging vulnerabilities before they are exploited. Institutions would also be expected to clearly document how national priorities are incorporated into their internal risk assessments and demonstrate a direct connection between federal guidance and corresponding changes to their monitoring systems.

The proposed rule introduces additional governance requirements concerning the leadership of institutional compliance programs. Under the draft regulations, the individual serving as the chief compliance officer would be required to reside within the United States. Regulators believe this domestic presence would ensure immediate accessibility for supervisory authorities and federal investigators conducting examinations or enforcement actions. Beyond physical location, the designated compliance officer would also need sufficient authority, independence, and resources to oversee, test, revise, and administer the institution's compliance program effectively. Responsibility for approving the written compliance framework would ultimately rest with each bank's board of directors, which would be required to formally review and authorize the program. These governance requirements are intended to prevent financial institutions from delegating primary compliance leadership to foreign offices or outside organizations lacking direct regulatory accountability.

Federal regulators indicate that these leadership requirements address increasing concerns about the fragmentation of compliance operations across multinational financial institutions. In recent years, many banks have shifted portions of their compliance functions to offshore operational centers as a cost-saving measure. Although administrative support functions may continue to be distributed internationally, the proposal makes clear that ultimate responsibility and decision-making authority must remain with an executive located within the United States and subject to domestic legal jurisdiction. That executive must be able to respond directly to technical questions from examiners without relying upon delayed communications involving overseas offices. Regulators believe this structure will improve accountability while ensuring that identified weaknesses can be corrected more efficiently.

The domestic presence requirement also extends to the ongoing supervision of internal training and independent compliance testing. Internal audit teams or qualified external consultants would be responsible for conducting independent assessments of the institution's anti-money laundering program and reporting their findings directly to the board of directors. These evaluations would be expected to determine whether the institution is implementing its risk-based compliance strategy as designed. For example, if auditors conclude that high-risk commercial customers receive the same degree of monitoring as lower-risk retail clients, directors would be expected to promptly address the imbalance by reallocating compliance resources according to the institution's documented risk assessment.

Should the proposal ultimately be adopted, financial institutions would face substantial operational changes as they transition toward a more outcomes-focused regulatory framework. Banks are expected to invest significantly in new technologies, expanded staff training, and enhanced analytical capabilities to redesign existing risk assessment models. Institutions would also be required to maintain an ongoing process of updating their compliance documentation whenever material business changes occur, including the introduction of new digital banking services or expansion into additional geographic markets. Although these requirements are expected to increase short-term compliance costs, regulators believe they will ultimately create a more resilient financial system while reducing unnecessary administrative burdens associated with lower-risk customers. The proposal remains open for public comment for 61 days, giving industry participants an opportunity to provide technical feedback before the rulemaking process is finalized.

The modernization initiative is also expected to accelerate the adoption of advanced automation technologies throughout compliance departments. Traditional transaction monitoring systems that depend primarily on fixed rules and predetermined thresholds frequently generate excessive false-positive alerts, consuming valuable investigative resources. Under the proposed framework, banks would be encouraged to implement more sophisticated machine learning technologies capable of adapting to changing threat patterns and identifying complex anomalies with greater accuracy. These systems would analyze contextual information—including shifts in customer behavior, counterparties, and geographic transaction patterns—to produce a more accurate assessment of financial crime risk than conventional rule-based monitoring systems.

Finally, the Federal Reserve's proposal signals a broader evolution in supervisory expectations. Rather than focusing primarily on written policies or verifying that mandatory compliance training has been completed, future examinations are expected to involve detailed technical assessments of the methodologies underlying institutional risk-scoring models. Examiners will seek quantitative evidence demonstrating that staffing levels and compliance resources are allocated appropriately based on the institution's documented areas of highest risk. Financial institutions will be expected to justify their internal risk-scoring decisions with objective data, clearly demonstrating how nationally identified illicit finance priorities have been translated into practical monitoring rules and day-to-day compliance operations.

By fLEXI tEAM