FinCEN just changed what counts as a working AML program. Here's what that actually means.
In April 2026, FinCEN proposed something it has threatened to do since the AML Act of 2020: replace the standard your program is judged against. Not the filing thresholds. Not the five pillars. The standard itself.
For as long as most compliance officers have been doing this job, an exam has asked two questions. Does your program exist? Is it reasonably designed? Under the proposed rule, a third question matters most: does it work?
That sounds like a small change. It is not. It moves AML compliance from a checklist exercise to something closer to an outcomes test, and it hands examiners language to ask about results instead of just documentation. If your program has always been built to survive an exam rather than to catch bad activity, this is the rule that notices the difference.
What changes at a glance
The comment period closed. The debate didn't.
FinCEN's comment period closed June 9, and the industry showed up. 111 comments came in, more than 50 of them on the final day, which tells you something about how many institutions were still arguing internally about what to say right up to the deadline. About 95 percent of those comments supported the effectiveness standard in principle.
That lopsided number can make it look like the fight is over. It isn't. The direction is locked. What's still genuinely contested is what sits in the binding rule text versus the preamble, and who gets to decide when a gap in your program crosses the line into something FinCEN will actually act on.
That line matters more than almost anything else in the proposal. The rule says FinCEN generally won't pursue enforcement or significant supervisory action unless there's a "significant or systemic" failure to maintain the program. Nobody has defined those two words. Depending on who you ask, that undefined threshold is either a real protection against death by a thousand paper cuts, or it's an invitation for an institution to talk itself out of a finding it should have escalated. Both readings have real support in the comment record, and the final rule hasn't picked a side yet.
Five pillars become four. That doesn't mean less work.
The most commonly repeated summary of this rule is that five pillars become four, with customer due diligence folded into internal policies, procedures, and risk assessment. That description is technically true and also a little misleading.
CDD isn't going anywhere. The actual change is that the risk assessment, which has mostly lived as a supervisory expectation, gets codified into something closer to a legal requirement. That's a bigger deal than the pillar count suggests, because it means the data feeding your customer risk ratings is no longer just a program hygiene issue. It becomes the thing an examiner can point to directly. Institutions that treat this as "one less box to check" are the ones most likely to be surprised later, usually in the form of a consent order built on stale or incomplete risk data.
There's a practical wrinkle buried in here too. If your risk assessment now has to be updated "promptly" on material change, and your risk weighting lives inside a vendor platform you don't control, that promptness requirement becomes a real compliance exposure, not just an operational annoyance. Waiting on someone else's release schedule to update your own risk judgment is a hard thing to defend in an exam.
AI gets a mention. Getting credit for it is harder than it sounds.
FinCEN says it will consider whether an institution is using innovative tools, including AI, when evaluating program effectiveness. Reactions to that line split almost exactly along institution size. Larger players read it as recognition of where the industry is already headed. Smaller institutions and credit unions read it as the start of a standard they can't afford to meet.
The more interesting question isn't whether AI counts. It's what actually earns credit. Buying a tool isn't evidence of anything on its own. What matters is whether you can show documented governance and measurable outcomes: fewer false positives, faster case resolution, consistent SAR quality, and whether a human can explain the decision behind an AI-assisted outcome. "The system flagged it" is not an answer an examiner will accept. Automation bias, where a compliance officer defers to a tool's output without understanding it, is quietly becoming its own exam risk.
The real deadline isn't the final rule. It's your next exam.
Here's the part that gets lost in most summaries of this proposal: the finish line everyone should actually be planning around isn't when FinCEN finalizes the rule. It's whenever your next exam or annual review happens to land.
Those two situations call for genuinely different priorities over the next few months, and most of the compliance commentary on this rule treats every institution the same way. It shouldn't.
Frequently asked questions
What is FinCEN's proposed AML effectiveness standard?
It's a proposed rule, published in April 2026, that would judge AML/CFT programs on whether they are established and maintained so they actually work, rather than only on whether they exist and are reasonably designed.
When would the rule take effect?
Not yet. The comment period closed June 9, 2026. FinCEN has proposed that the final rule take effect 12 months after it is issued, and the FinCEN hub tracks each step.
Does the proposed rule require AI?
No. FinCEN says it will consider whether an institution uses innovative tools, including AI, when evaluating effectiveness. Credit depends on documented governance and measurable outcomes, not on owning a tool.
What does "significant or systemic failure" mean?
The proposal doesn't define it yet. It's the threshold below which FinCEN generally wouldn't pursue enforcement or significant supervisory action, and defining it was one of the most common requests in the comment record.
There's more to this than fits in a blog post
The full comment record, the practitioner disagreements buried in it, and the specific playbook for where to spend your time depending on your exam timing are worth more than a summary. On October 8, American Banker hosted a session built around exactly that, with independent AML consultant Sarah Beth Felix and Unit21 CPO Kunal Datta on what the proposed rule requires and what banks and credit unions should do before their next exam.
Gal Perelman is the Product Marketing Lead at Unit21, where she spearheads go-to-market strategies for AI-driven risk and compliance solutions. With over a decade of experience in the fintech and fraud sectors, she has led high-impact launches for products like Watchlist Screening and AI Rule Recommendations.
Previously, Gal held marketing leadership roles at Design Pickle, Sightfull, and Lusha. She holds a Master’s degree from American University and a Bachelor’s from UCLA, and is dedicated to helping banks and fintechs navigate complex regulatory landscapes through innovative technology.
