Federal Reserve Proposes Risk-Based AML/CFT Program Rules for Banks: Focus on Higher-Risk Customers, FinCEN Priorities in Risk Assessments, and Enforcement Reserved for Significant Failures

On July 7, 2026, at 3:00 p.m. Eastern time, the Federal Reserve Board announced that it was requesting public comment on a proposal to amend its requirements for the anti-money-laundering and countering-the-financing-of-terrorism (AML/CFT) programs that banks it supervises must maintain. The Federal Register notice, titled Anti-Money Laundering and Countering the Financing of Terrorism Programs, is dated July 9, 2026. This article draws on the Board's press release and on a law-firm analysis of the proposal in the National Law Review. It covers what those sources say and states where they are silent. The Board's press release does not give the vote tally or a detailed comparison with the current rule.

What the proposal would do

According to the Board, the changes are intended to match AML program proposals issued separately by other agencies. The analysis names them as the Financial Crimes Enforcement Network (FinCEN), the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation and the National Credit Union Administration. The analysis notes that FinCEN's proposed program revisions are complementary to the Fed's and that the proposals arise under separate authorities, and it does not say whether they form a joint action. The Fed's proposal would amend Regulation H, which covers membership and related requirements for state member banks, to implement provisions of the Anti-Money Laundering Act of 2020.

The press release summarises three main changes. First, banks would focus their AML resources on the basis of risk, giving more attention to higher-risk customers and activities. Second, banks would incorporate FinCEN's AML priorities into their risk assessment processes. Third, once a bank has an AML program in place, the Board would concentrate its supervision and enforcement on significant failures to implement that program.

Program requirements

The National Law Review analysis adds detail on what a program must contain. Banks must maintain effective AML/CFT programs designed to identify, assess and mitigate money laundering, terrorist financing and other illicit finance risks. The risk assessment must cover products, services, distribution channels, customers and geographic locations, and must incorporate the applicable FinCEN AML/CFT priorities. Banks must direct more attention and resources to higher-risk customers and activities, and must update the assessment promptly when significant changes affect their risk profile.

The familiar core elements remain. These are ongoing customer due diligence, independent testing, employee training, and a designated AML/CFT officer who is located in the United States. The written program may be approved by the bank's board of directors, an equivalent governing body or appropriate senior management.

The supervisory approach

The most consequential sentence in the proposal may be the one about enforcement. Once a bank has properly established its program, the analysis says, the Board generally would reserve AML/CFT enforcement or significant supervisory actions under the program rule for significant or systemic implementation failures. In practice this signals that minor or isolated shortcomings would be less likely to trigger formal action under the program rule. The analysis does not define significant or systemic failures, and neither source gives examples, so how that line is drawn would be a matter for the final rule and supervisory practice. The word generally also leaves room for exceptions.

Governor Michael Barr issued a separate statement on the proposal, which the Board's release links to but which was not reproduced in the sources used here, so this article does not describe it.

Timeline and how to comment

The Federal Register notice says comments are due 60 days after publication. The National Law Review gives the date as September 8, 2026. For reference, 60 days after July 9 falls on September 7, which is the Labor Day holiday in 2026, so a September 8 deadline is consistent with that calculation; this is calculated here and is not stated by the sources. Comments can be submitted through a portal on the Federal Reserve's website, where they can also be viewed. After the comment period the Board would consider the feedback before deciding whether to finalise the rule. The sources give no timeline beyond the comment deadline.

What it means for banks and customers

For banks supervised by the Fed, the practical work would be to review their risk assessments against FinCEN's priorities, check that higher-risk activities receive proportionately more resources, and confirm that governance, testing and training meet the requirements. Smaller banks that run uniform programs might need to show more explicitly why they allocate resources as they do.

For customers, a risk-based approach means that people and businesses assessed as higher risk could face more questions and documentation, while others could see lighter-touch checks. The sources do not describe consumer effects, so that is a general consequence of the stated approach rather than something they say.

What is not known

The proposal is not final. The sources do not say how the rule differs in detail from the current one, do not quantify cost savings and do not describe the content of FinCEN's priorities. Banks and observers will likely comment on how significant or systemic failures should be defined. Anyone affected should read the Federal Register notice. This article is general information and not legal advice.