Daily Weekly Podcast Blog API Regulator Agent Subscribe
fedamlbsafincenenforcementaml-act-2020

The Fed Is the Last Agency to Rewrite Its AML Program Rule — and It Just Proposed to Raise the Bar for Enforcement

The Federal Reserve's BSA/AML program rule rewrite under 12 U.S.C. 1818(s) narrows examiner leverage—drawing a Barr dissent. What changed and why it matters.

By Lex, LexRegPulse Analyst · ·9 min read
Primary-source research · AI-drafted · human-reviewed. Methodology

By Lex

On July 7, the Federal Reserve Board requested comment on a rewrite of its Bank Secrecy Act compliance program rule, becoming the fifth and last of the federal AML regulators to move. FinCEN issued its proposal on April 7. The OCC, FDIC, and NCUA issued a joint version the same day. The Fed sat out that round and arrived roughly three months behind. Its own release sells the proposal as alignment — amendments "intended to align with changes to anti-money laundering program requirements separately proposed by four other agencies." Most wire coverage will take that at face value and file it under housekeeping.

That framing buries the lead. The proposal's center of gravity is not the risk-based language everyone expected; it is a few sentences in the supervision-and-enforcement section. Once a bank has established an anti-money laundering program, the Federal Reserve would focus supervision and enforcement activities on significant failures to implement the program. Read the regulatory text and the preamble together and the operative move is unmistakable. Once a Board-supervised bank has properly established a program, the proposed rule would raise the threshold for significant supervisory or enforcement actions based solely on implementation deficiencies; only significant or systemic failures to implement it in all material respects would warrant an "AML/CFT enforcement action" or a "significant AML/CFT supervisory action," rather than isolated, technical, or immaterial implementation issues. That is a narrowing of examiner leverage dressed as harmonization. And Governor Michael Barr dissented — the tell that this is a contested change to the enforcement baseline, not a conforming edit.

How we got here

The statutory engine is the Anti-Money Laundering Act of 2020, whose Section 6101(b) directed that programs be risk-based — "ensuring that more attention and resources of financial institutions should be directed toward higher-risk customers and activities … rather than toward lower-risk customers and activities" — and required incorporation of FinCEN's AML/CFT Priorities and a U.S.-located compliance officer. None of that is new; the agencies tried once already. FinCEN published a program NPRM on July 3, 2024 (89 FR 55428), and the Board and the other agencies followed with a substantially similar proposal on August 9, 2024 (89 FR 65242); those proposals were never finalized.

The current round is the do-over. FinCEN's April proposal fully supersedes the July 3, 2024 rule, which FinCEN is withdrawing. The Fed grounds its authority not in Treasury's delegation but in its independent statute: the Board may require banks to establish and maintain procedures reasonably designed to assure and monitor BSA compliance under 12 U.S.C. 1818(s), Section 8(s) of the Federal Deposit Insurance Act. That distinction matters — it is what lets the Fed set its own enforcement policy rather than simply adopt Treasury's, and it applies here to the 858 banks supervised by the Board as of the September 30, 2025 Call Report.

What "significant or systemic" actually changes

Start with the architecture. The proposed rule creates a two-pronged framework: a program is "effective" if the bank both establishes it and maintains it, and a bank maintains a properly established program by implementing it in all material respects. "Establishing" is design; "maintaining" is operation. The distinction is not academic — it is the hinge on which enforcement now turns. The rule ties the availability of AML/CFT enforcement and significant supervisory actions for an established program to a significant or systemic failure to implement it.

Now translate that into examiner vocabulary, because that is where compliance officers live. The rule defines two gating terms. A "significant AML/CFT supervisory action" is any written communication or other formal supervisory determination that identifies alleged deficiencies, weaknesses, violations, or unsafe or unsound conditions relating to an AML/CFT requirement, communicates supervisory expectations for corrective measures, and contemplates significant or programmatic actions or remedial measures — but the term does not include examiner observations, suggestions, or other informal comments. An "AML/CFT enforcement action" is any formal or informal action under 12 U.S.C. 1818 or other applicable law, including a cease-and-desist order, written agreement, consent order, memorandum of understanding, or civil money penalty.

That definition sweeps in the MRA. Barr said as much in dissent: he could not vote for the proposal because of "the introduction of a new, undefined standard for issuing matters requiring attention and for enforcement actions." An AML-related matter requiring attention that contemplates significant or programmatic remediation is, by definition, a significant AML/CFT supervisory action — and once a program is established, an examiner could not issue it absent a significant or systemic implementation failure. What survives the carve-out is the informal tier: observations and suggestions. The awkward part, from an examiner's chair, is that the most common tool for forcing remediation short of a formal action — the MRA — becomes unavailable for the run of "isolated, technical, or immaterial" implementation gaps that populate most BSA exam reports.

To be fair, the establishment prong stays fully live, and the Fed built in a backstop that industry should not underestimate. Even where a bank has previously established a program, a failure to update it to reflect significant changes in the bank's risk profile may mean the program no longer meets the establishment requirements, and the bank may be subject to action for a failure to establish an effective program. Establishment failures are not subject to the raised threshold. So a bank that lets a program go stale — new products, a new geography, a BaaS book that outgrows its monitoring — can be pulled back into the ordinary enforcement lane on a "failure to establish" theory. The safe harbor is for operating a good program imperfectly, not for standing pat while the risk profile moves.

The divergence everyone will miss

Here is the paragraph the harmonization narrative gets wrong. The peer agencies did more than raise the threshold. The OCC, FDIC, and NCUA proposal would establish a new notice-and-consultation framework: before initiating an AML/CFT enforcement action or a significant AML/CFT supervisory action, the agency would give the FinCEN Director an opportunity to review the action and would consider the Director's input. FinCEN's own materials describe this as requiring federal banking regulators, for the first time, to consult with FinCEN before taking certain supervisory or enforcement actions. Law-firm reads of the text put the advance-notice period at a minimum of 30 days. That is the mechanism that reroutes AML enforcement discretion toward Treasury.

The Fed did not adopt it. The Board's proposed enforcement and supervision policy applies only to actions by the Board; it notes that the Agencies' April proposals include the FinCEN notice-and-consultation and information-sharing provisions, and the Board invites comment on whether it should include the same or similar provisions in its final rule. In other words, the Fed harmonized the substantive threshold — the supervisory-relaxation piece — while pointedly withholding on the Treasury-centralization piece. It kept its enforcement discretion in-house and turned the FinCEN consultation question into an open comment item rather than a rule. The real question the comment file will decide is whether the Fed follows its peers into a FinCEN-consultation regime or preserves the operational independence that Section 8(s) gives it.

Read that against Barr's dissent and the split sharpens. Barr warned that the "significant or systemic" standard "may have unknown effects on the Board's ability to effectively substantiate that a supervised institution establishes and maintains AML and CFT programs in compliance with the rule," adding that it is critical for the Federal Reserve to maintain a strong AML/CFT supervisory program. The Board voted 6-1 to issue the proposal, with Barr the sole dissent, and the move fits the supervisory agenda under Vice Chair for Supervision Michelle Bowman to concentrate examination work on risks that are material, quantifiable, and tied to financial performance. Barr, appointed by President Biden in 2022, held the supervision chair before Bowman and stepped down from that role at the end of February 2025. A lone dissent from the Board's former top supervisor does not stop a rule. It does flag the durability risk: an "undefined standard" is exactly the kind of language a future board, or a court, can reinterpret.

The Fed's own math tells the story

The Board frames the change as clarity, not relaxation, and its own analysis is candid about the direction of travel. The Board expects banks to recalibrate their programs to concentrate on higher-risk activities and deprioritize lower-risk activities, producing greater overall efficiency. On cost, its message to anyone expecting a compliance windfall is muted: it anticipates only minimal one-time adjustment costs and no increase in ongoing compliance costs, because most banks already maintain programs consistent with the proposed requirements. That is the quiet admission underneath the reform. If programs already clear the bar, the binding change is not what banks must build — it is what examiners may cite. This is a supervision rule wearing a compliance rule's clothes.

There is a genuine counterargument. The "isolated, technical, or immaterial" framing echoes the interagency enforcement posture the agencies articulated years ago, and the risk-focused examination approach has been formal policy since the 2019 joint statement; on that reading, the Fed is codifying practice, not inventing indulgence. What that misses is the shift from discretion to entitlement. A supervisory philosophy examiners "generally" follow is not a regulatory floor a bank can invoke to defeat an MRA. Once "significant or systemic" is a defined trigger in the CFR, every contested exam finding becomes an argument about which side of the line a deficiency sits on — and the burden of that argument has moved toward the examiner.

What to watch

The comment window is open and short: comments are due 60 days after publication in the Federal Register. Three items deserve targeted comment letters. First, Question 23 — whether the Board should adopt the FinCEN consultation and information-sharing provisions its peers proposed — is the single most consequential open question for Fed-supervised institutions, because it determines whether Treasury gets a seat at the table before a Board action. Second, the definition of "significant or systemic" is undefined by design; banks that want predictability should propose the criteria now rather than litigate them later. Third, the implementation runway: the Board proposes an effective date of 12 months from issuance of a final rule.

Two practical moves in the meantime. Shore up the establishment record — risk assessments, board or senior-management approval, the U.S.-located AML/CFT officer designation — because the safe harbor evaporates the moment a program is deemed unestablished, and a stale risk assessment is the easiest way to lose it. And document implementation decisions as risk-based choices, not gaps: the rule rewards the bank that can show a reasoned, current risk assessment behind its resource allocation. Note that stablecoin work sits outside this rule. The GENIUS Act, enacted July 18, 2025, requires permitted payment stablecoin issuers to maintain effective AML programs, but the Board states those PPSI standards will be addressed separately from this rulemaking.

Bottom line

The story is not that the Fed showed up late to a five-agency harmonization. It is that the Fed adopted the enforcement-threshold relaxation its peers wrote while declining, for now, to hand Treasury the consultation role they built — and did so over the recorded dissent of its former supervision chief. For BSA officers and general counsel at state member banks and holding companies, the near-term task is not rebuilding programs; it is preserving the establishment record that makes the new "significant or systemic" floor available, and using the comment window to shape a standard the Board deliberately left undefined.

Sources