Regulators Put Bank and FinTech AML Infrastructure on Notice

The proposal, issued jointly by the Federal Deposit Insurance Corporation (FDIC), National Credit Union Administration (NCUA) and the Office of the Comptroller of the Currency (OCC), aligns with Treasury Department’s Financial Crimes Enforcement Network (FinCEN) parallel rulemaking and implements changes required under the Anti-Money Laundering Act of 2020 as reported. It retains the core obligation that banks establish and maintain programs for AML and countering the financing of terrorism (CFT), while redefining how those programs are evaluated.

The reach is extensive. Regulators estimate that roughly 8,100 banks and credit unions fall within scope. Institutions are expected to adjust how resources are deployed, concentrating attention on higher-risk activity while reducing effort in lower-risk areas.

A deeper reading of the proposed rule-making reveals that the traditional structure of AML programs remains intact. Banks must maintain internal controls, independent testing, a designated compliance officer and ongoing training. What seems on a glide path for change is how those components must operate. Internal controls must be risk-based and “reasonably designed” to identify, assess and mitigate risks tied to customers, products and geographies.

Banks must also update programs as their business changes. A new product, a new customer segment or expansion into a new market requires a reassessment of risk and, where necessary, redesign of controls.

The agencies have opened a 60-day comment period and are seeking input on how effectiveness should be defined and measured. They have also indicated that banks may have up to 12 months to implement changes once a final rule is issued.

The questions posed to industry focus on practical issues. Regulators have inquired how banks allocate resources, how they distinguish between establishing and maintaining programs and how they determine whether a program is effective.

The Takeaways

As for the takeaways for traditional providers and FinTechs: Monitoring must be continuous. Risk assessment must reflect current activity across products, customers and geographies. Programs must be updated as those factors change.

The proposal requires AML programs to adjust as risk profiles change. Banks must reassess exposure when they introduce new products, expand into new geographies or serve new customer segments. Risk assessment becomes an ongoing process that informs how controls are designed and where resources are applied.

Regulators expect institutions to direct more attention to higher-risk activity and reduce effort where risk is lower.

The proposal supports the use of technology as part of AML programs. Banks may use tools such as APIs and digital identity solutions to improve monitoring and reporting, provided those tools are aligned with risk and implemented responsibly.

For FinTechs, the implications are direct. Firms must integrate with bank compliance systems and provide data that supports monitoring, customer due diligence and reporting. Technology becomes part of the compliance infrastructure.

The proposal sets a clear expectation for how programs will be evaluated.

An AML/CFT program must be implemented in all material respects and must support effective risk mitigation. Weaknesses that affect monitoring, data quality or risk assessment may draw supervisory attention.

The proposal describes a compliance model that operates continuously, relies on integrated technology and requires evidence that controls function.

Banks will need to align risk assessment, monitoring and reporting with day-to-day operations. FinTechs will need to ensure that their platforms support those requirements through data access and system integration.

The comment period will refine the details, but the technologically oriented direction of the rule is already established.