The U.S. Department of the Treasury’s Financial Crimes Enforcement Network issued a proposed rule intended to “fundamentally reform” financial institutions’ anti-money laundering and countering the financing of terrorism programs under the Bank Secrecy Act. The three key changes according to FinCEN:
- Reduce unnecessary regulatory burden by allowing financial institutions to focus their resources on higher risk areas in their AML/CFT programs.
- Elevate FinCEN’s role in the AML/CFT supervision process for banks to promote consistent, risk-focused supervision by bank examiners.
- Refocus financial institutions’ AML/CFT programs on effectiveness in combatting and preventing illicit finance activity, rather than mere technical compliance.
Those all sound more like goals than changes. It doesn’t tell us what the changes are. So it’ll take a deep diver into the notice of proposed rulemaking.
The first change is the name. It would officially change from Anti-money laundering program requirements” to “Anti-money laundering/countering the financing of terrorism program requirements”. Okay.
The second change is toward a principle-based approach. An institution is required to have an “effective” AML/CFT program. The proposed rule would provide that a financial institution has an “effective” program if it
“(1) is established in accordance with the proposed rule’s establishment requirements; and
(2) is maintained, meaning that a properly established program is implemented in all material respects.”
- The establishment of a program as four elements
- internal policies, procedures, and controls (including risk assessment processes);
- independent program testing;
- an individual, located in the United States and accessible to FinCEN and the Agencies, responsible for establishing and maintaining the program, and coordinating and monitoring day-to-day compliance; and
- ongoing employee training.
That all seems standard.
Then you have to “implement” the program. Do the things you say you’re supposed to do in the policies and procedures. Run risk assessments. Etc.
The proposed rule-making does lean into Artificial Intelligence (see page 32)
It’s too early to dive deep into the details for a compliance program. Who knows if this will move forward and if it does, what changes will happen.
If you’re a commentor, you’ve got 60 days to submit comments.
Sources: