FinCEN's proposed AML/CFT program rule, announced on 7 April 2026 and published in the Federal Register on 10 April, would replace the program requirements for money services businesses (MSBs) and other financial institutions with a common, risk-based standard. Programs would have to be effective, meaning both established and maintained. A documented risk assessment would become mandatory, the government's AML/CFT priorities would have to be incorporated as appropriate, and the AML/CFT officer would have to be located in the United States. Comments closed on 9 June 2026. As at November 2026 no final rule has been issued, and the proposal would take effect 12 months after one is.
For money transmitters, the current rule in 31 CFR 1022.210 still applies. But examiners already expect much of what the proposal describes, so preparing now improves the program under both. This article sets out a compliance plan.
Current rule and proposal compared
| Element | 31 CFR 1022.210 today | Proposed rule |
|---|---|---|
| Standard | Effective program commensurate with risks | Effective: established and maintained, with defined elements |
| Risk assessment | Implied by the risk-based standard | Required and documented; updated after significant changes |
| Priorities | Not referenced | AML/CFT priorities incorporated as appropriate |
| Officer | Person designated to assure compliance | AML/CFT officer located in the United States |
| Training | Required | Ongoing training |
| Independent review | Required | Retained; objective criteria and independence emphasised |
| Technology | Not addressed | Effective use of advanced tools weighed in enforcement decisions |
Building the risk assessment
The risk assessment is the centre of the proposed rule, and the place most programs need the most work. A structure that will stand up to examination covers five dimensions and scores inherent risk, controls and residual risk for each.
| Dimension | Questions to answer |
|---|---|
| Products and services | Which products allow fast, high-value or anonymous movement of funds? |
| Distribution channels | Online only, agents, partners, embedded finance, API clients? |
| Customers | Consumer or business, high-risk industries, politically exposed persons, nested MSBs? |
| Geographies | Send and receive corridors, high-risk jurisdictions, sanctions exposure? |
| Transactions | Volumes, values, velocity, cash intensity, crypto exposure? |
Link each identified risk to the AML/CFT priorities that FinCEN published in 2021: corruption, cybercrime, terrorist financing, fraud, transnational criminal organisation activity, drug trafficking, human trafficking and smuggling, and proliferation financing. Then show the controls that address it. The proposed rule requires the assessment to be updated promptly when the risk profile changes significantly, so set triggers: a new product, a new corridor, a new customer segment, a new agent network, an acquisition.
A good risk assessment is short enough to be read by the board and specific enough to drive decisions. It uses the firm's own data: transaction volumes by corridor, customer counts by risk rating, alert and SAR statistics, agent performance and the results of the last independent test. It explains the methodology so that an examiner can follow how ratings were reached, and it records the date, the approver and the next review. Avoid generic risk statements that could apply to any money transmitter; examiners read them as a sign that the assessment does not drive the program.
The US-located officer
The proposal requires the designated AML/CFT officer to be located in the United States, while allowing some functions to be carried out by staff outside it, including through third-party providers. For domestic money transmitters this changes little. For foreign-located MSBs, and for groups that run compliance from abroad, it is significant.
Options include appointing a US-based officer for the existing entity, establishing a US subsidiary with its own program and officer, or using a qualified US-based individual supported by group compliance. Whichever is chosen, the officer needs the authority, independence and resources to run the program, and must be able to explain it to examiners. Senior US AML hires take months, and state regulators review the qualifications of compliance officers in licence applications and change filings.
Foreign-located MSBs
A foreign-located MSB that does business wholly or in substantial part in the United States is an MSB under FinCEN's rules. It must register, designate a US agent for service of process, keep records accessible in the US and maintain an AML program. Many payment, remittance and crypto firms based in the UK, the EU and Asia fall into this category because they serve US customers directly.
If the officer location requirement is finalised as proposed, these firms will need to decide how to meet it. Three questions shape the answer: how much US business the firm has and expects, whether it also needs state money transmitter licences, which bring their own compliance expectations, and whether its banking partners would prefer a US entity. A firm with a growing US business will often find that a US subsidiary with its own officer and program is simpler to run and easier to explain to banks and regulators than a foreign entity with a US-based officer.
Effective in practice: what examiners will test
| Area | Evidence of an effective program |
|---|---|
| Monitoring | Scenarios mapped to the risk assessment; tuning documented; alert backlogs controlled |
| SARs | Timely filing, quality narratives, decisions not to file documented |
| Customer due diligence | Risk ratings that drive enhanced measures for higher-risk customers |
| Agents | Oversight based on risk data, with action taken on findings |
| Sanctions | Screening coverage, list updates, true match handling |
| Information requests | Prompt responses to 314(a) and law enforcement requests |
| Testing | Independent reviewer with no conflicts; findings tracked to closure |
The proposal also says FinCEN would consider the effective use of AI and other advanced tools, and participation in information sharing, when deciding on enforcement. Document how models are validated, tuned and governed so the benefit can be shown. The same applies to rules-based systems: keep records of the scenarios in use, the thresholds, the reasons for changes and the results of below-the-line testing. A firm that can show it tuned its monitoring to reduce false positives while keeping coverage of its highest risks will be well placed under the new standard.
Crypto and stablecoin businesses
Convertible virtual currency businesses that FinCEN treats as money transmitters are MSBs and fall within the proposal. Their risk assessments need to cover risks specific to digital assets: mixers and privacy tools, unhosted wallets, exposure to sanctioned addresses and high-risk exchanges, chain-hopping and the use of stablecoins for cross-border value transfer. Blockchain analytics should be reflected in the controls and in the validation work.
Payment stablecoin issuers will also have AML obligations under the GENIUS Act from 18 January 2027. Our guide to GENIUS Act foreign issuer registration covers that regime.
State examinations
State regulators examine money transmitters' BSA/AML programs as part of licensing supervision, often through coordinated multistate examinations. A new federal standard will shape those examinations as well. Licensees should expect the risk assessment to be requested at the start of every examination and used to scope the review. Our guide to money transmitter compliance requirements covers the wider state requirements, and our compliance calendar sets out the dates.
Independent testing
The proposal keeps the requirement for independent testing and places more emphasis on objective criteria and freedom from conflicts. For money transmitters, the independent review should test the risk assessment itself, not just the controls: whether its methodology is sound, whether its inputs are accurate and current, and whether controls actually follow from it. Reviewers should sample transactions and alerts, test monitoring scenarios against the risks identified, and check that previous findings were closed.
Choose a reviewer with money transmission and, where relevant, crypto experience, with no role in designing or running the program. Agree the scope with the officer and present the report to the board or a board committee, with management responses and dates. State examiners will ask for the latest report and the tracking of findings, so keep both in the examination readiness file.
A 120 day plan
| Days | Work | Output |
|---|---|---|
| 1 to 30 | Gap analysis against the proposal; inventory of products, channels, customers and corridors | Gap report |
| 31 to 60 | Rebuild the risk assessment and map controls to risks | Approved risk assessment |
| 61 to 90 | Recalibrate monitoring; update CDD risk rating; agent oversight plan | Revised procedures |
| 91 to 120 | Officer location decision; independent test scoped to the new standard; board briefing | Board paper and test plan |
Firms that complete this plan will be ready for the final rule and in a stronger position in examinations under the current one. Keep the plan under review as FinCEN moves towards a final rule: changes to the officer requirement or the definition of an effective program may adjust the work, but the risk assessment and the evidence of effectiveness will be needed whatever the final text says. Our financial crime team runs the gap analysis and risk assessment rebuild.