Federal Agencies Propose Shift to Risk-Based Anti-Money Laundering Rules for Banks

WASHINGTON — A group of federal financial regulators on July 19, 2024, issued a joint notice of proposed rulemaking that would significantly overhaul how banks and credit unions manage compliance with the Bank Secrecy Act (BSA). The proposal, released by the Federal Reserve, the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and the National Credit Union Administration (NCUA), aims to shift institutions from a procedural, checklist-based approach to a more flexible and effective risk-based framework for their anti-money laundering (AML) and countering the financing of terrorism (CFT) programs.

The proposed amendments are designed to align the agencies’ rules with concurrent changes being developed by the Financial Crimes Enforcement Network (FinCEN). This regulatory synchronization stems from mandates in the Anti-Money Laundering Act of 2020, which seeks to modernize the nation's framework for combating illicit finance. The core of the proposal is to encourage financial institutions to focus their resources on higher-risk activities and systemic vulnerabilities rather than on technical compliance that may not effectively thwart criminal activity.

From our perspective, while the goal of a more flexible, risk-based system is laudable, it introduces a new layer of subjectivity that could create challenges for small and mid-sized businesses. When banks are given more discretion to define 'risk,' it can lead to inconsistent standards and increased compliance demands on their customers. We anticipate that businesses in certain sectors, or those with complex international supply chains, may face more intensive scrutiny, additional documentation requests, and potentially longer waits for transaction approvals as banks adjust their internal models. This shift places a greater burden on companies to proactively demonstrate their low-risk profile to their financial partners.

Navigating these evolving banking requirements is a core component of financial risk management. At C&S Finance Group LLC, we help our clients build robust internal controls and documentation practices to ensure they can meet these heightened expectations seamlessly. For guidance on preparing your business for this new regulatory environment, contact C&S Finance Group LLC at csfinancegroup.com to learn how we can assist.

Under the proposed rule, banks would be required to establish, implement, and maintain AML/CFT programs that are not only risk-based but also “reasonably designed” to assure and monitor compliance with the BSA. This marks a departure from a more rigid system, giving banks greater leeway to calibrate their programs according to their specific risk profiles, size, and complexity. The proposal also formally adopts the term “AML/CFT program” to replace the narrower “BSA compliance program,” reflecting a broader scope that is consistent with international standards.

The regulators argue that this change will not impose a significant new financial burden on most institutions, particularly smaller community banks. According to analysis cited in the Federal Register, BSA compliance costs for small banks currently average about 2.2 percent of their noninterest expenses. The agencies, including the FDIC and OCC, contend that because the rule largely codifies and reinforces existing best practices, it is implausible that costs would increase to a level considered a significant economic impact, which they define as exceeding 2.5 percent of total non-interest expense.

However, the move toward a risk-based framework will necessitate a thorough review of internal policies and procedures for all financial institutions. The proposal clarifies that banks must maintain an “ongoing” employee training program, a requirement that the FDIC described as a technical clarification of a long-standing rule rather than a new mandate. The emphasis on a risk-based approach means that banks will need to be more sophisticated in how they assess and document customer risk.

For small and mid-sized businesses, this regulatory shift at the bank level will have tangible consequences. Banks will likely enhance their customer due diligence (CDD) and enhanced due diligence (EDD) procedures to align with their newly defined risk appetites. This could translate into more detailed questioning during the account opening process and requests for more comprehensive documentation for transactions that fall into categories banks deem higher-risk. According to the FFIEC's BSA/AML Examination Manual, customer types that may pose heightened risk include money services businesses, foreign correspondent accounts, and customers connected to politically exposed persons.

Businesses operating in these areas or engaging in frequent cross-border transactions may find their banking relationships become more complex. The flexibility afforded to banks under the new rule could also lead to a phenomenon known as “de-risking,” where financial institutions may choose to exit relationships with entire categories of customers or industries they perceive as too risky or costly to monitor, regardless of the legitimacy of individual businesses within that category.

The current proposal follows a previous Notice of Proposed Rulemaking from earlier in 2024. According to the agencies, public comments on that earlier version suggested it did not adequately emphasize the increased flexibility for banks to focus on high-risk activities. The new proposal was issued to specifically address those concerns and to more clearly empower banks to move away from a purely procedural compliance mindset.

The joint proposal is now open for a public comment period, after which the agencies will review the feedback before issuing a final rule. Financial institutions and their business customers should monitor these developments closely, as the final regulations will shape the banking compliance landscape for years to come and will likely require adjustments to internal processes and documentation for both banks and the businesses they serve.