Fed proposes risk-based BSA/AML program requirements for supervised banks
On July 7, the Fed proposed a rule that would require Board-supervised banks to establish and maintain effective, risk-based AML/CFT programs reasonably designed to identify, assess, and mitigate illicit finance risks under the BSA. The Fed did not join the joint NPRM issued on April 10 by the OCC, the FDIC, and the NCUA (previously covered by InfoBytes here) and is instead issuing its own proposed rule aiming to align its AML/CFT program requirements with those of FinCEN and the other agencies, implementing provisions of the Anti-Money Laundering Act of 2020 (AML Act). The proposal would apply to 858 Board-supervised institutions, including state member banks, “Edge and agreement” corporations, and certain branches and agencies of foreign banks operating in the United States.
Among other things, the proposed rule would: (i) require banks to develop risk assessment processes that incorporate FinCEN’s national AML/CFT Priorities and direct more attention and resources toward higher-risk customers and activities; (ii) add customer due diligence as an express component of the Board’s AML/CFT program rule, aligning with FinCEN’s existing requirements; (iii) require the designated AML/CFT officer to be located in the U.S. and accessible to regulators, consistent with a new requirement under the AML Act; (iv) expand approval options for a bank’s written AML/CFT program to include the board of directors, an equivalent governing body, or appropriate senior management; and (v) establish a two-pronged supervision and enforcement framework distinguishing between program “establishment” and program “maintenance,” under which significant supervisory or enforcement actions for implementation deficiencies would be limited to “significant or systemic” failures. The NPRM also encourages banks to evaluate innovative compliance approaches, such as machine learning, generative AI, digital identity tools, and blockchain analytics. The proposed effective date is 12 months from issuance of the final rule. Comments must be submitted by September 8.