Most AML compliance programs have all the parts. There is a policy, a named officer, a training log and an audit report from last year. Programs get into trouble when the parts don't connect: the risk assessment describes a business that has since launched two new products, the policy sets a threshold the monitoring system never adopted, and last year's audit findings are still open. Pull on one of those threads and the others usually come with it.
FinCEN now says this in writing. Its April 2026 proposed rule on AML/CFT programs says that merely designating an individual responsible for establishing and implementing the AML/CFT program, and having that individual establish internal policies, procedures, and controls, an employee training program, and an independent testing program, are not sufficient to satisfy the proposed rule's obligations for a financial institution to have an effective AML/CFT program. It is still a proposal, but the question it asks is the right one to put to any program today: is the program you wrote down the program you run?
This guide is for MLROs, BSA officers and heads of compliance at banks, payment firms, fintechs and other regulated firms who are building a program or rebuilding one before an exam. It covers what an AML compliance program has to contain, which components to get right first, how suspicious activity reporting and proportionality fit, and how to run your own gap assessment before an examiner does. It draws on the FATF Recommendations, the US program rules for banks (31 CFR 1020.210 and the OCC's 12 CFR 21.21), the US reporting rules, FinCEN's April 2026 proposed rule and the UK Money Laundering Regulations 2017, as they stood on October 19, 2026. It isn't legal advice, and the rules that apply to you depend on your jurisdiction and licence type.
Five checks to run on your own AML compliance program, in the order the rules put weight on them, before an examiner runs them for you.
An AML compliance program needs a documented risk assessment, policies, procedures and controls that follow it, a named officer with approval from the board or senior management, independent testing, training and customer due diligence, with suspicious activity reporting built in. In our reading of the rules, the parts to get right first are the risk assessment and whether the controls follow it and actually run, then ownership and whether the last testing findings were fixed. Run that trace yourself as a gap assessment before an examiner does.
The international baseline is Recommendation 18 of the FATF Recommendations. It says financial institutions should be required to implement programmes against money laundering and terrorist financing. Its interpretive note lists what those programs should include: internal policies, procedures and controls, including appropriate compliance management arrangements and adequate screening procedures to ensure high standards when hiring employees; an ongoing employee training programme; and an independent audit function to test the system. Compliance management arrangements should include the appointment of a compliance officer at the management level. The FATF also says the type and extent of measures should be appropriate having regard to the risk of money laundering and terrorist financing and the size of the business.
Recommendation 1 adds the piece that holds the rest together. Its interpretive note says financial institutions should be required to take appropriate steps to identify and assess their money laundering and terrorist financing risks, and to document those assessments so they can demonstrate their basis and keep them up to date. They should have policies, controls and procedures that enable them to manage and mitigate effectively the risks that have been identified, approved by senior management.
National rules put this into law in different words. In the United States, the bank program rule at 31 CFR 1020.210 requires, at a minimum, a system of internal controls to assure ongoing compliance, independent testing for compliance to be conducted by bank personnel or by an outside party, designation of an individual or individuals responsible for coordinating and monitoring day-to-day compliance, training for appropriate personnel, and appropriate risk-based procedures for conducting ongoing customer due diligence. Those five items are what US practitioners call the five pillars. They are US rules for banks: other countries organise the same ideas differently, and other US institution types have their own program rules.
In the United Kingdom, the Money Laundering Regulations 2017 spread the same ideas across several regulations. Regulation 18 says a relevant person must take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which its business is subject. Regulation 19 requires policies, controls and procedures to mitigate and manage effectively the risks identified in that risk assessment, approved by senior management. Regulation 21 covers the responsible officer, the nominated officer, employee screening and an independent audit function, and regulation 24 covers training.
| Component | FATF standard | United States (banks) | United Kingdom (MLR 2017) |
|---|---|---|---|
| Risk assessment | Identify, assess and document ML/TF risks (R.1) | Not a separate listed component today; the 2026 proposal would add one | Regulation 18, with a written record |
| Policies, procedures and controls | Internal policies, procedures and controls, approved by senior management | A system of internal controls | Regulation 19, approved by senior management |
| Responsible officer | Compliance officer at management level | Individual(s) coordinating day-to-day compliance | Board or senior management officer, plus a nominated officer (regulation 21) |
| Independent testing | Independent audit function to test the system | Independent testing by staff or an outside party | Independent audit function, where appropriate to size and nature (regulation 21) |
| Training | Ongoing employee training programme | Training for appropriate personnel | Regulation 24, with a written record |
| Customer due diligence | Recommendation 10 | Ongoing CDD, including beneficial owners | Part of the regulation 19 policies |
| Approval | Senior management | Board or equivalent body for banks without a federal functional regulator; otherwise the regulator's own rule, such as board approval for national banks | Senior management |
Other countries that follow the FATF standard map these components into their own laws and supervisor guidance, often with different names for the officer roles and different approval rules. If you operate in several countries, write down which rule each component answers to in each one. Our AML compliance guide covers how the program sits alongside monitoring, screening and reporting.
Examiners don't publish a single order of testing that applies everywhere, and every exam is scoped to the institution in front of it. The rules still put weight in predictable places, and a program built in the right order holds up better when someone starts sampling it. In our reading of the sources above, three things come first.
The first is the risk assessment, because everything else is supposed to follow from it. Under regulation 18, a UK firm must provide the risk assessment it has prepared, the information on which that risk assessment was based and any required record to its supervisory authority on request. If the risk assessment is out of date, the controls built on it are hard to defend, however well written they are.
The second is whether the controls follow that risk and actually run. FinCEN's proposal says a financial institution would be examined for whether it has implemented, in all material respects, its established AML/CFT program, including whether the financial institution is, in fact, allocating resources as contemplated in its established AML/CFT program. In other words, the exam would look at what the program does as well as what it says.
The third is ownership and follow-through: who approved the program, who runs it day to day, and what happened to the last set of independent testing findings. A program can have every document in place and still fail this test if nobody acted on what the last audit found.
Key insight: every component answers the same question in a different place. Does the program you wrote down match the program you run? A gap anywhere in the chain from risk to clause to control to evidence is the thread an examiner pulls.
The first figure shows how the components connect. The risk assessment sets the policies, procedures and controls, so each control answers a risk you have written down. The policies, procedures and controls run in day-to-day operations, where examiners sample the evidence. Training prepares the people who run day-to-day operations. Independent testing checks whether the policies, procedures and controls work as written. Findings from independent testing go to the board and senior management, who approve the program and track the fixes.
The rest of this guide takes each component in that order. If you want to prepare for the exam itself, including document requests and interviews, our BSA/AML exam preparation guide covers the logistics.
The risk assessment is the document that tells an examiner what your program is for. FATF says institutions should document their risk assessments so they can demonstrate their basis, and keep them up to date. The UK rules list the risk factors a firm must take into account, including factors relating to its customers, the countries or geographic areas in which it operates, its products or services, its transactions and its delivery channels. They also say that in deciding what steps are appropriate, the relevant person must take into account the size and nature of its business. A firm must keep an up-to-date record in writing of all the steps it has taken, unless its supervisory authority tells it in writing that such a record is not required.
The current US bank rule is different. It doesn't list a risk assessment as a separate component, though its ongoing customer due diligence procedures must include understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile. FinCEN's 2026 proposal would change that. It would require risk assessment processes that identify, assess, and document the financial institution's ML/TF risks, review and, as appropriate, incorporate the AML/CFT Priorities, and are updated promptly upon any change that the financial institution knows or has reason to know significantly changes the institution's ML/TF risks. The proposal says these processes need not be in the form of a singular risk assessment process. In our reading, for a bank that already keeps an institution-wide risk assessment, the proposal mainly raises the bar on keeping it current and linking it to how resources are spent.
The second figure shows what goes in and what comes out. Customers feed the risk assessment through the types of customer you take on and how they behave. Countries and geographic areas feed the risk assessment through where you operate and where your customers' money moves. Products, services and channels feed the risk assessment through what you sell and how customers reach you. The risk assessment drives control design and where you put staff and budget. A significant change, such as a new product or market, sends you back to the risk assessment before launch.
Four questions test whether a risk assessment will hold up:
The last point is where many programs fall down. A risk assessment that rates cross-border payments as high risk, followed by a monitoring setup with the same rules for every product, shows that the assessment didn't drive anything. FinCEN's proposal makes the same point from the other side: a failure to update the program to reflect significant changes to the institution's risk profile may result in the program no longer meeting the program establishment requirements.
The UK rules are the most explicit here. Under regulation 19, a firm must establish and maintain policies, controls and procedures to mitigate and manage effectively the risks of money laundering and terrorist financing identified in any risk assessment undertaken by the relevant person under regulation 18(1). It must regularly review and update them, and keep a written record of those policies, of changes made in review, and of the steps taken to communicate those policies, controls and procedures, or any changes to them, within the relevant person's business. The policies must include the monitoring and management of compliance with, and the internal communication of, such policies, controls and procedures.
FATF adds that institutions should be required to monitor the implementation of those controls and to enhance them, if necessary. In the US, the rule asks for a system of internal controls to assure ongoing compliance. The words differ, but all three expect the same chain: a written risk, a written rule that responds to it, a control that enforces the rule, and evidence that the control ran.
That chain breaks most often between the policy and the system. A policy says high risk customers are reviewed every year, but the review scheduler is set to every two. A threshold changes in the policy after a regulatory update, but the monitoring rule keeps the old number. Nobody intended the gap, and nobody can see it, because the policy lives in a document and the control lives in a configuration screen.
You can test this chain with a simple trace, and you should run it before anyone else does:
| Start from | Ask | Evidence that passes |
|---|---|---|
| A higher risk in the risk assessment | Which policy clause addresses it? | A clause that names the risk and the measure |
| That policy clause | Which control enforces it? | A live rule, workflow step or check, with its setting |
| That control | Did it run, and did it match the policy? | Logs or samples showing it ran with the policy's setting |
| A sample alert or case | Which clause is behind it? | A traceable link from the alert to the control and the clause |
| A policy change | When did the control change? | Dated versions of both, showing the control followed |
If you can't run the trace in both directions, from risk to evidence and from an alert back to the clause, you have found your first gap.
Illustrative scenario, not a customer result.
A mid-sized payments company operates under licences in more than one country. The company, its products and every detail below are invented to show the process, not drawn from a real case.
The company launches a cross-border payout product for small businesses and updates its AML policy so that payouts to higher risk corridors get enhanced review. Six months later the compliance officer starts preparing for a scheduled supervisory review.
Every set of rules puts a named person in charge of the day-to-day program. The US bank rule requires designation of an individual or individuals responsible for coordinating and monitoring day-to-day compliance. FATF says compliance management arrangements should include the appointment of a compliance officer at the management level. In the UK, where appropriate with regard to the size and nature of its business, a firm must appoint one individual who is a member of the board of directors (or if there is no board, of its equivalent management body) or of its senior management as the officer responsible for the relevant person's compliance with these Regulations. Separately, an individual in the relevant person's firm must be appointed as a nominated officer. Within 14 days of the appointment, the firm must tell its supervisory authority who was first appointed to each role, and of any later appointment.
If your firm calls the nominated officer the MLRO, or one person holds both roles, write that down, because an examiner will ask who holds which role.
Approval sits above the officer. The OCC's rule for national banks, 12 CFR 21.21, says the compliance program must be written, approved by the national bank's or savings association's board of directors, and reflected in the minutes of the national bank or savings association. For banks without a federal functional regulator, the FinCEN rule requires a program that is approved by the board of directors or, if the bank does not have a board of directors, an equivalent governing body within the bank. Those banks must also make a copy of the program available to FinCEN or its designee upon request. Banks that do have a federal functional regulator must comply with that regulator's own program rule. The UK rules and FATF ask for policies, controls and procedures approved by senior management. FinCEN's proposal would standardise this, requiring a written program to be approved by the financial institution's board of directors or an equivalent governing body within the financial institution, or appropriate senior management. It would also require the responsible individual to be located in the United States and accessible to, and subject to oversight and supervision by, FinCEN and its designee, including the appropriate Federal functional regulator.
The third figure shows how these roles fit together. The board or senior management approves the written program and receives reports on how it is working. The written program names the compliance officer who coordinates and monitors day-to-day compliance. Staff send internal disclosures to the nominated officer, who decides whether each one gives rise to knowledge or suspicion of money laundering or terrorist financing. The compliance officer reports to the board or senior management on how the controls are working. The independent audit sends its findings to the board or senior management without going through the compliance officer it tests.
Regulation 21 sets the nominated officer's duty: where a disclosure is made to the nominated officer, that officer must consider it and determine whether it gives rise to knowledge or suspicion, or reasonable grounds for knowledge or suspicion. The reporting lines for the compliance officer and the audit are a common design rather than a rule in the texts cited here, so check what your own supervisor expects. For UK electronic money issuers and payment service providers, regulation 21 goes further: the person who monitors compliance must provide information to senior management about the operation and effectiveness of its policies, controls and procedures whenever appropriate and at least annually.
An org chart alone doesn't prove ownership. If the officer can't say why a threshold is set where it is, or what the last audit found, the records and the person don't match, and that gap is hard to explain away. The AML program charter template gives you a structure for writing down scope, roles, reporting lines and approval in one place. Check its approval wording against your own rule, since some of the rules above accept senior management or an equivalent body rather than a board.
All three sets of rules require some form of independent test. The US bank rule allows independent testing for compliance to be conducted by bank personnel or by an outside party. FATF calls for an independent audit function to test the system. The UK rules are the most specific about what that function does. It has to examine and evaluate the adequacy and effectiveness of the policies, controls and procedures adopted by the relevant person to comply with the requirements of these Regulations. It has to make recommendations in relation to those policies, controls and procedures, and it has to monitor the relevant person's compliance with those recommendations. In the UK this applies where appropriate with regard to the size and nature of the business.
That last duty, monitoring whether the recommendations were followed, is the one that shows whether a program corrects itself. An independent test that found problems a year ago, with no evidence that anyone fixed them, suggests it doesn't. FinCEN's proposal puts it plainly: the independent AML/CFT program testing should be focused on whether the AML/CFT program is effective, and it should identify issues and areas for remediation accordingly.
None of the rules cited here sets a fixed testing frequency. Set yours from your risk assessment, write down why, and test sooner after a significant change.
The fourth figure shows the testing cycle. Each independent test produces findings with the evidence behind them. Each of the findings gets a remediation owner and a due date. The remediation owner closes the gap and asks for a retest. The retest result goes into the board report, so open findings stay visible until they are closed.
A useful independent test covers more than whether documents exist. It asks whether the policies and controls address the risks in the current risk assessment, and whether samples show the controls ran as written with the documented settings. It looks for policy clauses with no control behind them and controls with no clause. It checks that the last test's findings were closed with evidence of the fix, and that the tester is separate from the people who run the controls being tested.
Our independent testing control guide covers scope and common findings in more detail.
Training is the easiest component to evidence and one of the easiest to get wrong. The UK rules require that relevant employees are made aware of the law relating to money laundering and terrorist financing, and to the requirements of data protection, which are relevant to the implementation of these Regulations. They must be regularly given training in how to recognise and deal with transactions and other activities or situations which may be related to money laundering, terrorist financing or proliferation financing. The firm must maintain a record in writing of the measures taken, and in particular of the training given to its relevant employees. The US bank rule asks for training for appropriate personnel, and FATF asks for an ongoing employee training programme.
Completion records show that people sat the training. They don't show that the training matched their job or the current risks. A training plan holds up better under testing when it is tied to roles and to the risk assessment: the people who onboard business customers get trained on beneficial ownership and the higher risk sectors you named, and the people who clear alerts get trained on the typologies your monitoring is built for. When the risk assessment changes, the training content should change with it.
Hiring is part of the same component. FATF expects adequate screening procedures to ensure high standards when hiring employees. The UK rules require a firm, where appropriate to its size and nature, to carry out screening of relevant employees appointed by the relevant person, both before the appointment is made and during the course of the appointment.
Customer due diligence is usually built and tested as its own control, but it is part of the program. The US bank rule lists appropriate risk-based procedures for conducting ongoing customer due diligence as a program component. Those procedures include conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information. In the UK, the regulation 19 policies must cover customer due diligence (see regulations 27 to 38).
For the program, the question is whether due diligence follows the risk assessment. If the assessment names a higher risk customer type, the due diligence procedures should say what extra steps apply to it, and the customer files should show those steps were taken.
Reporting is where the program's output becomes visible to the authorities. In the US, 31 CFR 1020.320 says every bank shall file a report of any suspicious transaction relevant to a possible violation of law or regulation, and a transaction requires reporting if it involves or aggregates at least $5,000 and the bank knows, suspects, or has reason to suspect one of the listed conditions. A bank is required to file a SAR no later than 30 calendar days after the date of initial detection by the bank of facts that may constitute a basis for filing a SAR. Currency transaction reports are a separate, threshold-based duty: under 31 CFR 1010.311, a financial institution other than a casino files a report for each transaction in currency of more than $10,000, except as the rule provides. Structuring transactions to evade that reporting is prohibited under 31 CFR 1010.314, and it is something your monitoring should look for, not the same thing as filing a currency transaction report. For the program, test that each reporting duty has an owner, a procedure and a record of the decision behind every filing and every decision not to file. Our SAR filing control guide covers the workflow in more detail.
None of these rules asks a small firm to build a big bank's program. FATF ties the type and extent of measures to risk and the size of the business. In the UK, the steps for the risk assessment, the board-level compliance officer, employee screening and the independent audit function are all scaled to the size and nature of the business. The nominated officer is not optional. FinCEN's proposal goes further for small US banks: a community bank may determine, based on its risk assessment processes, that certain AML/CFT Priorities may not be applicable to its business activities, and it would then not be required to put attention or resources into risks for which it has no identified exposure.
Scaling down still needs a written reason. A fintech that decides it doesn't need a separate audit function, or a community bank that sets aside a priority, should be able to show the risk assessment that supports the decision. Payment firms and e-money issuers in the UK carry one extra duty: the regulation 21 requirement to report to senior management at least annually.
In April 2026, FinCEN published a proposed rule. In its own words, FinCEN is proposing a rule to fundamentally reform the requirements for financial institutions' anti-money laundering and countering the financing of terrorism (AML/CFT) programs. Comments closed on June 9, 2026, and on October 19, 2026 the Federal Register still lists it as a proposed rule. Until a final rule is published, the current program rules apply. Treat the proposal as a signal of direction, not as a new obligation.
Four parts of it matter for program design:
The proposal also quotes the Treasury Secretary's criticism that supervision of AML/CFT programs has too often involved a "zero-tolerance focus on process and documentation". Even if the final rule changes, that direction favours the programs that can show their risk assessment drives where their resources go.
A gap assessment asks the questions an examiner is likely to ask, before the examiner arrives. Run it against your own program at least once a year and after any significant change. Take the components in the order above, collect the evidence for each, and rate each one honestly.
| Component | Evidence to pull | Gap to look for |
|---|---|---|
| Risk assessment | Current assessment, its data, its date and its update triggers | Products, customers or countries missing; no link from ratings to controls |
| Policies and controls | Policy versions, control settings and change logs | Clauses with no control; controls with no clause; settings that differ from the policy |
| Ownership and approval | Approval records, minutes, role descriptions, notifications to supervisors | Approval older than the current policy; roles unclear; officer unable to explain settings |
| Independent testing | Last test report, findings log and retest evidence | Open findings past due; tester not independent; scope that skipped higher risks |
| Training | Training plan, role mapping and completion records | Content not tied to roles or current risks; new teams missing |
| Customer due diligence and reporting | Procedures, a sample of higher risk files and filing decisions | Extra steps in the policy that don't appear in the files; filing decisions with no recorded reason |
| Management information | Reports to the board or senior management | No report since the last change; findings not visible |
Score each component, write down the evidence behind the score, and give every gap an owner and a date. The exam readiness scorecard gives you a quick first score in your browser. For the full exercise, the free exam-readiness self-assessment template is a spreadsheet that lets you rate each control domain Red, Amber, or Green; identify gaps; assign remediation owners; and track progress to closure.
Two rules make a gap assessment useful. Rate what you can prove, not what you believe happens, because an examiner will. Keep the results, too: a documented gap with an owner and a date is evidence that the program corrects itself, which is the opposite of a gap that was known and ignored.
The rules put the decisions with people. Senior management approves the policies, controls and procedures, and under the US bank rules cited here, the board or an equivalent body approves the program. A named officer runs the program day to day, and in the UK a nominated officer decides whether an internal disclosure gives rise to suspicion. The independent audit function tests the program and checks whether its recommendations were followed. Software can help with every step, but none of those decisions moves to a system.
The fifth figure shows where an AI agent layer fits. The written policy goes into the AI agent layer, which extracts rules and proposes a control for each one. The AI agent layer sends each proposed control to the compliance approver with the clause it came from. Only the compliance approver can put a control into live controls. The live controls write to the audit trail, which keeps policy and control versions together. The audit trail gives the independent tester and the examiner the clause behind any alert.
The written policy flows into an AI agent layer that extracts rules and proposes controls; a compliance approver decides what goes live; the audit trail lets testers and examiners trace any alert back to its clause. The approval, ownership and suspicion decisions stay with the people the rules name.
| Component | Responsibility | Boundary |
|---|---|---|
| Board or senior management | Approves the program and receives reports on it. | Doesn't decide individual alerts or cases. |
| Compliance officer (BSA officer) | Runs the program day to day, proposes changes and reports on it. | Doesn't approve their own program in place of the approval body. |
| Nominated officer (UK) | Decides whether an internal disclosure gives rise to knowledge or suspicion of money laundering or terrorist financing. | Doesn't own every control unless also appointed to that role. |
| Compliance approver | Decides which proposed controls go live and with what settings. | Doesn't change the risk appetite. |
| Business and operations teams | Run their controls and keep the evidence. | Don't grant exceptions to policy. |
| AI agent layer | Extracts rules, proposes controls, flags gaps and drift. | Doesn't approve controls, sign off the risk assessment or decide on suspicion. |
| Independent tester | Sets scope, reports findings and checks whether fixes worked. | Doesn't decide how gaps are fixed. |
The board or senior management approves the program, the compliance officer runs it, the nominated officer decides on suspicion, only a compliance approver puts a control live, autonomy is set by the customer, and any agent can be stopped with its kill switch.
Programmes against ML/TF; internal policies, procedures and controls; compliance officer at management level; employee screening; training; independent audit; documented, current risk assessment; senior management approval; proportionality.
International standard, October 2020 edition. OAS-hosted copy because fatf-gafi.org returned HTTP 403 to automated capture again on 2026-10-19; later FATF amendments were not checked. Byte-identical to the content-stage copy on 2026-10-19.
2026-10-19
Internal controls, independent testing, designated individual, training, ongoing CDD with customer risk profile; banks with a federal functional regulator also comply with that regulator's program rule; board or equivalent approval and a copy available to FinCEN on request for banks lacking a federal functional regulator.
United States banks; eCFR current text via the eCFR renderer API, retrieved 2026-10-19. Byte-identical to the content-stage copy on 2026-10-19.
2026-10-19
Written program approved by the board and reflected in the minutes; independent testing by staff or an outside party.
National banks and savings associations; eCFR current text via the eCFR renderer API, retrieved 2026-10-19. Byte-identical to the content-stage copy on 2026-10-19.
2026-10-19
Proposed risk assessment processes and Priorities review; establish versus implement; examination for implementation and resource allocation; testing focused on effectiveness; significant or systemic failures; US-located officer; approval options. Community bank Priorities point; Treasury Secretary quotation on zero-tolerance supervision.
PROPOSED RULE only. Comments closed June 9, 2026; Federal Register API still lists type "Proposed Rule" on 2026-10-19, and no final AML/CFT program rule appears in FinCEN Federal Register documents published since 2026-04-01. Not current law. GovInfo text byte-identical to the content-stage copy.
2026-10-19
Banks file reports of suspicious transactions relevant to a possible violation of law; reporting threshold of at least $5,000 with knowledge or suspicion; filing within 30 calendar days of initial detection; currency transaction reports for currency transactions over $10,000; structuring to evade currency reporting prohibited.
United States; eCFR current text via the eCFR renderer API, retrieved 2026-10-19 by the optimization stage (new sources added for the live post's SAR/CTR coverage).
2026-10-19
Risk assessment and written record; policies, controls and procedures approved by senior management; responsible officer, nominated officer, 14-day notification, employee screening, independent audit function; training and records. Nominated officer duty to determine whether a disclosure gives rise to suspicion (reg. 21(5)); annual reporting by e-money issuers and payment service providers (reg. 21(7)).
United Kingdom; legislation.gov.uk text captured with headless Chromium on 2026-10-19: regulation 18 up to date to changes in force on or before 16 October 2026, regulations 19, 21 and 24 to 19 October 2026, with future changes pending. Regulations 19, 21 and 24 are cited at their own URLs. Visible text identical to the content-stage capture.
2026-10-19
| Metric | Definition | Decision guardrail |
|---|---|---|
| Clause coverage | Share of policy clauses with a live control behind them. | Explain every uncovered clause. |
| Orphan controls | Live controls with no policy clause behind them. | Review each one; retire or document it. |
| Setting drift | Controls whose settings differ from the current policy. | Investigate every case. |
| Risk assessment age | Days since the last update, and launches since then. | Update before any launch goes live. |
| Overdue findings | Independent testing findings past their due date. | Report to the board or senior management. |
| Training coverage | Relevant staff trained on current content for their role. | Investigate any team below plan. |
Examiners test an AML compliance program as a working system. FATF asks for programs that include policies and controls, training and an independent audit, built on a documented risk assessment. The US and UK rules put those components into law in their own words, with named owners and approval above them. FinCEN's 2026 proposal, still a proposal, would make the US test of whether the program is implemented more explicit.
Build the risk assessment first, trace each risk through a clause to a live control, name the owners, and close your testing findings with evidence. Then run a gap assessment on your own program before an examiner runs one for you.
Under the FATF standard: a risk assessment, internal policies, procedures and controls with a compliance officer at management level, employee screening, ongoing training and an independent audit function. US banks must have internal controls, independent testing, a designated compliance individual, training and ongoing customer due diligence. In the UK, regulations 18 and 19 of the Money Laundering Regulations 2017 cover the risk assessment and the policies, controls and procedures, and regulations 21 and 24 cover the officers, employee screening, independent audit and training.
The current bank rule doesn't list it as a separate component, but ongoing customer due diligence includes developing a customer risk profile. FinCEN's 2026 proposal would make risk assessment processes an explicit requirement. FATF and the UK rules require one, and a documented assessment is the simplest way to show that your controls follow your risk.
It depends on the rule. National banks need board approval reflected in the minutes. Banks without a federal functional regulator need board or equivalent approval. In the UK and under FATF, senior management approves the policies, controls and procedures.
None of the rules cited here sets a fixed frequency. Set it from your risk assessment, write down the reason, and test sooner after a significant change. What matters is that findings are acted on: the UK rules require the audit function to monitor the relevant person's compliance with its recommendations.
The compliance officer is a board member or senior manager responsible for the firm's compliance with the regulations, where appropriate to its size and nature. The nominated officer receives internal disclosures and decides whether each one gives rise to knowledge or suspicion of money laundering or terrorist financing. One person can hold both roles, but the records should say so.
No. It was published as a proposed rule in April 2026, comments closed on June 9, 2026, and on October 19, 2026 it was still a proposed rule. The current program rules, including 31 CFR 1020.210 for banks, still apply.
They can do much of the preparation, but not the decisions. In FluxForce Policy and Compliance Management, the agent proposes controls and updates, and your compliance team approves every one before it goes live. Approving the program, signing off the risk assessment and deciding on suspicion stay with the people the rules name.