Potential AML program updates
The proposed rule will necessitate varying levels of program updates based on the type and complexity of each financial services organization. Some organizations will find the changes to be nominal, and others will be affected on a larger scale.
For example, banks and credit unions are accustomed to creating a risk assessment as part of the AML program. However, the AML program might not evaluate risks related to the governmentwide national priorities. Additionally, the proposed rule requires that AML risk assessments be revised whenever there are shifts in money laundering or terrorist financing threats that might result from changes in products, services, distribution methods, clientele, intermediaries, or geographic presence. AML and CFT risks might need to be fully reevaluated due to such changes, even outside of an organization’s existing risk assessment review cycle.
Although the proposed rule does not specify the frequency of updates, it does require consideration of several factors, including:
- The U.S. AML and CFT national priorities as released by FinCEN.
- The money laundering and terrorist financing risks of the organization based on periodic evaluations, including suspicious activity reports and currency transaction reports.
- A standardized need for board oversight and approval on AML and CFT programs. This requirement was previously variable depending on the type of organization and was not required for banks without a federal functional regulator and mutual funds.
Additionally, the proposed rule emphasizes modernization. Specifically, it urges financial services organizations to update their AML and CFT programs to address current and emerging risks and to qualitatively and quantitively assess various risk factors that affect their money laundering and terrorist financing exposures.
Modernization efforts can involve:
- Adopting new technologies
- Implementing agile processes
- Implementing best practices
- Collaborating with additional cross-functional stakeholders
- Developing or enhancing an organization’s culture of compliance
Quantitative assessment efforts can involve:
- Collecting and analyzing additional data
- Comparing and contrasting risk factors
- Identifying and prioritizing the most significant risk factors to the organization
How should organizations prepare?
If the rule is finalized as proposed, financial services organizations should anticipate greater regulatory expectations regarding their AML and CFT programs. Organizations might need to dedicate additional resources to developing robust risk assessment processes and enhance their compliance programs so that they are responsive to evolving risks, as these dynamic risk assessments must be the basis of AML and CFT programs. While this concept is not new for most financial services organizations, it will be critical for organizations to use data to quantify risk exposure in consideration of the governmentwide AML and CFT priorities and their relation to the inherent risks and characteristics of their organization’s products, services, customers, and geographic locations. Financial services organizations will also need to demonstrate how their risk assessments affect their policies, procedures, controls, and governance structures. FinCEN and other regulators will be able to enforce fines and penalties against financial services organizations with ineffective programs.
Some organizations might need to make operational adjustments to have a clearer understanding of the specific risk in each relevant area noted within the priorities. Compliance could involve revising current risk assessment frameworks, investing in new technologies, and enhancing staff training to provide a comprehensive understanding of the new requirements.
From a strategic standpoint, financial services organizations should consider incorporating the regulatory changes into their current BSA strategic compliance planning. Short-term changes might include risk assessment updates and policy reviews, while long-term goals might include budgeting for compliance-related expenditures and integrating risk management into broader business strategies. Such planning can help update policies and procedures and enhance the organization’s understanding of the new requirements ahead of implementation.
Additional steps to prepare for the potential rule change include:
- Conducting a gap analysis to identify areas of improvement or alignment
- Engaging with external stakeholders such as regulators, industry associations, and peers to share best practices and learn from their experiences
- Reviewing and updating customer due diligence and transaction monitoring processes to confirm they are risk based and aligned with the governmentwide AML and CFT priorities
- Establishing clear roles and responsibilities for the board of directors, senior management, and compliance staff in overseeing and implementing the AML and CFT programs
- Developing a communication and training plan to inform and educate employees, partners, and applicable stakeholders about changes and expectations
- Evaluating current risk assessment processes and defining tailored controls to assess unique risks
A proactive approach
FinCEN’s proposed rule is a significant step forward in the ongoing effort to strengthen financial crime prevention frameworks. By requiring more detailed and tailored risk assessments, the rule aims to enhance the effectiveness of AML and CFT programs across the financial sector. Organizations should proactively adapt to these changes to remain compliant and resilient against the evolving landscape of financial crime. Additionally, organizations should critically challenge their AML and CFT programs to effectively assess their risk.
