Federal: AFC Response to the Federal Reserve AML CFT Rulemaking

Benjamin W. McDonough
Secretary
Board of Governors of the Federal Reserve
20th Street and Constitution Avenue NW
Washington, DC 20551

Re: Response to Notice of Proposed Rulemaking Regarding Anti-Money Laundering and Countering the Financing of Terrorism Programs

Dear Secretary McDonough,

On behalf of the American Fintech Council (AFC),  the largest and most diverse trade association representing financial technology companies and innovative banks, I appreciate the opportunity to submit this comment letter in response to the Board of Governors of the Federal Reserve System’s (the “Federal Reserve” or “FRB”) proposed rulemaking regarding Anti-Money Laundering and Countering the Financing of Terrorism Programs (Proposed Rulemaking).

On behalf of more than 150 member companies and partners, AFC supports regulatory frameworks that promote responsible innovation, effective risk management, and operationally practicable compliance obligations while preserving the integrity and resiliency of the United States financial system. AFC’s membership spans banks, payments companies, fintech firms, money services businesses, lending platforms, infrastructure providers, and other participants operating throughout the modern financial services ecosystem. Collectively, AFC members possess substantial experience designing, implementing, and supporting Bank Secrecy Act (BSA) and Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) compliance programs across varied institutional structures, customer populations, technological architectures, and risk profiles.

AFC supports the FRB’s effort to modernize its AML/CFT program requirements and align them with the reforms contemplated by the Anti-Money Laundering Act of 2020. A supervisory framework that places greater emphasis on material illicit finance risk, institutional risk assessment, and the effectiveness of compliance outcomes can materially improve the allocation of compliance resources while strengthening the usefulness of information provided to law enforcement and national security agencies. The FRB’s recognition that banks are best positioned to understand their businesses and customer populations should guide the construction of a policy framework in which meaningful discretion in identifying risks and allocating resources, is given enough attention.

The effectiveness of this framework, however, will depend substantially upon how its principles are translated into examination and supervisory practice. A nominally risk-based regime can become functionally prescriptive if institutions remain compelled to defend reasonable judgments against hindsight-based examiner disagreement, continually refresh entire risk assessments in response to immaterial developments, or maintain duplicative processes primarily to demonstrate procedural compliance. Conversely, a framework grounded in materiality, proportionality, supervisory consistency, and meaningful deference to well-supported risk judgments can better direct institutional resources toward the financial crime risks of greatest consequence. Accordingly, AFC respectfully offers the following recommendations to strengthen the Proposed Rulemaking and to ensure that its modernization objectives are reflected consistently in implementation.

I. AFC Supports a Risk-Based and Outcomes-Oriented Supervisory Framework that Preserves Institutional Judgment and Focuses Supervisory Action on Material Compliance Failures

Effective AML/CFT supervision should primarily evaluate whether an institution has established a reasonably designed program, identified the illicit finance risks relevant to its operations, allocated resources in a manner consistent with those risks, and meaningfully implemented the resulting controls. It should not depend upon whether an examiner, reviewing the institution’s judgment after the fact, would have selected precisely the same monitoring threshold, testing frequency, resource allocation, or risk classification.

Accordingly, the Federal Reserve should consider recognizing this distinction by proposing that Board-supervised banks retain significant flexibility and discretion over risk identification and resource allocation and that examiners should not substitute their subjective judgment for a bank’s reasonable determinations. That principle should be carried expressly into the final rule, accompanying supervisory guidance, and examiner procedures. A risk-based framework cannot function as intended if regulated institutions perceive that exercising the discretion afforded by the regulation may itself become a source of examination criticism.

AFC therefore recommends that the FRB establish an express supervisory safe harbor for reasonable, good-faith, and adequately documented risk judgments. Where an institution reaches a determination that is supported by its risk assessment, reflects information reasonably available at the time, and is implemented through controls proportionate to the identified risk, the determination should not be criticized solely because an examiner might reasonably have reached a different conclusion. Such protection would not insulate deficient programs or disregard of known risks. Rather, it would distinguish legitimate exercises of risk-based judgment from failures to maintain effective controls and would reduce incentives for defensive compliance practices that consume resources without materially improving financial crime detection.

The Federal Reserve should similarly preserve and further clarify the proposed distinction between the establishment of an AML/CFT program and deficiencies in the implementation of an otherwise properly established program. Significant supervisory or enforcement consequences should be based solely upon implementation deficiencies, for failures that are significant or systemic and that result in a failure to implement the established program in all material respects. This materiality threshold is essential. Isolated documentation errors, discrete operational lapses, or individual control exceptions should not be treated as equivalent to systemic failures that materially compromise an institution’s ability to identify and mitigate illicit finance risk.

To reinforce that distinction, AFC recommends that the FRB clarify through regulation or supervisory guidance that a significant or systemic implementation failure constitutes deficient conduct that is pervasive, repeated, sustained, or sufficiently consequential to materially impair an essential element of the institution’s AML/CFT program. The presence of an individual error, an immaterial control deviation, or an isolated failure to follow an established procedure should not, standing alone, satisfy that threshold. The federal banking agencies have previously recognized that enforcement responses should distinguish between failures that warrant mandatory action and other deficiencies that may be appropriately addressed through the supervisory process.  A similar focus on materiality here would promote proportionate supervision and provide institutions with greater certainty regarding the consequences associated with different categories of deficiencies.

The same principle should govern evaluations of resource allocation. Compliance resources are finite, and a requirement to direct greater attention toward higher-risk customers and activities necessarily entails allocating comparatively fewer resources toward lower-risk areas. Examiners should therefore evaluate whether the methodology underlying resource allocation is reasonable and responsive to identified risk, rather than infer weakness merely because every portion of an AML/CFT program does not receive comparable staffing, monitoring intensity, or testing frequency. Genuine risk prioritization invariably produces differentiated treatment. Supervisory practice should affirmatively recognize that consequence rather than inadvertently penalize it.

II. AFC Supports Risk Assessment Requirements that Promote Targeted, Material, and Actionable Responses to Evolving Illicit Finance Risks

Risk assessment requirements should provide institutions with a disciplined mechanism for identifying and responding to meaningful changes in risk without converting continuous risk management into an obligation to repeatedly reconstruct an institution-wide assessment in response to isolated developments. Financial institutions regularly evaluate new customers, products, transaction patterns, geographic exposures, emerging typologies, changes in business strategy, and information received from regulators and law enforcement. These inputs do not invariably alter the institution’s overall risk profile, and the final rule should preserve institutions’ ability to determine when a development warrants targeted recalibration rather than wholesale reassessment.

The Federal Reserve should therefore adopt a materiality-based trigger for updating risk assessment processes. In particular, AFC recommends replacing the proposed requirement to update risk assessment processes when a bank knows or has reason to know of a change that “significantly changes” its money laundering, terrorist financing, or other illicit finance risks with a requirement tied to a change that “materially changes” those risks. A materiality standard would more clearly focus the obligation upon developments capable of affecting the institution’s risk conclusions, control environment, or allocation of compliance resources. It would also better distinguish consequential changes from routine fluctuations that institutions already address through ordinary monitoring and risk management.

Accordingly, the Federal Reserve should likewise clarify that the requirement to update a risk assessment “promptly” does not impose an inflexible number of days applicable to every institution or every factual circumstance. The appropriate period will depend upon the nature and severity of the development, the information required to validate its significance, the affected products and systems, the complexity of the institution, and whether interim controls have been implemented. A bank confronting an acute and confirmed illicit finance threat may reasonably be expected to act immediately, while a more complex or uncertain development may require analysis before an institution can responsibly determine its implications. The relevant supervisory inquiry should therefore be whether the institution responded within a reasonable period commensurate with the nature and materiality of the identified risk.

Relatedly, the FRB should make clear that an institution may update the portion of its risk assessment affected by a material development without reopening unrelated portions of the assessment absent a reasonable nexus between the change and those other risk categories. If, for example, a new payment product materially alters a particular transaction or customer risk, the institution should be able to reassess that exposure and corresponding controls without being compelled to reassess geographic, product, or customer risks that the development does not meaningfully affect. Permitting modular and targeted updates would better reflect how sophisticated risk management systems operate in practice and would reduce unnecessary documentation exercises.

The incorporation of national AML/CFT priorities should follow the same approach. National priorities provide important information regarding threats of particular concern to the United States, but they should function as relevant inputs to institution-specific risk assessments rather than as presumptive findings that every priority represents elevated risk for every institution. The final rule should clarify that an institution may determine, based upon its products, customers, geographic footprint, transaction activity, and other relevant characteristics, that a particular national priority presents limited or no material exposure to its operations. Requiring institutions to assign artificial significance to risks that have little connection to their activities would undermine the very prioritization the rule is intended to promote.

Greater transparency from the government would further enhance institutions’ ability to operationalize the national priorities effectively. AFC encourages the Federal Reserve, in coordination with the Financial Crimes Enforcement Network (FinCEN) and the other prudential regulators, to provide periodic typology information, threat indicators, and where feasible aggregated information regarding the investigative utility associated with suspicious activity reporting. Institutions can more effectively calibrate monitoring and investigative resources when they understand not only which threats have been designated as national priorities, but also which patterns of conduct and categories of reporting are producing meaningful value for law enforcement. Congress’s AML/CFT continued modernization reforms should proceed with substantial emphasis on improving coordination, information sharing, and the usefulness of information generated through the BSA framework. A more structured regulatory feedback loop would advance those objectives and allow regulated institutions to make more informed risk allocation decisions.

III. AFC Supports Operationally Practicable AML/CFT Requirements that Leverage Existing Compliance Infrastructure and Provide Sufficient Flexibility for Diverse Institutional Models

Modern financial institutions frequently operate integrated compliance environments in which AML/CFT monitoring, fraud prevention, customer due diligence, identity verification, sanctions screening, cybersecurity, transaction analysis, and investigative functions share data, technological infrastructure, personnel, governance processes, and third-party service providers. As such, the final rule should facilitate effective use of those existing capabilities rather than encourage institutions to establish parallel processes merely because individual regulatory requirements are described separately.

AFC therefore recommends that the FRB expressly recognize that institutions may satisfy the requirements of the final rule through integrated policies, controls, testing frameworks, governance structures, and technological systems where those arrangements adequately address the applicable AML/CFT risks. The relevant question should be whether a control is effective and appropriately governed, not whether an institution has created a separate process or document bearing a particular regulatory label. This approach would allow institutions to devote resources to improving substantive risk identification and mitigation rather than maintaining duplicative infrastructure.

That flexibility is particularly important for bank-fintech partnerships and other technology-enabled financial services models. Banks increasingly rely upon third parties for functions that may contribute to onboarding, customer verification, transaction monitoring, fraud detection, data analytics, customer servicing, and other components of the broader compliance environment. These arrangements do not diminish a supervised bank’s responsibility for its AML/CFT obligations, however the final rule should be interpreted in a manner that does not necessarily require every compliance function to be performed directly within the bank. The Federal Reserve’s existing third-party risk management framework recognizes that the structure and risk of third-party relationships differ and should be managed accordingly.  AML/CFT supervision should remain consistent with that principle.

The Federal Reserve should also preserve meaningful flexibility with respect to independent testing. Testing frequency, scope, methodology, and depth should be determined by the institution’s risk profile, the maturity and complexity of the relevant controls, prior testing results, changes in products or customer exposure, and identified deficiencies. An institution should not be expected to test every AML/CFT control at the same interval merely to demonstrate uniformity. Higher-risk areas, newly implemented systems, and controls subject to material remediation may warrant more frequent review, while stable and demonstrably lower-risk functions may appropriately receive less frequent testing.

Similarly, the independence requirement should not be implemented in a manner that unnecessarily restricts smaller institutions or institutions with specialized organizational structures from using qualified personnel or shared resources. The Federal Reserve has previously recognized that banks may share BSA resources where appropriate, including through collaborative arrangements that can reduce costs and increase access to specialized expertise.  The final framework should preserve that flexibility, provided that the individuals performing the testing maintain functional independence from the activities under review and do not possess conflicts that compromise the objectivity of the assessment.

AFC further supports the Federal Reserve’s proposed 12-month period between issuance of a final rule and its effective date. Twelve months should serve as the minimum implementation period, particularly if the final rule or accompanying guidance materially alters expectations beyond those reflected in the proposal. Institutions will need sufficient time to assess the final requirements, determine necessary changes to risk assessment methodologies and governance processes, update policies and procedures, modify technology and monitoring systems where appropriate, coordinate with third-party providers, conduct training, complete validation and testing, and obtain required internal approvals. A truncated implementation schedule could encourage rushed procedural changes rather than thoughtful integration into existing risk management systems.

The FRB should also coordinate the implementation date and supervisory transition period with FinCEN, the Office of the Currency of the Comptroller, the Federal Deposit Insurance Corporation, and the National Credit Union Administration to the greatest extent practicable. Substantially aligned regulatory text will yield limited benefit if institutions are required to implement materially similar requirements on different schedules or confront differing supervisory interpretations during the transition. Coordinated implementation guidance and an initial period emphasizing good-faith compliance and remediation would materially reduce unnecessary operational uncertainty.

IV. AFC Supports Technology-Neutral Supervisory Standards and Clear Regulatory Pathways for Innovative Compliance Technologies that Strengthen Financial Crime Detection

Technological capability has become an integral component to effective AML/CFT compliance. Artificial intelligence, machine learning, network analytics, automated transaction monitoring, identity verification tools, and other advanced systems can allow institutions to identify suspicious patterns across substantial volumes of data, improve investigative prioritization, reduce false positives, and detect relationships that may not be apparent through traditional manual or rules-based processes. As such, the ultimate supervisory framework should facilitate responsible use of these technologies where they improve risk management rather than inadvertently preserve legacy methodologies through uncertain or inconsistent examination expectations.

AFC recommends that the FRB expressly state that institutions may use innovative and automated technologies to perform AML/CFT functions when those systems are reasonably designed, appropriately governed, and commensurate with the institution’s risk profile. Supervisory evaluations should focus upon whether the technology produces effective and reliable compliance outcomes, whether institutions understand material limitations, and whether appropriate controls exist for the risks actually presented by the technology. They should not depend upon adherence to a preferred technological architecture or assumption that manual review is inherently superior to automated analysis.

The Federal Reserve has recently reinforced this principles-based approach in its revised interagency model risk management guidance, which recognizes that model risk management practices should vary according to an institution’s specific risk profile and model usage.  AML/CFT examination practices should be aligned with that framework. Institutions should not face inconsistent expectations in which the FRB encourages proportionate and principles-based technology governance in one supervisory context while examination teams apply more rigid or outdated standards to the same technology when deployed within AML/CFT compliance.

The Federal Reserve should also provide greater clarity regarding supervisory expectations for the validation, governance, monitoring, and documentation of emerging AML/CFT technologies. Regulatory uncertainty can itself discourage responsible deployment because institutions may retain less effective legacy systems rather than assume the examination risk associated with adopting a demonstrably superior but novel solution. Guidance should distinguish between the controls necessary to understand and manage a technology’s material risks and documentation requirements that add little substantive value. This is particularly important as financial crime methodologies and transactional systems evolve rapidly.

Examiner education should accompany that guidance. Effective evaluation of advanced analytics, machine learning, automated monitoring, and other emerging compliance technologies requires supervisory personnel to understand both their capabilities and limitations.  As a result, AFC encourages the Federal Reserve to establish recurring examiner training and interagency calibration processes focused specifically on new AML/CFT technologies and their governance. Such training would reduce the likelihood that novel systems are evaluated through assumptions developed for legacy manual processes and would promote greater consistency among Federal Reserve examination teams.

More broadly, principles-based supervision can effectively bolster the mechanisms that constrain unwarranted variation in how those principles are applied. As such, AFC encourages the Federal Reserve to use documented examination procedures, illustrative fact patterns, periodic calibration among Reserve Banks and other federal regulators, supervisory review of materially inconsistent findings, and transparent escalation mechanisms to promote consistency. The Federal Reserve’s modernization objectives will be realized only if institutions experience the risk-based framework in examination practice as well as in regulatory text.

* * *

AFC appreciates the Federal Reserve's efforts to modernize its AML/CFT program requirements and to better align supervision with material risk and effective compliance outcomes. A well-calibrated framework can strengthen protections against illicit finance while allowing institutions to direct compliance resources toward areas of greatest risk and regulatory value.

As the Federal Reserve finalizes its rulemaking, AFC respectfully encourages it to preserve institutional discretion, maintain clear materiality standards, provide workable risk assessment requirements, and support the responsible use of innovative compliance technologies. These principles would help ensure that modernization improves AML/CFT effectiveness without creating unnecessary procedural complexity. In pursuit of these efforts, AFC remains ready to serve as a resource to the Federal Reserve and to support the development of a modernized AML/CFT supervisory framework that is effective, risk-based, and responsive to the evolving financial services landscape.

Sincerely,

Ian P. Moloney
Chief Policy Officer
American Fintech Council

[1] American Fintech Council’s (AFC) membership spans banks, non-bank lenders, payments providers, EWA providers, loan servicers, credit bureaus, and personal financial management companies.
[2] Board of Governors of the Federal Reserve System, “Anti-Money Laundering and Countering the Financing of Terrorism Programs,” Federal Register 91, no. 130 (July 9, 2026): 42363, https://www.federalregister.gov/documents/2026/07/09/2026-13919/anti-money-laundering-and-countering-the-financing-of-terrorism-programs.
[3] Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, National Credit Union Administration, and Office of the Comptroller of the Currency, Joint Statement on Enforcement of Bank Secrecy Act/Anti-Money Laundering Requirements (August 13, 2020), https://www.federalreserve.gov/newsevents/pressreleases/files/bcreg20200813a1.pdf.
[4] Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, and Office of the Comptroller of the Currency, Interagency Guidance on Third-Party Relationships: Risk Management (June 6, 2023), Federal Reserve Regulatory Service.
[5] Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, Financial Crimes Enforcement Network, National Credit Union Administration, and Office of the Comptroller of the Currency, Interagency Statement on Sharing Bank Secrecy Act Resources (October 3, 2018), https://www.federalreserve.gov/newsevents/pressreleases/files/bcreg20181003a1.pdf.
[6] Board of Governors of the Federal Reserve System, Revised Guidance on Model Risk Management, SR Letter 26-2 (April 17, 2026), https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm.
‍
‍