On 7 April 2026, FinCEN issued a Notice of Proposed Rulemaking that would replace decades of process-driven Bank Secrecy Act examination with an effectiveness-based standard. Programmes would no longer be judged mainly on whether policies, a compliance officer and a training plan exist on paper. Examiners would ask whether a programme's transaction monitoring rules actually surface activity that matters to law enforcement, or whether they mostly generate alerts nobody acts on.
For compliance teams, that reframes transaction monitoring from a documentation exercise into an evidence exercise. This article sets out what the NPRM actually proposes, why the shift matters operationally, and what a monitoring programme needs to demonstrate under the new standard, whatever form the final rule takes.
What FinCEN's proposed rule actually changes
The NPRM supersedes FinCEN's narrower July 2024 proposal and implements provisions of the Anti-Money Laundering Act of 2020 directing FinCEN to modernise BSA programme requirements. Its core mechanism is a two-pronged framework that separates programme establishment (having the required policies, risk assessment and governance in place) from programme implementation (whether those elements function as intended day to day).
Under the proposal, enforcement would generally be reserved for significant or systemic implementation failures rather than isolated technical gaps, and a roughly 12-month implementation window is proposed after any final rule. FinCEN, the federal banking regulators and the NCUA requested comment on the NPRM through 9 June 2026. As of this writing the rule remains a proposal, not final law, so organisations should treat the direction of travel as clear while the specific text is still subject to change.
Why transaction monitoring sits at the centre of this shift
Transaction monitoring is where 'effective' and 'exists on paper' diverge most visibly. A bank can have a fully documented monitoring programme, an approved scenario library and a trained team, and still generate thousands of low-value alerts that never translate into a useful Suspicious Activity Report. FinCEN's framing asks directly whether monitoring rules are calibrated to the institution's actual customer base and risk profile, or copied from an industry template.
In practice this means examiners are likely to press on calibration methodology, alert disposition rationale, and whether a programme can show it has tuned scenarios in response to new typologies or persistent false positives, not just that a scenario library exists.
The enforcement backdrop compliance teams should know
This proposal is not arriving in a vacuum. On 6 March 2026, FinCEN entered a consent order imposing an $80 million civil penalty on a global broker-dealer, at the time the largest BSA enforcement action ever brought against a broker-dealer, over an alleged failure to implement an effective AML programme between 2018 and 2024. FinCEN found that at least 160 suspicious activity reports went unfiled and that, until late 2021, only four employees, none with prior AML experience, reviewed reports covering millions of line items a year.
That record did not stand for long. On 3 August 2026, FinCEN announced a $125 million penalty against another broker-dealer for a repeat BSA failure, the largest broker-dealer BSA penalty to date. Both actions cited the same underlying gaps: monitoring not tailored to the business, insufficient staffing and expertise, and weak customer due diligence on high-risk accounts. Both the SEC's 2026 examination priorities and FINRA's 2026 Annual Regulatory Oversight Report flag the same themes, including omnibus account risk and inadequate tailoring of AML programmes to business models.
What compliance teams should do while the rule is pending
Firms do not need to wait for a final rule to start closing the gap between having a monitoring programme and being able to prove it works. A practical starting point is documenting why each scenario and threshold was set the way it was, tied to the institution's own customer and product risk profile rather than a vendor default. A second is strengthening the audit trail behind alert closures, so an examiner (or FinCEN, under the proposed framework) can reconstruct the reasoning, not just the outcome.
A third is periodic, documented tuning: removing rules that reliably produce noise and adding coverage for typologies the institution has not previously modelled. None of this requires the final rule text to be settled. It is also, not incidentally, the same evidence base that supports a defensible response if a regulator asks the institution to show its monitoring is more than a checkbox.
