Industry
Banking
Banking Services Transformation: Unlocking Exponential Value
Highlights
- FinCEN’s April 2026 proposal places greater emphasis on AML program effectiveness, distinguishing significant or systemic failures from immaterial deficiencies and providing greater discretion in allocating resources based on risk.
- AML modernisation should focus on improving risk coverage and control effectiveness, not simply accelerating existing processes. Data quality, technology, analytics, and AI all have an important role, provided they improve the institution’s ability to identify and manage financial crime risks.
- Mature AML programs often accumulate layers of controls over time. We outline an approach that could give institutions greater flexibility to reassess legacy controls, challenge activities that contribute little to managing material risk and redirect resources toward areas of higher risk.
On this page
Is your risk management strategy really working?
When talking about anti-money laundering (AML), it won’t be wrong to say that mature AML programs can become weighed down by controls over time. Why? Because controls are much easier to add than to remove.
Most AML programs are not short of metrics. We typically measure alert volumes, investigation ageing, backlogs, review completion, quality results, suspicious activity report filings, staffing and training. These measures are important, but they mostly tell us if the predefined procedure was duly carried out rather than whether the underlying risk was effectively managed.
When a control fails, the root cause often lies beneath the visible control: data quality, lineage, mapping, system configuration, a business rule or an assumption that has not been revisited for years.
A customer review can be completed on time and still miss a meaningful change in ownership or activity. Transaction monitoring can meet every service-level target even when upstream transactions are missing. Sanctions screening can process millions of records successfully, while a critical data element remains incomplete.
Regulatory findings, changes in operating models, and newly identified risks – all lead to additional controls; procedures therefore keep growing. Extensive procedures and checklists make it easier to demonstrate that required controls were performed. Yet a less-than-perfect examination often results in another layer of testing or reporting. Each decision may have made perfect sense at the time. Years later, however, a financial institution may be performing thousands of control activities without an easy way to answer a basic question: which of them are actually mitigating AML risk?
The US Department of the Treasury's Financial Crimes Enforcement Network (FinCEN) seems to have challenged this now. Its April 2026 proposal, emphasising that AML programs should be effective, risk-based, and reasonably designed, was welcomed by some as relief from unnecessary work. At the same time, other compliance practitioners were unsure of what this would mean in practice. That question is still very much open.
FinCEN also draws a distinction between significant or systemic implementation failures and isolated technical or immaterial deficiencies. It expects institutions to direct resources toward higher-risk customers and activities, while proposing that examiners should not substitute their judgment for reasonable institutional decisions about how those resources are allocated.
There is nothing new about taking a risk-based approach to AML. What may be different is what an institution needs to demonstrate in line with this program. It may no longer be enough to show that a control exists, was performed on time, and that it produced the required evidence. The more important question now is whether that control adequately addressed the risk it was designed to manage.
Consider transaction monitoring. Alerts can be generated as expected and investigations can be completed within target timeframes. Quality assurance results can also be strong. Yet an upstream data mapping issue may mean that a certain number of transactions never entered monitoring at all. So, while every operational metric downstream can be green, the program can still have a serious issue. And there lies the effectiveness question.
From risk assessment to risk response
For decades, AML programs have operated on a risk-based approach, and financial institutions have prided themselves in having mature enterprise risk assessments covering products, customers, geographies, and other relevant risk factors. In practice, there often is a considerable gap between executing a risk assessment, identifying risks, and changing what the institution typically does to tackle it.
An effectiveness-based approach cannot sit within compliance alone. It requires a much clearer and solid connection with risk, process, data, and technology.
If a risk assessment identifies a certain customer segment as high risk, what changes? Does the institution implement different due diligence procedures? Does monitoring change? Are additional data sources considered? Are investigative resources redirected? Does management information show whether the risk is increasing or whether the controls are working?
Most mature risk assessments already show changes in risk and the resulting residual risk. The more difficult question is whether those findings consistently translate into changes in controls, monitoring, resources or other risk responses.
We outline an approach where this is particularly important because greater flexibility comes with greater reliance on institutional judgment. If examiners are expected to respect reasonable decisions about how resources are allocated, financial institutions will need to demonstrate the risk rationale behind those decisions and how they affect the program in practice.
This could also give AML leaders more room to challenge controls that consume significant resources but contribute relatively little to managing material risk.
This does not mean removing controls simply in the name of efficiency. It is about distinguishing between the controls that remain important because of the risk they manage and those that remain largely because they have always been there.
We may also need different measures, for example, information on whether monitoring covers the right activity, whether critical data is complete, or controls continue to perform as expected, and whether changes in risk are actually changing the way the overall program operates.
Modernising the right things, not just checking the boxes
As financial institutions accelerate investment in automation, analytics, and artificial intelligence, it becomes increasingly important to know what to modernise and when.
The potential is substantial as technology can reduce repetitive work, improve prioritisation, consolidate information for investigators, and help identify patterns that are difficult to detect manually. And that is, in addition to cost savings and speed that organisations already benefit from, thanks to technology.
If artificial intelligence (AI) can conduct an investigation in seconds, the quality and completeness of the underlying data become even more important. Technology can significantly improve a well-designed process, but it can also make a poorly designed process operate much faster.
But efficiency and effectiveness are distinct concepts for a reason. Let’s say a new solution reduces alert volumes by 40%, but what happened to the risk previously represented by those alerts?
Or if customer reviews are increasingly automated, is there confidence that the technology correctly identifies when human judgment is required?
For institutions already modernising their financial crime environments, this is the opportunity to take a broader look at the program before simply automating what exists today. Which risks matter most? Which controls genuinely address them? Where are people spending time without corresponding benefits? Where are data or technology limitations weakening otherwise robust controls?
Those questions bring compliance, operations, data, and technology together in the same conversation.
The last question before the final rule
As we know, FinCEN’s proposal is not final yet, however, financial institutions mustn’t wait for the final rule before closely looking at their risk programs through an ‘effectiveness’ lens.
Maybe it is a good idea to select key AML controls and ask:
- What specific risks are they intended to manage?
- What evidence shows that it is working?
- Has the risk changed since the control was designed?
- Is the effort devoted to it proportionate to the risk?
For some controls, the answers could be easy, but for others, it may be more difficult than expected, and this is already useful information.
The opportunity in FinCEN’s proposal is not simply to do less. It is to become much more deliberate about what we do, why we do it and how we know it works.
For institutions investing in AML modernisation, that distinction matters. Automating an existing process can improve productivity. Understanding the risk, designing the right controls, connecting the right data and then applying technology can improve the program itself.
While some of this may still seem abstract and the final rule may change, the effectiveness questions are worth asking now. How the regulators will apply this when they come to examine remains to be seen.