September 18, 2026

FinCEN Priorities in 2026: What Changed for AML Programs

Axle Team

Key takeaways

The eight AML/CFT national priorities FinCEN issued in June 2021 are still the list in 2026. FinCEN has not published a revised set.
What changed is the April 7, 2026 proposed AML/CFT program rule, which would make incorporating the priorities part of a mandatory risk assessment inside an effective, risk-based, reasonably designed program.
The proposal's center of gravity is resource allocation toward higher risk and limits on examiners substituting their judgment for yours. Documenting what you deprioritise will matter as much as what you escalate.
Comments closed June 9, 2026, with a proposed 12-month implementation period after a final rule. Mapping priorities to typologies, controls, and data fields is work you can start now.

FinCEN priorities 2026: what stayed the same

FinCEN's AML/CFT priorities in 2026 are the same eight issued on June 30, 2021: corruption, cybercrime, terrorist financing, fraud, transnational criminal organization activity, drug trafficking organization activity, human trafficking and smuggling, and proliferation financing. What changed is FinCEN's April 7, 2026 proposed rule, which would require institutions to incorporate these priorities into a mandatory risk assessment within an effective, risk-based program.

The priorities themselves were issued under the Anti-Money Laundering Act of 2020. The 2021 document lists them without ranking:

"the Priorities are, in no particular order: (1) corruption; (2) cybercrime, including relevant cybersecurity and virtual currency considerations; (3) foreign and domestic terrorist financing; (4) fraud; (5) transnational criminal organization activity; (6) drug trafficking organization activity; (7) human trafficking and human smuggling; and (8) proliferation financing"
— FinCEN, Anti-Money Laundering and Countering the Financing of Terrorism National Priorities, June 30, 2021

For five years the priorities have sat in an odd position. The statute required FinCEN to issue them, and it did, but the implementing regulations that would tell institutions how to use them never arrived. The 2021 document was explicit that the obligation was deferred:

"FinCEN recognizes that not every Priority will be relevant to every covered institution, but each covered institution should, upon the effective date of future regulations to be promulgated in connection with these Priorities, review and incorporate, as appropriate, each Priority based on the institution's broader risk-based AML program."
— FinCEN, AML/CFT National Priorities, June 30, 2021

Most programs responded by adding a section to the enterprise risk assessment that names the eight priorities and asserts coverage. Examiners generally accepted that. 2026 is the year that stops being enough.

What the April 2026 proposed rule changes

On April 7, 2026, FinCEN issued a notice of proposed rulemaking to reform AML/CFT program requirements across all covered financial institutions, with the FDIC, OCC, and NCUA proposing parallel amendments for their supervised institutions. The framing from Treasury was blunt:

"For too long, Washington has asked financial institutions to measure success by the volume of paperwork rather than their ability to stop illicit finance threats."
— Secretary of the Treasury Scott Bessent, quoted in FinCEN, FinCEN Proposes Rule to Fundamentally Reform Financial Institution Programs, April 7, 2026

FinCEN's release lists the reforms the proposal introduces. In its own words, the rule:

"refocuses compliance obligations and expectations on effectiveness by distinguishing between deficiencies stemming from program design and implementation"
"reinforces Treasury's belief that financial institutions are best positioned to identify and evaluate their illicit finance risks"
"empowers financial institutions to devote more attention and resources toward higher risks rather than toward lower risks"
"clarifies expectations related to certain program requirements and functions—including independent testing and audit functions—to ensure that examiners and auditors do not substitute their subjective judgment in place of financial institutions' risk-based and reasonably designed AML/CFT programs"
"affirms FinCEN's central role in AML/CFT supervision, including through the introduction of a notice and consultation framework between Federal banking supervisors and FinCEN with respect to significant AML/CFT supervisory actions"

The piece that touches the priorities directly is the risk assessment. Under the proposal, a risk assessment process becomes a required program component, and the national priorities are one of the inputs it must consider. That converts the 2021 "should, upon the effective date of future regulations" into an actual obligation once the rule is final.

Before and after, in practice

National priorities — How it worked through 2025: Referenced in risk assessment; no formal requirement. Under the proposed rule: Considered in a mandatory risk assessment process.
Risk assessment — How it worked through 2025: Expected by examiners, not an explicit program pillar. Under the proposed rule: Explicit minimum program component.
Resource allocation — How it worked through 2025: Coverage-driven; deprioritising anything felt risky. Under the proposed rule: Resources expected to follow higher risk; lower-risk effort can be reduced with documentation.
Deficiencies — How it worked through 2025: Design and implementation gaps treated similarly. Under the proposed rule: Distinguished; effectiveness is the test.
Independent testing — How it worked through 2025: Auditors and examiners often applied their own thresholds. Under the proposed rule: Not to substitute their judgment for the institution's risk-based program.

Comments were due June 9, 2026. FinCEN proposed a 12-month implementation period after a final rule. Check the Federal Register for the final rule's status before relying on any timeline; as of this writing the rule remains proposed.

Mapping the priorities into your risk assessment

Here is the test I use for whether a priority is genuinely incorporated rather than just named. For each of the eight, you should be able to point to at least one typology you have written down, one control (a scenario, a screening list, an EDD trigger) that targets it, and one data field you can query to measure exposure. If any leg is missing, the priority is a paragraph, not a control.

Fraud is the usual failure. It is on the list, every institution says it is relevant, and yet many transaction monitoring configurations cannot distinguish first-party fraud from a scam victim making authorized payments. Under a rule that asks whether your program is effective against your actual risks, that gap is visible.

A workable sequence:

Score relevance per priority using your customer base, products, and geographies. Write down why a priority is low-relevance if it is; that documentation is what lets you allocate away from it.
Inventory controls against each priority. Most programs discover heavy coverage on drug trafficking and structuring, light coverage on corruption and proliferation finance.
Check data sufficiency. Cybercrime and virtual-currency exposure in particular depend on fields (device data, VASP counterparty identification) that older stacks do not capture.
Rebalance investigative effort. If alert volume is dominated by low-relevance scenarios, the proposed rule gives you the language to tune them down, provided the risk assessment supports it.
Build the narrative for examiners. The rule asks examiners not to substitute their judgment for yours. That only helps if your judgment is written down.

The Axle AI readiness playbook includes a worksheet for step 2.

The model-risk angle nobody is talking about

Ten days after the FinCEN proposal, on April 17, 2026, the Federal Reserve, FDIC, and OCC issued revised supervisory guidance on model risk management. It narrows the definition of a model and states that the newest class of tools sits outside its scope:

"Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance. Nonetheless, a banking organization's risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document."
— Board of Governors of the Federal Reserve System, FDIC, and OCC, Supervisory Guidance on Model Risk Management (SR 26-2 attachment), April 17, 2026

Put the two April documents together. FinCEN wants effort concentrated on higher-risk activity tied to the priorities. The banking agencies are leaving governance of AI agents to institutions. The combined effect is that a BSA officer who uses agents to clear low-risk alert volume and redirect analysts toward priority typologies has regulatory room to do it, and full responsibility for documenting how. That is the trade-off: more freedom, more paper on your side of the desk.

This is the operating model Axle's agents are built for: working alerts and investigations across your existing systems with every step logged, so analysts spend their hours on the cases that map to your risk assessment. The ROI calculator lets you model the reallocation with your own volumes.

FAQ

Has FinCEN updated the national AML/CFT priorities for 2026?

No. The eight priorities published on June 30, 2021 remain current. The 2026 change is procedural: FinCEN's proposed program rule would require institutions to consider the priorities in a mandatory risk assessment process.

When does the FinCEN proposed AML program rule take effect?

It does not yet. The proposal was issued April 7, 2026, comments closed June 9, 2026, and FinCEN proposed a 12-month implementation period following issuance of a final rule. Confirm the current status in the Federal Register.

Do the FinCEN priorities apply to fintechs and crypto companies?

Yes, to any covered financial institution under the BSA, which includes money services businesses such as many fintechs and virtual asset businesses. FinCEN's 2021 document notes that not every priority will be relevant to every institution; relevance should be determined through the institution's own risk-based program.

Ready to redirect investigator hours toward the priorities that matter for your book? See how the Axle platform works.

FinCEN Priorities in 2026: What Changed for AML Programs

More from the blog