Effectiveness, Innovation, and the Limits of Flexibility
Risk-based AML/CFT programs in banking are easiest to misunderstand at the point where flexibility begins. This chapter tests a practical question: when does a bank’s different approach show sound judgment, and when does it conceal a design or implementation failure? The answer requires comparing more than the presence of formal controls. It requires asking whether the program was reasonably designed for the bank’s risks, kept current, materially put into operation, and supported by evidence.
The distinction matters because a thinner program is not automatically a better one. Nor is a longer checklist automatically safer. A bank may have many controls that are poorly connected to its exposure, or fewer controls that are well matched to a narrow and understood risk profile. The meaningful comparison is between a program that can explain and act on risk and one that merely displays compliance activity.
Effective means designed and materially used
The Federal Reserve’s July 2026 notice of proposed rulemaking offers a useful legal and supervisory framework for this comparison, but its status must be kept clear. It is a proposal for banks supervised by the Board, not a final rule or a general safe harbor. The proposal would treat an AML/CFT program as effective only when two conditions are met: the bank establishes it in accordance with the proposed requirements and maintains it by implementing the properly established program in all material respects.
“Establishing” concerns design. For a Board-supervised bank, the proposed design would include a risk-based set of internal policies, procedures, and controls reasonably designed to identify, assess, and document ML/TF risks, mitigate them consistently with the assessment, conduct ongoing customer due diligence, provide independent testing, designate an AML/CFT officer, and maintain ongoing employee training. The proposal also connects the design to the bank’s risk-assessment processes and its allocation of attention and resources.
“Maintaining” concerns operation. Once the bank has established a program, it must implement that program in practice. The distinction separates a problem in the design from a failure to carry out a design that was otherwise adequate. It does not make the distinction between paper and practice a loophole. A bank cannot adopt the right words, appoint a responsible officer, and then treat the program as effective while its material controls are ignored or unable to address the risks the bank knows it faces.
This two-part view is more informative than asking whether a program is simply compliant or noncompliant. Consider two different findings. In the first, a bank’s risk assessment never considered a material activity, so the controls were incomplete by design. In the second, the assessment recognized the activity and required monitoring, but warnings were repeatedly ignored or the monitoring system failed to cover a material volume or type of transaction. The first problem points toward a design gap; the second points toward implementation or resource failure. Both can matter, but the response should address the right cause.
The proposal identifies several ways a bank might discover implementation concerns: independent testing, examiner observations, management information and related reports, or issues identified by personnel who operate the AML/CFT program. Resource problems can also become part of the failure. If a bank’s controls require timely review but staffing or systems are inadequate and the bank knows of the problem without addressing it, the issue is not simply that an employee missed a task.