FinCEN's AML program rule 2026: what the proposal means for money services businesses and fintechs

By Harry Khan, Founder · Published 8 November 2026 · Last reviewed 8 November 2026

The short answer

On 7 April 2026 the Financial Crimes Enforcement Network (FinCEN) proposed the most significant change to anti-money laundering program rules in years. The proposal, published in the Federal Register on 10 April, would replace the current program rules for banks, money services businesses (MSBs), broker-dealers and casinos with a common, risk-based standard. Programs would need to be effective, meaning both established and maintained in a way that addresses the institution's actual risks.

For MSBs, including payment companies, remittance firms and crypto businesses registered with FinCEN, three changes matter most: a required risk assessment, an AML/CFT officer located in the United States, and an explicit link to the government's AML/CFT priorities. Comments closed on 9 June 2026. FinCEN has not yet issued a final rule, and the proposal would take effect 12 months after it does. Until then, the existing MSB rule in 31 CFR 1022.210 applies.

Who it covers

The proposal amends the program rules for several categories of financial institution and aligns them. MSBs registered with FinCEN are included: money transmitters, currency exchangers, check cashers, issuers and sellers of money orders and traveler's checks, prepaid access providers, and businesses dealing in convertible virtual currency that FinCEN treats as money transmitters.

Foreign-located MSBs that do business wholly or substantially in the United States are MSBs under FinCEN's rules, so the proposal reaches them too. That includes many non-US payment and crypto firms serving US customers. Our guide to FinCEN MSB registration covers who must register.

What would change

FinCEN also said it would weigh participation in information sharing and the effective use of AI and other advanced tools when deciding on enforcement. The aim is to shift effort from paperwork towards the activity that carries the most risk.

The word effective carries the weight. FinCEN's proposal defines an effective program as one that is both established, with the familiar internal controls, officer, training and independent testing, and maintained, meaning it operates in practice in line with the risk assessment. A firm with complete documents but controls that do not work as written would fall short, while a firm that focuses resources on its highest risks and can show results would be in a stronger position.

The risk assessment

The proposal would make a documented risk assessment a formal requirement. It must consider the institution's products and services, distribution channels, customers and geographic exposure, and draw on the government's AML/CFT priorities, which include corruption, cybercrime, terrorist financing, fraud, transnational criminal organisations, drug trafficking, human trafficking and proliferation financing. It must be updated promptly when the risk profile changes significantly, for example after a new product, new corridor or new customer segment.

Most well-run MSBs already prepare a risk assessment because state regulators and examiners ask for it. The difference is that it becomes the foundation of the program in law, and the rest of the program, including monitoring, customer due diligence and training, must follow from it. A risk assessment that sits in a drawer and does not drive controls would not meet the standard.

A US-located AML officer

The proposal requires the designated AML/CFT officer to be located in the United States. Certain functions can still be carried out by staff outside the US, including through third-party providers, but the accountable officer must be US-based.

This is the change with the biggest practical effect for foreign MSBs and for groups that run compliance from London, Dublin, Vilnius or Singapore. Many such firms appoint a group MLRO as the FinCEN compliance officer. If the rule is finalised as proposed, they will need a US-based officer, which can mean a hire, a relocation or a US subsidiary with its own compliance function. Recruitment for experienced US AML officers takes months, so firms should start planning now.

What examiners will look for

If the rule is finalised as proposed, examinations of MSBs by FinCEN, the IRS and state regulators will start from the risk assessment. Examiners will ask whether it reflects the firm's actual products, corridors and customer base, whether it was updated after significant changes, and whether controls follow from it. They will test whether transaction monitoring scenarios match the risks identified, whether high-risk customers receive more attention, and whether the firm can explain why lower-risk areas receive less.

Evidence of results will matter more than before: suspicious activity reports that are timely and useful, responses to information requests, and examples of risks identified and addressed. A program that generates paperwork but cannot show outcomes will be harder to defend.

Foreign MSBs and international groups

Many payment and crypto firms serving US customers are based outside the United States. Under FinCEN's rules, a foreign-located MSB doing business wholly or in substantial part in the US must register, appoint an agent for service of process in the US and maintain an AML program. The proposal would add the requirement that the AML/CFT officer be located in the US.

For international groups, the practical choices are to appoint a US-based officer for the foreign entity, to move US business into a US subsidiary with its own officer and program, or, for some, to reduce US activity. Each has consequences for state licensing, banking relationships and cost. Groups considering a US subsidiary should also consider the state money transmitter licences it will need, which take longer than FinCEN registration.

Crypto businesses

Exchanges, wallet providers and other convertible virtual currency businesses that FinCEN treats as money transmitters are MSBs and are covered by the proposal. Their risk assessments will need to address the specific risks of digital assets: mixers and privacy tools, exposure to sanctioned addresses, high-risk jurisdictions, peer-to-peer activity and the use of stablecoins. The proposal's recognition of advanced tools in enforcement decisions is relevant here, because blockchain analytics are central to most crypto monitoring programs. Stablecoin issuers should also follow the GENIUS Act, which brings its own AML requirements; our guide to the GENIUS Act for foreign issuers covers that regime.

Timing

Banking regulators issued aligned proposals for the institutions they supervise on the same day. A final rule could change in response to comments, particularly on the officer location requirement, which drew attention from foreign firms.

Firms should not wait for the final rule to start. The risk assessment and the officer question both take months, and examiners already expect a documented, risk-based program under the current rule.

How this fits with state licensing

State regulators examine money transmitters' BSA/AML programs as part of licensing and multistate examinations. A change to the federal standard will flow through to those examinations. Firms licensed in states that have adopted the Money Transmission Modernization Act will see their AML programs reviewed through the same lens as the rest of their compliance. Our US money transmitter licence guide explains how state licensing and FinCEN registration fit together, and our article on the NMLS renewal for 2026 covers the year-end licensing calendar.

Agents and the program

Many MSBs operate through agents: retail locations that accept cash for remittance, sell prepaid products or cash checks. FinCEN's rules already require MSBs to have procedures for monitoring their agents and to keep a list of them, updated each January. Under a risk-based standard, agent oversight becomes part of the risk assessment: which agents handle the most volume, which are in high-risk areas, which show unusual patterns, and how often each is reviewed. MSBs with large agent networks should make sure their oversight program is driven by risk data rather than a fixed schedule, and that findings lead to training, restrictions or termination where needed.

What MSBs should do now

1. Refresh the risk assessment. Make it documented, structured around products, channels, customers and geographies, and linked to the AML/CFT priorities.
2. Map controls to risk. Show how each high risk identified is addressed by a control, and where resources are focused.
3. Plan the officer role. Decide whether the current officer can be US-based or whether a US appointment is needed, and budget for it.
4. Review the independent test. Check the reviewer's independence and that the scope covers the risk assessment and its link to controls.
5. Record the use of technology. Document how monitoring tools, including AI, are used and governed.
6. Brief the board. Explain the proposal, its likely timing and the plan.

How Buckingham Capital Consulting helps

We prepare FinCEN registrations and state money transmitter applications for payment, remittance and crypto firms, and build the AML/CFT programs examiners review, including risk assessments structured to the proposed rule. For non-US groups, we advise on the US compliance structure, including the US-based officer role. Our financial crime services cover the program from policy to testing.

Questions

Get in touch: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or [email protected].

This article is general information, not legal advice. Requirements change, and the regulator’s own publications take precedence.