WASHINGTON — The Financial Crimes Enforcement Network said Wednesday that a significant overhaul of the nation’s anti-money-laundering regulatory framework is in the works.
In an advance notice of proposed rulemaking, Fincen said it plans to firm up the definition of an “effective and reasonably designed” AML compliance program, something the regulator said had “no specific, consistent definition in existing regulation.”
Fincen's stated goal is to “ensure that the [Bank Secrecy Act’s] AML regime adapts to address the evolving threats of illicit finance … while simultaneously providing financial institutions with additional flexibility in addressing these threats,” the notice said.
It outlines three core components of defining “effective and reasonably designed” under a new regulatory framework:
- Whether a program “identifies, assesses, and reasonably mitigates the risks resulting from illicit financial activity.”
- How well a program “assures and monitors compliance” with BSA reporting requirements.
- And whether that program provides useful information based on “the institution’s risk assessment and the risks communicated by relevant government authorities.”
One of the most significant changes under consideration involves the role of institutional risk assessments in designing AML programs. Fincen asked whether it should formally mandate such assessments and if doing so would create an undue burden for financial institutions.
“Even though a financial institution’s risk-assessment process is key to ensuring an effective AML program, it is not an explicit regulatory requirement for all types of institutions,” Fincen wrote, adding that such an evaluation could consider an institution’s “business activities, products, services, customers and geographic locations in which the financial institution does business or services customers.”
Fincen also asked the public whether “any regulatory changes” were necessary to better reflect the variety of business models and risk profiles among financial institutions.
“For example, should regulatory amendments to incorporate the requirement for an ‘effective and reasonably designed’ AML program be proposed for all financial institutions within each industry type,” the notice said, “or should this requirement differ based on the size or operational complexity of these financial institutions, or some other factors?”
Moreover, Fincen is mulling whether it should play a more active role in guiding the priorities of financial institutions with AML compliance requirements. According to the regulatory filing, it's considering a national bulletin called Fincen’s “Strategic Anti-Money Laundering Priorities,” to signal the highest-risk areas in AML/ BSA compliance. It would be updated every two years.
“Fincen does not expect that its Strategic AML Priorities would capture the universe of all AML priorities, nor would they be intended to serve as the only priorities informing a risk-assessment process,” the agency wrote. “Rather, they would seek to articulate Fincen’s existing AML priorities, informed by a wide range of government and private-sector stakeholders.”
Fincen said that such a bulletin could also highlight “emerging risks and provide red flags and typologies that assist financial institutions in identifying and reporting suspicious activity.”
Fincen is seeking feedback on how best to “articulate objective criteria and/or a rubric for independent testing of how financial institutions would conduct their risk-assessment processes and report in accordance with those assessments,” according to its regulatory filing.
Such a move toward objective measures of effectiveness would likely be cheered by many financial institutions, some of which have complained for years about the
Braddock Stevenson, counsel at O’Melveny & Myers and a former deputy of Fincen’s enforcement division, said in an email that it has historically been “very difficult to quantify and define ‘effectiveness,' ” but that “this [advance notice of proposed rulemaking] represents a crucial step forward in implementing an actual solution.”
“Without a method to quantify or define ‘effectiveness,’ these efforts would really become a question of who can tell their regulator the best ‘compliance program’ story,” Stevenson said.
