AML Compliance Program Development is about much more than having the right policies on paper. A strong program should show that an institution understands its financial crime risks and has controls that address them effectively. Examiners may look at how those controls work across customers, products, transactions, technology, and governance. They may also examine what happens when a control fails and how quickly management responds. For that reason, the strongest programs connect risk assessment, monitoring, reporting, testing, and remediation in a practical and accountable way.
Recent U.S. regulatory developments reinforce this approach. In April 2026, federal banking agencies proposed changes that would place greater emphasis on risk-based AML/CFT programs and higher-risk customers and activities. The proposal also addresses AML/CFT officer responsibilities and customer due diligence. This means institutions need to show not only that their programs exist, but that they work as intended.
The Real Standard Is Risk Alignment, Not Policy Volume
A lengthy AML manual does not necessarily indicate a strong compliance program. Examiners want to understand whether documented controls correspond with the institution’s actual risk profile.
That assessment begins with products, services, customers, delivery channels, and geographic exposure. It should then explain how those risks influence customer due diligence, transaction monitoring, investigations, and reporting.
A mismatch can create immediate concerns. For example, a bank may classify correspondent banking as high risk while applying monitoring designed primarily for conventional retail accounts. The written risk assessment and operational controls would then tell different stories.
AML Program Pillars Need to Work as One System
The traditional AML program pillars remain the foundation of a sound BSA compliance program. They include internal controls, independent testing, a designated compliance officer, and employee training.
However, effective programs connect these pillars to risk assessment and customer due diligence. Internal controls should reflect identified risks. Training should address the responsibilities created by those controls. Independent testing should determine whether they actually work.
This integrated approach matters because examiners can evaluate the program as a whole rather than reviewing each component in isolation.
Risk Assessment Is the Document Examiners Read First
A strong risk assessment should explain how the institution identifies and evaluates money laundering, terrorist financing, and other illicit finance risks.
The OCC’s current examination procedures direct examiners to consider the institution’s products, services, customers, geographic locations, and changes to its business activities. Examiners also consider whether the assessment is updated when the risk profile changes.
That creates an important practical test: can management explain why each major control exists?
If the answer is unclear, the risk assessment may not be sufficiently connected to the operating program.
BSA Compliance Program Design Should Follow the Business
A BSA compliance program should reflect how an institution actually conducts business. New products, digital channels, payment services, foreign exposure, and changing customer segments can alter the institution’s risk profile.
Consequently, compliance teams should assess material business changes before implementation. They should determine whether customer due diligence, monitoring scenarios, staffing, training, and controls remain appropriate.
The objective is not to make every control equally restrictive. Risk-based supervision allows resources to be concentrated where exposure is greatest.
What Examiners Test Beyond the Written Policy
Examiners can move quickly from policy documents to operational evidence. They may review customer files, transaction monitoring alerts, suspicious activity investigations, SAR decisions, training records, independent testing, and management responses.
They can also examine previous findings and remediation evidence. A recurring deficiency may indicate that management addressed the symptom without fixing the underlying control weakness.
The OCC’s examination procedures specifically allow examiners to consider previous findings, independent testing, changes in risk profile, technology, and other information when determining examination scope.
The Controls That Usually Face the Hardest Questions
| Area | Questions Management Should Be Ready to Answer |
| Risk assessment | Does the assessment accurately reflect current products, customers, services, and geographic risks? |
| Customer due diligence | Can the institution demonstrate how customer risk is identified and updated? |
| Transaction monitoring | Are scenarios aligned with actual products, risks, and transaction behavior? |
| SAR processes | Are investigations timely, well documented, and appropriately escalated? |
| Governance | Does the BSA officer have sufficient authority, resources, and access to management? |
| Independent testing | Does testing identify meaningful weaknesses and verify remediation? |
These areas are interconnected. A weakness in one can affect the effectiveness of several others.
AML Program Requirements Are Becoming More Risk-Focused
The direction of regulatory change is important for program development. The April 2026 proposed AML/CFT rules would incorporate a risk assessment process and require consideration of national AML/CFT priorities.
The agencies also proposed requirements concerning customer due diligence and the role of the AML/CFT officer.
For compliance leaders, the practical implication is clear. Program documentation should explain how regulatory priorities translate into institution-specific risks and controls.
Transaction Monitoring Must Be Defensible
Transaction monitoring should not be judged by the number of alerts it generates. Its value depends on whether scenarios identify activity that is relevant to the institution’s actual risks.
Examiners can consider the technology supporting the BSA/AML program and determine whether additional testing is appropriate. They may also examine whether monitoring reflects changes in products, services, systems, and customer behavior.
Therefore, institutions should document scenario design, thresholds, tuning decisions, validation, and change management. A defensible monitoring program should make its logic understandable to both management and examiners.
Customer Due Diligence Is Where Risk Meets Reality
Customer due diligence transforms the risk assessment into customer-level decisions. Institutions need sufficient information to understand customer relationships and identify activity that may warrant additional review.
That information should remain useful throughout the relationship. Changes in ownership, business activity, transaction patterns, geography, or customer circumstances can affect risk.
A strong program therefore treats onboarding as the beginning of due diligence rather than its endpoint.
Independent Testing Should Challenge the Program
Independent testing should provide meaningful assurance rather than simply confirm that policies exist. Testing should examine whether controls operate as designed and whether they address material risks.
The scope should reflect the institution’s risk profile. Higher-risk activities may require deeper testing, while lower-risk areas may justify more limited procedures.
Importantly, testing should also evaluate remediation. A finding is not truly resolved merely because management has documented a corrective action.
Training Should Reflect Actual Responsibilities
Effective AML training is role-specific. Front-line staff, investigators, relationship managers, operations teams, and senior executives do not face identical responsibilities.
Training should therefore address the risks employees are expected to identify and the actions they must take. Records should demonstrate completion, while knowledge checks can provide additional evidence of understanding.
Examiners may also consider whether training remains appropriate when products, systems, responsibilities, or regulatory expectations change.
What Recent Regulatory Developments Tell Compliance Leaders
The OCC introduced new community bank examination procedures effective February 1, 2026. Those procedures emphasize examiner discretion and allow reliance on satisfactory independent testing in appropriate circumstances. They also allow examiners to determine whether transaction testing is necessary based on the institution’s risk profile.
This development reinforces an important point. A well-designed program does not need identical controls across every institution. It needs controls that are appropriate, documented, implemented, and supported by evidence.
The Strongest Programs Treat Remediation as Governance
Remediation should not sit quietly within the compliance department. Material findings can require involvement from senior management, technology teams, operations, legal, internal audit, and the board.
Each significant issue should have a clear owner and defined corrective action. Management should also establish a method for validating whether the correction actually resolved the problem.
That creates an important distinction between closing a finding and fixing a control.
Three Lessons From Major AML Failures
TD Bank: Growth Cannot Outrun the Control Framework
The 2024 TD Bank resolution remains a major example of the consequences associated with inadequate AML controls. The Justice Department stated that 92% of transaction volume went unmonitored between January 2018 and April 2024.
The case demonstrates why institutions must reassess controls when products, customers, and transaction volumes change significantly. Program development should keep pace with business growth rather than respond after regulatory intervention.
EagleBank: Escalation Must Lead to Action
The 2026 EagleBank enforcement matter highlights another governance lesson. Compliance concerns have limited value when identified risks do not receive effective management attention.
The practical takeaway is straightforward. Escalation procedures should define who receives material concerns, how decisions are documented, and when issues move to senior management or the board.
UBS Financial Services: Repeat Issues Carry Greater Weight
FinCEN’s August 2026 action against UBS Financial Services resulted in a $125 million civil money penalty. FinCEN described the action as its largest penalty against a broker-dealer for BSA violations.
The broader lesson is the importance of sustainable remediation. Institutions should not assume that previously identified weaknesses disappear simply because corrective actions were recorded.
Clearing Up Common Questions About AML Programs
What Are the Pillars of an AML Compliance Program?
The core AML program pillars are internal controls, independent testing, a designated compliance officer, and employee training. Effective programs also integrate risk assessment, customer due diligence, monitoring, reporting, and governance.
What Are the Main AML Program Requirements?
AML program requirements vary by institution and applicable regulations. They generally include risk-based controls, customer identification, customer due diligence, suspicious activity reporting, independent testing, compliance leadership, and employee training.
What Do AML Examiners Test?
Examiners can assess risk assessments, customer files, transaction monitoring, suspicious activity investigations, SAR processes, training, independent testing, governance, technology, and remediation. The examination scope can vary according to institutional risk.
How Often Should an AML Risk Assessment Be Updated?
There is no single update interval appropriate for every institution. The assessment should be reviewed when material changes affect products, customers, services, geography, technology, or other risk factors.
Key Takeaways
AML Compliance Program Development should produce a program that can withstand operational testing, not simply document regulatory requirements.
The AML program pillars provide the foundation, but their effectiveness depends on integration. A strong BSA compliance program connects risk assessment with customer due diligence, monitoring, reporting, training, testing, and governance.
Meanwhile, AML program requirements continue to emphasize risk-based implementation. Regulatory developments in 2026 make it increasingly important for institutions to demonstrate why their controls are appropriate.
The most valuable preparation is therefore practical. Test the controls before an examiner tests them. Compare the written program with actual practices. Review previous findings, challenge remediation, and confirm that monitoring reflects current business risks.
That is the standard a mature compliance function should aim for: a program that is defensible on paper, effective in operation, and capable of demonstrating its value under examination.
