Is your anti-money laundering and countering the financing of terrorism (AML/CFT) program keeping up with your financial institution’s risk? Or is it still built around the organization you were a year ago?
Recent enforcement actions offer a timely reminder of why that question matters. Regulators found weaknesses at nearly every stage of the program, from the risk assessment at the front end to remediation at the back.
These compliance issues aren’t new or unusual, which is exactly why they deserve attention.
AML/CFT weaknesses take many forms and can have a cascading impact across your institution. Weak customer due diligence skews customer risk ratings, and inaccurate ratings throw off monitoring. Monitoring gaps then undermine suspicious activity reporting, while thin testing, staffing, and expertise enable all of it to continue.
Read together, the actions tell a bigger story: your AML/CFT program needs to reflect the risk you carry, and its pieces must work together.
Related: Learn how ERM software can help your organization better evaluate, measure, and report on AML/CFT risk.
5 Best Practices for Your AML/CFT Program
1. The risk assessment needs to describe the FI you run today
An accurate AML/CFT risk assessment should match the operations, products, and services your FI offers.
A recent action involved an assessment not tailored to the FI’s business, along with flaws in how AML risk was calculated for higher-risk relationships. Regulators were specific with the corrective requirements, noting that the assessment must cover products, services, customers, transaction types, geographies, business lines, affiliates, and shared services.
It’s not about whether the assessment has been reviewed and approved. The real test is whether it describes the business you operate today, and that means checking it against what is happening inside your organization:
- Are transaction volumes consistent with the risk you assigned?
- Are alerts concentrated in a segment you consider lower risk?
- Are suspicious activity reports (SARs) showing a pattern that the risk assessment doesn’t recognize?
- Has customer activity changed while the underlying risk rating has remained the same?
When the stated risk profile and actual activity begin telling different stories, that difference deserves attention.
Put it into practice: Compare your AML/CFT risk assessment with your FI’s current business and activity. Where the two don’t align, determine whether the risk conclusion, the controls, or both need another look.
Related: How to Create Dynamic BSA/AML/CFT Risk Assessments
2. Customer due diligence must produce an accurate picture of risk
Customer due diligence (CDD) gives every downstream control its starting point, so accuracy carries through the whole program.
Regulators identified weaknesses across customer identification, beneficial ownership information, ongoing and enhanced due diligence, customer risk ratings, and correspondent relationships. The findings also show how CDD weaknesses can undermine an organization’s ability to identify customer risk accurately and monitor activity effectively.
That leads to an important point: CDD can be completed and still be wrong.
Customer information, risk ratings, monitoring, investigations, and SAR reporting should work as connected parts of the AML/CFT program. If the customer risk profile is inaccurate at the start, that weakness carries into every control that depends on it.
Quality assurance should go beyond whether required fields are complete. Consider whether the information collected supports the assigned risk rating and whether higher-risk relationships are receiving appropriate enhanced due diligence as activity changes.
Put it into practice: Test the quality and outcome of your CDD process. Does the information in the file support the assigned risk and provide what is needed for effective ongoing monitoring?
3. Transaction monitoring and SAR Processes should reflect identified risks
Monitoring and SAR processes perform best when they trace back to the risks you identified.
The recent actions show continuing problems with suspicious activity monitoring, investigations, and reporting. Findings include weaknesses in monitoring scenarios and thresholds, data and system performance, alert investigations and backlogs, documentation, and timely, accurate SAR reporting. Regulators also required greater testing and validation of monitoring controls.
Monitoring scenarios, rules, thresholds, and coverage should connect to your products, customers, and geographies, and that information should flow in both directions.
Use SAR and alert history to test your assumptions
Filing patterns can provide useful information about where suspicious activity is occurring and whether existing risk assumptions still hold up. Alerts do the same. Concentrations involving specific products, customer or member types, locations, channels, or typologies may signal that something has changed.
Regulators are already treating it that way. One order required management reporting on SAR filing trends and alert and investigation volumes, and another found that management had received written reports showing missed SAR filings across several years.
Repeat patterns are also important. If the same weakness continues to surface after remediation, that raises questions about whether the underlying cause was addressed.
A strong program creates a feedback loop: the risk assessment helps determine what should be monitored, while monitoring and suspicious activity reporting provide information that determines whether the risk assessment remains accurate.
Put it into practice: Map significant AML/CFT risks to monitoring controls, then use alert and SAR activity to challenge whether the assumptions in the risk assessment continue to hold up.
Related: Leveraging Enforcement Actions to Strengthen Your Compliance Program
4. Resources, testing, and governance must match the risk
Policies and systems perform best when qualified people run them and when independent testing challenges them. Regulators cited inadequate staffing and expertise, weak training, and deficient independent testing and governance concerns, and called for stronger board and senior management oversight.
Resources should follow risk. If higher-risk customers, transaction activity, products, services, or geographies grow while AML/CFT resources stay essentially unchanged, management should be able to explain why current resources remain appropriate.
The same principle applies to independent testing, which should be scoped to your risk profile and able to find weaknesses in higher-risk areas. An October 2026 action linked ineffective independent testing to the failure to detect and remediate AML deficiencies on time.
Management and the board also need meaningful information about emerging risks, program performance, significant weaknesses, remediation, and resource needs.
Put it into practice: Make sure your FI’s staffing, expertise, training, independent testing, and oversight still match your AML/CFT program’s risks.
5. Fix the root cause before you close the finding
Remediation works when it removes the original weakness, and recent actions show how easily a closed finding comes back.
In addition to the October 2026 action highlighting failures to detect and remediate deficiencies, another program stayed deficient after making insufficient progress on weaknesses from an earlier order. One order ties compliance to results: the FI isn’t in compliance until corrective actions are effective, verified by the regulator, and sustained over time.
Effective remediation closes the findings loop. Identify the cause, correct it, test whether the correction works, and decide whether the issue changes your view of risk elsewhere in the program.
If the same weakness appears again, ask the harder question: did we fix the root cause, or did we close the finding?
Put it into practice: Before closing a significant AML/CFT issue, separate evidence that the corrective action was implemented from evidence that it works. Findings management software can help your FI track the steps you need to take with automated task reminders and notifications.
Related: Whitepaper: Best Practices for Tracking Audit & Exam Findings
What Makes an AML/CFT Risk Assessment Dynamic?
A dynamic AML/CFT risk assessment responds to changes in an organization’s business and actual activity. It connects risk conclusions to customer due diligence, monitoring, resources, testing, and corrective action, which is why risk assessments tie together many of the issues across these enforcement actions. An effective one shows where to put your resources, diligence, monitoring, and testing, and when a change in risk should change the program.
A dynamic risk assessment is:
- Linked to behavior. Start with your products, services, customers or members, and geography, then test that profile against transactions, alerts, SAR history, CDD results, and control performance. If actual activity tells a different story, investigate the difference.
- Triggered by change. Don’t rely on the annual review calendar. Set clear triggers for reassessing risk, such as a new product, geographic expansion, an M&A or charter change, a shift in customer mix, or a regulatory update. Advisories and enforcement activity count as intelligence, too. Not every change calls for a full redo, so build a process for deciding whether a change materially affects your risk.
- Supported by governance. When risk changes, management should be able to explain which controls change with it, such as staffing, monitoring, or testing. Findings should lead to action, and significant corrective actions should be validated for effectiveness.
Why AML/CFT best practices apply at every institution
It’s easy to read major enforcement actions and conclude that the lessons primarily apply to large, complex institutions, but they apply to all FIs, regardless of size.
At a smaller bank or credit union, a resource issue may be a BSA Officer balancing multiple responsibilities. Risk can change with a new product, a shift in member mix, geographic expansion, or a merger. Monitoring trouble can show up as growing alert backlogs or activity that no longer fits expected customer behavior.
The scale may differ, but the questions stay the same:
- Do you understand your risk?
- Do your controls address that risk?
- Can you demonstrate that those controls are working?
Terrorist financing belongs in the assessment too, scaled to your exposure. Regulators are already writing it into orders, alongside money laundering.
Frequently Asked Questions
What is an AML/CFT program?
An anti-money laundering and countering the financing of terrorism (AML/CFT) program is the set of policies, procedures, controls, and oversight an institution uses to identify and manage money laundering and terrorist financing risks and meet applicable obligations. This article focuses on how its risk assessment, due diligence, monitoring, testing, and remediation work together.
When should a bank update its AML/CFT risk assessment?
Revisit the assessment when changes in products, services, customers, geography, or activity could affect the bank’s risk profile. The FFIEC manual says there is no requirement to update the BSA/AML risk assessment on a continuous or specified periodic basis, but events such as new products, new customer types, or mergers and acquisitions can make an update necessary. Institution-specific orders may impose a schedule, so distinguish those requirements from general guidance and your own review policy.
That flexibility may not last. FinCEN’s April 2026 proposed AML/CFT program rule would require risk assessment processes to be updated promptly when an institution’s risk profile changes. It is still a proposal, so track its status in Ncomply and check whether your current review triggers would already meet that standard.
How can alert and SAR trends improve an AML/CFT risk assessment?
Alert and suspicious activity report (SAR) trends can help test whether risk ratings reflect actual activity. Review concentrations by product, customer segment, geography, or activity type, then investigate differences from the assessed risk. Interpret those trends alongside monitoring coverage, thresholds, and data quality; fewer alerts alone do not establish lower risk.
Turn Enforcement Findings into Control Questions
Use these enforcement actions as a starting point to challenge your own program. Some questions to get you started:
- Does our risk assessment reflect today’s business and activity, including affiliates, shared services, and third-party relationships?
- Do transactions, alerts, and SAR patterns support our risk conclusions?
- What triggers an evaluation between scheduled assessments?
- Does CDD produce reliable customer risk profiles, and does enhanced due diligence match our higher-risk relationships?
- Are monitoring scenarios and thresholds aligned with identified risks, and what do alert aging and backlogs tell us about control effectiveness?
- Are staffing, expertise, training, and technology aligned with assessed risk?
- Does independent testing reach our highest-risk areas?
- Are significant remediation items validated for effectiveness before closure?
A strong risk assessment connects these pieces. Know how to explain how you reached your risk conclusions and show that your resources and controls match them, and then make sure weaknesses lead to action.
Having an AML/CFT program is the baseline. The question is whether it’s keeping pace with the risks you carry today.
Building the case for a better risk assessment process? Download The Enterprise Risk Management Buyer’s Guide to see how centralizing your risk management processes can help.
