2026 U.S. AML/CFT Regulatory Developments Tracker

Table of Contents

• The Rule Landscape at a Glance
  • AML/CFT Program Modernization
  • Corporate Transparency Act and Beneficial Ownership
  • Investment Adviser AML Rule
  • Residential Real Estate Rule
  • GENIUS Act and Payment Stablecoin Issuers
• The National AML/CFT Priorities
• Beyond the Rules: Treasury Advisories, Alerts, and Orders
• On the Horizon: AMLA 2020 Rulemaking and Potential New Covered Entities
• Rule Readiness Checklist
• How BDO Can Help

What has changed, what is paused, and what to do now

A guide and readiness checklist for BSA-covered institutions, investment advisers, permitted payment stablecoin issuers, and certain real estate closing and settlement professionals. Current as of August 2026.

U.S. regulation related to anti-money laundering (AML) and countering the financing of terrorism (CFT) is in a period of rapid change. Rather than moving in a single direction, the United States is doing several things at once. It is modernizing and streamlining core Bank Secrecy Act requirements, pausing or litigating certain rules that were on the verge of taking effect, extending obligations to new types of businesses such as payment stablecoin issuers, and issuing a steady stream of advisories, orders, and other actions that shape day-to-day compliance. The Treasury Secretary has characterized the shift away from "the volume of paperwork" toward the ability to "stop illicit finance threats."¹

For compliance officers, boards, and business owners, the central question is no longer simply when a deadline falls. It is which obligations are in force today, which are on hold, which are expanding, and which could change on short notice. This tracker brings those developments together and discusses the major rule changes, recent Treasury and FinCEN advisories and orders, and proposals still on the horizon and then provides a consolidated self-assessment checklist that may be used to identify gaps before they become findings.

Much of the activity in this tracker implements parts of the Anti-Money Laundering Act of 2020 (AMLA), which became law on January 1, 2021. The AMLA is the most consequential reform of the Bank Secrecy Act since the USA PATRIOT Act of 2001.^2,3

The Rule Landscape at a Glance

See 'Beyond the rules' and 'On the horizon' for recent advisories, orders, and proposals.

1. AML/CFT Program Modernization

What Changed

On April 7, 2026, the Financial Crimes Enforcement Network (FinCEN) issued a proposed rule to fundamentally reform financial institutions’ AML/CFT programs under the Bank Secrecy Act.⁵ The proposal fully supersedes and withdraws FinCEN’s earlier July 2024 proposal, resetting the modernization effort.

The following are some of the key changes:

• Risk assessment becomes an explicit program requirement. For the first time, conducting a documented money laundering and terrorist financing risk assessment is written into the rule itself rather than left to examiner expectation. FinCEN incorporates it within the internal policies, procedures, and controls pillar. This represents a change from the July 2024 proposal, which would have established risk assessment as a standalone “sixth pillar.” The practical effect is that a program cannot be considered compliant if it is missing a defensible risk assessment.
• A genuine shift toward higher-risk customers and activities, rather than a check-the-box approach. The rule requires programs to be risk-based, directing more attention and resources toward higher-risk customers and activities consistent with the institution’s risk profile. Conversely, firms are expected to apply lighter, proportionate treatment to demonstrably lower-risk relationships rather than applying equal effort to every customer and account. Uniform controls applied without regard to risk become more difficult to defend.
• A U.S.-based AML compliance officer is a named pillar. The proposal retains the core program pillars and specifies them as (1) internal policies, procedures, and controls, including the risk assessment process, (2) independent program testing, (3) designation of a U.S.-based compliance officer, and (4) ongoing employee training. The compliance officer residency requirement is deliberate. Day-to-day AML responsibility must rest with a person subject to U.S. oversight rather than being situated beyond the reach of regulators.
• The National AML/CFT Priorities become an express program requirement. Programs would be required to review and, as appropriate, incorporate the National Priorities into the risk assessment, tying enterprise risk directly to the threats FinCEN has identified (see the section on the National Priorities).
• A higher bar for enforcement. The rule would reserve enforcement and significant supervisory action for “significant or systemic” program failures rather than isolated, technical defects. This provides relief to firms with sound programs, though it is accompanied by a heightened expectation that the program be genuinely effective. 

Current Status

Proposed rule stage. The public comment period closed June 9, 2026. If finalized as drafted, the rule would take legal effect shortly after publication of the final rule, and institutions would have approximately 12 months from that point to come into compliance. FinCEN has not announced a target date for finalization.

The OCC, FDIC, and NCUA issued a single joint proposal to keep their bank program rules aligned with FinCEN’s.⁶ The Federal Reserve did not join that proposal. It issued its own notice of proposed rulemaking on July 7, 2026, with comments due September 8, 2026.⁷ The Board’s proposal departs from the joint proposal in two respects that matter for supervised institutions: it omits the requirement that an agency notify and consult FinCEN 30 days before initiating a significant AML/CFT supervisory action, and it omits the confidential supervisory information sharing authorization. Depository institutions should track both proposals.⁸

What it Means for You

• Treat your AML/CFT risk assessment as the foundation of your compliance program. It should remain current, evidence-based, and explicitly tiered by risk, as it now drives both compliance and how examiners assess effectiveness. While the AML/CFT risk assessment takes on increased prominence, institutions must not neglect the separate risk assessment expectations that are foundational for a risk-based sanctions compliance program.⁹
• Reallocate effort toward higher-risk customers and typologies and be prepared to justify reduced procedures for lower-risk relationships. A uniform approach applied equally to all customers is no longer defensible.
• Confirm that the AML compliance officer is U.S.-based with genuine authority and resources, and that board oversight is documented.
• The approximately 12-month period following finalization is limited for firms that have allowed risk assessments and other compliance program requirements to falter. The interval before the final rule takes effect should be used to close those gaps.

Key Dates

2. Corporate Transparency Act and Beneficial Ownership

What Changed

Under FinCEN’s interim final rule published March 26, 2025, all entities created in the United States, including their beneficial owners, fall outside the definition of “reporting company” and have no obligation to file beneficial ownership information (BOI) with FinCEN (the “domestic exemption”) under the Corporate Transparency Act (CTA). Only entities formed abroad and registered to do business in the U.S. remain “reporting companies,” and even those covered entities are not required to report U.S. persons as beneficial owners.¹⁰

Current Status

On August 11, 2026, FinCEN issued a final rule making these exemptions permanent and broadening them in three specific respects: 

• Foreign entities registered in the United States no longer report the beneficial ownership information of U.S. person beneficial owners or U.S. person company applicants; 
• U.S. persons who obtained a FinCEN identifier no longer need to update or correct that information; and 
• Foreign pooled investment vehicles do not need to report U.S. persons who control them. 

The rule takes effect on publication in the Federal Register.¹¹ FinCEN has stated that it will delete U.S. person information it reasonably believes it has already collected, though it has not published a completion timeline. Foreign reporting companies must still report the beneficial ownership information of their non-U.S. individual owners, and entities registering on or after March 26, 2025, must file within 30 calendar days of registration. Separately, the Eleventh Circuit upheld the constitutionality of the CTA in December 2025.¹² None of this affects the separate Customer Due Diligence Rule at 31 C.F.R. 1010.230, which continues to require covered financial institutions to identify and verify the beneficial owners of their legal entity customers.¹³

What it Means for You

• The exemption for U.S. entities and U.S. persons is now permanent under the final rule, and FinCEN has said it will delete U.S.-person information already collected. U.S. filers do not need to take further action to have data removed.
• Foreign reporting companies and cross-border ownership chains remain the principal area of ongoing risk. You should confirm whether any entity meets the “foreign reporting company” test as reporting obligations still exist for non-U.S. individual owners.
• State-level transparency regimes operate independently of the federal rule and may still apply. New York’s LLC Transparency Act took effect January 1, 2026. Because it incorporates the federal “reporting company” definition, its reach is now limited to LLCs formed outside the United States, and even exempt companies must affirmatively file an attestation of exemption. Other states, including California, are advancing comparable legislation.¹⁴

Key Dates

3. Investment Adviser AML Rule

What Changed

The Investment Adviser AML Rule was originally scheduled to take effect on January 1, 2026.¹⁵ FinCEN announced on December 31, 2025, that the rule would be delayed until January 1, 2028.¹⁶ The rule amends the Bank Secrecy Act’s definition of “financial institution” to include certain registered investment advisers (RIAs) and exempt reporting advisers (ERAs), subjecting them to full AML/CFT program requirements, including suspicious activity report (SAR) filing obligations.¹⁷

Current Status

The rule is postponed until January 1, 2028, which is both the effective date and the compliance date. The substance of the rule is intact for now, but FinCEN has stated that it intends to revisit the substance of the rule in a future rulemaking, and the companion customer identification program (CIP) rule proposed jointly with the SEC on May 21, 2024 remains unresolved. Note that FinCEN’s April 2026 program modernization proposal does not apply to investment advisers and expressly leaves this rulemaking on a separate track.

What it Means for You

• The postponement should be treated as time to prepare rather than as a reprieve. Planning, developing, and implementing a risk-based AML/CFT program before the rule takes effect represents a sound investment.
• Advisers should avoid committing to only the precise 2024 rule text when planning an AML/CFT compliance program. FinCEN has not yet determined whether it will amend the final requirements.

Key Dates

4. Residential Real Estate Rule

What Changed

FinCEN’s Residential Real Estate Rule became effective on publication in 2024, with an original compliance date of December 1, 2025 that FinCEN moved to March 1, 2026 by exemptive relief order issued September 30, 2025. The rule was vacated in its entirety on March 19, 2026 by the U.S. District Court for the Eastern District of Texas.¹⁸ The order has been appealed.¹⁹ The rule would have required certain closing and settlement professionals to report non-financed transfers of residential real property to legal entities and trusts, with a seven-tier reporting cascade determining which single professional in a transaction bears the filing obligation. The Rule was designed as a targeted transparency measure to prevent illicit actors from disguising their identities through legal entities and trusts during “all-cash” sales.²⁰ Financed real estate transactions are already subject to significant oversight through institutions that have robust AML/CFT programs.

Current Status

Rule vacated and not in effect. FinCEN, together with the Department of Justice, has appealed, but while the court’s order stands, reporting persons are not required to file real estate reports and face no liability for not filing.²¹

What it Means for You

• No filing obligation exists at present. However, the appeal could reinstate the rule, and covered professionals would benefit from establishing the data-capture and reporting workflow now rather than following a sudden reinstatement.

Key Dates

5. GENIUS Act and Payment Stablecoin Issuers

What Changed

The Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act was signed into law on July 18, 2025, creating the first comprehensive federal framework for payment stablecoins.²² It directs that permitted payment stablecoin issuers (PPSIs) be treated as financial institutions under the Bank Secrecy Act and subject to federal requirements for economic sanctions, anti-money laundering, customer identification, and due diligence. On April 10, 2026, FinCEN and OFAC announced jointly published rules implementing these obligations, establishing PPSIs as a new category of BSA covered financial institution separate from money services businesses.^23,24

The following are some of the key changes:

• AML/CFT program obligations that mirror other financial institutions. A PPSI must maintain a written, risk-based AML/CFT program with internal controls, ongoing customer due diligence, independent testing, ongoing employee training, and a U.S.-based AML/CFT officer. Individuals convicted of felonies involving insider trading, embezzlement, cybercrime, money laundering, financing of terrorism, or financial fraud are barred from that role.²⁵
• Customer identification program. On June 2, 2026, FinCEN, the OCC, the Federal Reserve, the FDIC, and the NCUA published a joint notice of proposed rulemaking to implement the CIP requirement the GENIUS Act imposes on PPSIs. The comment period runs through August 21, 2026, and the proposal contemplates a 12-month implementation period after a final rule is issued.²⁶
• Suspicious activity and currency reporting. Issuers would file suspicious activity reports for primary-market activity at a $5,000 threshold, file currency transaction reports, apply recordkeeping and Travel Rule requirements to transfers of $3,000 or more, and transmit Travel Rule data to other institutions.²⁷
• A mandated sanctions compliance program. For the first time by statute, issuers must maintain a sanctions compliance program built on management commitment, risk assessment, internal controls, testing and auditing, and training.²⁸
• A block, freeze, burn, and reject capability. The Act defines a lawful order as one requiring a person to seize, freeze, burn, or prevent the transfer of payment stablecoins. This means issuers must maintain the technical ability to do each of those things, as well as to block and reject transactions that violate federal or state law. These controls apply across both primary and secondary markets.²⁹
• Primary versus secondary market requirements. The full AML suite of customer identification, ongoing due diligence, transaction monitoring, and suspicious activity reporting attaches only to primary-market activity, meaning the issuance and redemption of stablecoins and other direct dealings with the issuer. Secondary-market transfers between third parties, which reach the issuer only through its smart contract,³⁰ do not make those parties customers of the issuer, so they fall outside customer identification, ongoing due diligence, and monitoring requirements. Two sets of obligations do reach the secondary market. The block, freeze, and reject capability and the duty to comply with lawful orders apply to both markets, and the sanctions compliance program must prevent sanctioned persons from transacting with the issuer's stablecoin and must freeze blocked property wherever it sits.³¹

Current Status

The FinCEN and OFAC proposed rule was published in 2026, and the public comment period closed June 9, 2026. The GENIUS Act takes effect on the earlier of January 18, 2027, or 120 days after the primary federal payment stablecoin regulators issue final implementing regulations. Because those regulators missed the statutory July 18, 2026 deadline and no final rules were issued as of this writing, January 18, 2027 is now the operative date. The corresponding CIP rule is open for comments through August 21, 2026, with a final rule expected thereafter.³²

What it Means for You

• If you issue or plan to issue a payment stablecoin, confirm whether you are a permitted payment stablecoin issuer and begin standing up a BSA compliant AML/CFT and sanctions compliance program now.
• Build the block, freeze, and reject capability into your token and transaction infrastructure early, since it spans both primary and secondary markets and cannot be added at the last minute.
• Appoint a U.S.-based AML/CFT officer, confirm there is no disqualifying financial-crime history, and plan for suspicious activity, currency transaction, and Travel Rule reporting operations.

Key Dates

The National AML/CFT Priorities

Across all of the above changes, the National AML/CFT Priorities remain the most durable reference point, though they are not fixed. Firms should map their programs to the Priorities, which cover corruption; cybercrime, including relevant cybersecurity and virtual currency considerations; foreign and domestic terrorist financing; fraud; transnational criminal organizations; drug trafficking; human trafficking and smuggling; and proliferation financing. FinCEN issued the Priorities on June 30, 2021, and the AML Act requires that they be updated at least once every four years. No update had been published as of August 2026, so a refresh is overdue and could be issued at any time. The modernization proposal would, if finalized, make review and incorporation of the Priorities an express program requirement. Today that requirement remains proposed rather than effective. Aligning your risk assessment to the Priorities now is durable work regardless of how the individual rules settle, but build in a process for revisiting those mappings when an updated list is issued.

Beyond the Rules: Treasury Advisories, Alerts, and Orders

Not every development that affects an AML/CFT program originates as a rule or legislative action. Since early 2025, Treasury and FinCEN have issued advisories, alerts, geographic targeting orders, special-measures orders, and executive actions that firms are expected to build into their risk assessments, transaction monitoring, and screening even without a change in the rules. FinCEN’s April 2026 proposal signals that supervision will increasingly weigh the effectiveness of a program against known typologies rather than the volume of filings. The actions below are the most program-relevant issued since early 2025.

On the Horizon: AMLA 2020 Rulemaking and Potential New Covered Entities

Several of the AMLA mandates continue to work through rulemaking, while others have stalled.⁵⁶ One example is the potential extension of BSA obligations to dealers in antiquities. Section 6110 of the AMLA added dealers in antiquities to the BSA definition of financial institution, but that amendment takes effect only when FinCEN issues implementing regulations. FinCEN published an advance notice of proposed rulemaking on September 24, 2021, missed Congress’s deadline of December 27, 2021 for a proposed rule, and formally withdrew the rulemaking as of April 16, 2025.⁵⁷ No antiquities-specific requirement is in effect today.

In February 2022, Treasury published a study of the high-value art market that concluded the art market should not be an immediate focus for comprehensive AML/CFT requirements, while recommending targeted measures including private-sector information sharing, use of FinCEN’s recordkeeping authorities, and AML/CFT requirements for art-finance firms offering collateral-based loans.⁵⁸

More recently, Congress has taken up the question directly. In July 2025, a bipartisan group of senators introduced the Art Market Integrity Act (S.2400), which would extend BSA obligations to dealers, galleries, advisors, auction houses, and museums engaged in the trade of works of art, with exemptions for artists selling their own work, nonprofit organizations, and lower-value sellers, defined as those with no single transaction above $10,000 and aggregate annual transactions below $50,000. The bill was referred to the Senate Banking Committee and has seen no further committee action since introduction. The bill would need to pass both chambers before taking effect, so it remains proposed legislation rather than a current requirement. Even so, dealers in antiquities, and potentially the art trade, could become subject to BSA obligations if FinCEN revisits its rules or if this legislation advances, so businesses in these sectors may wish to closely monitor developments.⁵⁹

Key Dates

Rule Readiness Checklist

This checklist serves as a starting point for identifying gaps in your AML/CFT compliance program. Any “No” response is a known gap and any “Unsure” response is an information gap; both are candidates for remediation or discussion with BDO. Mark “N/A” only where an obligation does not apply to your institution.

Rule 1. AML/CFT Program Modernization

Relevant to banks, MSBs, broker-dealers, credit unions, and other BSA-covered financial institutions. Investment advisers are not within the scope of this proposal: FinCEN’s April 2026 proposal expressly excludes investment advisers and leaves the Investment Adviser Rule on a separate track.

Rule 2. Corporate Transparency Act and Beneficial Ownership

Relevant to entities formed outside the United States and registered to do business in the U.S., U.S.-formed entities confirming their exempt status, and to companies operating in states with their own transparency laws. Note that the test is where an entity was formed, not the nationality of its owners. A U.S.-formed entity is exempt regardless of foreign ownership, while a foreign-formed entity registered in the U.S. remains a reporting company.

Rule 3. Investment Adviser AML Rule

Relevant to registered investment advisers (RIAs) and exempt reporting advisers (ERAs).

Rule 4. Residential Real Estate Rule

Relevant to closing and settlement professionals involved in residential real estate transfers.

Rule 5. GENIUS Act (Permitted Payment Stablecoin Issuers)

Relevant to permitted payment stablecoin issuers (PPSIs) and other entities that issue or plan to issue payment stablecoins. 

Advisories, Alerts, and Orders

Relevant to all covered institutions, with heightened relevance for money services businesses and firms with cross-border, correspondent-banking, or cartel-adjacent exposure. 

How BDO Can Help

The pace and reversibility of U.S. AML/CFT regulatory change make it easy to over-invest in rules that may shift and under-invest in the fundamentals that endure. BDO assists highly regulated institutions and newly in-scope businesses navigate this complex and dynamic environment. 

Our relevant services include the following:

• Independent AML/CFT program reviews and gap assessments against current and proposed requirements.
• Enterprise AML/CFT and sanctions risk assessments mapped to the National AML/CFT Priorities and relevant money laundering and sanctions risks.
• AML/CFT and sanctions compliance systems development, validation, and tuning.
• Beneficial ownership and cross-border structure analysis, including state-law exposure.
• Readiness roadmaps for the Investment Adviser Rule and other pending rule expansions, calibrated to worthwhile investments in compliance program development and infrastructure.
• AML/CFT and sanctions compliance program readiness for permitted payment stablecoin issuers under the GENIUS Act.
• Sanctions compliance program design, independent testing, and screening model validation, including OFAC risk assessments.
• Geographic targeting order readiness and look-back support for money services businesses.

Disclaimer. This tracker is provided by BDO for general informational purposes only and is current as of August 13, 2026. It is not legal, tax, or compliance advice, does not reflect every aspect of the laws, rules, and regulatory actions it describes, and should not be relied upon for any specific matter. The U.S. AML/CFT landscape is changing rapidly, and the status of the developments summarized here may change after the date of this document. Litigation outcomes, pending comment deadlines, and the expiration or renewal of geographic targeting orders are particularly likely to move. Verify the current status of any item and seek professional advice before acting.