A $1.2 billion penalty against Bank of America, proposed federal stablecoin regulations and changes to beneficial ownership requirements are reshaping the U.S. anti-money laundering (AML) regulatory landscape in 2026. For banks, commercial lenders, fintech companies and other financial institutions, these developments raise an important question: Are existing compliance programs keeping pace with evolving regulatory expectations? The U.S. anti-money laundering regulatory landscape has undergone significant developments in 2026, reflecting a combination of heightened enforcement, emerging digital asset regulation and efforts to modernize compliance requirements under the Bank Secrecy Act (BSA). These developments underscore the importance of effective risk management, transaction monitoring, customer due diligence and sanctions compliance.
The October 13, 2026, enforcement actions against Bank of America highlight the financial and regulatory consequences of inadequate compliance controls. Meanwhile, federal regulators are advancing new AML requirements for payment stablecoin issuers under the GENIUS Act, extending traditional financial crime compliance principles into digital payment systems. Together, these developments reflect a regulatory environment in which certain compliance obligations are being streamlined, but expectations for effective financial crime prevention remain high.
Bank of America’s $1.2 Billion AML Enforcement Action: What Financial Institutions Should Know
On October 13, 2026, the U.S. Department of the Treasury announced coordinated enforcement actions against Bank of America, including a $1.2 billion civil money penalty imposed by the Financial Crimes Enforcement Network (FinCEN), a $750 million penalty assessed by the Office of the Comptroller of the Currency (OCC), and an $11.6 million sanctions settlement with the Office of Foreign Assets Control (OFAC). Importantly, the OCC penalty is credited against FinCEN’s assessment, rather than added to it.
The enforcement actions represent the third-largest penalty in Treasury Department history and the largest civil money penalty ever assessed by the OCC.
FinCEN determined that Bank of America willfully violated the BSA by failing to maintain an effective AML compliance program, conduct required due diligence concerning foreign correspondent accounts, and timely file suspicious activity reports (SARs). The deficiencies involved significant national security risks, including Chinese money laundering networks and potentially illicit financial activities along the southwestern U.S. border.
The OCC separately identified widespread weaknesses in transaction monitoring, personnel training, internal controls and independent auditing. Of particular concern was the bank’s failure to adequately address deficiencies previously identified in a December 2024 consent order.
The OFAC settlement addressed 475 apparent sanctions violations involving multiple sanctions programs, including those targeting Russia, Iran, narcotics trafficking, and global terrorism. Deficiencies included improperly calibrated sanctions screening, delayed watchlist updates, and errors in processing correspondent banking transactions.
What does this mean for financial institutions? The enforcement actions reinforce a fundamental regulatory expectation: AML compliance programs must be effective in practice, not simply comprehensive on paper. Written policies, substantial technology investments and remediation commitments cannot substitute for controls that demonstrably identify, investigate and mitigate financial crime risks. For banks and lenders, the case also highlights the importance of promptly addressing known compliance deficiencies, validating transaction monitoring systems and maintaining meaningful oversight of remediation efforts.
GENIUS Act: Proposed AML Regulations for Payment Stablecoin Issuers
As stablecoins become increasingly relevant to financial services and digital payments, federal regulators are developing a more defined compliance framework for permitted payment stablecoin issuers. Another major development is the federal government’s implementation of the Guiding and Establishing National Innovation for U.S. Stablecoins Act, commonly known as the GENIUS Act.
On April 8, 2026, FinCEN and OFAC jointly proposed regulations establishing AML and sanctions compliance requirements for permitted payment stablecoin issuers. The proposal would subject qualifying issuers to BSA obligations and require effective programs designed to identify and mitigate money laundering, terrorist financing, and sanctions risks.
On June 18, FinCEN, the OCC, Federal Reserve, FDIC, and National Credit Union Administration jointly proposed customer identification program requirements for stablecoin issuers. These rules would establish identity-verification obligations tailored to stablecoin businesses.
The OCC followed with a June 22 proposal establishing a supervisory and enforcement framework for stablecoin issuers subject to its jurisdiction.
Collectively, these proposals would bring stablecoin issuers more firmly within the federal financial crime compliance framework. However, financial institutions should distinguish between proposed requirements and final, effective regulations when evaluating their current compliance obligations.
What should banks and lenders consider? For banks and lenders considering stablecoin-based payments, custody arrangements or partnerships with digital asset businesses, the proposed framework underscores the importance of evaluating third-party relationships before adopting new payment technologies. Financial institutions should consider how customer identification, transaction monitoring, sanctions screening and contractual responsibilities would operate within these arrangements, particularly where multiple parties share responsibility for processing or monitoring transactions.
Proposed Changes to Bank Secrecy Act and AML Compliance Programs
On April 7, 2026, FinCEN proposed substantial revisions to AML and countering-the-financing-of-terrorism (CFT) program requirements under the Anti-Money Laundering Act of 2020.
The proposal would emphasize risk-based, reasonably designed compliance programs rather than rigid procedural requirements. It would also clarify expectations for independent testing, distinguish program-design deficiencies from implementation failures, and strengthen coordination between FinCEN and federal banking regulators.
Importantly, the proposal supersedes FinCEN’s July 2024 proposed AML program rule.
If adopted, these changes could provide financial institutions with greater flexibility to allocate compliance resources according to their specific risk profiles, including higher-risk customers, transactions and activities. Nevertheless, the Bank of America enforcement action demonstrates that a risk-based approach does not diminish an institution’s responsibility to address known deficiencies, investigate suspicious activity or maintain effective internal controls. The practical challenge for financial institutions will be balancing greater flexibility in program design with continued accountability for compliance outcomes.
Beneficial Ownership Reporting and Customer Due Diligence Changes in 2026
Financial institutions are also navigating changes to beneficial ownership reporting and customer due diligence requirements, two related but distinct components of the federal financial crime compliance framework.
On February 13, FinCEN granted exceptive relief under its Customer Due Diligence Rule, 31 C.F.R. § 1010.230. Covered financial institutions generally no longer must identify and verify beneficial owners every time an existing legal-entity customer opens another account. Verification remains necessary at the initial account opening, when previously obtained information becomes unreliable, or when warranted by risk-based procedures.
On August 11, FinCEN issued a final rule permanently eliminating Corporate Transparency Act beneficial ownership reporting requirements for U.S. companies and U.S. persons, while retaining specified reporting requirements for certain foreign entities.
Although these changes reduce duplicative reporting obligations, they do not eliminate financial institutions’ independent customer due diligence responsibilities. For banks and commercial lenders, the distinction is particularly important. Relief from certain beneficial ownership reporting or reverification requirements does not eliminate the need to understand customer relationships, assess relevant risks and maintain appropriate documentation.
Additional 2026 AML Regulatory Developments
Real estate reporting: On March 19, 2026, a federal district court vacated FinCEN’s residential real estate reporting rule. FinCEN appealed, but reporting is not required while the vacatur remains in effect.
Investment advisers: A final rule issued December 31, 2025, postponed the effective date of new AML and SAR requirements for certain investment advisers from January 1, 2026, to January 1, 2028.
Digital assets: On October 5, FinCEN withdrew proposed rules concerning unhosted cryptocurrency wallets and cryptocurrency mixing transactions, reflecting a change in the agency’s approach to these proposed digital asset compliance requirements.
Taken together, these developments illustrate an important regulatory distinction: federal agencies are reducing certain prescriptive compliance burdens while maintaining significant enforcement expectations for established BSA and sanctions obligations.
Five AML Compliance Priorities for Banks, Lenders and Financial Institutions
With regulatory requirements evolving and enforcement scrutiny continuing, financial institutions should evaluate whether their existing compliance programs adequately address both current obligations and emerging risks. Five areas warrant particular attention:
- Evaluate transaction monitoring effectiveness. Review alert-generation thresholds, data integrity, investigation backlogs, and SAR filing timeliness. Monitoring systems should reflect actual customer activity and emerging financial crime risks. Institutions should also assess whether existing controls are identifying suspicious activity as intended.
- Strengthen governance and accountability. Boards and senior management should receive meaningful reporting on compliance deficiencies, remediation deadlines, staffing adequacy, and independent testing results. Clear accountability and timely remediation are critical to demonstrating effective oversight.
- Modernize customer due diligence. Incorporate FinCEN’s 2026 beneficial ownership relief without abandoning risk-based verification, ongoing monitoring, or appropriate documentation. Institutions should review their procedures to ensure they reflect current requirements without creating unnecessary administrative burdens.
- Assess stablecoin exposure. Banks and nonbank lenders partnering with stablecoin issuers should evaluate customer identification, transaction traceability, sanctions controls, contractual responsibilities, and vendor oversight. These considerations are particularly relevant when evaluating new payment platforms or digital asset partnerships.
- Integrate sanctions and AML compliance. Financial institutions should coordinate OFAC screening with transaction monitoring and customer risk assessments, particularly for cross-border payments and correspondent banking relationships. A coordinated approach can help identify gaps that may otherwise go undetected across separate compliance functions.
What AML Requirements Apply to Commercial and Nonbank Lenders? For nonbank lenders, an additional consideration is determining which BSA requirements apply based on the institution’s activities and regulatory classification. Residential mortgage lenders and originators, for example, are subject to specific AML program and SAR requirements under 31 C.F.R. §§ 1029.210 and 1029.320. Other commercial lenders may face different direct obligations, although banking relationships and contractual requirements can impose additional compliance expectations. Accordingly, commercial lenders should not assume that all BSA requirements applicable to banks automatically apply to their operations. Instead, they should evaluate their regulatory classification, lending activities, banking relationships and contractual commitments to determine the appropriate scope of their compliance programs.
Conclusion: Preparing for the Next Phase of AML Regulation
The defining theme of U.S. anti-money laundering regulation in 2026 is the balance between modernizing compliance requirements and maintaining rigorous enforcement of fundamental financial crime controls.
The Bank of America penalties demonstrate the consequences of ineffective financial crime controls, while the GENIUS Act proposals signal the expansion of AML oversight into stablecoin-based financial services. Meanwhile, changes to beneficial ownership requirements and broader BSA reforms reflect efforts to reduce unnecessary compliance burdens without compromising financial crime prevention.
For banks, lenders and their counsel, the appropriate response is not simply increasing compliance expenditures. It is developing and maintaining risk-based, demonstrably effective AML programs that satisfy existing legal obligations, address institutional risks and remain adaptable to regulatory change. As financial institutions evaluate their compliance frameworks, a proactive review of existing controls, regulatory obligations and emerging business activities can help identify vulnerabilities before they become enforcement concerns.
To discuss further, contact KJK attorney Jessica Groza (JLG@kjk.com).