AML's Board Accountability Moment: What the 2026 Examination Standard Expects Beyond Transaction Monitoring

TL;DR

• FinCEN’s April 2026 NPRM keeps program approval flexible — board, equivalent governing body, or appropriate senior management — and drops the 2024 proposal’s board oversight mandate. Examiners and bank partners still expect the board to see and understand the risk assessment.
• TD Bank’s roughly $3.09 billion in combined penalties (Oct 2024) — the largest BSA resolution ever against a US bank — came with Treasury blaming the bank’s lax oversight. TD responded by creating a dedicated board committee to oversee AML remediation.
• OCC Bulletin 2025-37a, effective February 2026, updated community bank examination procedures: well-documented programs get streamlined review; programs with weak governance documentation get the same scrutiny as before.
• UBS’s $125M FinCEN penalty (Aug 2026) reinforced the pattern: monitoring failures went unescalated to the regulator for years despite a prior consent order.
• Examiners now look for evidence the board actually reviewed the risk assessment, substantive minutes, an independent BSA reporting line, and evidence the board engaged with the BSA/AML officer’s reporting — not just received it.

For most of the past decade, the AML examination question was about the transaction monitoring system. Did it exist? Was it tuned? Were the alert volumes reasonable? Did SARs file within required timeframes?

That question hasn’t disappeared. But a second question has moved up the stack — one that goes directly to your board: does the board understand your AML program, and do you have the documentation to prove it?

This shift has been building since TD Bank’s $3 billion settlement in October 2024. FinCEN’s April 2026 proposed rule doesn’t mandate it — but it doesn’t need to. And the UBS penalty from three days ago puts fresh evidence in front of every compliance officer about what happens when program failures don’t get escalated.

Why TD Bank reset the standard

TD Bank’s October 2024 guilty plea — entered across the DOJ, FinCEN, OCC, and Federal Reserve, totaling $3.09 billion in combined penalties — is the event that redefined board-level AML expectations for the current examination cycle.

Treasury’s framing was blunt: TD Bank’s chronic failures were enabled by its lax oversight. As part of the resolution, TD Bank established a dedicated committee of its board of directors to oversee AML remediation — a structural change that acknowledged the prior governance arrangement wasn’t working.

Regulators have referenced this case consistently since then. When examiners assess board oversight in an AML context, TD Bank is the implicit benchmark: what did that board know, when did they know it, and what did they do about it? The expectation isn’t that every board acts as an AML review committee. The expectation is that the board received substantive information and engaged with it substantively.

What FinCEN’s April 2026 NPRM actually says about boards

FinCEN published a proposed rule in April 2026 that would fundamentally rewrite the structure of AML/CFT program requirements for covered financial institutions. The proposal withdraws and supersedes a prior July 2024 NPRM.

Here’s the part that gets misreported: the withdrawn 2024 proposal would have required board (or equivalent) approval and oversight of the AML/CFT program, and commenters pushed back hard. The April 2026 NPRM instead requires the written program to be approved by the board, an equivalent governing body, or appropriate senior management — standardizing today’s approval language across institution types and explicitly giving institutions flexibility. The proposal also folds risk assessment processes into the internal controls requirement rather than treating them as a standalone pillar, but it doesn’t require board approval of the risk assessment itself.

FinCEN proposes an effective date 12 months after the final rule is issued. It has not yet been finalized as of this writing. So the board pressure isn’t coming from new rule text — it’s coming from examiners, enforcement actions, and bank partners who want to see that someone at the top understands the program. FinCEN’s fact sheet is the primary source if you’re tracking the rulemaking.

What OCC examiners look for in 2026

OCC Bulletin 2025-37a, effective February 1, 2026, revised the community bank BSA/AML examination procedures. The stated goal was reducing unnecessary regulatory burden on banks with well-functioning programs while preserving risk-based scrutiny where deficiencies exist.

The practical effect: examiners now have more discretion to rely on satisfactory independent testing and to tailor examination scope to a bank’s risk profile. For banks with clean programs, this means a more efficient exam. For banks whose programs have documentation gaps — including gaps in board-level governance — the scrutiny is the same as before the revision.

What the updated procedures do not change: the expectation that the board understands and oversees the AML program. The Wolters Kluwer BSA/AML 2025–2026 analysis summarizes the shift as moving from “do you have an AML program” to “can you demonstrate it is effectively working, with governance that reaches the board level.”

At the board level, OCC examiners have consistently flagged four specific gaps:

Gap 1: The risk assessment was presented, not engaged with. There’s a meaningful difference between the BSA officer flashing the annual risk assessment at the board and the board actually reviewing it. No rule requires a board vote on the risk assessment, but a documented approval or acknowledgment in the minutes is the cleanest evidence that the board understood it.

Gap 2: Minutes don’t show engagement. Board minutes that say “BSA officer presented annual report; no questions” create an exam problem. Examiners look for evidence that the board engaged: questions documented, concerns raised, action items assigned. Minutes that show a report was received but not discussed suggest the board is not functioning as an oversight body for AML purposes.

Gap 3: The BSA officer reports through business lines. When the person responsible for AML compliance reports upward through a business line manager rather than to the board or audit committee, examiners identify a structural independence problem. Commercial pressure can displace compliance judgment when the reporting line creates a conflict of interest.

Gap 4: The board has no documented AML risk appetite. The board is expected to set the institution’s risk tolerance — including for AML risk. If there is no documented position on which customer types, geographies, or product categories the institution will and won’t serve based on BSA risk, the board’s role in program governance is incomplete.

The UBS case as a governance failure, not just a monitoring failure

The UBS $125 million FinCEN penalty from August 3, 2026 is the most recent illustration of what happens when escalation doesn’t reach regulators.

FinCEN’s findings described a two-phase failure. From 2019 to 2021, UBS’s legacy monitoring system excluded certain FX wire transactions from surveillance due to a booking anomaly. From 2021 to 2023, the new monitoring system — itself implemented more than 18 months behind UBS’s own schedule — had data-transmission problems that left thousands of transactions unsurveilled.

The outcome of the new settlement was largely driven by FinCEN being kept in the dark. The gaps were discovered during a subsequent examination, not disclosed proactively. UBS had entered a prior consent order with FinCEN in 2018 (FINRA fined it separately), and told FinCEN it would fix the exact problem that persisted for years afterward.

This is a board-level governance failure as much as a monitoring failure. The question FinCEN would ask in any follow-on governance review: how did the board know the remediation committed to under the prior consent order was actually complete? What did the board see, and when?

What board-level AML oversight actually looks like in practice

Translating the examination standard into something operational:

Annual risk assessment review. Once a year, the board or its risk/audit committee formally reviews the institution’s BSA/AML risk assessment, and the minutes or a resolution document it. The risk assessment covers products and services, customers, and geographies (the FFIEC manual’s core categories) plus delivery channels (which FinCEN’s 2026 proposal names as “distribution channels”), with the inherent risk and control strength matrix that supports the residual risk conclusion.

BSA/AML officer annual report with documented engagement. The BSA officer presents an annual summary covering SAR filing volumes, alert volumes and disposition, transaction monitoring coverage (including any known gaps), audit findings, open regulatory findings, training completion, and any significant suspicious activity patterns. The board minutes document what was reviewed, what questions were asked, and what actions were assigned.

Independent reporting line. The BSA/AML officer has a direct path to the board or audit committee that does not run through business line leadership. This doesn’t require a separate chain of command for everything — it means that when the BSA officer has a concern that business line pressure is affecting compliance judgment, they have a documented route to the board that bypasses the conflict.

Documented risk appetite for high-risk categories. The board has explicitly reviewed and approved the institution’s approach to high-risk customer types (MSBs, PEPs, marijuana-related businesses, offshore shell companies), high-risk geographies, and high-risk products. This doesn’t mean the institution must exit all high-risk relationships — it means the board has documented that it understands the risk and has set a boundary.

The FinCEN student aid fraud alert from July 2026 is a useful example of the kind of emerging typology that should reach the board as part of the BSA/AML officer’s annual report — not because every alert type needs board attention, but because significant emerging typologies represent program-level decisions about monitoring coverage that require board awareness.

The documentation burden is real, but it’s finite

None of the above requires a large compliance team or a GRC platform. What it requires is discipline:

• A written BSA/AML risk assessment, updated annually, reviewed by the board with that review documented
• Board minutes that reflect engagement with AML reporting
• A documented escalation path from the BSA officer to the board
• A written risk appetite statement that covers AML risk categories

For fintechs and smaller financial institutions, the BSA/AML risk assessment is almost always the first document an examiner requests — and the first document a bank partner asks for during onboarding and annual review. It’s not a theoretical governance artifact. It’s the operational record that determines whether your program is examined as well-governed or examined as a concern.

The AML/BSA Risk Assessment Template (Fintech Edition) gives you the document the board should be reviewing — 32 risk factors across product/service, customer, geography, and delivery channel categories, inherent-to-residual scoring, a 30-control inventory mapped to the BSA program pillars, and a Board Summary Dashboard. It’s pre-populated with fintech examples so you’re editing a credible draft rather than starting from a blank page.

So what?

If your BSA/AML program has the monitoring system, the SAR workflow, and the training calendar — but the board’s involvement is passive or undocumented — you have a gap that examiners are already flagging under current guidance — with or without a new rule.

The cases from 2024 and 2026 tell a consistent story: the transaction monitoring gap is almost never the only finding. Behind it is a governance failure — someone who should have known, didn’t. Someone who should have escalated, didn’t. A board that should have pushed for answers, didn’t.

The monitoring system is table stakes. The governance around it is where the next examination cycle is focused.

Check your BSA/AML KRIs for board-reportable metrics before your next exam cycle starts. If your board hasn’t seen the SAR filing rate, the alert false-positive rate, or the open regulatory findings in the past year — that’s the gap to close first.

FAQ

What does FinCEN’s April 2026 AML NPRM require of boards?

Less than you might think. The April 2026 proposed rule would require the written AML/CFT program to be approved by the board, an equivalent governing body, or appropriate senior management, and it drops the withdrawn 2024 proposal’s board approval-and-oversight requirement. It folds risk assessment processes into internal controls but does not require board approval of the risk assessment itself. FinCEN proposes an effective date 12 months after the final rule is issued.

What did TD Bank’s AML settlement mean for board accountability standards?

TD Bank’s October 2024 resolution — roughly $3.09 billion in combined US penalties, the largest BSA resolution ever against a US bank — came with Treasury describing the failures as enabled by the bank’s lax oversight. TD Bank created a dedicated committee of its board of directors to oversee AML remediation. Regulators now reference this case when defining adequate board engagement.

What changed in the OCC’s BSA/AML examination procedures?

OCC Bulletin 2025-37a, effective February 1, 2026, revised community bank BSA/AML examination procedures to streamline oversight for well-documented programs while preserving scrutiny for programs with deficiencies. Banks with documented risk-based AML governance benefit from more efficient examinations; banks with weak documentation face the same level of scrutiny as before the change.

What do AML examiners look for at the board level?

Four things: (1) documented evidence the board reviewed the AML risk assessment, not just sat through a presentation; (2) board meeting minutes reflecting substantive discussion of AML risks; (3) an independent reporting line from the BSA officer to the board, separate from business line management; and (4) evidence that the board set and reviewed risk appetite for high-risk AML categories.

What is the BSA/AML officer’s annual report and why do examiners review it?

The BSA/AML officer’s annual report summarizes the year’s AML program performance for the board: risk assessment status, SAR volumes, monitoring coverage, audit findings, open regulatory findings, and significant suspicious activity patterns. Examiners assess whether the board engaged substantively — not just whether the report was presented. A board that received the report without questions or follow-up creates an exam risk.

How should a fintech without a full-time BSA/AML officer handle board-level AML accountability?

The role doesn’t have to be full-time — the substance does. The designated BSA compliance officer must have a direct reporting line to the board or equivalent. At minimum, the board should annually: (1) approve the AML risk assessment, (2) review SAR filing activity and monitoring coverage, and (3) review any open exam findings. Document all three. If your board has never seen your BSA risk assessment, that’s the gap examiners will find first.