Filing is not finding: FinCEN’s effectiveness question meets the FinCEN Files

The week

On September 16, 2020, the Financial Crimes Enforcement Network, or FinCEN, announced an advance notice of proposed rulemaking. FinCEN is the Treasury Department agency that collects banks’ reports on possible financial crime. The notice appeared in the Federal Register the next day, with comments due within 60 days of publication.

An advance notice is a formal early step in which a regulator asks the public for views before it drafts a rule. The question was whether to define, in regulation, what an “effective and reasonably designed” anti-money laundering program is.

Every bank in the United States runs such a program, usually shortened to AML. Its job is to spot money that might come from crime, such as fraud, drug trafficking or corruption, and to tell the government about it. The law behind it is the Bank Secrecy Act. The main report is the suspicious activity report, or SAR: a confidential filing in which a bank describes a transaction or pattern it thinks looks wrong.

The existing rules described what a program had to contain, not what it had to achieve. A bank’s program needed internal controls, independent testing, a designated compliance officer and training. A customer due diligence rule issued in 2016, which took effect in May 2018, added risk-based customer due diligence, including identifying the beneficial owners of business customers. Examiners checked those components against a long federal examination manual.

The notice did not come from nowhere. It followed work begun in 2019 by a group formed under the Bank Secrecy Act Advisory Group, the standing forum in which FinCEN consults banks, regulators and law enforcement. That group had developed recommendations for strengthening the regime. In the preceding two years the banking agencies and FinCEN had also issued joint statements encouraging innovative approaches to compliance and explaining how they approach enforcement.

The notice suggested that an effective program would do three things. It would assess and manage risk as informed by the institution’s own risk assessment. It would provide for compliance with Bank Secrecy Act requirements. And it would provide information with a high degree of usefulness to government authorities, guided by national priorities. The third idea was the radical one. A program would be judged by whether its reports helped anyone, and by more than whether it filed them.

Measuring usefulness was hard for a structural reason. Banks, credit unions, broker-dealers, casinos and money services businesses send FinCEN a very large volume of reports every year. Law enforcement’s use of them is itself confidential. A filer usually had no way of knowing whether any given report had been read, let alone acted on, so the industry had defaulted to measuring the one thing it could see.

Two further ideas came with it. The notice floated an explicit requirement for a risk assessment process. It also proposed that FinCEN’s Director issue a list of national AML priorities, called Strategic Anti-Money Laundering Priorities, every two years. FinCEN’s stated aims were to let institutions move resources away from low-value activity and to give supervisors and banks a shared understanding of what was required. It also said programs already meeting expectations should face little new burden.

Days later, on September 20, BuzzFeed News and the International Consortium of Investigative Journalists began publishing the FinCEN Files with media partners around the world. The series was based on more than 2,100 suspicious activity reports, documents that are normally secret. They spanned 1999 to 2017, and the consortium put the value of the flagged transactions at more than $2 trillion.

The banks named most often included JPMorgan Chase, HSBC, Standard Chartered, Deutsche Bank and Bank of New York Mellon. The consortium itself noted that a SAR is not proof of wrongdoing, and that the leaked set was a tiny fraction of the reports banks file. Unauthorized disclosure of a SAR is a federal crime, which is why such a leak was so rare.

The picture was uncomfortable. Banks had done what the system asked of them, which was to report. Yet the reports described large flows that had been flagged, often after the fact, while money moved on, sometimes through the same institutions that had flagged it. A reader outside banking was left with an obvious question: if a bank thinks money is suspicious, why does it keep handling it?

So in one week, the regulator asked how to measure whether AML programs produce value, and journalists showed what the system looked like when activity was reported and little changed. The two events had nothing to do with each other. Together they framed a question every bank board should still be asking.

The two events had unrelated origins, but they came at the same question from opposite ends. FinCEN was asking how to measure whether anti-money laundering programs produce value. The leaked reports showed what the system looked like when activity was reported and little changed.

Compliance and technology leaders at banks, credit unions and broker-dealers, and their boards, need to separate three things the system had blended. They are how much is reported, how useful the reports are, and what the institution does after filing. Each has a different owner, a different data source and a different metric. Before taking each in turn, we start with how an AML program actually works. After the three parts, we follow one hypothetical customer through all of them, then look at the business case and at what a board should see.

From account opening to filing: how the machinery runs

Most people picture money laundering as suitcases of cash. In a modern bank it is mostly data. Every day, millions of payments, deposits, withdrawals and transfers flow through the bank’s systems. The AML program’s job is to find the handful that might be criminal among the millions that are ordinary.

It does this in stages, a little like airport security.

• Knowing the customer. When an account is opened, the bank collects information about who the customer is and what kind of activity to expect. This is customer due diligence. A local bakery is expected to deposit modest sums from card sales, and not to receive large wire transfers from overseas shell companies.
• Monitoring transactions. Software, called a transaction monitoring system, runs rules or models over the flow of payments. A rule might say: flag any customer who makes many cash deposits just under the reporting threshold, or whose activity suddenly jumps far beyond what was expected. Each flag is an alert.
• Investigating alerts. Human analysts review the alerts, usually in a case management system, a workflow tool that tracks each alert, the evidence gathered and the decision made. Most alerts turn out to be harmless. Those are false positives.
• Filing. If the analyst still thinks the activity is suspicious, the bank files a SAR with FinCEN, describing who, what, when and why.
• Deciding about the relationship. Separately, the bank decides whether to keep the customer, restrict the account or close it.

The legal frame around each stage

The obligations differ by type of institution, and the differences matter when a group runs one platform for several entities. Banks file under FinCEN’s bank SAR rule, generally for suspicious transactions of $5,000 or more where a suspect can be identified, and $25,000 or more regardless. Federally insured credit unions carry parallel obligations in the National Credit Union Administration’s rules. Broker-dealers file under a separate FinCEN rule and must also meet FINRA Rule 3310, which sets out their AML program requirements. Money services businesses have a lower $2,000 threshold.

The clock is short. A SAR is generally due within 30 calendar days of the bank first detecting facts that may require a filing. If no suspect has been identified, the bank may take up to 30 more days to find one, but no longer. Supporting documentation must be kept for five years.

Two further features shape everything downstream. SARs are confidential: a bank may not tell the subject that a report was filed, and staff who handle them work under strict need-to-know rules. Filers also have a statutory safe harbor from civil liability for the act of reporting. Confidentiality explains why the relationship manager often does not know. The safe harbor explains part of why filing feels safer than not filing.

Where the data comes from

Every stage depends on data. Customer due diligence data usually lives in the onboarding platform and the core banking system. Transactions come from the core, the wire system, card processors and, at larger institutions, separate platforms for trade finance or correspondent banking. Monitoring tools ingest feeds from each, often overnight, and each feed has its own identifiers and its own gaps.

If customer records are incomplete, monitoring flags the wrong things. If records for the same person are scattered across systems, the investigator sees fragments. If the decision about the relationship is made somewhere else, by someone else, the filing and the action drift apart. That drift is the story of the FinCEN Files.

A small bank and a global bank feel this differently. A community bank may run everything on one core platform with a vendor’s bundled monitoring module, and its weakness is usually rule tuning and staffing. A large bank may have dozens of source systems across countries, and its weakness is usually integration. The correspondent banking flows that featured heavily in the FinCEN Files are almost entirely a large-bank problem, because a correspondent bank sees payments for customers it never onboarded.

How much is reported

For years the incentives pointed toward more. Examiners criticized missed filings far more often than unnecessary ones, so defensive filing was rational: if in doubt, file. Monitoring systems were tuned to generate alerts, and alert queues were staffed to clear them. Program health was described in alerts reviewed, cases opened and reports filed.

The FinCEN Files reporting showed the limit of that approach. Many leaked reports described activity flagged long after it happened, sometimes repeatedly for the same customers. Filing met the legal obligation without necessarily stopping anything. A program that measures itself by filings will produce filings, in the same way that a sales team paid on calls made will make calls.

Why the volume ratchet only turned one way

Several mechanisms pushed volume up and almost none pushed it down. Enforcement actions over the previous decade had cited failures to file, and each one prompted peers to lower thresholds. Model validators and auditors tend to criticize a rule that is switched off more readily than one that fires too often. Once a scenario exists, retiring it requires a documented rationale, testing and sign-off, while leaving it running requires nothing.

Continuing-activity reviews added another layer. Long-standing FinCEN guidance suggested reviewing a reported customer again after 90 days and filing again if the activity continued. For a customer who stays open, that produces a fresh SAR every few months, each one describing the same pattern a little further along. Repeat filings on the same customers, a recurring feature of the FinCEN Files, are what that cycle produces when nothing else changes.

Reading volume as a signal

Volume is still worth measuring, as long as it is read for what it signals. A false positive rate near the ceiling says the monitoring rules are blunt: they catch so much that analysts spend their days clearing noise. A rising count of reports on existing customers, as opposed to new ones, says the program is recording the same risk over and over. Both are tuning signals, and both are already recorded in the case management system.

Take a regional bank that tells its board it reviewed tens of thousands of alerts last year and filed a large number of SARs, up on the year before. The board nods. But if nearly all those alerts were false positives, and a growing share of filings concerned customers already reported, the same numbers describe a program that is busy rather than effective. The figures are identical; only the reading changes.

The useful volume measures are ratios and trends, broken down by scenario. They show which rules produce alerts that never become cases, and which produce cases that never become filings. A scenario with years of alerts and no filings is either miscalibrated or watching for something that does not happen at this bank. Either way it is consuming analyst hours that could go elsewhere.

What it takes to tune safely

Turning volume down is harder than turning it up, because each change must be defended to an examiner. The evidence pack typically includes the original rationale for the scenario and below-the-line testing, which samples activity just under the proposed new threshold. It adds the results of that sample and sign-off by the BSA officer and the model risk function. Changes are best made in a planned cycle, with each one logged, instead of in a rush to clear a backlog.

The cost is real. Tuning work needs data analysts who understand both the transaction data and the typologies, and they are scarce. A credit union or community bank may need its monitoring vendor or an outside firm to do it. The payoff is that every hour saved on noise is an hour available for the cases that matter.

How useful the reports are

The advance notice’s central idea was that a report should be judged by its value to the authorities who receive it. That changes the design question from whether the institution filed to whether it filed something an investigator can act on.

Usefulness depends on factors that compliance and technology teams control:

• Narrative quality. Who did what, when, through which accounts, and why it is suspicious, written plainly instead of in boilerplate.
• Data quality. Correct identifiers, counterparties and linked accounts. These come from upstream customer and transaction data, and the investigator cannot invent them.
• Timeliness. A report that arrives months after activity ends helps reconstruct history. It rarely helps interrupt anything.
• Priority alignment. Effort weighted toward the threats the government has named as most important, instead of spread evenly across every alert type.

Who reads a SAR, and how

A SAR is not read once by one person. It goes into FinCEN’s database, where authorized users at federal, state and local agencies search it, often years later, while working an unrelated case. An investigator types in a name, an account number or a phone number and sees every report that mentions it. Reports are also reviewed by teams that look across filings for networks and trends.

That use pattern explains what makes a report useful. Structured fields that are filled in correctly make a report findable. A narrative that names every account, counterparty and identifier makes it connectable. A report with a misspelled name, a missing date of birth and a narrative that says only “unusual activity” is close to invisible, however conscientiously it was filed.

Narratives an investigator can use

The narrative is the part of a SAR that most rewards effort. A useful one opens with a summary of what is suspicious and why, then sets out a chronology. It names every subject, account, counterparty and identifier the bank holds, and says how the activity differs from what the customer told the bank to expect. Where the bank has filed before on the same subject, it says so and refers to the earlier report.

Programs that take narratives seriously write a short style guide, train to it, and have a senior reviewer sample a set share of filings each month against a checklist. The results feed coaching and, over time, the board report. The trade-off is time: a better narrative takes longer to write, which is one more reason to free analysts from noise first.

Entity resolution as the foundation

Most usefulness problems are data problems. An institution with fragmented customer records cannot link a suspicious transfer to the same person’s other accounts, so its reports describe fragments. One technical term matters here. Entity resolution is the work of recognizing that several records describe one person or business: that “J. Smith Ltd,” “John Smith Limited” and a business account at a different address are in fact the same customer. A family doctor faces the same problem on discovering that three patient files with slightly different spellings belong to one patient with one set of allergies.

Entity resolution is the single investment that most improves report quality. It is also the one most often deferred, because it looks like infrastructure and never gets a ribbon-cutting. Without it, an investigator writing a SAR sees one account rather than the whole web of a customer’s relationships, and the report that reaches law enforcement is correspondingly thin.

The work has recognizable steps. Standardize names, addresses and identifiers from each source system. Match records using deterministic rules where identifiers agree and probabilistic scoring where they nearly do. Route uncertain matches to people for review, and keep a record of every merge and split so it can be explained. Then expose the resolved view to monitoring and case management as well as to the reporting warehouse. Each step has an owner: data engineering builds it, the BSA function sets the matching tolerance, and model risk validates it.

There are trade-offs. Matching too aggressively merges strangers, which can put an innocent customer into someone else’s case file. Matching too cautiously leaves the fragments in place. Privacy and access rules also matter: a resolved view that links a customer’s accounts across business lines must respect the same need-to-know limits as the SARs themselves.

The feedback loop

The feedback loop is the other gap. Institutions rarely learn which of their reports law enforcement used. Feedback sometimes arrives as law enforcement requests, subpoenas or keep-open letters, in which investigators ask a bank to keep an account open so they can watch it. Where it exists, it should be recorded against the original report. Those links are the closest thing a bank has to a usefulness measure. A bank that can say “these kinds of reports led to follow-up, these never did” has the beginnings of a way to improve.

Capturing it is mostly a workflow change. Subpoenas usually arrive at the legal department, and keep-open letters may go to the BSA officer. Each needs a field in the case management system that links it to every prior report on the same subject, and a monthly report that counts those links by scenario and by narrative author. Over time, that shows which typologies and which writing habits attract follow-up.

The signal is imperfect. Investigators may use a report without ever contacting the bank, and a subpoena may be prompted by something else entirely. A sceptic would say the measure is too noisy to manage by. It is noisy, but it is the only outcome signal most banks have, and it is better used carefully than ignored.

What happens after filing

A suspicious activity report does not, by itself, require an institution to close an account or block a transaction. Those are risk decisions the institution makes under its own policies. The FinCEN Files raised hard questions about repeated reports on the same customers with no visible change in the relationship.

Every program should be able to answer three things from its own records. The first is how many customers were the subject of more than one report in a year. The others are what was decided about each relationship, and who decided it on what basis. The answers should take minutes to produce, not weeks. If those answers require a manual project, the program is filing without learning, and that is where supervisory criticism and reputational damage concentrate.

Why filing and acting drift apart

The systems problem is usually fragmentation. Monitoring, investigations and customer due diligence often run on separate platforms, sometimes from separate vendors and teams. An investigator reviewing an alert may not see prior reports on the same customer, the due diligence file or the relationship manager’s notes. Connecting those records is unglamorous integration work, and it decides whether a program can act on what it already knows.

The organizational problem compounds it. The BSA officer owns filing. The business line owns the relationship and its revenue. Exit decisions often go to a committee that meets monthly, reviewing a list prepared by hand. If the list is built from customer records that are not resolved, a customer with reports under two names never appears as a repeat subject.

Seeing beyond the bank’s own walls

Some of what a bank needs to decide sits at other institutions. Section 314(b) of the USA PATRIOT Act lets financial institutions that register with FinCEN share information with each other about possible money laundering or terrorist financing, under a safe harbor. A bank investigating the import business could ask the bank on the other side of its wires what it has seen.

Use of 314(b) varies widely. Large banks often have dedicated teams for it, while many smaller institutions register and rarely use it. Making it a routine step for high-risk repeat subjects is a cheap way to turn a fragment into a picture, though it adds turnaround time and needs careful handling of what is shared.

Designing the escalation path

Relationship decisions need an escalation path that works. A repeat-subject customer who is profitable to a business line creates pressure to keep the account. A documented threshold helps. For example, a second report within twelve months could trigger a mandatory relationship review by someone outside the business line. That takes the decision away from the people with the strongest incentive to defer it. The principle is the one behind an independent auditor: the person who benefits from a decision should not be the only one making it.

The review itself should produce a short, standard record: the reports considered, the options weighed, the decision, the conditions attached and the date of the next review. Options include exiting, restricting products such as wires, requiring enhanced due diligence, or retaining with closer monitoring. Each is legitimate in the right case. What examiners and boards object to is the absence of a decision.

The case for keeping accounts open

There is a serious counter-argument, and it deserves a hearing. Closing accounts has costs. Law enforcement sometimes asks banks to keep an account open so investigators can follow the money. Exiting a customer also moves the activity to another institution, often a less capable one, where it may become harder to see.

Broad exits create their own harm. Wholesale de-risking of categories such as money transmitters, foreign correspondent banks or charities operating in conflict zones cut off legitimate users along with bad ones. Congress later directed Treasury to study the problem, and Treasury published a de-risking strategy in 2023. A rule that says “two reports and you are out” would recreate that harm customer by customer.

The answer is not a mechanical exit rule but a deliberate, documented decision, made independently and revisited. Keeping a reported customer can be right. Keeping one by default, because no one was asked, is the pattern the FinCEN Files exposed.

One customer, three systems

To see how these pieces interact, follow a hypothetical customer through a mid-sized bank: a small import business with two checking accounts, plus a separate account opened later under a slightly different name by the same owner.

In January, the monitoring system flags a run of incoming wire transfers into the first account that are far larger than the business’s expected activity. An analyst opens the alert. The case management system shows the account, the transfers and a short due diligence profile. It does not show the third account, because the customer database treats the second business name as a different customer. The analyst finds the transfers odd but cannot see the pattern, and files a SAR describing only what is visible.

In April, the third account generates its own alert: money arriving and leaving within days, the classic sign of an account used as a pass-through. A different analyst picks it up, sees no prior history (as far as the system knows, this is a new customer) and files a second SAR. Neither report mentions the other.

In July, the continuing-activity review on the first account comes due. The first analyst notes that the large wires have continued and files a third report, again without the third account. The bank has now filed three times on one owner and holds three narratives that each describe a piece.

In August, a law enforcement agency sends a subpoena about the owner. It lands with the legal team, which handles it competently and files the paperwork. Nobody records it against the earlier SARs, so the AML team never learns that its reports attracted interest.

Meanwhile, the relationship manager who brought in the importer sees a growing, profitable client. No one has told them about the SARs, because SARs are confidential and the process for escalating relationship decisions only triggers on reports against a single customer record. The accounts stay open and the money keeps moving.

Every individual in this story did their job. The bank filed, the legal team responded and the relationship manager served the client. Yet the institution as a whole flagged suspicious money three times and kept handling it, which is the pattern the FinCEN Files described.

The same year, redesigned

Now replay it with three changes. Entity resolution links the three accounts to one owner. The case management system shows prior reports. And a second report within twelve months triggers an independent relationship review. In April the analyst sees the January report and writes a single, connected narrative that is far more useful to investigators, and the review is triggered automatically. The subpoena is logged against both reports. The bank’s decision about the importer is made deliberately, documented and defensible, whatever it turns out to be.

The bank needed no extra staff for any of those changes. All of them were data and decision design.

How it differs elsewhere

At a broker-dealer, the same owner might move money through a brokerage account by depositing funds, buying little and wiring out. The data problem is similar, but the monitoring scenarios and the examiner, FINRA alongside the SEC, are different. At a credit union, the owner might be a member with a small business account, and the field of membership and board structure shape who reviews the relationship. At a global bank, the import business might never be a customer at all, appearing only as a counterparty in correspondent payments, where the bank can file but cannot easily exit anyone.

A reputational problem as much as a compliance one

AML can feel like a cost center that exists to keep examiners happy. The FinCEN Files showed otherwise. When leaked reports reveal that a bank flagged money as suspicious and kept moving it, the damage falls on the bank’s name as well as its compliance record. Customers, counterparties, investors and politicians read the headlines, not the filing statistics.

The leak also exposed an assumption. Programs had been built on the premise that SARs would never be seen outside the bank and the government. Narratives were written for an investigator, with no thought for how they would read in a newspaper. A bank cannot control whether its reports leak, but it can ensure that its own records show what it did next.

The cost of noise

There is also a straightforward money question. Analysts reviewing false positives are expensive, and a program that generates noise must hire more of them. Spending on data quality and entity resolution can reduce that waste while improving the reports that matter. The effective program and the efficient program are often the same program.

The budget conversation is usually framed wrongly. Alert review is an operating cost that grows with transaction volume. Entity resolution and tuning are investments that reduce the operating cost and improve output. A finance team that sees only the investment line will defer it, year after year, while the operating line keeps rising.

The counter-argument from caution

A compliance officer could reasonably object that efficiency talk is how programs get cut. In 2018, U.S. Bancorp’s resolution with federal authorities described a bank that had capped monitoring alerts to fit its staffing levels. The objection is fair. The answer is sequencing: improve data first, test every tuning change, document it, and only then redeploy the hours saved. Efficiency that cannot be evidenced is a risk.

What supervisors were starting to ask

Regulators, meanwhile, were signaling a shift in what they would ask. FinCEN’s notice pointed toward usefulness and national priorities. A bank whose only evidence of effectiveness is a filing count will struggle to answer a question framed around value.

What a board should see instead of a filing count

A board that sees only filing counts is looking at the least informative of the three measures. A short report that pairs false positive rates, time from activity to filing, recorded law enforcement follow-up and the share of repeat-subject customers with a documented decision tells a far more useful story.

A dashboard in three parts

• Volume. Alerts by scenario, the share that became cases and the share of cases that became filings, with the trend. A note on tuning changes made and the testing behind them.
• Usefulness. Median days from activity to filing, the share of filings with resolved customer identifiers, recorded law enforcement follow-up by scenario, and results of quality reviews of a sample of narratives.
• Action. The number of repeat-subject customers, the share with a documented independent decision, the decisions taken and any overdue reviews.

Each measure needs a named owner. Volume belongs to the BSA officer and the monitoring team. Usefulness is shared with data engineering. Action belongs to whoever chairs the relationship review committee, ideally someone senior outside the revenue line.

How the picture differs by institution

The same three-part report works at different scales. A credit union or community bank board may see it quarterly from the BSA officer, with the independent testing results alongside. A broker-dealer’s report will also reflect FINRA Rule 3310, including its requirement for periodic independent testing of the AML program. A large bank will see it through its risk committee, with the first line, the compliance function and internal audit each reporting their part. The measures are the same; the layers of review differ.

Features of programs that hold up

The programs that hold up have a few recognizable features. Their customer data is connected, so an investigator sees the whole customer. Their monitoring is tuned against the government’s stated priorities rather than against everything at once. They record feedback from law enforcement, and they have a clear, independent path from repeated reports to a decision about the relationship.

They also report honestly to their boards. Rather than a single headline number, directors see a handful of measures that cover all three questions: how much is reported, how useful it is and what happens next. When a measure moves the wrong way, a named owner explains why and what will change. A board expects the same discipline for credit risk or liquidity; financial crime deserves no less.

Where technology fits

Technology plays a supporting role. Newer monitoring tools, including those that use machine learning, can reduce false positives and surface patterns rules miss. But they inherit whatever is wrong with the underlying customer data, and a sophisticated model reading fragmented records will produce sophisticated fragments. The order matters: connect and clean the data, then improve the detection.

Any model used in monitoring also brings model risk management obligations at supervised banks: documentation, validation, ongoing performance monitoring and explainability that an examiner and an investigator can follow. Those obligations are manageable, but they should be budgeted from the start rather than discovered at the first exam.

The mirror image

The weak programs look like the mirror image. They treat rising filing numbers as proof of strength and add analysts to clear alert backlogs instead of fixing the data and rules that create them. They leave monitoring, investigations and due diligence on disconnected systems. They let the business line that earns from a customer decide alone whether to keep a repeatedly reported relationship. And they throw away the feedback signal when law enforcement follows up.

The aim is not to file less. It is to connect reporting, investigation and relationship decisions so that each can be seen. Institutions should confirm their specific obligations with counsel.

What the AML team should be able to answer

These questions test all three parts at once. Each should be answerable from system records, without a special project.

• What share of our monitoring alerts turn out to be false positives, and is that number going up or down?
• When an investigator opens an alert, can they see every account, prior report and due diligence file for that customer on one screen?
• How many customers were the subject of more than one report last year, and who decided about each relationship, independent of the business line that earns from it?
• Do we record law enforcement requests and subpoenas against the original reports, and what do they tell us about which reports are useful?
• If our filings leaked tomorrow, what would they show about how we acted on what we knew?

A team that can answer all five from its systems has a program that can evidence effectiveness under almost any definition a regulator settles on. A team that needs weeks to answer them has found its first project.

With hindsight

The September 2020 notice turned out to be the start of a long road. Within months, Congress enacted the Anti-Money Laundering Act of 2020 as part of the annual defense authorization law, which became law on January 1, 2021 after Congress overrode a presidential veto. The act wrote much of the effectiveness agenda into statute. What had been a regulator’s question became a legislative direction.

The act did more than endorse the idea. It required national AML priorities, directed FinCEN to give institutions periodic feedback on which reports proved useful, and ordered reviews of reporting thresholds and of ways to streamline filing. It also carried the Corporate Transparency Act, which created a beneficial ownership reporting regime that was later narrowed sharply in 2025.

FinCEN published its first national AML and countering-the-financing-of-terrorism priorities in June 2021. There were eight: corruption, cybercrime, terrorist financing, fraud, transnational criminal organization activity, drug trafficking organization activity, human trafficking and smuggling, and proliferation financing. They gave substance to the idea, floated in the notice, that programs should be guided by what the government most needs.

FinCEN said at the time that institutions would not have to incorporate the priorities into their programs until a final rule took effect. That left banks with a choice. Some mapped their monitoring scenarios to the eight priorities straight away. Others waited for the rule, which is still not final.

In April 2021 the federal banking agencies clarified how model risk management guidance applies to systems that support Bank Secrecy Act compliance. They said it did not require any particular framework. That removed one brake on banks wanting to tune or replace monitoring systems.

The leak itself had a legal ending. In June 2021 a former FinCEN senior adviser, who had pleaded guilty to conspiring to disclose SARs unlawfully, was sentenced to six months in prison. BuzzFeed News then confirmed she had been its source. Confidentiality of SARs was reaffirmed, not loosened.

A proposed rule to make programs effective, risk-based and reasonably designed followed in mid-2024. FinCEN withdrew that proposal and replaced it with a new one in April 2026, which separates program design from implementation. The banking agencies issued parallel proposals. As of this writing in October 2026 it remains a proposal.

Enforcement made the after-filing question concrete. In October 2024 TD Bank pleaded guilty to Bank Secrecy Act and money laundering charges and agreed to pay more than $3 billion. FinCEN’s share, about $1.3 billion, was the largest penalty it had ever imposed on a depository institution. The Justice Department said the bank had failed to monitor $18.3 trillion of customer activity over six years.

The volume question also moved. In October 2025, FinCEN and the banking agencies issued SAR answers to frequently asked questions. They said there is no requirement for a separate continuing-activity review after a filing, and no explicit requirement to document a decision not to file. That loosened two of the mechanisms that had pushed volume up.

The timeline says something on its own. Six years after the notice, the formal definition of an effective program is still being written. Anyone who waited for the final rule before acting would still be waiting.

The shift in emphasis from activity to outcomes has held. Examiners and institutions talk more about feedback, prioritization and report quality, and many banks have invested in entity resolution and analytics. The direction FinCEN signaled in 2020, and that the FinCEN Files made vivid, has become the mainstream way of talking about AML.

The incentive problem has proved harder. Defensive filing remains common because missing a report still feels costlier than filing a weak one. No rule fully removes that asymmetry, and compliance officers are understandably cautious.

The durable advantage lies in the plumbing. Programs that can show their own loop from alert to relationship decision are best placed whatever the final rule says. Connected customer data, recorded feedback and a documented, independent path from repeat reports to action are useful under any definition of effectiveness. They are also what a regulator, a journalist or a board will ask to see.