AML programmes stay effective during regulatory change by following four principles: focusing resources on real risk, keeping activity inside the monitored financial system, building a culture of compliance that does not depend on the mandate, and documenting decisions for future examiners.

How to stay effective through regulatory change was a recurring theme at September’s ACAMS Carolinas Chapter AML Symposium. These principles matter because compliance teams in 2026 are absorbing new obligations, responding to proposed FinCEN rule changes, and preparing for examinations judged against standards not yet written. 

Four principles for resilient AML programmes:

1. Focus resources on real risk

2. Keep activity inside the monitored financial system

3. Build a culture of compliance that does not depend on the mandate

4. Document decisions for future examiners

Why does Focus Matter in an AML Programme?

An AML programme is effective when its resources are directed at real financial crime risk. Focus is the principle most easily lost as regulatory scope widens.

Why it matters: Every new advisory, typology, or reporting expectation adds to what a programme must cover. Scope can grow faster than the resources available to support it.

What is happening: Programmes stretched across too many priorities become less effective. Analysts spend more time on activity with little connection to financial crime, alert volumes rise, and high-risk cases compete for attention with low-risk ones.

How to respond: Financial institutions should set clear boundaries on what their AML programme is designed to detect. That means:

• Testing whether each new obligation adds meaningful risk coverage or only adds volume

• Reviewing risk assessments and typologies against real risk, not just the latest guidance

• Meeting new requirements without diluting focus elsewhere

Prioritisation is not the same as doing less. It means deciding deliberately where effort goes and being able to explain that reasoning to an examiner.

Focused AML programmes detect more financial crime because their resources go where the risk is.

Why can De-Risking Reduce Visibility into Financial Crime?

De-risking reduces visibility into financial crime because the underlying activity rarely disappears. It moves outside the regulated financial system.

De-risking is the practice of exiting relationships with customers or customer groups perceived as high risk, rather than managing that risk.

Why it matters: Exiting a relationship can look like the cautious option because it reduces an institution’s own exposure. For the financial system as a whole, the effect can be the opposite.

What is happening: Funds that leave the regulated system shift into cash and informal channels. These channels have no transaction records, no transaction monitoring, and no suspicious activity reporting.

How to respond: Managing risk within the system is often more effective than exiting it. Tools include:

• Enhanced due diligence for higher-risk customers

• Proportionate transaction monitoring

• Clear escalation routes for unusual activity

• SAR filing that keeps law enforcement aware of potential illicit activity

Exiting a relationship remains the right decision where risk cannot be managed. That decision is best when made case by case, rather than applied to whole populations.

Keeping activity inside the monitored financial system preserves the visibility AML programmes depend on.

Why Should a Culture of Compliance Go Beyond Regulatory Requirements?

A culture of compliance should go beyond regulatory requirements because programmes built around the minimum standard weaken whenever regulatory emphasis shifts.

A culture of compliance is the shared set of values and behaviours that leads staff to identify, escalate, and act on financial crime risk. It rests on three conditions: staff feel safe raising concerns, trust the institution they work within, and believe their actions make a difference.

Why it matters: Rules and systems are only part of an effective AML programme. Detection also depends on people, from the analyst who escalates an unusual pattern to the team lead who supports a difficult filing decision.

What is happening: When regulatory expectations shift or become uncertain, institutions ask whether a given control is still required. If the answer is no, the temptation is to scale it back. Applied across a programme, this reasoning reduces compliance to the minimum standard.

How to respond: The strongest AML programmes are anchored in purpose rather than mandate. Their controls exist because they detect and prevent financial crime, and that rationale holds regardless of regulatory emphasis. Compliance leaders should set this expectation and make sure staff see their work as more than a checklist.

A culture of compliance anchored in purpose keeps AML programmes stable through regulatory change.

Why Should AML Teams Document Decisions Beyond Current Requirements?

AML teams should document decisions beyond current requirements because examinations look back, and future examiners may apply different expectations.

Why it matters: Proposed changes to FinCEN rules may reduce the documentation financial institutions are required to keep. For stretched compliance teams, this can look like relief, but it carries long-term risk.

What is happening: How examiners apply new rules in practice will only become clear over time. Decisions made today may be reviewed years from now, against expectations that differ from current ones.

How to respond: Documentation proves that a decision was reasonable when it was made. Financial institutions should record the rationale behind:

• Closing an alert

• Clearing a screening match

• Filing a suspicious activity report

The same standard applies to automated and AI-assisted decisions. Examiners expect a clear, explainable record of how each outcome was reached.

Documenting decisions to a standard that holds up under any future review protects institutions long after today’s rules change.

Key Takeaways

• AML programmes are most effective when resources focus on real financial crime risk.

• De-risking can push activity into cash and informal channels, reducing visibility across the financial system.

• A culture of compliance anchored in purpose, not mandate, keeps AML programmes stable through regulatory change.

• Documentation should be written for future examiners, including for automated and AI-assisted decisions.