An AML compliance officer coordinates the institution’s work under its applicable anti-money laundering requirements. The appointment becomes mandatory when the governing program rule requires a designated person. It does not arise simply because a company reaches a particular headcount or revenue.
The details depend on the institution. A bank, a money services business, and an investment adviser do not necessarily face the same requirements or compliance date. The officer also needs enough authority and resources to carry out the assigned responsibilities.
Compliance Officers supports designated officers with documented background research and due diligence. This article explains the appointment, its limits, and the distinction between current duties and FinCEN’s proposed changes, reviewed on September 30, 2026.
When an AML compliance officer is required
The Bank Secrecy Act establishes AML program obligations for covered financial institutions, subject to applicable regulations and exceptions. Designating a compliance officer forms part of that framework. First determine which rule covers the business and when it applies.
For banks, the applicable program requirements include responsibility for coordinating and monitoring day-to-day compliance. Banking rules can refer to an individual or individuals. Sharing responsibilities does not excuse an institution from identifying who performs them.
Meanwhile, money services businesses have their own program rule in 31 CFR 1022.210. It requires a designated person to assure day-to-day compliance. The rule also addresses written procedures, training, and independent review.
By contrast, an ordinary commercial company does not become subject to every BSA program requirement merely by opening a bank account. Its bank may request identification and ownership information, but that request does not establish an identical program duty for the customer.
Appointment deadlines depend on the sector
For a money services business, the rule specifies the later of July 24, 2002, or the end of a 90-day period. That period begins the day after the business is established. It is not a grace period that begins with a regulator’s first inquiry.
Other institutions must check their own rules and effective dates. A program deadline from one sector should not become a general deadline for every financial business.
Before documenting an appointment, identify the relevant legal entity, activities, and regulatory category. A business name alone may not reveal the applicable obligations. If the classification is uncertain, obtain legal advice before relying on a deadline.
What the designated person does
The MSB rule gives concrete examples of the designated person’s duties. They include assuring proper reporting and recordkeeping, updating the program when needed, and providing appropriate training and education.
Those responsibilities continue after the initial appointment. For example, a change in requirements may call for revised procedures or staff guidance. The officer should know who evaluates the change and who puts the necessary response into practice.
The work also involves coordination. Operations staff may collect information, technology teams may support monitoring, and management may approve resources. The appointment should make clear how the officer works with those teams and raises unresolved issues.
As a result, documented responsibility helps prevent gaps. If two departments each assume the other handles a matter, naming an officer will not by itself resolve the confusion. The institution needs an arrangement that works in its daily activities.
Independent review is a separate responsibility
Under the MSB rule, the designated person cannot conduct the required independent review. Another officer or employee may perform it when the arrangement satisfies the rule. An outside reviewer is also an option where suitable.
This distinction matters in a small business. A person who runs the AML program may understand it well, but familiarity does not create independence. The review must provide the separate assessment that the applicable requirement calls for.
Similarly, a counterparty investigation is not automatically an independent review of the whole AML program. The two engagements ask different questions. One examines a subject or relationship; the other tests the relevant program.
Before engaging a provider, define the work and assess any conflicts. The label “compliance review” does not establish its scope. Management should understand what the engagement covers and what remains outside it.
Does an AML compliance officer need certification?
The bank and MSB program requirements discussed here do not make a named commercial certification the universal condition for appointment. That does not mean an institution can ignore qualifications or assign the role to someone unprepared.
The FFIEC bank examination manual addresses competence, authority, independence, and access to resources. An officer needs to understand the bank’s requirements, program, and risk profile. A certificate may support professional development, but it does not replace that knowledge.
Therefore, distinguish regulatory requirements from the employer’s hiring criteria. An institution may require experience, credentials, or specialized training as part of its staffing policy. Those standards can be appropriate without being a universal federal licensing rule.
When considering a candidate, discuss the actual work. Ask about relevant products, customer types, systems, and escalation responsibilities. The job description should reflect the institution’s needs rather than relying on a title alone.
Authority and resources for the AML compliance officer
For banks, the FFIEC manual emphasizes the board’s responsibility to support the designated officer. Appointment alone is insufficient. The officer needs appropriate authority, independence, and access to resources to administer the program.
Reporting matters as well. The officer should keep the board and senior management informed about the program’s status and relevant issues. Delegating tasks to staff does not remove responsibility for overseeing day-to-day compliance.
In practical terms, the institution should know how the officer obtains missing records or raises a staffing problem. It should also know who decides when business priorities conflict with a compliance concern.
For instance, a useful appointment record can identify the role, reporting route, delegated tasks, and access to information. These details help management assess whether the arrangement matches the responsibilities it has assigned.
Current U.S. location duties and the 2026 proposal
The existing statutory requirement
Section 5318(h)(5) already addresses where responsibility for the program rests. The duty to establish, maintain, and enforce an AML/CFT program must remain with persons in the United States. Those persons must be accessible to Treasury and the appropriate federal functional regulator for oversight and supervision.
Consequently, a group should not assume that all relevant responsibility may sit abroad simply because a proposal remains pending. Assess the present statute alongside the rules for the institution.
What FinCEN proposed
FinCEN announced its program reform proposal on April 7, 2026, and published it on April 10. Among its changes, the proposal would expressly require the designated AML/CFT officer to be in the United States and accessible to regulators.
It would also describe that person’s responsibility for establishing and implementing the program and coordinating and monitoring daily compliance. FinCEN proposed a 12-month period after a final rule for implementation.
As of this review, these proposed amendments remain a proposal. They do not replace current obligations. Nor should the proposed timetable become a fixed future deadline before a final rule establishes it.
Board oversight is not entirely new: banks already have program approval and governance requirements. A discussion of the proposal should distinguish changes from duties that an institution already owes.
Investment advisers: the delayed effective date
FinCEN’s final rule delayed the effective date of its investment adviser AML rule from January 1, 2026, to January 1, 2028. The delay concerns the rule covering certain registered investment advisers and exempt reporting advisers.
That distinction matters. It is inaccurate to tell every adviser that the delayed rule already requires an AML compliance officer in 2026. It is also inaccurate to treat the delay as relief from every other applicable obligation.
An adviser may have responsibilities arising from another regulated capacity, other law, or contractual arrangements. The firm should assess those separately. FinCEN has also indicated that it will review the adviser rule, so preparation should allow for further developments.
Therefore, keep the effective-date decision in the compliance file. If someone relies on the delay, the record should identify which rule it concerns and why it applies to the firm.
Can one officer serve several companies?
A group should assess this arrangement rather than assume that a shared title makes it acceptable. For example, different entities may have different products, risks, records, and reporting obligations.
Interagency guidance on sharing BSA resources cautions that sharing a BSA officer among banks may be inappropriate. It identifies challenges involving confidential suspicious activity reports, daily oversight, and communication with each bank’s leadership.
Thus, permission to share some resources does not establish blanket permission to combine every responsibility. Review the applicable rules, capacity, confidentiality restrictions, and conflicts before adopting the arrangement.
For example, an officer who cannot access one entity’s records may struggle to oversee its program. Likewise, an arrangement that relies on informal conversations may leave unclear which entity addressed a problem. Those practical limits deserve attention before the appointment.
Due diligence support and the institution’s decisions
An AML compliance officer may need research about a customer, owner, supplier, or proposed transaction. External support can help establish facts, document sources, and identify unanswered questions.
However, a report does not make the institution’s decision for it. Instead, the institution must connect the findings to its own program, risk assessment, and authorized decision process.
Our guide to company due diligence explains what a business review can establish. The related discussion of the CDD rule addresses the requirements that apply to covered financial institutions.
Ownership questions also require care. Identifying a beneficial owner, satisfying a bank’s CDD requirements, and determining a company’s BOI reporting duties involve different rules. A finding under one framework does not automatically settle the others.
Before commissioning research, identify the question and the subject. Provide appropriate identifiers and context through the agreed channel. Also define who will receive the results and assess any restrictions on information sharing.
Personal accountability and escalation
Compliance responsibilities can carry personal consequences. FinCEN has brought enforcement actions involving individual compliance executives, including its settled case against former MoneyGram officer Thomas Haider.
That history does not mean every control failure makes an officer personally liable. The legal standard, conduct, authority, and surrounding facts matter. An individual facing a specific concern should obtain qualified legal advice.
For management, the practical lesson is to give compliance concerns a clear route for resolution. Record material issues, the response, and any work that remains open. A record helps explain what happened; it does not excuse a failure to meet a duty.
AML compliance officer: common questions
When must a business appoint an AML compliance officer?
When its applicable AML program requirement calls for a designated person, by the relevant compliance date. Start with the business’s activities and regulatory classification. A bank’s request for customer information does not automatically impose that same program requirement on every customer.
Is ACAMS certification legally mandatory?
The bank and MSB program rules discussed here do not impose a universal requirement for that specific credential. However, the institution still needs a competent person with appropriate authority and resources. Its own hiring standards may require credentials or experience.
May the officer conduct the independent review?
The MSB rule expressly excludes its designated compliance person from performing the required independent review. A different internal reviewer or an appropriate external provider may perform that work. Confirm the standards for the institution and the engagement.
Can the officer work outside the United States?
Assess the existing U.S. responsibility requirement in 31 U.S.C. 5318(h)(5) and the applicable sector rules. FinCEN’s 2026 proposal would expressly locate the designated officer in the United States. A pending proposal is not permission to disregard the current statute.
Can one person serve several institutions?
Do not assume that the arrangement is appropriate. Review the governing rules, time, authority, conflicts, and information restrictions. Banking regulators have specifically identified difficulties with sharing a BSA officer among banks, even where sharing other resources may be useful.
Does the investment adviser rule apply in 2026?
FinCEN delayed that rule’s effective date to January 1, 2028. The delay concerns the specified adviser AML rule, not every duty an adviser might have. Check other regulated activities and requirements separately, and follow any later rulemaking.
Support your designated officer with documented research
Compliance Officers provides background research and due-diligence support for a defined person, company, or relationship. The work can help an AML compliance officer assess available evidence and identify matters requiring further review.
Contact Compliance Officers to discuss the scope. Call +1 (305) 647-3000, use WhatsApp, or email info@complianceofficers.org.
This publication provides general information, not legal advice, a legal opinion, or a guarantee of any regulatory result. Obligations depend on the institution, its activities, and applicable law. Consult qualified counsel about classification, appointments, staffing arrangements, and individual liability.
