US Bank AML Program Rule: 31 CFR 1020.210 Explained

Every US bank has to run an anti-money laundering program, and the minimum content of that program is set out in 31 CFR 1020.210. This guide summarises the section as shown on the eCFR, the unofficial online Code of Federal Regulations, which displayed Title 31 as current to 15 October 2026. The section is useful for accountants, internal auditors and consultants because it describes, in a short list, the building blocks that most compliance reviews test. Our guide to firm-wide AML risk assessments covers the risk side for practices.

Two categories of bank

The section sets requirements for two groups. Paragraph (a) covers banks regulated by a federal functional regulator, which the section describes as including banks, savings associations and credit unions. Such a bank is deemed to satisfy the statutory requirement in 31 U.S.C. 5318(h)(1) if it implements and maintains an AML program with the listed elements, and it must also comply with its federal functional regulator's rules on these programs.

Paragraph (b) covers banks that lack a federal functional regulator, for example private banks, non-federally insured credit unions and certain trust companies. These banks must have a written program whose internal controls specifically ensure compliance with the Bank Secrecy Act and 31 CFR Chapter X, the program must be approved by the board of directors or an equivalent governing body, and a copy must be available to FinCEN or its designee on request.

The minimum elements

For both groups, the program must include the following elements, as the eCFR text sets them out:

• Internal controls reasonably designed to ensure ongoing compliance.
• Independent testing of compliance, which can be carried out by bank personnel or an outside party.
• One or more designated individuals responsible for coordinating and monitoring day-to-day compliance.
• Training for appropriate personnel.
• Risk-based procedures for ongoing customer due diligence, including understanding the nature and purpose of customer relationships to develop a customer risk profile, ongoing monitoring to identify and report suspicious transactions, and keeping customer information up to date, including beneficial ownership information for legal entity customers.
• Compliance with 31 CFR 1010.610 and 1010.620, the sections on due diligence for correspondent and private banking accounts.

How the elements fit with other bank rules

The customer due diligence element links to the bank's customer rules. Account opening checks sit in the Customer Identification Program rule, ownership information for entity customers sits in the beneficial ownership rule, and monitoring feeds into suspicious activity reporting. The program is the umbrella under which these rules operate.

What "deemed to satisfy" means

The wording in paragraph (a) is worth reading carefully. A bank that implements and maintains a program with the listed elements is deemed to satisfy the statutory requirement, but the section adds that the bank must still comply with its federal functional regulator's rules. In other words, section 1020.210 is a floor set by FinCEN, and each bank also answers to its own supervisor, which may expect more detail in areas such as board oversight or the approval of the program. A review that tests only against section 1020.210 would therefore be incomplete for a regulated bank.

Why independent testing matters

The text requires independent testing but leaves the method to the bank and does not prescribe a frequency in the paragraphs we read. Practices that audit or advise banks often compare the bank's own policy with what staff actually do, then report gaps to senior management. Our guide to independent AML reviews in accountancy practices shows how the same idea works in a smaller setting.

Using the list in practice: our suggestions

These steps are our suggestions, not requirements in the section. When you review an AML program, map the evidence you are given to each element in turn, and write down where the evidence is missing. Check that the designated individual's role is defined, that training records match job roles, that the independent testing was truly independent of the people being tested, and that ongoing customer due diligence is described as risk-based rather than one-size-fits-all. Keep the review in writing, with dates.

A proposal that could change the picture

This rule is not the end of the story. In April 2026 FinCEN published a proposed rule that would rework the program rules, and the proposal states that it would add references to countering the financing of terrorism to program rule titles such as section 1020.210. We cover what it says in our separate guide to the April 2026 FinCEN program proposal. The proposal is not a final rule.

What we could not confirm

We read the eCFR text of section 1020.210 but not the federal banking agencies' own program rules, examination manuals or interagency guidance, so we cannot describe how examiners test each element. We did not read sections 1010.610 and 1010.620 and have only described them from the cross-reference. The eCFR timeline listed several changes to Part 1020 but did not say which affect this section. The eCFR is unofficial, so anyone relying on the text should check the official Code of Federal Regulations. This post is general information, not legal advice.