As Treasury overhauls AML rules, banks need a new measure of success

• Key insight: As regulators rewrite the rules for anti-money-laundering compliance, they have an opportunity to create standards that will actually prevent financial crime rather than just documenting suspicious activity.
• What's at stake: Filing a suspicious activity report isn't the same as stopping a fraudulent transaction or recouping the money, especially on blockchain rails, where settlement is final.
• Supporting data: The value of assets received by illicit blockchain addresses spiked by 162% in 2025, much of this going to sanctioned entities linked to Iran or Russia.
  

"For too long, Washington has asked financial institutions to measure success by the volume of paperwork rather than their ability to stop illicit finance threats."

Processing Content

Those were the words of Treasury Secretary Scott Bessent in April, as Fincen vowed to "fundamentally reform" how banks fight illicit finance. 

This has been in the cards since the Anti-Money Laundering Act became law in 2021. But five years and two proposals later, the rules still prioritize reporting over prevention. On paper, this overhaul is exactly what the sector needs. In reality, the proposal still doesn't spell out what prevention means in practice, or how success will be measured. 

Under the current rules, financial institutions have 30 days to file a report on suspicious activity after detecting it. Some 4.8 million suspicious activity reports, or SARs, were filed in fiscal 2025, according to Fincen. But reporting doesn't necessarily mean more effective crime prevention. The sheer volume of reporting has been a drain on Fincen's resources; it's not realistic to process them all quickly. More importantly, filing a SAR isn't the same as stopping a fraudulent transaction or recouping the money, especially on blockchain rails, where settlement is final. 

As the paperwork piles up, the illicit finance market has ballooned. In 2025 alone, Nasdaq Verafin estimates that $4.4 trillion of illicit funds flowed through the global financial system, roughly the size of Japan's entire economy. The value of assets received by illicit blockchain addresses spiked by 162% in 2025, much of this going to sanctioned entities linked to Iran or Russia. As more assets move on-chain, this becomes an even more viable avenue for money laundering, so the problem will only escalate.

If the goal is to prevent crime rather than just document it, blocking illicit activity before the money disappears should be a more prominent focus for Fincen. Banks already do much of this every day, screening payments against sanctions lists and blocking suspected fraudulent activity. That work should count as proof of effective AML controls. 

Fincen's April proposal asks banks to mitigate money laundering risks and focus on their highest-risk customers, but it doesn't spell out how examiners will know that this mitigation has worked in practice. As it stands, an AML program is considered effective simply for existing and running in accordance with requirements. Here's what measuring prevention could look like in practice.

First, regulators should credit banks for blocking a suspicious wire transaction before the money goes out or for rejecting a payment to an address that comes up on a sanctions list. As banks increasingly integrate blockchain rails, the same applies to rejecting a transaction if a deposit address is flagged as high-risk.

Read more:

• AI-linked hacks hit Korean banks through loan-agent sites
• Fed, OCC order Amex to overhaul AML controls, fine $350M
• Fed supervision reform funnels more authority to Washington
• Ex-Fed nominee Shelton tapped to advise Treasury's Bessent

Second, freezing sanctioned entities before they receive or move digital assets should count in a bank's favor, especially as it relates to tokenized assets that they themselves issue. This is a capability the GENIUS Act already requires of stablecoin issuers, which could be extended more broadly to banks tokenizing other types of assets. Fincen already tracks funds frozen and returned via its Rapid Response Program, which could be a blueprint for how banks' AML programs are assessed on both traditional and blockchain rails.

Third, when assets can move almost instantly on-chain, speed is of the essence. Acting on a new sanctions designation or information from another bank could be essential to preventing losses, so speed of enforcement should be a key measure of success.

With Fincen encouraging the use of AI and blockchain technology, banks have the opportunity to show exactly which transactions they stopped and why. Collecting this information wouldn't be a new reporting requirement, because this data already exists. Banks log sanctions rejections, fraud holds and recovered funds. Similarly, blockchain records are public and permanent, making it possible for examiners to see exactly what was stopped when.

The danger with measuring stopped transactions is that banks could overcorrect, blocking legitimate customers in an effort to prove the rigor of their AML controls. Banks already overblock out of caution, so this is a real risk. That's why, when examiners review a bank's AML/CFT program and in the guidance that follows, banks should receive credit for blocking genuine illicit or criminal activity and for proving that they had a sufficient reason for doing so. 

This would be a far better metric than counting how many transactions have been stopped, which could encourage some banks to block just for the sake of blocking. That would be exactly the kind of box-ticking exercise Fincen is trying to move away from. Equally, wrongfully blocking legitimate transactions should weigh against a bank. 

As Fincen finalizes the rules, it should expand the list of factors its director considers before taking enforcement action beyond "useful information" and "innovative tools," to include language around illicit money stopped, recovered, or acted on quickly. 

Banks need a new framework to guide their AML policies and measure success, and Fincen finally has the opportunity to provide this. Implementing these recommendations would get us closer to the outcomes-based approach Bessent has called for.