ACAMS Assembly Las Vegas 2026:

The ACAMS Assembly in Las Vegas brought together regulators, law enforcement, banks, fintechs and technology leaders for two days of discussion on the future of financial crime compliance. Our team attended sessions across both days.

Two messages stood out. Regulators and law enforcement want programs judged on effectiveness, not paperwork. And AI is welcome in investigations as long as a human stays accountable.

Sessions covered: the opening plenary with FinCEN's Acting Director and a panel on financial intelligence 25 years after 9/11; the US regulators panel (NCUA, OCC, Federal Reserve, FDIC and FinCEN); the ACAMS International Anti-Fraud Technology Task Force; "AI Fast and Slow" (fintechs vs. banks); and transaction monitoring in gaming.

Five themes from Day 1

1. Effectiveness over box-ticking. FinCEN, the banking regulators and the fintech panel all said programs will be judged on outcomes, not paperwork.
2. Feedback loops. FinCEN wants to tell institutions which of their reporting is useful. IRS Criminal Investigation (IRS-CI) showed that SARs feed most of its cases.
3. Sharing information across silos and sectors. 314(b), the Global Signals Exchange and the fraud task force's legal analysis all push firms to share more.
4. AI drafts, humans decide. Speakers welcomed AI for gathering evidence and drafting narratives, but judgement and sign-off stay with people.
5. Data is the foundation. The UBS consent order, the 9/11 panel and the gaming panel all traced failures back to fragmented or untraced data.

Session highlights

FinCEN fireside and the 9/11 panel. FinCEN's Acting Director made feedback to institutions her top priority, so firms can put resources where they matter most. The AML program rule is still being finalised. Law enforcement and bank veterans said today's threats combine terrorist financing, fraud, cyber and crypto, while banks still handle them in separate teams.

US regulators panel. Regulators want a risk assessment that is a real working tool, not a template. Their good practice for investigations includes pulling case data together automatically, automating case workflows and QA, and, in early cases, auto-generating SAR narratives. The panel also said that from 2 November, a Matter Requiring Attention (MRA) must be linked to material financial risk or a substantive violation. Bank–fintech partnerships remain a focus because of fast onboarding and over-reliance on the fintech's own controls.

Anti-Fraud Technology Task Force. Using pig-butchering scams as the example, the task force mapped the fraud lifecycle. Banks only see the payment and laundering stages, while the earliest signals sit with telecoms, social media and domain registrars. The task force has published a legal analysis of what data can be shared, a toolkit on the most useful data for fighting fraud, and a live pilot with the Global Signals Exchange.

AI Fast and Slow. A trust and safety leader from a global technology company said efficiency is a poor goal but a great byproduct. The real goals are pointing investigators at the right cases and protecting customers. His rule: AI drafts, human signs. A bank leader described agents that compile due diligence files for analysts, and said the hard part is getting regulators comfortable with how the AI is tested.

Gaming: land-based vs. digital. Casinos see behaviour on the floor but struggle with manual data. Digital platforms have rich data but no face-to-face contact, and can't see money before or after it touches the platform. In both, systems often don't talk to each other. IRS-CI asked for SARs that state the suspicion first, back it with detail and make no unsupported claims.

Numbers worth knowing

• HSBC using Google Cloud AML AI: 60% fewer alerts and 2–4x more suspicious activity found.
• IRS-CI investigations (FY25): 89% had a BSA filing on the main subject, and 80% were linked to a SAR.
• UBS Financial Services penalty (2026): $125M, a repeat violation.
• UBS foreign currency wires not properly monitored (2019–2023): more than 61,500 wires, about $10.5B.

Sessions covered: FinCEN's SAR FAQs panel and a reaction panel; "After the Fall" on cartel disruption and AML investigations; investigation tips, tools and SARs that stand up to law enforcement; and agentic AI and the investigations operating model.

Five themes from Day 2

1. Relief from FinCEN, doubt about examiners. The SAR FAQs remove burdens such as the 90-day continuing review and mandatory no-SAR memos. Banks fear examiners may still challenge their decisions 18 months later, so many will keep the old habits.
2. "Is it highly useful to law enforcement?" This question was repeated all day as the test for every control. Law enforcement asked for the same things throughout: state the suspicion first, categorise it, keep it organised, and make the filer easy to contact.
3. Gathering data is still the investigator's biggest pain. In a session poll, AML managers named the time it takes to gather information as the most frustrating part of an investigation, ahead of waiting for technology and worrying about AI.
4. Decisions must be defensible and traceable. Short no-SAR rationales, auditors being able to follow the logic, and AI that is audit-ready at the decision level are the same idea at three levels.
5. AI agents are moving from cases to whole programmes. Agents first handle a single case, then a full workflow, then the programme. Humans stay accountable, agents run alongside people first, and monitoring never stops.

Session highlights

SAR FAQs and the reaction panel. Being near $10,000 is not suspicious on its own. Reviews after a SAR are not required, the 90-day continuing-SAR cycle is optional, and no law requires documenting a decision not to file. A former OCC lawyer warned that examiners still challenge these decisions and that FAQs can change with a new administration. A bank practitioner said dropping repeat reviews frees investigators to spot new behaviour. FinCEN enforcement said SAR failures are usually symptoms of weaknesses elsewhere, such as monitoring, due diligence or data quality, and that the goal is not more SARs for the sake of more SARs.

Cartel disruption. Designating cartels as terrorist organisations has given law enforcement new tools, especially asset forfeiture. When a leader is removed, the cartel fragments, but the money keeps moving through separate channels. Agencies named Chinese money laundering networks as the top threat. Their ask for SARs: say why it's suspicious (you don't have to be right) and make the filer easy to reach.

Investigations and SARs. Investigators' top complaint was the time spent gathering data. Managers want them to use the tools provided and reach a clear conclusion. A law enforcement agent explained that SARs are read aloud at regional review roundtables, so the suspicion belongs in the first paragraph. A well-organised six-page SAR opened a case for her. One practitioner treats QA as quality improvement, turning the most common errors into next month's training.

Agentic AI operating model. A technology lead described three generations of agents: one case, the whole case workflow, and the whole programme. A head of AML and fraud operations at a fintech uses AI to prepare and prioritise cases while humans stay accountable. His team ran the AI alongside human decisions for a long time before relying on it, and he warned that rolling out AI is not a light switch and the savings take time. His advice: find a real pain point, clean the data, run it in parallel, measure and adjust.

Numbers worth knowing

• FinCEN SAR FAQs (9 October 2025): being near $10K is not suspicious on its own, there are no mandatory reviews after a SAR, the 90-day continuing-SAR cycle is optional, and there is no legal requirement to document decisions not to file.
• SAR confidentiality joint statement (September 2026): banks can discuss transaction facts with customers without revealing that a SAR exists.
• Canaccord Genuity penalty: $80M in March 2026, then a record for a broker-dealer.
• UBS Financial Services penalty: $125M in 2026, a repeat violation.

Across both days, one idea tied the sessions together: make every decision defensible and traceable.

• Regulators want outcomes they can see.
• Law enforcement wants clear, well-organised suspicion.
• Examiners may still ask why a decision was made.
• Investigators still lose most of their time gathering data.

The practical path is to automate the preparation, not the judgement. Start with the data, run AI alongside people, keep a human accountable, and keep monitoring. That is how institutions can turn regulatory relief into better investigations.