New AML Rules Are Adding a Compliance Layer to M&A Due Diligence

Three regulators on two continents made significant moves on anti-money laundering and customer due diligence requirements in the first quarter of 2026. Individually, each action is a compliance update. Taken together, they signal a meaningful shift in how financial institutions and their acquirers approach due diligence, one that is already affecting deal timelines and buyer behavior in the M&A market.

On February 13, the Financial Crimes Enforcement Network (FinCEN) issued an exceptive relief order (FIN-2026-R001) that changed the framework for customer due diligence. On April 7, the FDIC Board of Directors approved a new Notice of Proposed Rulemaking for AML/CFT program requirements, issued jointly with the Office of the Comptroller of the Currency and the National Credit Union Administration. And in early April, the UK's Financial Conduct Authority published findings from a review of customer due diligence practices, highlighting gaps between regulatory expectations and actual implementation.

What Changed at FinCEN

The most significant development is FinCEN's shift from periodic re-verification to continuous, trigger-based monitoring. Under the new framework, financial institutions are no longer required to re-verify the beneficial owners of a legal entity customer each time that customer opens a new account. Instead, the emphasis moves to ongoing monitoring for trigger events that indicate a change in the customer's risk profile.

This is a practical change, not a relaxation of standards. The old approach treated beneficial ownership verification as a box to check at defined intervals. The new approach requires institutions to maintain what one regulatory commentator described as a "living, evidenced argument" about each customer's risk profile, updated when circumstances change rather than on a fixed calendar.

For companies that are themselves subject to these requirements, the compliance infrastructure needed to support continuous monitoring is more sophisticated than what periodic re-verification demanded. That infrastructure (or its absence) becomes relevant during M&A due diligence.

The FDIC's New Proposed Rulemaking

The FDIC's April 7 action is broader in scope. The proposed rule, developed jointly with the OCC and NCUA, revises AML/CFT program requirements for banks to align with the Anti-Money Laundering Act of 2020. The rulemaking introduces several updates, including risk-based approaches to program design, enhanced requirements for transaction monitoring, and clearer expectations around suspicious activity reporting.

For financial institutions considering acquisitions, this creates a new layer of analysis. Any acquisition that involves a regulated financial entity, including fintech companies, money services businesses, and payment processors, now requires a more detailed evaluation of the target's compliance posture relative to the evolving regulatory baseline.

The UK Dimension

The FCA's April review of customer due diligence practices adds an international dimension. The review identified specific gaps in how firms are implementing CDD requirements, including insufficient documentation of risk assessments, inconsistent application of enhanced due diligence for higher-risk customers, and inadequate ongoing monitoring processes.

For businesses with UK operations or customer bases, the FCA's findings serve as both a warning and a benchmark. A buyer evaluating a target with UK-facing activities will want to see evidence that the target's CDD practices meet the FCA's stated expectations, not just the minimum statutory requirements.

Cross-border transactions face a compounding effect. A deal involving a U.S. parent acquiring a company with UK operations now needs to satisfy both the evolving U.S. standards and the FCA's expectations. The due diligence workstream for compliance has expanded accordingly.

How This Affects M&A Transactions

The practical impact on deal activity shows up in several ways. Due diligence timelines are extending. Compliance reviews that once took days are now taking weeks, particularly for targets in regulated industries. Buyers are engaging specialized compliance advisors earlier in the process to assess the target's AML/CFT program before the letter of intent is signed, rather than discovering issues during confirmatory diligence.

Deal structures are adapting. Buyers are more frequently including compliance-related representations, warranties, and indemnities in purchase agreements. Some are structuring holdbacks or escrow arrangements tied to the target's ability to meet specific compliance milestones post-closing.

Valuation adjustments are appearing. When a target's compliance program requires significant investment to meet current standards, that cost is being factored into the purchase price. A business with a robust, well-documented compliance infrastructure is worth more than a comparable business that needs a compliance overhaul.