Recent acts show how other law rides on the NDAA:
- 1 January 2021. The Senate overrode a veto and the FY2021 act became Public Law 116-283, carrying the Anti-Money Laundering Act of 2020 and the Corporate Transparency Act.
- 18 December 2025. The FY2026 act was signed as Public Law 119-60.
- 22 July 2026. The House passed the FY2027 bill, H.R. 8800, 216 to 212, after the Senate's S. 4784 failed a cloture vote on 14 July.
A bill Congress takes up every year makes a dependable vehicle, and several of the laws it carried reshaped AML in the US.
How does an NDAA become law, and is it a spending bill?
An NDAA authorizes; the spending comes later. Its long title gives the scope: appropriations "for military activities of the Department of Defense, for military construction, and for defense activities of the Department of Energy", plus military personnel strengths, for one fiscal year starting on 1 October. Appropriations acts then fund those programs separately, so a program can be authorized and still go unfunded.
Table 2. How an NDAA passes, with dates from recent acts.
| Stage | Who | Output |
|---|---|---|
| Markup | House and Senate Armed Services Committees | Each chamber's bill |
| Floor votes | House and Senate | Two passed versions (FY2027: the House bill, 22 July 2026) |
| Reconciling the texts | A conference committee or an exchange of amendments | One text both chambers pass (FY2026: Senate agreed on 17 December 2025) |
| Signature or veto | President | Law on signature (FY2026: 18 December 2025) |
| Override | Two thirds of each chamber | Law despite a veto (FY2021: House 28 December 2020, Senate 1 January 2021) |
The FY2021 act went through every row of that process. Both chambers agreed to the conference report between 8 and 11 December 2020, the President vetoed it on 23 December, and Congress overrode the veto, the last row of the table, which an act reaches only after a veto.
Which AML and sanctions laws rode on an NDAA?
Table 1. Financial crime laws carried by recent NDAAs (status as of October 2026).
| NDAA and public law | Provision | What it does | Status |
|---|---|---|---|
| FY2019, Public Law 115-232 | Section 889; Title XVII (FIRRMA, Export Control Reform Act of 2018) | Bars federal agencies from buying certain telecommunications and video surveillance equipment; widens foreign investment review; sets export control law | In force |
| FY2020, Public Law 116-92 | Fentanyl Sanctions Act; Caesar Syria Civilian Protection Act of 2019 | Sanctions on foreign opioid traffickers; Syria sanctions | Caesar Act repealed by the FY2026 act |
| FY2021, Public Law 116-283 | Division F, Anti-Money Laundering Act of 2020 | Amends the Bank Secrecy Act, including the AML program duty | Program rule proposed 10 April 2026 |
| FY2021 | Sections 6309, 6310, 6312 | Repeat violators: up to the greater of three times the profit gained or loss avoided, or twice the maximum penalty; a 10 year bar from US financial institution boards after an egregious violation; on conviction, the profit fined and bonuses repaid | In force |
| FY2021 | Section 6314 | Awards for whistleblowers who report Bank Secrecy Act violations | Rule proposed 1 April 2026 |
| FY2021 | Title LXIV, Corporate Transparency Act | Reports of beneficial owners to FinCEN | Narrowed to foreign reporting companies (90 FR 13688, 26 March 2025; final rule 14 August 2026) |
| FY2026, Public Law 119-60 | BUST Fentanyl Act; Caesar Act repeal; Comprehensive Outbound Investment National Security Act of 2025 | Amends the Fentanyl Sanctions Act and adds narcotics money laundering items to the State Department's control strategy report; ends the Syria act; outbound investment rules | In force |
| FY2027, H.R. 8800 and S. 4784 | Whole bill | Passed the House | Not law on 29 October 2026 |
Division F amended the Bank Secrecy Act of 1970, the law behind the currency transaction report and the suspicious activity report. The sanctions acts in the table are Treasury and State Department programs, listed here only because the NDAA carried them.
An AML change that rides on an NDAA starts working only when Treasury writes the rule. The FY2021 act became law on 1 January 2021, yet FinCEN proposed its whistleblower rule on 1 April 2026 and its program reform on 10 April 2026, both still proposals in October 2026, while the beneficial ownership title was narrowed by rule in March 2025 and August 2026. A compliance calendar records each rule's effective date, not the act's.
Each of those rules then lands as a dated change to a threshold or a report. complead, formerly Sanction Scanner, keeps that change log in its regulatory compliance and reporting workflows, where every threshold change is dated, given a cause and made reversible.
How much can an AML whistleblower receive?
Section 6314 rewrote the Bank Secrecy Act's whistleblower provision, 31 U.S.C. 5323. An award is "not less than 10 percent" and "not more than 30 percent, in total, of what has been collected" of the monetary sanctions, in an action whose sanctions exceed $1,000,000. Since December 2022 the law also covers sanctions cases under IEEPA, the Trading with the Enemy Act and the Kingpin Act.
Picture an action (illustrative) with $8 million of sanctions, all collected: the award falls between $800,000 and $2.4 million. If only $2 million is collected, the band drops to $200,000 to $600,000, because the base is what is collected, not what is imposed.
FinCEN's proposed rule gives its own example (91 FR 16328, p. 16333): one tip leads to separate actions by FinCEN, OFAC and the Justice Department, "each with total sanctions of $500,000", and FinCEN may add them up to pass the $1,000,000 threshold as one covered action. If all $1.5 million were collected, the band would run from $150,000 to $450,000 (the page's arithmetic). FinCEN counts about 87 original tips a year on average from 2021 to 2024.
Which NDAA and FinCEN steps came in 2026?
- 1 April. FinCEN proposed the whistleblower rule; comments closed on 1 June.
- 10 April. FinCEN proposed its AML/CFT program reform under the 2020 act.
- 22 July. The House passed the FY2027 bill; the Senate had not passed one by 29 October.
- 14 August. FinCEN's final beneficial ownership rule (91 FR 52508) took effect, keeping US person beneficial owners and US person company applicants out of the reports.
Of the titles the FY2021 act carried, the Corporate Transparency Act is the one FinCEN has rewritten twice by rule, in March 2025 and August 2026.
Related terms
- Suspicious activity report. The report a financial institution files on activity it suspects.
- Currency transaction report. The US report on cash transactions over $10,000.
- Bank Secrecy Act. The 1970 US law behind recordkeeping, reports and AML programs at financial institutions.
- Corporate Transparency Act. Title LXIV of the FY2021 NDAA, on beneficial ownership reports to FinCEN.
- USA PATRIOT Act. The 2001 law whose Title III widened the Bank Secrecy Act.
How this entry was checked. Dates and vote counts on this page come from the enrolled acts and their legislative history on govinfo (Public Laws 115-232, 116-92, 116-283 and 119-60), the House Clerk's roll call 278 of 22 July 2026, the Congressional Record of 14 July 2026 and the congress.gov records of H.R. 8800 and S. 4784, all reread on 29 October 2026 with 31 U.S.C. 5323 and FinCEN's Federal Register notices of 26 March 2025, 1 April 2026, 10 April 2026 and 14 August 2026. The award figures are illustrative except FinCEN's own aggregation example, and Ufuk Gürdaş, Compliance Specialist, traced every status cell back to its notice after Minhac Celik (Marketing Advisor, complead) drafted the entry. Last reviewed: 30 October 2026.
