Why Your Bank Asks About Your AML Program

Sooner or later, most dealers in precious metals, stones, or jewels get a questionnaire from their bank, a request to "refresh" account information, or a call asking about cash deposits. Some get a closure letter. None of that means the bank has decided you are doing something wrong. It means the bank has its own BSA obligations, and you are one of the customers those obligations reach.

Why the bank is asking

Banks have their own Bank Secrecy Act rules, and they are broader than yours. A bank must run risk-based customer due diligence: it must understand the nature and purpose of each customer relationship so it can build a customer risk profile, and it must monitor accounts on an ongoing basis to identify and report suspicious transactions. Unlike a dealer, a bank is subject to a mandatory suspicious activity reporting rule.

When the customer is a business that buys and sells gold, diamonds, or jewelry, often for cash and sometimes across borders, the bank's risk profile for that customer will usually call for more questions than it asks a dentist's office. The questionnaire is how the bank gathers what it needs to decide whether, and on what terms, to keep the account.

What the examination manual says about dealers

Bank examiners work from the FFIEC BSA/AML Examination Manual. Its section on nonbank financial institutions (NBFIs) lists dealers in precious metals, stones, or jewels among the types of NBFI that banks serve, along with pawnbrokers and others. That section makes two points worth knowing.

The BSA does not require banks to act as the regulator of an NBFI industry or of an individual NBFI customer, and neither FinCEN nor the federal banking agencies expect them to.
A bank's due diligence on an NBFI customer should match the level of risk that customer presents.

In other words, your bank is expected to understand your business and manage the risk it presents to the bank. It is not expected to supervise your AML program.

The banking agencies and FinCEN made a related point in a joint statement of July 6, 2022. The Federal Reserve, FDIC, FinCEN, NCUA, and OCC reinforced their position that "no customer type presents a single level of uniform risk." They said they "continue to encourage banks to manage customer relationships and mitigate risks based on customer relationships, rather than decline to provide banking services to entire categories of customers." The statement covers nonbank financial institutions and cash-intensive businesses by name. It also says the manual's customer-type sections are not meant to signal that those customer types should be considered uniformly higher risk.

The same statement is just as clear on the other side: the agencies do not direct banks to open, close, or maintain specific accounts, and banks choose whether to enter or keep a relationship based on their business objectives, the customer's products, locations, and the bank's ability to manage the risk.

What changed in 2025 and 2026

Three federal developments since mid-2025 bear on how banks treat customers in lawful but scrutinized industries.

Executive Order 14331

Executive Order 14331, "Guaranteeing Fair Banking for All Americans" (signed August 7, 2025; 90 FR 38925) states a policy that banking decisions be made on the basis of "individualized, objective, and risk-based analyses." It directed the federal banking regulators to remove reputation risk and similar concepts that could result in what it calls politicized or unlawful debanking from their guidance and examination materials. Its definition of that term covers restricting access on the basis of political or religious beliefs, or on the basis of lawful business activities the provider disagrees with or disfavors for political reasons.

The reputation-risk rules

The OCC and FDIC adopted a final rule, "Prohibition on the Use of Reputation Risk by Regulators" (91 FR 18279, April 10, 2026, effective June 9, 2026). Under it, those agencies will not criticize or take adverse action against a bank on the basis of reputation risk, and will not require, instruct, or encourage a bank to drop a customer on that basis. The preamble says the rule bars supervisors from using BSA/AML concerns as a pretext for reputation risk. The NCUA adopted a similar final rule for credit unions (91 FR 38270, effective July 27, 2026).

Note the limit. These rules govern what the regulators do. In discussing its part of the rule, the FDIC said the rule applies only to the FDIC's own activities and does not require banks to take any action. A bank can still decline or close an account based on its own assessment of money laundering, fraud, credit, or operational risk.

FinCEN's April 2026 proposal

FinCEN's proposed rewrite of the AML/CFT program rules (91 FR 18704, April 10, 2026) says FinCEN "encourages financial institutions to manage customer relationships on a case-by-case basis," without "broad de-risking that can result in debanking." It ties the proposal to Executive Order 14331. As of this writing it is still a proposal, and that passage is explanatory text in the preamble, not a rule.

Taken together, these developments push regulators away from treating whole industries as off-limits. They do not require any bank to serve any particular customer. What they make more likely is that a bank will look at your actual risk and your actual controls. That makes a well-run program more useful to you, not less.

What a bank typically asks to see

Banks set their own due diligence requirements, and no regulation tells a bank exactly what to request from a dealer. In practice, requests to dealers tend to cover the same ground, and most of it maps directly to what 31 CFR 1027.210 already requires of you.

The written AML program, and evidence that senior management approved it. Part 1027 requires both.
The risk assessment, including the purchase side: who you buy from, foreign sources of supply, walk-in scrap, and how you handle suppliers you do not know. The dealer rule names products, customers, suppliers, distribution channels, and geographic locations as factors.
The compliance officer: who it is, and that the person has the authority and time to do the job.
Training records: who was trained, when, and on what.
Independent testing: the most recent test report and how findings were addressed.
Form 8300 procedures: how you identify reportable cash, including cashier's checks and money orders in designated reporting transactions, how you aggregate related transactions, and how many forms you filed.
OFAC screening: what you screen, when, against which lists, and how you clear and document alerts. See our post on clearing OFAC alerts.
Cash handling: expected cash volumes, why your deposits look the way they do, and your controls against structuring.

Consider a coin shop whose deposits jump every time spot gold spikes. A bank's monitoring will flag that pattern. A short explanation, prepared in advance, that ties deposit volume to buying activity and shows the matching Form 8300 filings answers the question before it becomes a review.

When the bank asks for more than Part 1027 requires

Some requests reflect the bank's own rules or policy choices, not your obligations. Keep two questions separate: what information will you give the bank, and what will your own program require of you.

Information about your business. The bank must identify and verify the beneficial owners of legal entity customers when they open accounts. That is the bank's obligation under the CDD rule (31 CFR 1010.230), and your business is the bank's customer. Providing your own ownership information is part of being a bank customer.

Questions about your customers. A questionnaire may ask whether you run a Customer Identification Program, collect beneficial ownership certifications from your entity customers, or file SARs on a set timeline. Those are rules for banks and other covered institutions, not for dealers. Answer accurately: describe the know-your-customer procedures your program actually contains, explain that SAR filing is voluntary for dealers and describe how you decide whether to file, and note that the bank-only rules do not apply. You do not need to write a bank's rules into your program to answer the question, and you should not promise procedures your staff will not perform. Your AML Program Is Not a Bank's explains why.

If a bank makes a particular practice a condition of the account, that is a business decision for you. If you agree, record it in your program as a voluntary choice, and follow it.

Third-party standards that can support your answers

Some dealers and their suppliers take part in industry programs whose audits may be useful when a bank or counterparty asks about supply-chain due diligence. Each applies only to its participants, none replaces a BSA program, and each bank decides for itself what weight to give them.

LBMA Good Delivery refiners. All gold and silver refiners on the LBMA Good Delivery List must implement LBMA's Responsible Gold Guidance (Version 9, November 2021) and its silver counterpart, and obtain annual independent assurance on their publicly available compliance reports. The guidance includes know-your-counterparty, anti-money laundering, and sanctions screening steps. LBMA has a Version 10 out for consultation. If you buy from Good Delivery refiners, their published reports can support your supplier risk assessment.
Responsible Jewellery Council certification. The RJC Code of Practices is mandatory for RJC commercial members and is third-party audited. Its provision on know your counterparty (COP 12) requires members to apply documented KYC procedures to suppliers and customers, including identity checks, screening against relevant government lists, and transaction monitoring. A certified dealer can point to its certification. Certification shows conformity with RJC's standard. It does not show compliance with Part 1027.

Keep a bank packet ready

The dealers that get through bank reviews with the least disruption tend to have the answers assembled before anyone asks. A short packet works: a one-page business description, your dealer-status analysis, the approved program, the risk assessment, the latest independent test and responses, training logs, a Form 8300 summary, and your OFAC screening procedure. Keep it current and consistent with what your staff actually does.

If a bank closes your account anyway, ask whether specific information would change the decision, and keep the correspondence. The same packet is what the next bank will want to see.

If you want help preparing for a bank review or tightening the program behind it, see our services, browse the FAQ, or contact us.