AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readFor BSA officers and AML compliance leads at banks, broker-dealers, money services businesses and other covered institutions preparing for an examination or independent test.
30-day trialUnlimited free viewersNo credit card required
Checked against primary sources on 18 October 2026.
Financial institutions covered by the BSA, including banks, broker-dealers, money services businesses, casinos and other covered institutions, must maintain an AML program under 31 U.S.C. 5318(h).
Federal banking agencies (OCC, Federal Reserve, FDIC, NCUA) using the FFIEC BSA/AML Examination Manual; the SEC for broker-dealers, alongside FINRA; the IRS for institutions without a federal functional regulator
Program kept current and independently tested on a risk basis; examined within the institution's regular supervisory examination cycle
31 CFR Chapter X AML program rules (for example 1020.210 banks, 1022.210 money services businesses, 1023.210 broker-dealers), last substantively amended by the 2016 customer due diligence rule, 2016-05-11. Free to read.
| Date | What happens | Status |
|---|---|---|
| 2026-01-02 | FinCEN final rule postpones the investment adviser AML/CFT program and SAR rule to 2028 | Done |
| 2026-04-10 | FinCEN proposes a rule to reform AML/CFT programs across financial institutions, superseding the July 2024 proposal | Done |
| 2026-06-09 | Comment period closes on the AML/CFT program proposal | Done |
| 2028-01-01 | Investment advisers must have an AML/CFT program in place under the delayed FinCEN rule | Scheduled |
Each one needs an owner, an approval, and proof it reached the people it covers.
12 CFR 21.21(c)(1); 31 CFR 1023.210; 31 CFR 1022.210(c)
The program is in writing; OCC-supervised banks need board approval reflected in the minutes, broker-dealers need senior management approval, and MSBs make copies available to Treasury.
31 CFR 1020.210(a)(2)(i); 1023.210(b)(1)
Policies, procedures and internal controls reasonably designed to assure ongoing compliance with the BSA and its implementing regulations.
31 CFR 1020.220(a)(1)
A written CIP appropriate to the bank's size and type of business, with risk-based identity verification procedures, forming part of the AML program.
31 CFR 1010.230(a); 1020.210(a)(2)(v)
Written procedures to identify and verify beneficial owners of legal entity customers, plus risk-based procedures for ongoing customer due diligence and monitoring.
31 CFR 1020.210(a)(2)(iii); 1023.210(b)(3)
Designation of the individual or individuals responsible for coordinating and monitoring day-to-day BSA compliance.
31 CFR 1020.210(a)(2)(iv); 1023.210(b)(4)
Training for appropriate personnel, ongoing for broker-dealers; the FFIEC manual expects the program documented, with materials, session dates and attendance kept for review.
Citations are to the standard or regulation; wording is ours.
What reviewers sample about these documents and the people they cover.
Examiners confirm the written program and its approval; for OCC-supervised banks the program must be approved by the board of directors and reflected in the minutes.
The FFIEC manual expects training and testing materials and session dates kept for auditor or examiner review, with attendance records, missed training and corrective actions documented.
Examiners determine whether all personnel whose duties require BSA knowledge are in the training program, and whether materials cover regulatory requirements, supervisory guidance and the bank's own AML policies and procedures.
Independent testing by internal staff or a qualified outside party is a required pillar; examiners review its scope and results, which include comparing staff training records with the bank's training standards.
Write each policy, send it through approval, and send it to the people it covers. Each acknowledgment is recorded by name, with the version, the date and the time.
When a policy changes, the new version is approved, its Editor sends it out again, and everyone it applies to is asked again. Export the record as a PDF or CSV, or give a reviewer Viewer access to the documents their tags allow.
Need help with the rest of BSA/AML program? Find a consultant for your standard (opens in a new tab).
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
Yes. FinCEN's final rule published January 2, 2026 moved the effective date from January 1, 2026 to January 1, 2028, and FinCEN has said it intends to revisit the rule's scope. The April 2026 program proposal does not amend the adviser rule.
It would require four pillars: internal policies, procedures and controls including risk assessment processes, independent testing, a U.S.-based compliance officer, and ongoing employee training. It would also harmonize approval of the written program by the board, an equivalent body or appropriate senior management, and it remained a proposal on October 18, 2026.
It depends on the institution type: OCC rules require board approval reflected in the minutes, and the broker-dealer rule requires senior management approval. The program rule for each institution type sits in its own part of 31 CFR Chapter X.
The bank rule requires training for appropriate personnel and the broker-dealer rule requires ongoing training, with no fixed calendar interval in either. The FFIEC manual expects periodic training that reflects regulatory changes and the bank's products, customers and locations.
The MSB rule requires copies of the written program to be available to Treasury on request. The April 2026 proposal would standardize that availability requirement for FinCEN, federal regulators and their designees across institution types.
free for 30 days