BSA/AML
The Bank Secrecy Act and its implementing rules in 31 CFR Chapter X require covered financial institutions to run an anti-money laundering program, keep records, and report suspicious and large cash activity to FinCEN.
The program is built on the well known pillars: a system of internal controls, independent testing, a designated BSA/AML compliance officer, ongoing training, and customer due diligence with beneficial ownership. Federal examiners also expect a written risk assessment that drives the whole program.
What an institution needs on paper is a board-approved BSA/AML program document, the risk assessment, customer identification and due diligence procedures, suspicious activity and currency transaction reporting procedures, OFAC screening procedures, training records, and the report of the most recent independent test.
For SEC-registered and exempt reporting investment advisers, FinCEN's 2024 rule brought them into the program requirement, but the effective date has been pushed from January 1, 2026 to January 1, 2028.
Who has to comply
Banks and credit unions, broker-dealers, money services businesses, casinos, mutual funds, futures commission merchants, insurance companies for covered products, dealers in precious metals, and other financial institutions listed in 31 CFR Chapter X. SEC-registered investment advisers and exempt reporting advisers become covered on January 1, 2028 under the delayed rule.
What the assessor asks to see
Examiners typically ask for, in order: the BSA/AML risk assessment; the board-approved program and policies; the BSA officer's designation and reporting line; the most recent independent test and management's response; customer identification and CDD/beneficial ownership procedures with sample files; transaction monitoring alert and case records; SAR and CTR filing logs; OFAC procedures and screening records; training materials and attendance; and board and committee minutes showing oversight.
Where the requirement sits: 31 CFR 1020.210 (banks), 1023.210 (broker-dealers), 1026.210 - the written-programme pillars incl. ongoing training; FinCEN IA rule effective date moved
Investment adviser rule timing
FinCEN's investment adviser AML rule was finalized in 2024 with an original effective date of January 1, 2026. FinCEN proposed a delay in September 2025 and issued a final rule (published in the Federal Register January 2, 2026) moving the effective date to January 1, 2028.
FinCEN has said it intends to revisit and tailor the rule before that date, so advisers should verify the current text before building a program to it.
Every internal policy in one place
AllyMatter is a full system for every internal policy your company keeps, including the ones BSA/AML turns on. Build the whole library in one place, across every department, and prove who has read what.
Start here
RIA Compliance Manual: who needs it, what goes in it, how often it is reviewed and who signs it off. Run exactly that in AllyMatter, alongside every other policy your company keeps.
How it works
Every document is approved by someone other than its author, versioned, distributed to the people it covers and acknowledged by name. Sign it where a signature is what the standard wants, send a set out together as a package, and export a dated record of who read which version when an assessor asks.
The written policies this standard turns on live here, with every version and every acknowledgment on the record.
Who helps with BSA/AML
A mature ecosystem: BSA/AML consulting firms, outsourced BSA officers for smaller banks and MSBs, independent testing providers, and law firms that draft program documents and handle enforcement responses. A typical engagement is a risk assessment refresh, program rewrite, and an annual or 12-to-18-month independent test with a written report to the board.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Consultants
Be the first BSA/AML consultant listed here
The people reading this are working out who can help them get there.
Who assesses BSA/AML
Examiners from the institution's functional regulator: OCC, FDIC, Federal Reserve, and NCUA for depository institutions; SEC and FINRA for broker-dealers; IRS Small Business/Self-Employed for MSBs and other non-bank institutions; state regulators alongside them. FinCEN retains enforcement authority. There is no certification.
Examiner authority comes from statute and delegation from FinCEN.
Assessors
Be the first BSA/AML assessor listed here
This page is read by the organizations looking for someone to certify them.
Tools for BSA/AML
Tools that name this framework in their own material.
Grouped by type. Inside each group the order is random, reshuffled each time the page loads. AllyMatter, the publisher of this site, is always first.
AllyMatterPolicy management tool, the policy and acknowledgment layerPublisher of this siteGRC and compliance automation1 tool
Controls, evidence and audit workflows, with a policy module inside.
Related reading
- FinCEN, Banking Agencies Propose to Overhaul Bank Secrecy Act ComplianceReports the proposed rewrite of the AML program rule and the new minimum standards institutions would have to document.ABA Banking Journal
- The Five Pillars of an Anti-Money Laundering Compliance ProgramPlain description of the five pillars, including what independent testing and the designated BSA officer role are expected to produce.Ankura
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Find a Consultant for BSA/AML
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Run the Policy Side of BSA/AML in AllyMatter
Approve the policies BSA/AML asks for, keep every version, and record a named acknowledgment from each person who has to read them.