Framework Financial Services
BSA/AML
The Bank Secrecy Act and its implementing rules in 31 CFR Chapter X require covered financial institutions to run an anti-money laundering program, keep records, and report suspicious and large cash activity to FinCEN.
The program is built on the well known pillars: a system of internal controls, independent testing, a designated BSA/AML compliance officer, ongoing training, and customer due diligence with beneficial ownership. Federal examiners also expect a written risk assessment that drives the whole program.
What an institution needs on paper is a board-approved BSA/AML program document, the risk assessment, customer identification and due diligence procedures, suspicious activity and currency transaction reporting procedures, OFAC screening procedures, training records, and the report of the most recent independent test.
For SEC-registered and exempt reporting investment advisers, FinCEN's 2024 rule brought them into the program requirement, but the effective date has been pushed from January 1, 2026 to January 1, 2028.
Who has to comply
Banks and credit unions, broker-dealers, money services businesses, casinos, mutual funds, futures commission merchants, insurance companies for covered products, dealers in precious metals, and other financial institutions listed in 31 CFR Chapter X. SEC-registered investment advisers and exempt reporting advisers become covered on January 1, 2028 under the delayed rule.
What the assessor asks to see
Examiners typically ask for, in order: the BSA/AML risk assessment; the board-approved program and policies; the BSA officer's designation and reporting line; the most recent independent test and management's response; customer identification and CDD/beneficial ownership procedures with sample files; transaction monitoring alert and case records; SAR and CTR filing logs; OFAC procedures and screening records; training materials and attendance; and board and committee minutes showing oversight.
Where the requirement sits: 31 CFR 1020.210 (banks), 1023.210 (broker-dealers), 1026.210 - the written-programme pillars incl. ongoing training; FinCEN IA rule effective date moved (verify)
Investment adviser rule timing
FinCEN's investment adviser AML rule was finalized in 2024 with an original effective date of January 1, 2026. FinCEN proposed a delay in September 2025 and issued a final rule (published in the Federal Register January 2, 2026) moving the effective date to January 1, 2028.
FinCEN has said it intends to revisit and tailor the rule before that date, so advisers should verify the current text before building a program to it.
What AllyMatter does here
The written-programme and training-record layer of an AML programme.
AllyMatter publishes this site.
Assessors
Who assesses BSA/AML
Examiners from the institution's functional regulator: OCC, FDIC, Federal Reserve, and NCUA for depository institutions; SEC and FINRA for broker-dealers; IRS Small Business/Self-Employed for MSBs and other non-bank institutions; state regulators alongside them. FinCEN retains enforcement authority. There is no certification.
Examiner authority comes from statute and delegation from FinCEN.
No firm has claimed a BSA/AML assessor listing yet. Claim yours →
Consultants
Who helps with BSA/AML
A mature ecosystem: BSA/AML consulting firms, outsourced BSA officers for smaller banks and MSBs, independent testing providers, and law firms that draft program documents and handle enforcement responses. A typical engagement is a risk assessment refresh, program rewrite, and an annual or 12-to-18-month independent test with a written report to the board.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
No firm has claimed a BSA/AML consultant listing yet. Claim yours →
Software
Tools for BSA/AML
Tools that name this framework in their own material.
Related reading
- FinCEN, Banking Agencies Propose to Overhaul Bank Secrecy Act ComplianceReports the proposed rewrite of the AML programme rule and the new minimum standards institutions would have to document.ABA Banking Journal
- The Five Pillars of an Anti-Money Laundering Compliance ProgramPlain description of the five pillars, including what independent testing and the designated BSA officer role are expected to produce.Ankura
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Find a Consultant for BSA/AML
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Run the Policy Side of BSA/AML in AllyMatter
Approve the policies BSA/AML asks for, keep every version, and record a named acknowledgment from each person who has to read them.