What a Written BSA/AML Policy Must Contain

Every bank has a BSA/AML policy. Fewer have one that does its job. The common failure is not a missing section; it is a document that tries to be two things at once. Some policies run to a hundred pages of step-by-step instructions that no director could meaningfully approve. Others are four pages of principles that never say who does what. Neither gives examiners what they look for, which is a clear statement of how the bank meets each BSA requirement, approved by the board, with procedures underneath that show how the statement is carried out.

This post walks through the sections a written BSA/AML policy should contain, explains where each comes from, and shows how the policy should connect to procedures. It is aimed at BSA officers drafting or revising a policy and at compliance staff preparing it for board approval.

Where the written-program requirement comes from

Two sets of rules apply at once.

FinCEN's program rule. Under 31 CFR 1020.210, a bank regulated by a federal functional regulator satisfies the BSA program requirement if it maintains a program that complies with the correspondent and private banking due diligence rules (31 CFR 1010.610 and 1010.620), includes at a minimum a system of internal controls, independent testing, a designated individual responsible for day-to-day compliance, training for appropriate personnel, and appropriate risk-based procedures for ongoing customer due diligence, and complies with its federal functional regulator's program regulation.

The banking agencies' program rules. Each federal banking agency has its own BSA compliance program regulation: 12 CFR 21.21 for the OCC, 12 CFR 326.8 for the FDIC, 12 CFR 208.63 for the Federal Reserve, and 12 CFR 748.2 for the NCUA. These say the program must be written, approved by the board of directors, and noted in (or reflected in) the board minutes, and they set out the same four core elements. They also require a customer identification program as part of the BSA program.

The FFIEC BSA/AML Examination Manual puts it plainly: written policies, procedures, and processes alone are not sufficient; practices that correspond to them are needed. And the first examination procedure in the program section is to confirm that the program is written, approved by the board, and that approval is noted in the minutes.

A rule in motion

In April 2026, FinCEN and the federal banking agencies proposed rules to reform AML/CFT program requirements. Among other changes, the FinCEN proposal would make the risk assessment process an explicit program requirement and would allow program approval by the board, an equivalent governing body, or appropriate senior management. Comments closed June 9, 2026. As of this writing these are proposals, not final rules, and the current requirements above remain in force. If a final rule is issued, expect to revise the approval and risk assessment sections of your policy.

Policy versus procedures

Before drafting, decide what belongs in the policy and what belongs in procedures. A workable split:

The policy should name the procedures that implement each section, so a reader can trace from commitment to practice. Many banks attach a procedures index as an appendix.

Section-by-section outline

1. Purpose, scope, and statement of commitment

• Purpose: to establish a program reasonably designed to assure and monitor compliance with the BSA and its implementing regulations
• Scope: the bank, its subsidiaries, and any affiliates or agents covered
• A short statement from the board that compliance is a priority and that the program will be resourced accordingly

Keep it short. Its value is that it sets the tone examiners look for when assessing culture.

2. Regulatory framework

• The statutes and regulations the program addresses: the BSA (31 U.S.C. 5311 and following), 31 CFR Chapter X, the bank's agency program rule, and OFAC regulations if OFAC is covered by the same policy
• A note that the policy follows the FFIEC BSA/AML Examination Manual as the supervisory reference

Avoid copying regulatory text in full. Cite it and summarize.

3. Risk assessment

• Commitment to maintain a written BSA/AML risk assessment covering products, services, customers, entities, and geographic locations
• Who prepares it, how often it is updated, and what events trigger an update (new products, new markets, acquisitions, significant changes in customer base)
• How the risk assessment drives the rest of the program: CDD categories, monitoring rules, independent testing scope, and training

Although the current program rule does not name the risk assessment as a separate pillar, the examination manual treats it as the foundation for judging whether the program is reasonably designed. See our guide to the BSA/AML risk assessment.

4. Governance and roles

• Board of directors: approves the policy, designates the BSA officer, receives reports, ensures resources
• Board committee if oversight is delegated, with its charter referenced
• Senior management: implements the program and holds business lines accountable
• BSA officer: designated by the board, with authority, independence and resources described
• Business lines and branches: first-line responsibilities
• Internal audit or outside tester: independent testing

Spell out reporting lines. The examination manual expects the BSA officer to have appropriate authority, independence, access to resources, and competence, and a policy that has the BSA officer reporting only to a business line head whose activity the officer must scrutinize invites a finding. Our post on BSA officer responsibilities covers the role in more depth.

5. Internal controls

This is the largest section. It commits the bank to controls for each regulatory requirement. Typical subsections:

• Customer Identification Program: minimum information before account opening, verification within a reasonable time, procedures when identity cannot be verified, government list comparison, customer notice, recordkeeping, and any reliance arrangements
• Customer due diligence: customer risk profiles, risk rating methodology, ongoing monitoring, and updating customer information on a risk basis
• Beneficial ownership: identification and verification for legal entity customers under 31 CFR 1010.230, exclusions applied, and whether the bank uses FinCEN's February 2026 relief order that allows reliance on previously obtained ownership information for later accounts
• Enhanced due diligence: categories the bank treats as higher risk, and mandatory procedures for foreign correspondent accounts and private banking accounts under 31 CFR 1010.610 and 1010.620
• Suspicious activity monitoring and reporting: detection (automated and manual referrals), alert investigation, SAR decision authority, filing deadlines, continuing activity, confidentiality, and board notification
• Currency transaction reporting: aggregation, filing, and exemption designation and review
• Monetary instrument sales and funds transfer recordkeeping, including the travel rule
• Information sharing: responses to FinCEN 314(a) requests and voluntary 314(b) sharing if the bank participates
• Special measures and FinCEN orders: how new section 311 measures and geographic targeting orders are captured
• Recordkeeping and retention
• Law enforcement requests: subpoenas, keep-open letters, and national security letters
• Account closure decisions related to BSA concerns
• Dual control and segregation of duties, for example separating preparation of SARs and CTR exemptions from the decision to file or grant them, which the examination manual highlights

State the key regulatory requirements accurately. For example, the bank SAR rule at 31 CFR 1020.320 requires filing no later than 30 calendar days after initial detection of facts that may constitute a basis for filing; if no suspect is identified, filing may be delayed an additional 30 calendar days to identify one, but never more than 60 calendar days after initial detection. A CTR is required for currency transactions of more than $10,000 in a business day, aggregated when the bank knows they are by or on behalf of the same person.

Be careful about writing expectations into policy that the regulations do not impose. In October 2025, FinCEN and the banking agencies issued SAR FAQs stating that there is no requirement or expectation to document a decision not to file a SAR, and that prior guidance on reporting continuing activity did not create an expectation of a separate review after each SAR solely to determine whether activity continued. A bank may still choose to document no-file decisions, and many do for quality and defensibility, but the policy should present that as a bank standard rather than a legal requirement. Once it is in the policy, examiners will hold the bank to it.

6. Independent testing

• Who performs it (internal audit, outside party, or both) and the independence standard
• Frequency: the examination manual says there is no regulatory requirement setting testing frequency; it should be commensurate with risk, and the manual gives periodic intervals such as every 12 to 18 months, or after significant changes, as examples
• Scope: all program components, including the risk assessment, monitoring systems, and training
• Reporting directly to the board or a designated committee, and tracking of findings to closure

7. BSA compliance officer

• Board designation and the record of it
• Responsibilities: coordinating and monitoring day-to-day compliance, maintaining the risk assessment, reporting to the board, managing filings
• Authority to escalate and to recommend closure of relationships
• Succession or backup arrangements

8. Training

• Who is trained: all personnel whose duties require knowledge of the BSA, the BSA officer and staff, the board and senior management, and any agents performing BSA functions
• Content: regulatory requirements, supervisory guidance, internal policies and procedures, and role-specific examples
• Timing: new hires during orientation or reasonably thereafter, periodic training for others, and additional training after regulatory changes or testing findings
• Records: dates, attendance, materials, testing results if used, and failures to complete with corrective action

No regulation fixes a training frequency. If the policy sets one, such as annually for most staff, the bank will be held to it. See our separate post on BSA/AML training requirements for detail, or browse Bank Secrecy Act training options.

9. Recordkeeping

• General BSA retention: records required under 31 CFR Chapter X are generally retained for five years, with specific rules for some records (for example, CIP and beneficial ownership identification records are kept for five years after the account is closed)
• SAR supporting documentation retention and production on request
• Where records are kept and how quickly they can be retrieved

10. Reporting to the board

• What the board receives and how often: risk assessment updates, SAR statistics, CTR and exemption activity, monitoring metrics, testing results, exam findings, training completion, staffing and system issues
• Notification of SARs filed, in the form the bank's procedures specify

Good board reporting is a control in its own right. A board that only hears "no issues" every quarter cannot exercise oversight.

11. Policy maintenance and approval

• Review cycle (most banks review annually) and triggers for out-of-cycle review
• Who drafts changes and who approves them
• Version history and date of the last board approval
• Location of current procedures

12. Appendices

• Procedures index
• Definitions
• Organization chart for the BSA function
• Board resolution designating the BSA officer

Common policy weaknesses

• Out of date. References to rules that changed, such as statements about Corporate Transparency Act filings that no longer apply to domestic companies, or beneficial ownership language that predates the 2026 relief order.
• Copied from a template with risk categories and products the bank does not offer.
• Commitments the bank does not meet: review intervals, training frequencies, or documentation standards that sounded good when drafted.
• No link to procedures, so testers cannot trace policy commitments to practice.
• Approval not in the minutes, or the minutes say "the board approved the compliance policies" without identifying the BSA/AML policy.
• Missing sections for activities the bank actually conducts, such as remote deposit capture, third-party payment processors, or fintech partnerships.

Building drafting skills

Writing a policy that serves both the board and examiners is a compliance skill, not a BSA-specific one. Our Elements of a Compliance Program course covers the building blocks of a compliance program that a written BSA/AML policy should reflect. For the BSA-specific requirements, see our AML compliance program pillars post and compliance management systems for how BSA fits the wider control framework.

Next step

Pull your current policy and test it against the outline above. For each section, ask two questions: does it state what the bank actually does, and does it point to the procedure that shows how? Gaps in either direction are what examiners find first. If your team is rebuilding the policy, Elements of a Compliance Program is a practical starting point.

Frequently Asked Questions

Is a written BSA/AML policy required?

Yes. The federal banking agencies' BSA program rules (12 CFR 21.21 for the OCC, 12 CFR 326.8 for the FDIC, 12 CFR 208.63 for the Federal Reserve, and 12 CFR 748.2 for the NCUA) require the BSA compliance program to be written, approved by the board of directors, and noted in the board minutes. FinCEN's program rule at 31 CFR 1020.210 requires banks to comply with these regulations as well as FinCEN's own minimum program elements.

What are the required elements of a BSA/AML program?

At a minimum: a system of internal controls to assure ongoing compliance, independent testing, a designated individual or individuals responsible for day-to-day compliance, training for appropriate personnel, and risk-based procedures for ongoing customer due diligence, including beneficial ownership for legal entity customers. Banks must also maintain a customer identification program and comply with the due diligence rules for foreign correspondent and private banking accounts.

How often should the BSA/AML policy be approved by the board?

No regulation sets a fixed interval for re-approval. Most banks review and re-approve the policy annually and whenever the program changes materially, such as after a new product launch, an acquisition, a regulatory change, or a significant examination finding. Whatever cycle the policy states, the bank should follow it and record each approval in the minutes.

What is the difference between a BSA policy and BSA procedures?

The policy states what the bank will do to comply, who is accountable, and the standards that apply. It is approved by the board. Procedures describe how staff carry out each task step by step and change more often as systems and forms change. The policy should reference the procedures for each section so examiners and testers can trace commitments to practice.

Has FinCEN changed the AML program rule?

FinCEN and the federal banking agencies proposed program reforms in April 2026. Among other things, the FinCEN proposal would formally require a risk assessment process and allow program approval by the board, an equivalent governing body, or appropriate senior management. The comment period closed June 9, 2026. As of this writing these remain proposals; the current program rules apply until a final rule takes effect.

Should the policy require documenting decisions not to file a SAR?

The regulations do not. FinCEN's October 2025 SAR FAQs state there is no requirement or expectation to document a decision not to file. Many banks still choose to document no-file decisions briefly, because it supports consistency and quality review. If your policy requires it, present it as a bank standard and make sure staff follow it, because examiners will test the bank against its own policy.