BSA/AML Training Requirements: Who Must Be Trained

9/5/2026

Training is the BSA/AML pillar most banks believe they have covered and most often cannot prove. The sessions happened. The online modules were assigned. But when an examiner asks which lenders completed training on lending-related red flags, what the board was taught and when, or what happened to the six employees who never finished, the answers live in three systems and two people's memories.

This post covers what the rules actually require for Bank Secrecy Act training, who must be trained, what content belongs in each role's training, how often training should happen, and what documentation examiners review. It is written for BSA officers and training coordinators building or auditing a training program.

What the regulations say

The training requirement is short. The bank AML program rule at 31 CFR 1020.210 requires a program that includes, at a minimum, "training for appropriate personnel." Each federal banking agency's BSA program rule repeats the same element: 12 CFR 21.21 for the OCC, 12 CFR 326.8 for the FDIC, 12 CFR 208.63 for the Federal Reserve, and 12 CFR 748.2 for the NCUA all require the program to "provide training for appropriate personnel."

That is the entire regulatory text. It does not define appropriate personnel, specify content, or set a frequency. Those expectations come from the FFIEC BSA/AML Examination Manual, which is what examiners work from.

No fixed frequency

The regulations do not require annual training. Neither does the examination manual, which speaks of "periodic" training. Many banks train most staff annually, and that is a reasonable, common practice. But it is a bank standard, not a legal requirement. If your policy says annual, examiners will hold you to annual. If your risk profile or a change in requirements calls for more frequent training for some roles, the policy should say so.

Who must be trained

The manual describes appropriate personnel as those whose duties require knowledge or involve some aspect of BSA/AML compliance. In a typical bank that includes far more people than the BSA department.

Groups the manual names specifically

• The BSA compliance officer and BSA compliance staff. They should receive periodic training that is relevant and appropriate to remain informed of changes to regulatory requirements and changes to the bank's risk profile.
• The board of directors and senior management. They should receive foundational training and be informed of changes and new developments in the BSA, its implementing regulations, the banking agencies' regulations, and supervisory guidance. The manual notes the board may not need the same depth as operations staff, but it needs enough understanding of the bank's risk profile and BSA requirements to provide oversight, including approving the written program, establishing independence for the BSA function, and providing sufficient resources.
• New staff. An overview of the purposes of the BSA and its requirements is typically provided during employee orientation or reasonably thereafter.
• The bank should provide training for any agents responsible for conducting BSA-related functions on its behalf.
• Business lines with specific risks. Targeted training may be necessary for specific risks in business lines or operational units such as lending, trust services, foreign correspondent banking, and private banking.

Roles most banks include

Role	Why they are in scope	Focus of their training
Tellers and head tellers	Conduct currency transactions, see structuring first	CTR aggregation, structuring, cash red flags, monetary instrument recordkeeping, escalation
New accounts and deposit operations	Collect CIP and CDD information	CIP minimums and verification, beneficial ownership, expected activity, risk-rating inputs
Branch managers	Supervise front line, approve exceptions	Red flags, escalation, SAR confidentiality, CTR exemptions
Wire and ACH operations	Process funds transfers	Recordkeeping and travel rule, sanctions screening, wire red flags
Commercial and consumer lenders	See borrowers' finances and collateral	Money laundering through loans, beneficial ownership on business loans, loan-related red flags
Trust and private banking	Higher-risk relationships	Source of wealth, PEP screening, EDD, private banking rule where relevant
BSA analysts and investigators	Clear alerts, write SARs	Typologies, investigation, SAR narratives and deadlines, continuing activity
BSA officer	Owns the program	Regulatory changes, examination expectations, risk assessment
Internal audit and testers	Test the program	Program requirements and testing scope
IT and vendor management	Run BSA systems	Data integrity, system changes, model governance
Board and senior management	Oversight	Bank risk profile, obligations, program status, regulatory changes

 

The table above reflects common practice, not a regulatory list. Map your own roles against the bank's risk assessment and procedures.

What training should cover

The manual says training should cover BSA regulatory requirements, supervisory guidance, and the bank's internal BSA/AML policies, procedures, and processes, tailored to each person's specific responsibilities. Its examination procedures ask whether the training materials address:

• The importance the board and senior management place on ongoing education, training, employee accountability, and compliance
• Results of previous findings of noncompliance with internal policies and regulatory requirements, where applicable
• An overview of the purposes of the BSA and its regulatory requirements, supervisory guidance, and internal policies and procedures
• Different forms of money laundering, terrorist financing, and other illicit financial activity as they relate to identifying suspicious activity, with examples
• Information tailored to the specific risks of individual business lines or operational units
• Current developments and changes to BSA regulatory requirements
• Adequate training for agents conducting BSA-related functions

Two points stand out. First, examples should be role-specific. The manual gives the example that training for tellers should focus on large currency transactions or suspicious activities, while training for the loan department should give examples involving money laundering through lending arrangements. Generic training that shows tellers wire fraud typologies and lenders structuring at the window misses the point.

Second, training should reflect findings. If independent testing found that account-opening staff were leaving the control prong blank on beneficial ownership certifications, the next round of training for those staff should address it explicitly, and the training record should show it.

What changed recently and belongs in 2026 training

Training content goes stale. Topics that should appear in current update training for relevant roles include:

• Beneficial ownership. FinCEN's February 13, 2026 exceptive relief order lets banks identify and verify beneficial owners when a legal entity customer first opens an account, when facts call prior information into question, and as their risk-based ongoing CDD procedures require, rather than at every new account. FinCEN consolidated its CDD FAQs in May 2026.
• The Corporate Transparency Act. A final rule effective August 14, 2026 permanently exempts U.S. companies and U.S. persons from beneficial ownership reporting to FinCEN. Front-line staff need to understand that this does not change the bank's own CDD collection.
• SAR FAQs. FinCEN's October 2025 FAQs stated there is no regulatory requirement to document a decision not to file a SAR and clarified expectations around continuing activity reviews. Staff should know what the bank's own procedures now require.
• TIN collection. A June 2025 order from the OCC, FDIC and NCUA, with FinCEN's concurrence, permits covered banks to obtain TIN information from a third-party source; if your bank uses it, account-opening staff need to know how.
• Proposed program reforms. FinCEN's April 2026 proposal to reform AML/CFT programs remained a proposal as of this writing. The BSA officer and board should understand what it would change; front-line staff do not need it until it is final.

Covering a proposal as if it were final, or failing to cover a final change, are both training findings waiting to happen.

Documentation examiners review

This is where most training programs fall short. The manual says banks should document their training programs, maintain training and testing materials (if testing is used) and the dates of training sessions, and make training materials and records available for auditor or examiner review. It also says the bank should maintain documentation of attendance records and any failures of personnel to take required training in a timely manner, as well as corrective actions taken.

A training file that holds up includes:

1. A written training plan tied to the risk assessment: roles in scope, content by role, timing for new hires, update cadence
2. Materials for each course or session, retained by version, so the bank can show what was taught on a given date
3. Attendance and completion records by employee, with dates
4. Test results where the bank uses assessments
5. Exception reports: who did not complete on time, and the escalation and corrective action taken
6. Board training records: date, content, and attendees, not just a minute that says "the board received a BSA update"
7. Agent and third-party training evidence where agents perform BSA functions, or documentation of reliance on another party's training
8. Evidence of change-driven training after regulatory changes, new products, or testing findings

If the bank relies on another institution or party to perform training under a collaborative arrangement, the manual says appropriate documentation should be maintained.

How independent testing looks at training

The examination manual's independent testing section lists training among the areas testing may cover, specifically whether training is provided for appropriate personnel, tailored to specific functions and positions, and includes supporting documentation. Expect testers to:

• Compare the HR roster with the training roster to find staff in scope who were missed
• Sample employees by role and check that their training matched their function
• Check new hires' training dates against start dates
• Review board training records
• Follow up on prior training findings

Running that comparison yourself before the testers do is one of the simplest exam-readiness steps available.

Common training findings

• Board training undocumented or limited to a brief annual mention.
• One-size-fits-all content with no role-specific modules.
• New hires starting work in BSA-sensitive roles long before completing training, with no rationale.
• No tracking of non-completion and no consequences.
• Stale content: references to rules that have since changed.
• Policy says annual, practice says otherwise.
• Agents or contractors performing BSA functions without training records.
• BSA officer's own training undocumented, often because the officer is the one keeping the records.

Building the program

A practical sequence:

9. List every role and map it to BSA touchpoints using your procedures and risk assessment.
10. Define a curriculum by role: foundational content for all, role-specific modules, update training for the BSA function and board.
11. Choose delivery: external courses for regulatory foundations, in-house sessions for the bank's own procedures and systems, live updates for changes.
12. Set timing standards for new hires, periodic refreshers, and change-driven training, and write them into the policy.
13. Build the records: one place where completion, materials, and exceptions can be pulled for any employee and date.
14. Report completion and exceptions to management and the board.
15. Feed testing and exam findings back into content.

For the roles that most need structured regulatory content, our BSA/Anti-Money Laundering course provides a foundation in Bank Secrecy Act and anti-money laundering requirements for bank staff. For staff who need a deeper, structured program, the Certificate in BSA and AML Compliance covers the framework in more depth. Front-line roles benefit from context in the bank teller training guide, and the BSA officer's role in the program is covered in BSA officer responsibilities. For exam preparation more broadly, see BSA/AML examination procedures.

Get your team trained

Training is a pillar examiners assess on its own. A bank with strong monitoring and weak training records still has a training finding. Start with the people whose roles touch BSA most often and the records that prove what they learned. BSA/Anti-Money Laundering is a practical place to begin, and the full range is on our Bank Secrecy Act training page.

Frequently Asked Questions

Is BSA/AML training required by law?

Yes. The bank AML program rule at 31 CFR 1020.210 and each federal banking agency's BSA program rule require the program to provide training for appropriate personnel. The regulations do not define who that is, what content applies, or how often training must occur. Those expectations come from the FFIEC BSA/AML Examination Manual, which describes appropriate personnel as those whose duties require knowledge of the BSA or involve some aspect of BSA/AML compliance.

Is annual Bank Secrecy Act training required?

No regulation requires annual BSA training, and the FFIEC examination manual refers to periodic training rather than a fixed interval. Annual training for most staff is a common and reasonable bank practice. If the bank's policy sets an annual standard, examiners will expect the bank to meet it. Some roles, such as the BSA officer and staff, may need more frequent updates when requirements or the bank's risk profile change.

Who needs BSA training at a bank?

Anyone whose duties require knowledge of the BSA or involve BSA/AML compliance. In practice that usually includes tellers, new-accounts and deposit operations staff, branch managers, wire and ACH operations, lenders, trust and private banking staff, BSA analysts, the BSA officer, internal audit, relevant IT staff, senior management, and the board. Agents performing BSA functions on the bank's behalf should also be trained.

Does the board of directors need BSA training?

Yes. The FFIEC manual says the board and senior management should receive foundational training and be informed of changes and new developments in BSA requirements. Board training need not be as detailed as operations training, but it should give directors enough understanding of the bank's risk profile and BSA requirements to oversee the program. Keep a dated record of what the board was taught, not just a minute noting an update.

What records of BSA training should a bank keep?

The manual says banks should document their training programs and maintain training and testing materials, dates of sessions, and attendance records, available for auditor and examiner review. Banks should also document failures to complete required training on time and the corrective action taken. Retaining materials by version lets the bank show exactly what was taught on a given date.

What should BSA bank training cover?

BSA regulatory requirements, supervisory guidance, and the bank's own policies and procedures, tailored to each person's role. The manual's examination procedures also look for coverage of the importance management places on compliance, prior findings, money laundering and terrorist financing typologies with examples, business-line risks, current regulatory developments, and training for agents. Examples should match the role: currency activity for tellers, lending schemes for lenders.