search

CTR and SAR Training for Frontline Bank Staff

10/15/2026

Most suspicious activity reports start at a teller window, a new-accounts desk or a loan officer's office, not in the BSA department. Most CTR errors start in the same places. The BSA officer can design a flawless program, but if the person taking a $9,800 cash deposit for the third day running does not recognize the pattern, or the person completing the CTR records the conductor as the account owner, the program fails at the first step.

That is why transaction-reporting training for frontline staff is not a box-ticking exercise. It is the detection layer of the bank's suspicious activity reporting process and the data-quality layer of its CTR process. This guide covers who needs CTR and SAR training, what each role actually has to learn, how to document it so it holds up at examination, and how to choose a course.

Why frontline training is required, and what examiners test

Training is one of the required elements of every bank's BSA/AML program. Under 31 CFR 1020.210, a bank's program must include, at a minimum, internal controls, independent testing, a designated BSA compliance individual, training for appropriate personnel, and risk-based customer due diligence. The federal banking agencies' own program rules carry the same requirement.

The rule says "appropriate personnel," not "everyone" and not "the BSA department." That phrase is where the design work happens: the bank decides who needs what, and examiners test whether the decision makes sense for the bank's risk. FinCEN's April 2026 proposed AML/CFT program rule would restate the requirement as an "ongoing employee training program," matching the statute, and describes the change as clarifying rather than substantive. FinCEN's fact sheet says it would expect training to reflect the bank's internal controls, risk assessment and current requirements, with frequency and content tailored to risk profile and personnel roles. That is a proposal, not a final rule, but it describes what good programs already do.

In an examination, training is usually tested in three ways:

  • Who was trained, on what, and when, including new hires and the board.
  • Whether the material is current and matches the bank's actual procedures and risks.
  • Whether staff behavior matches the training. Late SARs, weak referrals, CTR errors and missed aggregation are all evidence of a training gap, whatever the attendance records say.

The third test is the one that matters. Our guide to BSA/AML examination procedures explains how examiners connect findings in transaction testing back to the training pillar.

Who needs CTR and SAR training

A role-based approach is the only one that works. Here is how the needs usually break down at a community or regional bank.

Role

CTR focus

SAR focus

Tellers and head tellers

Identifying reportable cash, aggregation across the day, collecting ID, conductor vs beneficiary

Recognizing structuring and unusual cash patterns, escalating, never coaching customers

New accounts and personal bankers

Exempt customer basics, business account roles

Account opening red flags, CDD inconsistencies, referral process

Branch managers

Reviewing CTR data before filing, branch-wide aggregation

Being the first escalation point, confidentiality, handling customer questions

Deposit operations and CTR preparers

Form completion, aggregation reports, corrections, exemptions

Spotting patterns in CTR and cash data and referring them

Lenders

Cash loan payments and aggregation

Loan fraud, straw borrowers, unexplained source of down payments

BSA analysts and investigators

Exemption reviews, CTR quality control

Investigation, the SAR decision, narratives, deadlines, continuing activity

Board and senior management

Program oversight

SAR notification, oversight of the SAR process, confidentiality

 

The rest of this guide focuses on frontline and operations roles, which is where most banks under-train.

What frontline staff need to learn about CTRs

CTR rules are mechanical, which makes them very trainable. The core content:

The threshold and the aggregation rule. A CTR is required for a transaction in currency of more than $10,000 (31 CFR 1010.311). Multiple currency transactions are treated as one when the bank knows they are by or on behalf of the same person and total more than $10,000 cash in, or cash out, in one business day; deposits made at night, over a weekend or on a holiday count as received on the next business day (31 CFR 1010.313). Cash in and cash out are aggregated separately, not netted. Branches count together.

Who is on the report. The person conducting the transaction and the person on whose behalf it is conducted may be different people, and both may need to be reported. The courier depositing a restaurant's receipts and the restaurant itself are a classic example.

Identification. The CTR requires identifying information for the people involved, and staff need to know how to collect and record it properly.

The deadline. CTRs are due within 15 days after the transaction (31 CFR 1010.306), which sounds generous until a branch's aggregation report sits unreviewed for a week.

Exemptions. Frontline staff do not usually decide exemptions, but they need to know that some customers are exempt, that the exemption covers only certain accounts and transactions, and that exempt customers still get watched for suspicious activity.

Our guide to currency transaction reports covers the form and process in more depth.

What frontline staff need to learn about SARs

Frontline staff do not file SARs. They make the referrals that become SARs, and they protect the confidentiality of the result. Their training needs to cover four things.

1. Recognizing suspicious activity

Staff need concrete patterns from their own channel, not a generic list. For tellers, that means cash: deposits just under $10,000 on consecutive days, multiple people depositing into one account at different branches, customers who reduce a deposit after learning about reporting, large amounts in small bills that do not fit the business. For new accounts, it means identification and profile issues. For lenders, it means application and source-of-funds issues.

Training should also be honest about what is not suspicious on its own. FinCEN's October 9, 2025 FAQs, issued jointly with the federal banking agencies, state that a transaction or series of transactions at or near the $10,000 CTR threshold is not, by itself, enough to require a SAR. A SAR is required only if the bank knows, suspects or has reason to suspect the activity is designed to evade reporting. That distinction helps staff refer the right things with the right context: not "she deposited $9,500," but "she asked about the reporting limit, then split the deposit."

2. Structuring and the "never coach" rule

Structuring is conducting or attempting to conduct currency transactions, in any amount, at one or more institutions, on one or more days, in any manner, for the purpose of evading CTR reporting (31 CFR 1010.100(xx)). It is illegal under 31 U.S.C. 5324 even if the money itself is clean.

Staff need a firm rule: explain that cash transactions over $10,000 are reported if asked, but never suggest how to avoid a report, never help a customer split a transaction, and never discourage a customer from completing a transaction as presented. If a customer changes a transaction after learning about the reporting requirement, complete what the customer asks for and escalate it internally.

3. The referral

The detection clock for a SAR starts at initial detection of facts that may constitute a basis for filing (31 CFR 1020.320(b)(3)), and the bank's SAR deadline is generally 30 calendar days from that point. A referral that sits in a branch manager's inbox consumes that time. Training should cover exactly how to refer, to whom, what to include (who, what, when, where, and why it looked unusual), and how fast.

4. Confidentiality

A SAR and any information that would reveal its existence are confidential (31 CFR 1020.320(e)). Frontline staff are the people most likely to disclose one accidentally, because they are the people customers ask. Give them scripts. "We review transactions as part of our normal procedures" is fine. "Compliance flagged your deposits" is not.

Elder financial exploitation deserves its own module for frontline staff, because the people who spot it first are almost always tellers and personal bankers. Our guide to elder financial exploitation covers the warning signs.

How often, and how to deliver it

The regulation does not set a frequency. Most banks train all appropriate personnel at least annually and train new hires before or soon after they start handling transactions. Better programs add:

  • Event-driven updates when rules or guidance change, such as the 2025 SAR FAQs or a revised internal referral process
  • Targeted refreshers after exam findings, audit findings, or a run of poor referrals or CTR errors
  • Role-specific modules rather than one general session for everyone
  • Scenario testing rather than definition quizzes, because recognizing structuring in a realistic case is the skill that matters

Online courses are the practical way to cover a dispersed branch network consistently, with completion records that are easy to produce for examiners. They work best combined with short in-branch discussions of the bank's own procedures and anonymized examples of good referrals.

Documenting training so it counts

Training that cannot be evidenced did not happen, as far as an examination is concerned. Keep:

  • A training plan or matrix that maps roles to required courses and frequency
  • Completion records by person, with dates and test results where available
  • Copies or outlines of the training content, with the date it was last updated
  • Records of new-hire training timing
  • Board training records and the materials presented
  • Evidence of follow-up for people who missed or failed training

The training matrix should be reviewed at least annually against the bank's risk assessment. If the bank opened a new market, added a cash-intensive business line or saw a spike in a particular fraud type, the training should change too.

Choosing a course

The practical question for most banks is which off-the-shelf course covers the frontline need, and what to layer on top.

SARs and Information Sharing is the primary fit for this audience. As the title says, it covers suspicious activity reports and information sharing, the two subjects where frontline judgment and confidentiality matter most. It suits tellers, personal bankers, branch managers and operations staff who make referrals, and BSA staff who want a focused refresher on the SAR process. Check the course page for the current outline, format and length.

BSA/Anti-Money Laundering is the broader option for staff who need the whole Bank Secrecy Act framework that CTRs and SARs sit within, including newer hires in operations and compliance.

Certificate in BSA and AML Compliance is aimed at people building a BSA/AML career path, such as analysts moving toward a compliance role, rather than at frontline refresher training.

Financial Crimes Red Flags Training, on identifying and investigating red flags, fits alert reviewers and investigators who take the referrals frontline staff make.

A sensible frontline plan for a community bank looks like this:

  • All customer-facing and operations staff: SARs and Information Sharing, annually and at hire
  • CTR preparers and deposit operations: add the BSA/Anti-Money Laundering course, plus the bank's own CTR procedures
  • Analysts and investigators: add Financial Crimes Red Flags Training
  • BSA staff on a career track: the Certificate in BSA and AML Compliance

The Bank Secrecy Act training and suspicious activity reporting pages list related options, and our bank teller training guide covers where BSA modules fit within broader teller onboarding.

What a good result looks like

A year after a solid training cycle, the BSA officer should see referrals that arrive faster and contain usable detail, fewer CTR corrections, no confidentiality incidents, and examiners who find that staff can explain the referral process in their own words. Those are the measures worth tracking, alongside completion rates.

Start with the frontline course

If your frontline staff learned CTR and SAR rules from a colleague at the next window, they learned some version of the rules. Give them the real ones, with the referral and confidentiality habits that go with them. SARs and Information Sharing is the place to start.

Frequently Asked Questions

Who needs suspicious activity reporting training at a bank?

Every bank's BSA/AML program must include training for appropriate personnel under 31 CFR 1020.210, and the bank decides who that includes based on its risk. In practice it covers tellers, personal bankers, branch managers, deposit operations staff, lenders, BSA analysts and investigators, and the board. The content should differ by role: frontline staff need recognition, referral and confidentiality, while analysts need investigation, decision-making and narrative writing. Examiners test whether the scope and content make sense for the bank's risk profile.

How often should bank staff receive SAR and CTR training?

The regulation does not set a frequency. Most banks train appropriate personnel at least annually and train new hires before or soon after they begin handling transactions. Good programs also update training when rules or guidance change, after examination or audit findings, and when referral quality or CTR accuracy slips. FinCEN's April 2026 proposed program rule would describe the requirement as an ongoing employee training program tailored to risk and role, though that rule was still a proposal when this was written.

What should SAR training for tellers cover?

Tellers need to recognize suspicious cash patterns, understand structuring, know the referral process and its urgency, and protect SAR confidentiality. Training should include the rule that staff must never advise customers how to avoid a CTR, and should explain that a transaction near $10,000 is not automatically suspicious. FinCEN's October 2025 FAQs say a SAR is required only when there is reason to suspect evasion. Scripts for customer questions and realistic scenarios work better than definitions alone.

Is CTR training different from SAR training?

Yes, though they are often delivered together. CTR training is mechanical: the over-$10,000 threshold, aggregation across a business day and across branches, conductor versus beneficiary, identification, exemptions and the 15-day filing deadline. SAR training is judgment-based: recognizing unusual activity, referring it quickly with useful detail, and keeping SARs confidential. Frontline staff need both because structuring sits between them. A customer avoiding a CTR is exactly the kind of activity that should become a SAR referral.

How do we document BSA training for examiners?

Keep a training matrix mapping roles to required courses and frequency, completion records by person with dates and test results, the content or outlines with update dates, evidence that new hires were trained on time, board training materials and attendance, and follow-up for anyone who missed or failed training. Review the matrix against the risk assessment at least annually. Examiners also look at results, so link training to referral quality and CTR error trends where you can.

Which course should our frontline staff take?

For tellers, personal bankers, branch managers and operations staff, the SARs and Information Sharing course is the primary fit because it covers suspicious activity reports and information sharing. Staff who need the broader Bank Secrecy Act framework can add the BSA/Anti-Money Laundering course. Alert reviewers and investigators should look at Financial Crimes Red Flags Training, and staff building a compliance career can consider the Certificate in BSA and AML Compliance. Check each course page for the current outline and format.