Financial Crimes Investigation Training for BSA Analysts

10/16/2026

A BSA analyst's job is easy to describe and hard to do well. An alert fires, a teller refers something, a 314(a) list produces a possible match, and the analyst has to work out whether what happened has a reasonable explanation or belongs in a suspicious activity report. Do it too cautiously and the bank files low-value SARs and drowns in alerts. Do it too loosely and the bank misses the one case that mattered.

Most analysts learn this on the job, from whoever trained them, with whatever habits that person had. This guide is for BSA officers deciding how to train alert reviewers and investigators properly, and for analysts who want to know what good investigation skills look like. It walks through the work from red flag to SAR decision, the skills each step needs, and how to choose financial crimes training for the team.

What the job actually involves

Alert reviewers and investigators sit between detection and reporting. Their work typically includes:

• Alert triage. Reviewing transaction monitoring alerts and closing the ones with a clear explanation.
• Case investigation. Escalated alerts, employee referrals, law enforcement inquiries, negative news and 314(b) contacts become cases that need a full review.
• The SAR decision. Recommending or deciding whether the facts meet the standard for filing.
• SAR preparation. Writing the narrative and completing the filing.
• Follow-up. Continuing activity, relationship decisions, 314(a) searches and law enforcement requests.

The regulatory frame is 31 CFR 1020.320. A bank must file a SAR for a transaction conducted or attempted by, at or through the bank that involves or aggregates at least $5,000 in funds or other assets if the bank knows, suspects or has reason to suspect it involves funds from illegal activity or is meant to disguise them, is designed to evade BSA requirements, or has no business or apparent lawful purpose and is not the sort the customer would normally be expected to engage in, with no reasonable explanation after examining the available facts. The banking agencies' own SAR rules add criminal-violation categories, including insider abuse involving any amount, and violations aggregating $25,000 or more even when no suspect can be identified (for national banks, 12 CFR 21.11).

That third prong, "no reasonable explanation after examining the available facts," describes the analyst's job almost exactly. Investigation is the process of examining the facts until either an explanation emerges or it does not.

From red flag to SAR decision: the skills, step by step

1. Reading the red flag

A red flag is a reason to look, not a conclusion. The first skill is understanding what the alert or referral actually indicates and what typology it might point to: structuring, funnel accounts, elder exploitation, check kiting, trade-based laundering, money mule activity, account takeover, a scam victim sending funds.

Good analysts know the typologies well enough to ask the right next question. A pattern of cash deposits in several states followed by withdrawals in one city points toward a funnel account; the next step is to look at who is depositing and where. A sudden series of wires from an elderly customer to a new beneficiary points toward exploitation or a scam; the next step is the customer's history and who has recently been added to the account. Our guide to money laundering red flags lists the common indicators by category.

FinCEN publishes advisories and alerts on specific typologies, and many ask filers to include a particular key term in the SAR so that reports can be grouped. Analysts should know where those advisories live and check them when a case fits one.

Training also needs to cover what a red flag is not. In joint FAQs issued October 9, 2025, FinCEN and the federal banking agencies stated that transactions at or near the $10,000 CTR threshold are not, on their own, enough to require a SAR; a SAR is required only if the bank knows, suspects or has reason to suspect the activity is designed to evade reporting. Analysts who close threshold alerts without considering the context miss structuring. Analysts who file on every amount near $10,000 waste the bank's time and law enforcement's.

2. Scoping the investigation

Before pulling data, decide what the investigation needs to answer. A useful frame is three questions:

• What happened, in full, beyond the alerting transactions?
• Is there an apparent lawful purpose consistent with what the bank knows about the customer?
• Who is involved, including related accounts, counterparties and beneficial owners?

Scoping protects both quality and time. An investigation that reviews every account the customer has ever touched takes weeks; one that reviews only the alerting transactions misses the pattern.

3. Gathering evidence

The core sources:

• Full transaction history for the review period, across all accounts and channels
• The customer profile: CDD and enhanced due diligence records, expected activity, business type, beneficial owners, risk rating. Our guide to KYC and customer due diligence covers what that file should contain.
• Related parties: joint owners, signers, shared addresses and phone numbers, frequent counterparties
• Prior alerts, cases and SARs on the same subjects
• Frontline knowledge: the teller or banker who handled the activity often knows things no system recorded
• Open-source information: business registrations, news, websites, property records
• Information from other institutions, through section 314(b) when both institutions are registered

Section 314(b) is underused by investigators. Under 31 CFR 1010.540, institutions that register with FinCEN can share information about activity they suspect may involve money laundering or terrorist financing, with a safe harbor from liability. FinCEN's Section 314(b) Fact Sheet, updated June 12, 2026, confirms that suspected fraud qualifies, that sharing can happen in real time and by phone, and that the receiving institution may use the information to decide whether to open or keep an account. It also states that 314(b) does not permit sharing a SAR or revealing that one exists, so analysts need to know where that line sits.

4. Analysis

Analysis is where training makes the biggest difference. It means:

• Comparing actual activity with expected activity, and quantifying the gap
• Following funds in and out: where the money came from, where it went, and how fast
• Building a timeline
• Testing the plausible innocent explanations and documenting why each does or does not hold
• Distinguishing a customer who is a suspect from one who is a victim, such as a scam victim or an exploited older adult

The most common analytical weakness is stopping at description. "The customer made 14 cash deposits totaling $126,400" is a fact. "The customer's stated business is a consulting firm with no expected cash activity, and the deposits were made at four branches, each under $10,000, on consecutive days" is analysis.

5. The SAR decision

The decision requires judgment against a legal standard, and analysts need to understand that standard precisely. Suspicion is enough; proof is not required, and the analyst does not need to identify the underlying crime.

On documentation, the October 2025 FAQs said there is no requirement or expectation under the BSA to document a decision not to file, and that if a bank chooses to document it, a short, concise statement will likely suffice in most cases, with more detail appropriate for complex investigations. Most banks still record a brief rationale for every closed case, because their own procedures, quality assurance and examiners' transaction testing rely on it. Train analysts to write that rationale clearly and briefly, not at length.

6. Deadlines

The filing deadline runs from initial detection of facts that may constitute a basis for filing, not from the end of the investigation: 30 calendar days, with up to 30 more days to identify a suspect if none was identified at detection, and never more than 60 days after detection (31 CFR 1020.320(b)(3)). Analysts must know when the clock starts, record that date and work to it. Where activity requires immediate attention, such as an ongoing money laundering scheme, the bank must also notify law enforcement by telephone.

7. The narrative

The narrative is what law enforcement reads. It should answer who, what, when, where, why and how, in plain language, and stand on its own without the bank's systems. The step-by-step guide on how to file a SAR covers narrative structure in detail.

8. After the filing

Continuing activity reviews are a choice the bank makes, not a mandate. The October 2025 FAQs said banks are not required to conduct a separate post-filing review and may rely on risk-based monitoring instead. For banks that follow FinCEN's continuing activity guidance, the FAQs set out the timeline: a 90-day review period after the prior SAR, with the continuing activity SAR due 30 days later, or 120 days after the prior filing. Analysts also need to know the bank's process for relationship exit decisions, and that the existence of a SAR stays confidential throughout (31 CFR 1020.320(e)).

Skills that separate strong investigators

Beyond the process, training should build:

• Typology knowledge that keeps pace with fraud trends: scams, money mules, synthetic identities, account takeover
• Data skills: reading transaction exports, spotting patterns, and sanity-checking what the monitoring system shows
• Interviewing judgment: when and how to involve frontline staff, and when customer contact is appropriate without tipping off
• Writing: concise case notes and SAR narratives that a stranger can follow
• Calibration: filing on genuine suspicion, closing what has an explanation, and knowing the difference

Our guides to elder financial exploitation and synthetic identity fraud cover two typologies that analysts at most banks now see regularly.

Measuring analyst quality

Training should connect to measures the BSA officer already has:

Measure	What it tells you
Quality assurance results on closed alerts	Whether closures are supported by evidence
SAR timeliness against detection dates	Whether analysts manage the clock
Narrative QA scores	Whether reports are usable by law enforcement
Rework and escalation rates	Whether analysts are calibrated
Audit and exam findings on SAR decisioning	Whether the process holds up independently

 

A pattern in these numbers tells you which training to buy. Weak narratives call for writing practice. Unsupported closures call for analysis and documentation training. Late SARs call for process discipline.

Choosing financial crimes training for the BSA team

For alert reviewers and investigators, the primary fit is Financial Crimes Red Flags Training: Identifying and Investigating Red Flags. As its title describes, it addresses both halves of the analyst's work: identifying red flags and investigating them. It suits new analysts learning the job, experienced reviewers who need a structured refresher, and frontline supervisors who route referrals to the BSA team. Check the course page for the current outline, format and length.

Other options, depending on the role:

• SARs and Information Sharing for the reporting and information-sharing side of the job, including staff who prepare SARs or handle 314(b) contacts
• BSA/Anti-Money Laundering for analysts who need the broader Bank Secrecy Act framework
• Certificate in BSA and AML Compliance for analysts on a path toward a BSA officer or compliance role
• Internal Investigation Training and Certification for staff who also handle internal or employee-related investigations

A practical plan for a small BSA team:

• New analysts: Financial Crimes Red Flags Training and SARs and Information Sharing in their first months, alongside the bank's own procedures and supervised casework
• Experienced analysts: an annual refresher, plus targeted training when QA or exam findings point to a gap
• Senior analysts moving toward the BSA officer role: the Certificate in BSA and AML Compliance

The Bank Secrecy Act training and suspicious activity reporting pages list related courses.

Documenting analyst training

Examiners look at whether the people making SAR decisions are qualified to make them. Keep a record for each analyst of courses completed, dates, and any internal training or supervised casework, and link the training plan to the risk assessment and QA results. Training for appropriate personnel is a required program element under 31 CFR 1020.210, and for the people deciding what gets reported, the bar for "appropriate" is high.

Build investigators, not alert-closers

Alert volume pushes analysts toward speed, and speed without method produces weak closures and weak SARs. The fix is a shared, trained method for moving from red flag to decision. Start with Financial Crimes Red Flags Training for everyone who reviews alerts or works cases.

Frequently Asked Questions

What is financial crimes training for bank analysts?

It is training for the people who review alerts and investigate potential money laundering, fraud and other financial crime at a bank. It covers recognizing red flags and typologies, scoping and conducting an investigation, analyzing transactions against expected activity, deciding whether the facts meet the SAR standard, meeting the filing deadline, writing the narrative and handling follow-up. It differs from frontline BSA training, which focuses on recognizing and referring activity, because analysts make the reporting decision itself.

What should AML investigator training cover?

At minimum: the SAR standard and thresholds in 31 CFR 1020.320 and the banking agency rules, typologies such as structuring, funnel accounts, elder exploitation and scams, evidence gathering including 314(b) information sharing, analysis of activity against the customer profile, documenting decisions, the 30- and 60-day filing deadlines, narrative writing, continuing activity, and SAR confidentiality. Good programs add practice cases, because judgment improves through supervised casework more than through definitions.

Do analysts have to document decisions not to file a SAR?

Not as a matter of regulation. In October 2025 FAQs, FinCEN and the federal banking agencies said there is no requirement or expectation under the BSA to document a decision not to file, and that where a bank chooses to document it, a short, concise statement will likely suffice in most cases. Many banks still require a brief rationale for every closed case under their own procedures, because it supports quality assurance and independent testing. Analysts should follow their bank's procedures.

What are red flags in financial crimes investigations?

Red flags are indicators that activity may be suspicious and deserves review: cash deposits structured below reporting thresholds, activity inconsistent with the customer's business, rapid movement of funds through an account, deposits in multiple locations followed by withdrawals elsewhere, sudden changes in an older customer's transactions, or reluctance to provide information. A red flag is a reason to investigate, not a conclusion. FinCEN's October 2025 FAQs note that a transaction near $10,000 is not, by itself, enough to require a SAR.

How does 314(b) help investigators?

Section 314(b), implemented at 31 CFR 1010.540, lets registered financial institutions share information about activity they suspect may involve money laundering or terrorist financing, with a safe harbor from liability. Investigators can confirm where funds went, learn about related accounts and build a fuller picture before deciding whether to file. FinCEN's June 2026 fact sheet confirms fraud information qualifies and sharing can happen in real time. Both institutions must be registered, and 314(b) never permits sharing a SAR or revealing one exists.

Which course should a new BSA analyst take first?

For someone reviewing alerts and working cases, Financial Crimes Red Flags Training: Identifying and Investigating Red Flags is the primary fit, since it addresses identifying and investigating red flags. Pair it with SARs and Information Sharing for the reporting side, and with the bank's own procedures and supervised casework. Analysts who need the broader Bank Secrecy Act framework can add BSA/Anti-Money Laundering, and those moving toward a compliance leadership role can consider the Certificate in BSA and AML Compliance.