What Training Is Required for Bank Employees? Mandatory Training by Regulation

9/10/2026

Ask ten bankers which training is legally required and you will get ten different lists, most of them too long. Annual fair lending training, UDAAP training, elder abuse training, OFAC training, Reg CC training: all of them are common, most are wise, and examiners will ask about several. But only a handful of training obligations are actually written into regulation, and the ones that are rarely say "annual."

The difference matters. A training program built on "everything is mandatory, every year" spends its time on volume and loses the thread of what examiners actually test. A program built on "only what the rule says" will be technically compliant and still produce findings, because examiners judge training as part of a compliance management system, not as a checklist.

This guide separates the two. It lists the training obligations that come directly from regulation, with the citation behind each, and then the training that is expected but not prescribed. It does not invent frequencies. Where a rule is silent on how often, we say so.

A note on scope: citations below are to the rules for banks and savings associations supervised by the OCC, Federal Reserve and FDIC, plus the FinCEN and CFPB rules that apply to them. Credit unions have parallel NCUA rules. State-chartered institutions may also have state requirements, which vary.

Required by Regulation: The Short List

Obligation	Rule	What the rule says about training	Frequency stated?
BSA/AML program	31 CFR 1020.210; 12 CFR 21.21 (OCC), 208.63 (Fed), 326.8 (FDIC)	Program must provide "training for appropriate personnel"	No
Bank security program	12 CFR 21.3 (OCC), 208.61 (Fed), 326.3 (FDIC)	"Initial and periodic training" in security responsibilities and conduct during and after a robbery	"Initial and periodic"
Information security program	Interagency Guidelines, e.g. 12 CFR Part 364, Appendix B (FDIC)	"Train staff to implement" the information security program	No
Identity theft red flags	12 CFR 41.90 (OCC), 334.90 (FDIC), 222.90 (Fed)	"Train staff, as necessary" to implement the program	No
Registered mortgage loan originators	12 CFR 1026.36(f)(3)(iii) (Reg Z)	"Periodic training" on federal and state law for unlicensed individual loan originators	"Periodic"
SAFE Act registration	12 CFR 1007.104(b) (Reg G)	MLO employees must be informed of registration requirements and instructed how to comply	No

That is the core. Each is discussed below.

BSA/AML: "Training for Appropriate Personnel"

The best-known training requirement in banking comes from the Bank Secrecy Act program rule. FinCEN's rule at 31 CFR 1020.210 requires a bank's AML program to include, at a minimum, internal controls, independent testing, a designated BSA officer, training for appropriate personnel, and risk-based customer due diligence. The banking agencies' own program rules repeat the training pillar: 12 CFR 21.21(d)(4) for national banks and savings associations, 12 CFR 208.63(c)(4) for state member banks, and 12 CFR 326.8(c)(4) for FDIC-supervised institutions.

Three things about this requirement are routinely misread.

It does not say annual. The rule sets no frequency. Annual BSA training is a near-universal practice, and the FFIEC BSA/AML Examination Manual discusses how training should be ongoing and tailored, but the annual cycle is an expectation built on top of the rule, not the rule itself.

"Appropriate personnel" is functional, not positional. It means the people whose duties require BSA knowledge: tellers who see cash, new-accounts staff who collect customer identification, lenders who onboard business customers, operations staff who process wires, investigators, and the BSA officer. It also includes the board, which approves the program and must understand it well enough to oversee it.

Tailoring is expected. A teller and a commercial lender should not take the same course. Examiners look for training that matches each role's exposure, and for training that reflects the bank's own risk assessment.

The rule may change. In April 2026 FinCEN proposed a rewrite of the AML/CFT program requirements, superseding an earlier 2024 proposal. As of this writing it is a proposal, not a final rule, and the existing program requirements, including the training pillar, remain in force. Watch for a final rule and its effective date.

For the program itself, see our guides to the AML compliance program pillars. The Bank Secrecy Act training page lists courses by audience.

Bank Security: The Bank Protection Act Rules

The Bank Protection Act rules are the oldest mandatory training requirement most bankers have never heard of. Each agency's rule requires the bank's written security program to provide for initial and periodic training of employees in their responsibilities under the security program and in proper conduct during and after a robbery. The FDIC (12 CFR 326.3) and Federal Reserve (12 CFR 208.61) versions extend this to officers and to burglary and larceny as well; the OCC version is at 12 CFR 21.3.

The same rules require the bank to designate a security officer and, under the OCC rule at 12 CFR 21.4, the security officer reports at least annually to the board on the effectiveness of the security program.

"Initial" is the important word for onboarding. New tellers should be trained on robbery procedures before they work a teller line, not at the next annual session. "Periodic" is not defined; set a frequency in the security program and follow it.

The Bank Protection Act course addresses this rule directly.

Information Security: The Interagency Guidelines

The Interagency Guidelines Establishing Information Security Standards implement the Gramm-Leach-Bliley Act's safeguards requirements for banks. They appear as appendices to each agency's rules; the FDIC's version is Appendix B to 12 CFR Part 364. Among the measures a bank must take to manage and control risk, the guidelines direct it to train staff to implement the institution's information security program.

The guidelines also require the bank to report to its board, or an appropriate committee, at least annually on the overall status of the information security program and its compliance with the guidelines. That annual frequency applies to the board report, not to staff training.

As with BSA, the rule sets no training frequency. Most banks run annual security awareness training for all staff with deeper, role-specific training for IT and anyone with privileged access, and add phishing simulations as a tested control. Those are reasonable practices built on the rule, not requirements of it. Our post on the GLBA information security program covers the guidelines in detail, and the Certificate in Cybersecurity is one option for staff in security roles.

Identity Theft Red Flags

The Red Flags Rule requires financial institutions that offer covered accounts to maintain a written identity theft prevention program. Each agency's version (12 CFR 41.90 for the OCC, 334.90 for the FDIC, 222.90 for the Federal Reserve) requires the institution, in administering the program, to train staff, as necessary, to effectively implement it.

"As necessary" is deliberately flexible. In practice, the staff who need training are those who open accounts, change addresses, reissue cards and handle account access, because that is where red flags appear.

Mortgage Loan Originators: Reg Z and Reg G

Bank-employed mortgage loan originators are registered through the Nationwide Multistate Licensing System rather than state-licensed, so the state pre-licensing and continuing education requirements that apply to licensed originators do not apply to them. That leads some banks to assume there is no MLO training requirement at all. There is.

Regulation Z. Under 12 CFR 1026.36(f)(3)(iii), a loan originator organization must, for each individual loan originator employee who is not required to be licensed and is not licensed, provide periodic training covering federal and state law requirements that apply to that individual's loan origination activities. That is the provision that covers bank MLOs. "Periodic" is not defined.

Regulation G. Under 12 CFR 1007.104(b), a bank that employs MLOs must have written policies and procedures that, among other things, require that MLO employees be informed of the SAFE Act registration requirements and instructed on how to comply.

The Secure and Fair Enforcement for Mortgage Licensing Act (SAFE Act)/Reg G course addresses the registration side.

Expected but Not Prescribed

This is the longer list, and it is where most of a bank's training hours go. None of these items has a training mandate written into a regulation in the way the rules above do. All of them are areas where examiners expect to see training, and where the absence of training is difficult to defend after a violation.

OFAC. OFAC's regulations do not prescribe training, but OFAC's published framework for sanctions compliance commitments lists training as one of the essential components of a sanctions compliance program, and examiners review OFAC training as part of BSA/AML exams. Treat it as required in practice. Our OFAC compliance guide explains the program.

Fair lending. ECOA, Regulation B and the Fair Housing Act do not prescribe training, but fair lending violations are among the most expensive a bank can have, and training is a standard element of a fair lending program.

UDAAP. No training mandate, but UDAAP risk sits in sales practices, marketing and servicing, and examiners look for training wherever incentive pressure exists.

Consumer deposit rules. Regulation CC, Regulation E, Regulation DD and privacy rules set operational requirements for frontline and operations staff. Training is how a bank makes those requirements work at a teller window.

Elder financial exploitation. Federal guidance encourages banks to train staff to recognize and respond to exploitation, and some states have their own requirements. Check your state.

HMDA, CRA, flood insurance and other lending rules. Each sets data and process requirements that depend on trained staff, without prescribing the training.

The test examiners apply here comes from the compliance management system framework. Training is one of the elements of a CMS's compliance program, and examiners ask whether training is current, tailored to roles and tied to the bank's compliance risk. A bank can be compliant with every training mandate above and still receive a CMS finding for training that does not reach the people who need it.

Who Has to Be Trained

Across both lists, the same groups recur.

The board. BSA program approval, information security reporting and overall oversight all assume a board that understands what it oversees. Record board training with dates, content and attendees.
Frontline staff. BSA, security, red flags, deposit rules and fraud recognition.
Lenders and MLOs. Fair lending, Reg Z, SAFE Act and the BSA aspects of lending relationships.
BSA recordkeeping, wires and ACH, Reg E, Reg CC and information security.
Compliance, audit and the BSA officer. Practitioner depth on everything they monitor or test.
New hires. Before they assume duties, especially where a rule says "initial."

How Often: Setting Frequencies When the Rule Is Silent

Because most rules set no frequency, the bank sets its own. Do it on purpose.

Write the frequency into the policy for each training item, with a reason.
Train at onboarding for anything a person needs to do their job compliantly on day one.
Train on change, meaning a new role, a new rule, a new product or a finding from testing.
Use annual as the default for core regulatory topics like BSA and information security, because examiners expect it and because knowledge decays.
Track completion and follow up on gaps, because training that was assigned but not completed is not training.

Building a Defensible Training Program

What examiners want to see is less about the course catalog and more about the system around it.

A training policy or plan that ties topics to roles and to the bank's risk assessments.
Records showing who was trained, on what, when, and with what result.
Content that is current with the rules in force.
Evidence that training was tailored, not one module for everyone.
Follow-up when testing or audits show knowledge gaps.

Our post on how to become a bank compliance officer covers the skills behind running such a program.

Where to Start

For staff who need a grounding in the regulations behind these obligations, the Certificate in Compliance Essentials is the broad foundation. From there, add topic courses for the mandatory items: BSA/Anti-Money Laundering, the Bank Protection Act, and role-specific courses for lenders and operations.

Next Step

Start by listing the training obligations your bank actually has, with the citation for each, and then the expected training you have chosen to add and why. The Certificate in Compliance Essentials gives compliance staff and new officers the regulatory grounding to build and defend that list.

Frequently Asked Questions

What training is required for bank employees by law?

Only a few training obligations are written into banking regulations. The BSA/AML program rules require training for appropriate personnel. The Bank Protection Act rules require initial and periodic training in security responsibilities and robbery conduct. The interagency information security guidelines require training staff to implement the information security program. The identity theft red flags rules require training staff as necessary. Regulation Z requires periodic training for unlicensed, registered mortgage loan originators. Most other common training, such as fair lending or UDAAP, is expected by examiners but not prescribed.

Is annual BSA training required?

The BSA program rules require "training for appropriate personnel" but do not specify a frequency. Annual BSA training is the standard practice, and examiners expect training to be ongoing and kept current, which in practice means at least annually for most staff, plus training at hire and on role changes. The rule itself, at 31 CFR 1020.210 and the banking agencies' parallel rules, does not use the word annual. Set your frequency in the BSA program, explain why, and follow it consistently.

Do bank directors need compliance training?

Yes, in practice. The BSA program must be approved by the board, the information security program must be reported to the board at least annually, and the board oversees the compliance management system. None of that works without directors who understand what they are approving. Examiners expect the board to receive BSA/AML training appropriate to its oversight role. Record each board training session with the date, content and attendees, because a minute that only says "compliance update" is hard to defend.

What compliance training do bank tellers need?

Tellers need BSA/AML training covering currency transaction reporting, structuring and suspicious activity escalation; customer identification; OFAC screening procedures; Bank Protection Act security training, including robbery procedures, before they work a teller line; and information security awareness. Most banks also train tellers on Regulation CC holds, fraud recognition and elder financial exploitation. Several of these are regulatory requirements and the rest are examiner expectations, so tellers carry one of the heaviest training loads in the bank.

Do bank mortgage loan originators need continuing education?

Bank-employed MLOs are registered, not state-licensed, so the state pre-licensing and continuing education requirements for licensed MLOs do not apply to them. They are not exempt from training, though. Regulation Z, at 12 CFR 1026.36(f)(3)(iii), requires their employer to provide periodic training covering federal and state law requirements that apply to their loan origination activities, and Regulation G requires the bank to inform MLOs of registration requirements and instruct them on compliance.

Is OFAC training mandatory for banks?

OFAC's regulations do not contain a training mandate in the way the BSA program rule does. However, OFAC's framework for sanctions compliance commitments identifies training as one of the essential components of an effective sanctions compliance program, and examiners review OFAC training during BSA/AML examinations. Because OFAC violations are strict liability, banks should treat OFAC training as required in practice, especially for frontline, wire and operations staff who screen or process transactions.