BSA compliance software is any system that carries part of a bank's Bank Secrecy Act workload: transaction monitoring, case management and SAR filing, CTR aggregation and exemptions, customer due diligence, 314(a) searches, and the research behind every answer staff are given. Most buying decisions start with monitoring and filing, because those have visible volumes. The research load is harder to see. By Botminds' estimate, one cash question from a branch takes the BSA team about 70 minutes to answer properly by hand, which at public wage rates is about $64 of staff time, roughly what FinCEN estimates a SAR filing costs in paperwork. Botminds' BSA/AML Manual Search is built for that unit: staff ask in plain words and get the rule beside the institution's own procedure, cited and dated, in about six minutes of BSA-team time by the same estimate.
The product examples come from a fictional sample credit union, Norrell Federal Credit Union. Wage and cost figures are from BLS, O*NET, FinCEN and GAO, linked at first use; every calculation built on them is ours and is labelled as an estimate.
One counter cash question, priced: about the cost of a SAR filing by hand, about a tenth with agents
What is BSA compliance software? Five jobs, often five products
BSA compliance software is a family, not a product. Each member automates a duty the Bank Secrecy Act puts on a bank, and most institutions buy several, from a core provider, a specialist vendor or both. A community bank survey by the state regulators' association found BSA/AML technology sourced in-house by 34.3% of respondents, through a combination by 47.8% and fully outsourced by 17.9%, with more than 75% satisfied (CSBS, 2025 Annual Survey of Community Banks).
The BSA software stack: what each kind does, and what it leaves undone
| Category | The duty it carries | What it does | What it does not do |
|---|---|---|---|
| Transaction monitoring | Identify and report suspicious activity (31 CFR 1020.320) | Runs scenarios and models over transactions and raises alerts | Decide whether activity is suspicious; that is an analyst's call |
| Case management and SAR filing | File SARs within 30 days, keep supporting documents five years | Organises alerts into cases, drafts and e-files SARs | Answer a teller's question at the window |
| CTR aggregation and exemptions | Report cash over $10,000 per business day; manage exempt persons | Adds up cash across channels, prepares CTRs and exemption reviews | Explain the rule to the person taking the cash |
| Customer due diligence and risk rating | CIP, beneficial ownership, the customer risk profile | Collects, verifies and scores customer information | Interpret new guidance on how ratings should work |
| 314(a) search | Search records for FinCEN's named subjects within 14 days | Matches subject lists against accounts and transactions | Anything beyond the match |
| Regulatory research and manual search | Every answer staff are given, and the procedures they follow | Finds the rule and the procedure, cites them with dates, flags lagging procedures | Monitor transactions, file reports or decide a SAR |
The categories overlap at the edges, and the boundary that matters for a buyer is the one in the last column. A monitoring system that raises a cash alert cannot tell the teller who took the cash what to say to the member. That answer comes from a person on the BSA team, today usually by phone.
What does BSA compliance cost a small bank?
FinCEN's own estimate is the best current figure: a bank or credit union spends about $598,700 a year on program compliance on a size-weighted average, or $414,300 at the median, between $3.7 and $5.4 billion a year across banks with a federal regulator (FinCEN, AML/CFT program proposal, April 2026). It is an estimate built for a proposed rule, not a survey of actual budgets.
What BSA compliance costs, by the public estimates
$414,300
median annual AML program spend per bank or credit union, FinCEN estimate
25%
of community bank compliance expense goes to money laundering rules, by banker report
~2%
of operating expense on direct BSA costs at the smallest banks GAO studied, against under 1% at the largest
The weight falls hardest on small institutions. The St. Louis Fed found total compliance costs averaged 8.7% of noninterest expense at banks under $100 million in assets, against 2.9% at banks of $1 billion to $10 billion, with personnel making up more than 60% of compliance spending (St. Louis Fed, 2016). A ten-year CSBS analysis found the smallest banks spent roughly 11% to 15.5% of payroll on compliance tasks, against 6% to 10% at the largest, and concluded the costs act more like fixed overhead than a variable cost (CSBS, 2025).
Personnel being the largest cost is the point. Software that removes staff time removes the expensive part; software that adds a review step for the same people does not.
The unit nobody prices: one regulatory question
A regulatory question is the smallest piece of BSA work with a real cost and no budget line. A teller asks whether two $9,500 deposits need a CTR; a lender asks whether a cash loan payment counts; an analyst asks whether the 90-day continuing activity review is still required. Each needs the rule, anything newer than the rule, the institution's procedure and a written answer.
Botminds estimated the BSA team's time on one such counter question at 70 minutes by hand, and called it modest. Priced at the O*NET 2025 median wage for compliance officers, $38.81 an hour, and loaded with the 1.42 benefit factor FinCEN uses in its own burden estimates, that is about $64. At the financial examiner median, $45.27, the occupation whose reported titles include BSA/AML officer, it is about $75. FinCEN's paperwork estimate for the SAR works out at about $75 a filing. The estimate leaves out the member's wait, which is unpriced but not free.
Where the seventy minutes go
Most of the time goes to finding things, not deciding them. Finding the rule in 31 CFR Chapter X and the FFIEC manual takes the largest share; checking FinCEN's FAQs and rulings for anything newer, and finding the right version of the procedure, take as long again between them.
Where the BSA team's time goes on one counter cash question
By hand · 70 minutes
- Calling the branch back for the deciding fact (10 min) · 14.3%
- Looking up the member's cash in the core (5 min) · 7.1%
- Finding the rule (20 min) · 28.6%
- Checking FinCEN for anything newer (10 min) · 14.3%
- Finding the procedure and its version (10 min) · 14.3%
- Writing the answer, referral and record (15 min) · 21.4%
With the agents · 6 minutes
- Confirming the deciding fact (1 min) · 16.7%
- Reviewing the rule, FinCEN, procedure and core lookups (2 min) · 33.3%
- Reviewing the answer and referral (3 min) · 50%
Two things change with agents, and only one of them is speed. The lookups shrink to checking what was found. And the share of time spent on judgment, reviewing the answer and the referral, rises from about a fifth to half. That is the part a BSA officer should want staff time spent on.
How much time do compliance officers spend on research?
No government survey measures it. FinCEN's burden estimates time filings, about eight minutes per CTR and 1.98 hours per SAR, not the questions behind them, and the community bank surveys measure spending, not tasks. That gap is why the estimate above is ours and labelled as one.
An institution can measure its own. For two weeks, log every BSA question that reaches the team: who asked, the topic, the minutes spent and whether a member was waiting. The log gives the volume, the average and the repeats, and the repeats are the cheapest to remove, whether through a standard answer, a procedure rewrite or training.
Pricing a year of questions at your institution
The annual cost is volume times minutes times a loaded wage. The table works one illustration through; the volume is an assumption to replace with your own log, not a measurement.
An illustration: 25 questions a week, by hand and with agents
| Step | By hand | With the agents |
|---|---|---|
| Questions a year (25 a week, 50 weeks) | 1,250 | 1,250 |
| Minutes of BSA-team time each | 70 | 6 |
| Hours a year | 1,458 | 125 |
| Share of one full-time role (2,080 hours) | about 0.70 | about 0.06 |
| Cost at $55.11 an hour (compliance officer median × 1.42) | about $80,400 | about $6,900 |
Set against FinCEN's median program spend of $414,300, the illustration's by-hand cost is about a fifth. The number that matters more is the hours: seven-tenths of a person, at an institution whose BSA team is a handful of people, spent finding text rather than judging cases.
Is compliance software worth it for community banks?
It is worth it where it removes staff time from work that does not need judgment, and not where it adds a screen to watch. Because compliance costs at small banks behave like fixed overhead, a tool with a fixed price helps most where the workload is steady and repetitive, and least where a bank's volumes are too small to notice.
Three conditions make research software worth testing. Questions reach the BSA team daily from branches or a contact center. The same questions come back. And procedures have not been reviewed since the October 2025 SAR FAQs, so staff are being given answers the newer guidance has changed. If none applies, a well-kept FAQ page and a quarterly procedure review may be the better spend.
The BSA/AML Manual Search queue: questions the agents could not settle, with clocks
What to ask a BSA software vendor before you buy
The useful questions are about evidence and limits. A vendor that answers them on your own procedures and a sample of your staff's questions has shown more than any demonstration on its own data.
Questions for any vendor of BSA research or manual search software
- Which sources, and how current?
The list of rules, guidance and FAQs it answers from, with the date of each copy and what happens when an update fails.
- Does each sentence cite a passage?
And is each answer checked against those passages before anyone sees it?
- What happens below its confidence threshold?
The question should go to a named person with what was found, not get a vaguer answer.
- Does it read our procedures, and flag the ones that lag?
Staff follow the procedure, so an answer that ignores it is half an answer.
- How does it protect against tipping off?
Member-linked questions need restricted history and a check that nothing reaches statements, online banking or the contact center's view.
- What can we show an examiner?
Every answer with the sources as they stood that day, referrals by date and author, and no SAR outcome anywhere.
- What does it not do?
A clear boundary, no filing and no SAR decisions, is a feature, not a gap.
- How is it priced against our volume?
Compare the price with your own two-week question log, not the vendor's average customer.
Where BSA/AML Manual Search fits, and where it does not
BSA/AML Manual Search sits in the last row of the stack. Staff ask from a box on the intranet. Agents read the question and the asker's role, ask back the one fact that would change the answer or read it from the core with the asker's permission, search the regulations, the FFIEC manual and FinCEN guidance, match the institution's procedures, and answer verdict first with every sentence cited and checked. When a member is at the window, the answer says what to do now and drafts an internal referral for the teller to submit and a BSA analyst to accept. Over 30 days of sample questions at the fictional credit union, the median time to a cited answer was 41 seconds, against a design target of under a minute.
It does not replace a monitoring system, a case management system or a CTR filing tool, and it connects to them rather than competing: referrals go into case management, where outcomes stay. It never decides or shows whether a SAR was filed. Its second job is upkeep: a procedure watch flags procedures older than a source they rely on and drafts the update for the BSA officer and the compliance committee, which matters most in a year like 2026, summarised in Bank Secrecy Act changes in 2026. Its third is evidence: every answer is kept with the source versions it rested on.
The examiner export: what staff were told, and on what basis
The trust side of the same purchase, what regulators expect of AI and how a compliance team comes to rely on it, is in AI for compliance in banking, and the failure modes of a general chatbot are in ChatGPT for AML compliance.
Questions people ask
What is the best BSA compliance software?
There is no single best product, because the stack covers different duties. Choose monitoring, case management and CTR tools on coverage and evidence for examiners, and research tools on whether every answer is cited, dated and checked. In the CSBS survey the largest group of community banks, about 48%, combined in-house and outsourced BSA technology.
How can a BSA officer save time without adding risk?
Remove the searching, not the judging. Log the questions the team answers for two weeks, turn the repeats into approved standard answers or procedure fixes, and automate only the lookups that can be checked against a cited passage. Keep SAR decisions, filings and procedure approvals with named people.
What are BSA compliance program requirements?
A bank's program must include internal controls, independent testing, a designated BSA officer, training for appropriate personnel and risk-based customer due diligence, under 31 CFR 1020.210 and each regulator's parallel rule. Software can support every pillar but cannot be the program; the board approves the written program.
Do examiners accept software-generated answers?
Examiners judge the program, not the tool. What they can test is whether staff were given correct answers and whether the institution can show the basis, so an answer kept with its dated sources is easier to defend than a phone call. A proposed rule should never be the sole basis of an answer.
Is BSA software required by regulation?
No. The rules require outcomes, such as reporting suspicious activity and cash over $10,000, not particular technology. FinCEN's April 2026 proposal names no technology and requires none, and a small institution can meet the rules with manual processes if they are reasonably designed for its risk.