BSA training requirements: who needs to know what, seat by seat

The BSA training requirements for banks and credit unions come down to one line in each regulator's rule: the written BSA compliance program must "provide training for appropriate personnel." That line, in 12 CFR 21.21 for national banks, 12 CFR 326.8 for FDIC-supervised banks, 12 CFR 208.63 for state member banks and 12 CFR 748.2 for federally insured credit unions, sets no frequency, no hours and no syllabus. The detail comes from the FFIEC BSA/AML Examination Manual, which expects training tailored to each person's duties, foundational training for the board, periodic updates for the BSA team and records of who attended. The hard part is the tailoring: a teller and an analyst face different questions every day. Botminds' BSA/AML Manual Search answers those questions with the rule and the institution's own procedure side by side, and turns the ones staff keep asking into short, cited training.

The examples below come from a fictional sample credit union, Norrell Federal Credit Union, as it runs through the solution. The rules are quoted from the eCFR and the FFIEC manual as they stood in October 2026.

What are the BSA training requirements? One line in every agency's rule

The requirement is short and identical across the agencies: the program must "provide training for appropriate personnel." FinCEN's own program rule for banks, 31 CFR 1020.210, lists "training for appropriate personnel" as the fourth of its required elements, alongside internal controls, independent testing, a designated BSA officer and customer due diligence. A bank with a federal regulator is deemed to meet the statute's program requirement when its program includes those elements and also complies with its own regulator's program rule.

The same rules add two conditions that reach the training program. The BSA program must be written, and it must be approved by the board of directors and noted in the minutes. Training is part of that approved program, so a training plan that lives only in a learning system, outside the program the board approved, is a gap an examiner can find.

FinCEN's April 2026 proposal to rewrite the program rule would keep training as one of four pillars, worded as "ongoing employee training" (91 FR 18704). Comments closed on June 9, 2026, and no final rule had been published by late October. Until one is, the current wording governs, and the 2026 changes page tracks which parts of the proposal would move.

Who needs BSA training? "Appropriate personnel", read seat by seat

Appropriate personnel are everyone whose job touches a BSA duty, not only the compliance team. The FFIEC manual defines them as "those whose duties require knowledge or involve some aspect of BSA/AML compliance," and tells examiners to check "whether all personnel whose duties require knowledge of the BSA are included in the training program" (FFIEC manual, BSA/AML Training).

In practice that reaches far past the BSA department. Tellers and member service representatives take cash and see structuring first. Contact center staff field the call that asks whether a report was filed. Lenders accept cash payments and open accounts for businesses whose owners must be identified. Deposit operations files the CTRs and keeps the wire records. The manual adds a seat many programs forget: "The bank should provide training for any agents who are responsible for conducting BSA-related functions on behalf of the bank," and if another party delivers the training, "appropriate documentation should be maintained."

The weight of the work sits at the counter. In its 2024 paperwork estimate for the CTR, FinCEN modelled the record-keeping and reporting time as 90% teller, 9% compliance officer and 1% financial manager (FinCEN, CTR paperwork notice, February 2024). A program that spends most of its training hours on the BSA team is training the people who make 10% of the cash decisions.

How often is BSA training required? No rule says annually

No regulation sets a frequency for BSA training. The four agency rules and FinCEN's rule require training but name no interval, and the FFIEC's training section uses the word "periodic" and never "annual." Annual training is a common choice, often driven by the examination cycle, but it is the institution's choice, set in its own program.

What the manual does require is that training keep up. "Periodic training for appropriate personnel should incorporate current developments and changes to BSA regulatory requirements; supervisory guidance; internal policies, procedures, and processes; and the bank's products, services, customers, and geographic locations." New staff should get an overview "during employee orientation or reasonably thereafter."

The practical consequence is that the trigger for training is a change, not a date. When FinCEN and the banking agencies issued four SAR FAQs on October 9, 2025, staff trained in the spring were trained on an older answer to at least one common question: whether a deposit just under $10,000 is, on its own, a reason to report (SAR FAQs, Q1). An annual calendar would teach the new answer up to a year late.

Training should be tailored to each individual's specific responsibilities, as appropriate.

FFIEC BSA/AML Examination Manual, BSA/AML Training

What should BSA training cover for tellers, lenders and analysts?

Training should cover the BSA requirements, supervisory guidance and the institution's own procedures, with examples drawn from each person's work. The manual is specific about the examples: "training for tellers should focus on examples involving large currency transactions or suspicious activities, and training for the loan department should provide examples involving money laundering through lending arrangements." Business lines with their own risks, such as trust, correspondent banking and private banking, may need targeted training.

For the counter, three rules carry most of the weight. Cash is added up per business day across branches and channels, and a CTR is due when one day's cash in, or cash out, passes $10,000 (31 CFR 1010.313(b)). Splitting cash to avoid that report is structuring, whatever the amount, however many institutions or days it spans and however it is done, as 31 CFR 1010.100(xx) defines it. And nobody may disclose a SAR, or anything that would show one exists (31 CFR 1020.320(e)), which is why the words a teller uses when a member asks about reports belong in training, not improvisation.

For analysts, the content shifts to the SAR itself: the $5,000 threshold, the 30-day clock that may run to 60 days to identify a suspect, and the October 2025 FAQs on near-threshold cash, continuing activity and decisions not to file. For deposit operations it is the filing mechanics: CTRs within 15 days, the annual review of exempt customers under 31 CFR 1020.315, and the funds transfer records banks keep for transfers of $3,000 or more under 31 CFR 1020.410(a). The Bank Secrecy Act's requirements on one page lists each with its section.

Is board BSA training required? Foundational, and kept current

Yes, in the sense examiners apply it: the FFIEC manual says "the board of directors and senior management should receive foundational training and be informed of changes and new developments in the BSA." The board approves the written program, so it needs enough understanding to do that with judgment.

The manual is careful about depth. "While the board of directors may not require the same degree of training as banking operations personnel, the training should provide board members with sufficient understanding of the bank's risk profile and BSA regulatory requirements." Its reason is oversight: without a general understanding of the BSA, "it is more difficult for the board of directors to provide adequate oversight," including approving the program, giving the BSA function independence and providing enough resources.

A useful board session is therefore short on mechanics and long on the institution's own risk: which products and customers carry it, how many SARs were filed and why (boards are notified of SAR filings), what the last independent test found, and what changed in the rules since the last session.

BSA officer training requirements, and the OCC's carry-forward

The BSA officer and the BSA team need training that keeps them current, and the manual says so in those words: they "should receive periodic training that is relevant and appropriate to remain informed of changes to regulatory requirements and changes to the bank's risk profile." No rule names a certification, a course or a number of hours. External courses and certifications are a way to meet the expectation, not the expectation itself.

For community banks supervised by the OCC, the examination of this pillar became lighter in 2026. Under the OCC's community bank BSA/AML procedures, effective for examinations beginning February 1, 2026, examiners may use discretion to carry forward prior-cycle conclusions for one examination cycle "for the Training and BSA Compliance Officer pillars" (OCC Bulletin 2025-37). A strong file from the last exam can stand for the next one; it cannot stand for two.

NCUA BSA training requirements for credit unions

Federally insured credit unions are held to the same pillar under 12 CFR 748.2(c)(4): the compliance program must "provide training for appropriate personnel." The program must be written, approved by the board of directors and reflected in the credit union's minutes, under 748.2(b)(1). NCUA examiners use the same FFIEC manual as the banking agencies, so the expectations on tailoring, the board and documentation apply in the same way.

Two features of credit unions shape the training load. Shared branching raises counter questions a bank teller rarely meets, such as how cash a member brought to another credit union's shared branch is counted, and the institution's own procedure should give that answer in writing. And a credit union has a supervisory committee responsible for audit work alongside its board, a natural second audience for the board-level session.

How do you document BSA training for examiners?

Examiners look for evidence that the program was delivered to the right people and that gaps were fixed. The manual lists it: "Training and testing materials (if training-related testing is used by the bank), and the dates of training sessions should be maintained," and the bank "should maintain documentation of attendance records and any failures of personnel to take the required training in a timely manner, as well as any corrective actions taken to address such failures."

A syllabus from the questions staff ask: BSA/AML Manual Search

The most precise training needs analysis an institution has is the list of questions its staff ask the BSA team. Every call that begins "the member wants to..." is a gap in someone's training, and every repeated one is a gap across a branch. Most institutions lose that list, because the answers are given by phone.

BSA/AML Manual Search keeps it. Staff ask in plain words, and the agents answer with the rule beside the institution's own procedure, each sentence cited and dated. Because every question is kept, the BSA officer can see what each branch keeps asking. At the sample credit union, one branch asked 11 questions in 30 days, four of them about cash brought in over two or more days. The solution drafted a five-minute huddle on that topic from 23 questions across 14 branches, with each line cited and no member named, for the branch manager to give and the BSA officer to approve for every branch.

A five-minute huddle BSA/AML Manual Search drafted from the questions branches keep asking

The same answers double as just-in-time training. A member service representative who asks whether two deposits of $9,500 on consecutive days need a CTR gets the verdict, the rule, the procedure and three steps for what to do now, including the only words the procedure allows if the member asks. That is the content the FFIEC manual asks tellers to be trained on, delivered at the moment it is needed. Which decisions stay with people when agents answer is set out in the guide to AI for compliance in banking.

What to do now, at the counter: the training a teller needs, at the moment it is needed

Training after a rule changes: the October 2025 SAR FAQs

A rule change makes some training wrong overnight, and the materials rarely say which. The October 2025 SAR FAQs are the clearest recent case. They said that a transaction near the $10,000 CTR threshold is not, by itself, enough to require a SAR; that no separate post-SAR review of continuing activity is required; and that there is no requirement to document a decision not to file. Training that taught the older practice on any of these points needed changing.

The harder part is finding the procedures and materials that rely on the old answer. The sample credit union's procedure on unusual activity referrals, written in March 2024, still told staff to refer every cash deposit between $8,000 and $10,000. The FAQs speak to the SAR duty, not to internal referral thresholds, so the procedure was not unlawful; it was older than a source it relied on. In the solution, a procedure watch flags that lag, drafts a cited redline for the BSA officer, and lists the saved answers and training to re-check once the compliance committee approves the change.

Training content is only as current as the procedure it teaches, which is why keeping up with FFIEC manual updates and FinCEN's FAQs belongs in the same loop.

Questions people ask

Is annual BSA training a legal requirement?

No federal rule requires annual BSA training. The agency rules require "training for appropriate personnel," and the FFIEC manual calls for periodic training that incorporates current developments. Annual training set by the institution's own policy is a sound default, as long as rule changes also trigger updates between sessions.

Do part-time tellers and contact center staff need BSA training?

Yes, if their duties involve any part of BSA compliance, which taking cash or answering member questions about reports does. The FFIEC manual defines appropriate personnel by duties, not by title or hours. FinCEN's own CTR cost model puts 90% of CTR record-keeping time on tellers.

What are FFIEC BSA training requirements, as opposed to the rule?

The rule requires training; the FFIEC manual describes what examiners expect it to look like. That includes tailoring to each role, foundational training for the board, periodic training for the BSA officer and staff, training for agents doing BSA work, and records of materials, dates, attendance and corrective action. The manual instructs examiners and does not itself create requirements.

Should BSA training include a test?

No rule requires a test. The FFIEC manual mentions testing materials only "if training-related testing is used by the bank," and asks that they be kept. A short check question at the end of a session, like the one in the sample huddle, gives evidence that the point landed without a formal exam.

How long should BSA training records be kept?

No section of 31 CFR Chapter X names training records, so their retention is set by the institution's own policy. A practical policy keeps them at least until the next examination and independent test have reviewed them; five years matches the BSA's general retention period in 31 CFR 1010.430(d). The guide to BSA record retention sets out what the rule itself covers.