The FFIEC manual updates come in pieces: since the last full edition in 2014, the FFIEC has rewritten the BSA/AML Examination Manual section by section, in releases dated April 2020, February 2021, June 2021, December 2021, August 2023 and, most recently, February 27, 2026. Each release says it establishes no new requirements, and between releases the manual can fall behind newer guidance. In October 2026 its suspicious activity reporting section still tells banks to document decisions not to file a SAR, a year after FinCEN and the banking agencies said there is no such requirement. A quote from the manual can therefore be accurate and the answer built on it out of date. Botminds' BSA/AML Manual Search, which answers BSA questions from the manual, FinCEN guidance and the institution's own procedures, keeps the date of every passage it cites and flags the newer source when the two disagree.
The product examples come from a fictional sample credit union, Norrell Federal Credit Union. The manual's change log is quoted from the FFIEC InfoBase.
Where the FFIEC manual and a newer source disagree, and which one governs
Decisions not to file a SAR
What the manual says"Banks should document SAR decisions, including the specific reason for filing or not filing a SAR."
The newer sourceSAR FAQs, Q4 (October 9, 2025): "There is no requirement or expectation under the BSA or its implementing regulations for a financial institution to document its decision not to file a SAR."
Which governs todayThe FAQ. The manual's own notice now calls the FAQs "the most current guidance".
Where the CDD rule sits
What the manual saysCites the customer due diligence element as 31 CFR 1020.210(b)(5).
The newer sourceThe eCFR places it at 1020.210(a)(2)(v) for banks with a federal regulator, (b)(2)(v) for those without.
Which governs todayThe eCFR numbering. The substance is unchanged; a search for the old number finds stale text.
Is a risk assessment required?
What the manual saysA BSA/AML risk assessment is "not a specific legal requirement."
The newer sourceFinCEN's April 2026 proposal would make risk assessment processes an explicit requirement.
Which governs todayThe manual, for now. The proposal is not in force; the newer document is not always the governing one.
When was the FFIEC BSA/AML manual last updated?
The most recent update is dated February 27, 2026. The FFIEC revised five sections, the Introduction, Suspicious Activity Reporting, Payable Through Accounts, Electronic Banking and Nondeposit Investment Products, "to remove references to reputational risk, consistent with Executive Order 14331 of August 7, 2025," and said the updates "do not establish new requirements" (FFIEC BSA/AML InfoBase, What's New).
That release changed wording, not substance. The binding change on reputation risk came separately: an OCC and FDIC final rule, effective June 9, 2026, prohibits the two agencies from criticizing or taking adverse action against an institution on the basis of reputation risk (91 FR 18279), and the NCUA's parallel rule took effect July 27, 2026. A procedure that still lists reputational risk is out of step with both, which is why the sample credit union's procedure watch flagged one.
What sections of the FFIEC manual were updated, release by release
Six releases have reshaped the manual since 2020. The early ones rebuilt the examiner's core procedures and the regulatory requirement sections; the 2023 release reorganized sections to match individual regulations; the 2026 release was a targeted edit.
Every FFIEC BSA/AML manual release since the 2014 edition
| Release | What changed | What the agencies said about it |
|---|---|---|
| April 15, 2020 | First section updates since 2014, giving examiners instructions for risk-focusing examinations and assessing the compliance program | "The updates offer further transparency into the examination process and establish no new requirements." |
| February 25, 2021 | New introduction to Assessing Compliance with BSA Regulatory Requirements; revised Customer Identification Program, Currency Transaction Reporting, Transactions of Exempt Persons | "The Manual itself does not establish requirements for banks; such requirements are found in statutes and regulations." |
| June 21, 2021 | Revised monetary instrument recordkeeping, Special Measures, Reports of Foreign Financial Accounts, International Transportation of Currency | Revisions incorporate "regulatory and other changes since the last update of the Manual in 2014" |
| December 1, 2021 | New Introduction – Customers; revised Independent ATM Owners or Operators, Politically Exposed Persons, Charities and Nonprofit Organizations | No specific customer type automatically presents a higher risk |
| August 2, 2023 | Six sections rebuilt around single regulations, including information sharing (1010.520, 1010.540) and correspondent and private banking due diligence; sections deleted from the risks portion | "There were no changes to the regulatory requirements covered by these sections." |
| February 27, 2026 | Introduction, Suspicious Activity Reporting, Payable Through Accounts, Electronic Banking, Nondeposit Investment Products | References to reputational risk removed; "do not establish new requirements" |
Sections revised or created in each FFIEC manual release since 2021
The pattern matters for anyone who answers from the manual. Most of the manual has not been touched since 2021 or 2023, and some sections still carry earlier text. A section's date is part of what it says.
Does the FFIEC manual have the force of law?
No. The manual tells examiners how to assess a bank; the requirements themselves are in statutes and regulations. The FFIEC said so plainly with its February 2021 release: "The Manual itself does not establish requirements for banks; such requirements are found in statutes and regulations." Every release since has repeated that it establishes no new requirements.
That does not make the manual optional reading. It is how examiners scope an exam, what they test and what they expect to see documented, so a bank that ignores it is ignoring the examiner's checklist. But when the manual and a newer FinCEN statement disagree, the manual is not the tie-breaker. How the sources rank, from statute down to the manual, is set out in what actually binds a bank.
Is the FFIEC BSA manual current? Three places it lags in 2026
Most of the manual is current on the rules it describes, but three passages show how it falls behind. The first is the one examiners themselves have been told about. The SAR section opens with a notice, "SAR Section to be updated to reflect interagency Frequently Asked Questions," and tells examiners that the FAQs of January 2021 and October 9, 2025 "are the most current guidance regarding certain SAR topics such as SAR filing on continuing activity, documentation of a decision not to file a SAR, and maintaining a customer relationship after filing a SAR" (FFIEC manual, Suspicious Activity Reporting).
SAR Section to be updated to reflect interagency Frequently Asked Questions
FFIEC BSA/AML Examination Manual, Suspicious Activity Reporting, notice at the head of the section
The second is a citation. The customer due diligence section cites the CDD element as 31 CFR 1020.210(b)(5), the numbering from before a 2020 amendment. The eCFR now places the same words at 1020.210(a)(2)(v) for banks with a federal regulator. Nothing changed in substance, but the current regulation has no paragraph (b)(5), so a reader who follows the manual's citation into the eCFR finds nothing there.
The third shows the opposite risk. The manual says a BSA/AML risk assessment is "not a specific legal requirement." FinCEN's April 2026 proposal would make risk assessment processes explicit (91 FR 18704), but it is a proposal, and until a final rule takes effect the manual's sentence is still accurate. Newer is not the same as governing.
A correct quote, a wrong answer: decisions not to file
Here is the failure in one example. A BSA analyst asks whether the team must write up every alert it closes without a SAR. An answer that quotes the manual, "Banks should document SAR decisions, including the specific reason for filing or not filing a SAR," cites a real passage, quotes it exactly and gives the wrong answer for October 2026.
The current answer comes from the October 2025 FAQs: there is no requirement or expectation under the BSA to document a decision not to file, FinCEN has encouraged but not required it, and where an institution does keep one, a short statement will usually be enough (SAR FAQs, Q4). The FAQs say they change no legal requirement; they clarify what the requirements never included.
A citation check would pass the wrong answer, because the sentence matches its source. What catches it is a second question: is there anything newer on this topic? That is the difference between a valid citation and an accurate answer, and it is why a general chatbot that quotes the manual well can still mislead, as the guide to ChatGPT for AML compliance shows.
What replaced the 2014 FFIEC BSA manual?
Nothing replaced it in one piece. The 2014 edition was the last full release of the manual; since 2020 the FFIEC has replaced it section by section in the online InfoBase, and the FFIEC's own log describes the 2021 revisions as incorporating "regulatory and other changes since the last update of the Manual in 2014." Any section not yet rewritten still descends from that edition.
The practical rule is to stop thinking of the manual as an edition. It is a set of sections, each with its own date, and the 2014 PDF on a shared drive is a snapshot that misses six releases. The examination procedures that sit beside each section were updated with it.
Where is the FFIEC BSA/AML manual PDF, and which date to trust?
The manual lives online in the FFIEC BSA/AML InfoBase, which also offers a PDF of the manual and a Spanish translation from its menu. Revised sections are identified by their release date in the InfoBase, as the FDIC noted of the 2021 release. A downloaded PDF is a copy as of the day it was saved, and it will not show a notice added later, such as the one at the head of the SAR section.
Two habits keep an answer honest. Record the date of the section you relied on, not the date you read it. And before relying on any section, check the InfoBase's What's New log and FinCEN's FAQs and rulings for anything newer on the same topic.
Keeping answers current when a section changes: BSA/AML Manual Search
BSA/AML Manual Search does both checks for every answer. Its library holds the rules and guidance it answers from, each with the date of the copy used, synced nightly; the sample credit union's library lists ten source families and 24,617 passages, the FFIEC manual among them with its change log entry of February 27, 2026. A proposed rule, such as the April 2026 program proposal, is shown with a "not in force" label and is never the only basis of an answer.
Rules and guidance in BSA/AML Manual Search, each with the date of the copy the answers use
When a newer source changes the answer to a topic, the solution does not wait for the manual. Its procedure watch compares each of the institution's procedures with the sources it relies on; at the sample credit union, 3 of 14 procedures were older than a source they rely on, and the one on unusual activity referrals was redrafted against the October 2025 FAQs for the BSA officer to edit and the compliance committee to approve. And every answer is kept with the sources as they stood that day, so it can be replayed against today's: an answer given in September 2025 on no-file documentation would show its basis, and what has changed since.
An answer kept with its sources as they stood that day, ready to replay
Questions people ask
What are the FFIEC BSA exam manual updates for 2026?
One release, dated February 27, 2026, revised five sections to remove references to reputational risk, consistent with Executive Order 14331. The FFIEC said it establishes no new requirements. Through October 2026 no further release appeared, and the SAR section still carried its notice that it is to be updated for the interagency FAQs.
Does the FFIEC manual still say to document SAR decisions?
Yes. Its SAR section says banks should document the reason for filing or not filing. The October 9, 2025 SAR FAQs say there is no requirement or expectation to document a decision not to file, and the manual's own notice tells examiners the FAQs are the most current guidance on that topic.
Are the FFIEC examination procedures the same as the manual?
They are part of it. Each section of the InfoBase has overview text and examination procedures, and the releases since 2020 updated both together. The procedures describe what examiners do; like the rest of the manual, they create no requirements of their own.
Who writes the FFIEC BSA/AML manual?
The FFIEC's member agencies, the Federal Reserve, FDIC, NCUA, OCC and the State Liaison Committee, in close collaboration with FinCEN, which administers the BSA. Each release is announced by the agencies, for example in FDIC FIL-76-2021 and Federal Reserve SR 23-6.
How often is the FFIEC BSA manual updated?
Irregularly: six releases in the six years from April 2020 to February 2026, from four to six sections each in the releases logged since 2021. There is no fixed cycle, which is why each section's date, and anything FinCEN has issued since, has to be checked rather than assumed.