BSA officer responsibilities, in the words of the FFIEC BSA/AML Examination Manual, are to coordinate and monitor day-to-day compliance with the Bank Secrecy Act and to manage "all aspects of the BSA/AML compliance program," reporting regularly to the board (FFIEC, BSA Compliance Officer). At a large bank that is a department with deputies. At a community bank it is often one person who also writes the institution-wide risk assessment, reviews the alerts, signs the SARs and presents to the board. Botminds' BSA/AML Risk Assessment exists for that person: agents build the annual BSA/AML risk assessment from the bank's own systems, every rating cited to its source, so the officer spends the fall deciding, not copying.
The examples come from a fictional sample bank as it runs through the solution: Tessaly Community Bank, $3.4 billion, 41 branches, with a BSA officer named Renee Coyle. Industry figures come from regulators and research bodies, linked where they appear.
Most US banks are small enough for one person to hold the BSA program
4,238
FDIC-insured institutions at the end of June 2026
3,190
of them with less than $1 billion in assets
8.7%
of noninterest expense spent on compliance at banks under $100 million (2014)
2.9%
at banks of $1 billion to $10 billion, the largest group surveyed
What are the responsibilities of a BSA officer?
The BSA officer is responsible for coordinating and monitoring day-to-day BSA/AML compliance, managing all aspects of the program and reporting its status to the board. The FFIEC manual adds that the officer carries out "the board's direction, including the implementation of the bank's BSA/AML policies, procedures, and processes," and "may delegate BSA/AML duties to staff, but the officer is responsible for overseeing the day-to-day BSA/AML compliance program."
The legal anchor is short. The bank's AML program rule, 31 CFR 1020.210, and each banking agency's own rule (for a state nonmember bank, 12 CFR 326.8) require "designation of an individual or individuals responsible for coordinating and monitoring day-to-day compliance." Everything else in the job description follows from the other pillars that individual coordinates: internal controls, independent testing, training, customer identification and customer due diligence.
What the BSA officer answers for, pillar by pillar
| Program element | What the BSA officer does | What an examiner reads |
|---|---|---|
| BSA/AML risk assessment | Identifies the bank's risk categories, analyzes the data behind them and keeps the assessment current as products, customers and geographies change | The written assessment, its factors and weighting, and whether the program follows from it |
| Internal controls | Writes and maintains policies and procedures; runs or oversees alert review, SAR decisions, CTR filing, 314(a) searches and recordkeeping | Procedures against practice, and transaction testing sized to the bank's risk |
| Customer due diligence | Sets how customer risk profiles are built, reviewed and changed, and who may change them | Risk ratings, enhanced reviews and the triggers for re-rating |
| Independent testing | Supplies the tester with access and evidence; tracks every finding to closure, but does not test their own work | The test's scope, findings and management's responses |
| Training | Decides who needs which training and keeps it current with the rules and the risk assessment | Who was trained, on what, and when |
| Board reporting | Reports the status of compliance, including the required notification of SAR filings, to the board or a board committee | Board and committee minutes and the reports behind them |
Who appoints the BSA officer, and who does the BSA officer report to?
The board of directors appoints the BSA officer, and the officer reports, ultimately, to the board or a designated board committee. The manual is explicit that the appointment is the start of the board's duty, not the end of it.
The act by the bank's board of directors of appointing a BSA compliance officer is not, by itself, sufficient to meet the regulatory requirement to establish and maintain a BSA/AML compliance program.
FFIEC BSA/AML Examination Manual, BSA Compliance Officer
What the board owes in return is authority, independence and resources. The manual lists the signs examiners look for. Authority shows when senior management asks the officer about the money laundering risk of new products, customer types and geographies before launch. Independence shows in "clear lines of reporting and communication ultimately up to the board," and in "the ability to undertake the BSA compliance officer's role without undue influence from the bank's business lines." Resources means staff with the right skills for the bank's risk and systems that support "the timely identification, measurement, monitoring, reporting, and management" of that risk.
FinCEN's 2014 culture-of-compliance advisory puts the same point in plainer words: compliance staff "should be empowered with sufficient authority and autonomy," and an institution's "interest in revenue should not compromise" the program (FIN-2014-A007). In practice, at a small bank, the officer often reports administratively to the chief executive or the chief risk officer and functionally to the board's audit or risk committee. The second line is the one that protects independence.
What a BSA officer does in a year at a small bank
Most of a one-person program's year goes to suspicious activity work, and the risk assessment takes a concentrated block every fall. No regulator publishes a time study of the role, so the split below is our estimate, built from the duties above for a bank of a few hundred million dollars with one BSA officer and part-time help.
One BSA officer's year, by task (our estimate)
A one-person program at a bank under $1 billion
- Alerts and investigations · 35%
- SAR and CTR filing · 15%
- Customer due diligence and 314(a) · 15%
- Risk assessment · 11%
- Testing, exams and board reporting · 14%
- Training and policies · 10%
The risk assessment's share looks modest, but it lands in one season and it is the document everything else is judged against. For the sample bank, our estimate of the annual assessment by hand is about 25 working days: 15 of them copying 112 data points out of six systems with their sources, three scoring 38 categories and rating 41 controls, four rewriting last year's narrative and three checking the draft and building the committee and board packs. The design target with the solution is four days. If that target holds, the officer gets back about three weeks a year, almost all of it in the busiest quarter.
Can the BSA officer have other duties?
Yes. No rule says the BSA officer must do nothing else, and at small banks the role is commonly combined with compliance, operations or risk. The manual says "the actual title of the individual responsible for overall BSA compliance is not important; however, the individual's authority, independence, and access to resources within the bank is critical."
The limits come from independence, not from a job count. Three combinations deserve care. A BSA officer who also runs a business line is open to the "undue influence" the manual warns about. A BSA officer who performs the independent test of the program is testing their own work, and FinCEN's 2026 proposal would require testers independent of the AML/CFT function (FinCEN fact sheet, April 2026, still a proposal). And a BSA officer who is also the only person able to approve their own risk assessment has nobody checking the work. One community bank chief executive put the reality bluntly in the Conference of State Bank Supervisors' 2025 survey: "I'm essentially a quasi-BSA officer, quasi-chief risk officer, and so on" (CSBS, 2025 survey of community banks).
Who carries the BSA/AML risk assessment at a small bank, and what changes with agents
Today
Appoints the BSA officer, approves the written program and receives the assessment once a year, often as a grid of ratings without the data behind them.
With agents
Reads what changed and why in plain words, can ask where any figure came from, and votes on a version that has been challenged.
Still theirs: The appointment, the approval and the oversight.
Today
Copies counts from six systems, edits last year's narrative and answers an examiner's "why" from a spreadsheet tab.
With agents
Opens a cited draft, resolves every challenge with a reason and submits it for approval.
Still theirs: Every rating, every override and the submission.
Today
Spends three weeks pulling numbers, often without writing down where each came from.
With agents
Confirms each figure against its source passage and works the action plans.
Still theirs: The confirmation that each figure is right.
Today
Reviews ratings with little time to test them.
With agents
Reviews the five rows and the action plans as first checker, and approves methodology changes.
Still theirs: The first approval and the risk appetite.
Today
Reconstructs who changed what from emails and file versions.
With agents
Reads a version history with who, what, when, why and the evidence, read-only.
Still theirs: The independent judgement on the program.
What qualifications does a BSA officer need?
The rules ask for competence, not a credential. The FFIEC manual says the BSA officer "should be competent, as demonstrated by knowledge of the BSA and related regulations, implementation of the bank's BSA/AML compliance program, and understanding of the bank's ML/TF and other illicit financial activity risk profile." No regulation names a certification, a degree or a minimum number of years.
Examiners test the three parts of that sentence separately, and the OCC's community bank procedures, in force for examinations beginning February 1, 2026, set them out as steps. The checklist below follows them. The same procedures let examiners carry forward a satisfactory conclusion on the BSA officer for one cycle when nothing material has changed, but "exam findings may not be carried forward for two consecutive examinations."
What an examiner checks about the BSA officer
- The board designated a qualified individual
In the minutes, with the scope of the role, not only a name.
- Regular updates to the board and senior management
On the status of compliance, including the required notification of SAR filings.
- Knowledge of the BSA and its regulations
Shown in how procedures are written and kept current.
- Understanding of the bank's own risk profile
The risk assessment is the usual evidence: can the officer explain each rating?
- Authority
Consulted before new products, customer types, geographies and system changes.
- Independence
Reporting lines up to the board or a board committee, free of undue influence from business lines.
- Resources
Staff and systems sized to the bank's risk, size and structure.
Enforcement actions show what happens when the answer is no. In October 2026 the OCC found that Bank of America's BSA officer and staff did not have the skills and expertise the job required (OCC, October 2026). FinCEN's 2023 order against Shinhan Bank America found the bank went through five BSA compliance officers in 2019 alone (FinCEN, 2023). And Treasury's 2026 National Money Laundering Risk Assessment, reviewing recent actions, names the BSA officer among the program components most often cited, with internal controls and customer due diligence (Treasury, 2026 NMLRA).
How much does a BSA officer make?
Federal statistics do not track the BSA officer as its own occupation, so pay has to be read from the nearest categories. O*NET, the Labor Department's occupational database, lists "Bank Secrecy Act Anti-Money Laundering Officer (BSA/AML Officer)" among the reported job titles of financial examiners, whose 2025 median wage was $94,160 (O*NET 13-2061). The broader compliance officer group had a 2025 median of $80,730 (O*NET 13-1041).
Both figures cover far more than bank BSA officers, and a BSA officer who leads the program at a bank of several billion dollars will usually sit well above them. What the statistics cannot show, community bankers describe: in the same CSBS survey, a chief executive said that each time the rules expand to new kinds of firms, "my trained BSA officers, whom I work hard to retain, get calls offering double or triple their compensation." For a one-person program, losing that person means losing the only one who can explain the risk assessment, which is why a version that explains itself has value beyond the hours it saves.
The risk assessment: the BSA officer's document, examined first
The institution-wide risk assessment is where examiners usually start. The FFIEC manual says the scoping and planning of a BSA/AML examination "generally begins with a review of the bank's BSA/AML risk assessment, independent testing (audit), analyses and conclusions from previous examinations" (FFIEC, Scoping and Planning). If the assessment is missing or inadequate, "examiners must develop a BSA/AML risk assessment for the bank" (FFIEC, BSA/AML Risk Assessment), which is rarely a better outcome for the bank.
Two things make it the BSA officer's heaviest document. It is not a legal requirement today, the manual says, but it is the basis on which examiners judge whether the program is "commensurate with the bank's ML/TF and other illicit financial activity risk profile," so every weakness in it travels into the rest of the examination. And FinCEN's April 2026 proposal, not yet final, would make "risk assessment processes" an explicit part of every program, updated "promptly" when the risk changes significantly. The question of how often a bank must update its risk assessment gets its own guide; the short answer is that no rule sets a cycle.
BSA/AML Risk Assessment: the officer submits, and cannot approve
What one person can hand to agents, and what stays with the BSA officer
The part of the job agents can take is the part that is mechanical: finding the numbers, citing where each came from, scoring categories the way the bank's methodology says, drafting sentences that state those numbers, and checking the draft against last year's version and the regulators' current texts. In BSA/AML Risk Assessment seven agents do that work overnight. For the sample bank the run took 27 minutes: 112 data points pulled, 38 categories scored, 41 controls rated, nine sections drafted and seven out-of-date claims flagged for the officer.
The judgement does not move. The officer decides whether a rating stands, overrides it with a reason code when the methodology misses something, accepts or dismisses each challenge by name and submits the assessment as maker. The agents never submit or approve, and a change to the bank's methodology needs the chief risk officer's approval as a new version. Which inputs the officer should gather before any tool can do this is the subject of the guide to the inputs a BSA/AML risk assessment tool needs; what the work costs at different bank sizes is set out in the cost of AML compliance by bank size.
The board's ten-minute version of the assessment
For a one-person program the gain is not only time. It is that the assessment no longer depends on one person's memory: a successor, an examiner or an internal auditor can open any rating and see the data, the rule and the source behind it. See how the whole assessment is built in BSA/AML Risk Assessment.
Questions people ask
What does a BSA officer do?
A BSA officer coordinates and monitors a bank's day-to-day compliance with the Bank Secrecy Act and manages the whole BSA/AML program: the risk assessment, policies and procedures, suspicious activity monitoring and reporting, currency transaction reporting, customer due diligence, training, and support for independent testing and examinations. The officer reports the program's status, including SAR filings, to the board or a board committee.
Does the BSA officer have to be a separate person from the compliance officer?
No. The FFIEC manual says the title is not important, and many community banks give one person both roles. What matters is that the person has authority, independence from business lines and enough resources for the bank's risk, and that someone else performs the independent test.
Is a BSA officer certification required?
No regulation requires a certification. Examiners judge competence by knowledge of the BSA and its regulations, by how the officer runs the bank's program and by how well they understand the bank's own risk profile. Professional certifications can help show that knowledge but are not a substitute for it.
Can the board delegate oversight of the BSA officer to a committee?
Yes. The manual expects the officer's reporting line to run "ultimately up to the board of directors or a designated board committee," and the required notification of SAR filings may go to the board or an appropriate committee. The board remains ultimately responsible for the bank's BSA/AML compliance.
Does FinCEN's 2026 proposal change the BSA officer role?
It would rename the role the AML/CFT officer, make it responsible for setting up, running and overseeing day-to-day compliance, and require the officer to be located in the United States and accessible to FinCEN and the regulators. The proposal was issued in April 2026 and is not yet final, so the current rule still governs.
How many BSA officers does a bank need?
The rule asks for "an individual or individuals," so one is enough if that person has the staff and systems the bank's risk requires. Enforcement orders show the risk of too little: FinCEN found Shinhan Bank America had five different BSA officers in 2019 alone, and turnover in key positions is one of the factors the FFIEC's quantity-of-risk matrix rates higher.