The cost of AML compliance for a US bank or credit union is about $598,700 a year on average and $414,300 at the median, by FinCEN's own estimate in its April 2026 proposal, or between $3.7 billion and $5.4 billion a year across federally regulated banks and credit unions (FinCEN, 91 FR 18704). The averages hide the shape of the burden: the Government Accountability Office found direct BSA costs near 2% of operating expenses at the smallest banks it studied against under 1% at the largest, because much of the work costs the same whatever the bank's size. The BSA/AML risk assessment is a small line in that bill and a large lever on it, since it decides where every other dollar of the program goes. Botminds' BSA/AML Risk Assessment builds that assessment with agents from the bank's own data.
Industry figures on this page come from FinCEN, the GAO, the Federal Reserve Bank of St. Louis and the Conference of State Bank Supervisors, each linked where it appears. Figures for the sample bank, the fictional Tessaly Community Bank, are our estimates or the solution's design targets, and say so.
The smaller the bank, the larger the share of spending that goes to compliance
What is the cost of AML compliance?
The best current estimate for a US bank is FinCEN's: about $598,700 a year for the size-weighted mean bank or credit union and $414,300 for the median, on program compliance alone. FinCEN built it for the regulatory impact analysis of its April 2026 proposal, applying the methods of a 2020 GAO study and a 2018 St. Louis Fed report to data at the end of 2024. It is an estimate, not a survey, and it is the regulator's own.
FinCEN's own estimate of what an AML program costs a bank
$598,700
a year, size-weighted mean bank or credit union
$414,300
a year, the median
$3.7–5.4B
a year across banks and credit unions with a federal regulator
The same analysis gives a second reading from the older studies: aggregate program costs for banks and credit unions "would have been over $4 billion at the time of the surveys, with the average bank spending approximately $500 thousand or just under two percent of operating expenses." The two readings agree on the order of magnitude. What neither shows is the spread, and the spread is where the policy argument lives.
Why is AML compliance so expensive for small banks?
AML compliance is expensive for small banks because most of its work is fixed: a program must have a qualified officer, written procedures, monitoring, training and an independent test whether the bank has one branch or a hundred. The GAO studied 11 banks of different sizes and found "total direct BSA compliance costs generally tended to be proportionally greater for smaller banks than for larger banks": about 2% of operating expenses at each of the three smallest against less than 1% at each of the three largest (GAO-20-574). The sample is small and not generalizable, and the GAO says so; it is still the only federal study that measured BSA costs bank by bank.
Research on all compliance, not BSA alone, shows the same slope with larger samples. The St. Louis Fed's analysis of 469 community banks in the chart above runs from 8.7% of noninterest expense under $100 million to 2.9% between $1 billion and $10 billion. Ten years of the CSBS community bank survey, analyzed by its chief economist in 2025, found the smallest banks spending "roughly 11% to 15.5% of their payroll on compliance tasks, compared with 6% to 10% at the largest institutions," and concluded that "regulatory costs behave more like a fixed overhead cost than a variable one, meaning they do not scale down gracefully" (CSBS, Too Small to Scale, 2025).
The count of small banks makes the slope matter. At the end of June 2026, 3,190 of the 4,238 FDIC-insured institutions held less than $1 billion in assets, and many run their BSA program with one officer and part-time help. For them, a requirement that takes the same hours at every bank is a requirement that takes a larger share of a smaller budget. What that one person is responsible for is set out in its own guide.
How much do banks spend on BSA compliance, and on what?
The GAO's 11 banks spent between about $14,000 and about $21 million on direct BSA compliance in 2018. Two requirements took more than half of it on average: verifying customer identity, 29%, and reporting suspicious and other activity, 28%. Everything else, from currency transaction reports to recordkeeping, training and independent testing, shared the rest.
Where a bank's direct BSA compliance dollars went
Average across 11 banks studied by the GAO, 2018
- Customer identity verification · 29%
- Suspicious and other activity reporting · 28%
- All other BSA requirements · 43%
Most of that money is people. In the St. Louis Fed study, personnel was "by far, the largest category in all size groups, representing more than 60 percent of total compliance expenses." That is why the cost of the BSA program tracks the hours it takes, and why the questions worth asking are which hours are mechanical and which are judgement.
What share of compliance cost is BSA?
BSA and anti-money laundering work takes about a quarter of a community bank's compliance spending. In the CSBS 2025 survey of community banks, respondents put money laundering at 25% of their total compliance expense, second only to safety and soundness at 27% and ahead of consumer protection at 23% (CSBS, 2025 Annual Survey of Community Banks).
Put the two surveys together and the order of magnitude for a small bank is clear. If compliance is 5% to 9% of noninterest expense at banks under $500 million, and BSA is a quarter of compliance, BSA alone runs at roughly 1.3% to 2.2% of noninterest expense: our arithmetic on survey averages from different years, close to the GAO's 2% for its smallest banks.
What did FinCEN estimate the 2026 rule would cost?
FinCEN does not claim its April 2026 proposal would lower total costs, and does not expect it to raise them. The analysis says FinCEN "cannot definitively conclude that the aggregate annual expenditure level across all categories of affected financial institutions would be expected to decrease, particularly in the short run," but has no reasonable basis "to expect that the proposed rule would necessitate an increase in aggregate costs because of the flexibility in risk-based resource allocation that it is intended to promote."
The added paperwork it does estimate is small: about 132,960 hours and about $16.6 million a year in aggregate, across 48,680 financial institutions of every type. The proposal it replaced, published in July 2024 and now withdrawn, had estimated AML program and SAR reporting costs at between $5.1 billion and $7.5 billion a year. The FinCEN AML program rule NPRM has its own guide; for cost, the point is that the new rule would let a bank spend less on low risk only if its risk assessment shows where the low risk is.
The cost of getting it wrong
The largest AML costs are not in any compliance budget. They arrive as penalties, remediation and growth restrictions, and in several recent cases the risk assessment sat at the start of the chain.
What weak programs have cost, from the regulators' findings
| Case | What the regulator found | The cost |
|---|---|---|
| American Express National Bank, OCC, October 2026 | A risk assessment centred on deposit accounts rather than the bank's dominant card products | $350 million civil money penalty and a cease-and-desist order |
| Bank of America, FinCEN and OCC, October 2026 | Failures to mitigate and report priority national security risks; the OCC also faulted the skills of the BSA officer and staff | $1.2 billion FinCEN penalty, with $750 million credited to the OCC's penalty, the largest in OCC history |
| TD Bank, FinCEN, October 2024 | The bank knowingly spent about a tenth of what its peers did on AML, and its AML spending "remained flat" while backlogs grew | $1.3 billion FinCEN penalty, the largest against a depository institution in FinCEN's history |
| City National Bank of New Jersey, failed 2019 | A new strategy brought heavy money services business activity without controls; BSA/AML remediation expense outpaced income | Bank failure, per the Treasury Inspector General's review |
Enforcement is concentrated, and most banks never see it. Treasury's 2026 National Money Laundering Risk Assessment puts the share of banks facing AML/CFT enforcement actions at about one percent a year, while counting, since January 1, 2024, 33 cease-and-desist or consent orders, seven formal agreements and five civil money penalties against five banks worth more than $2 billion in all (Treasury, 2026 NMLRA). Lesser findings are common: the GAO reported that the banking agencies "cited about 23 percent of their supervised banks for BSA violations each year" in fiscal years 2015 to 2018. The same Treasury report describes TD Bank's internal "flat cost paradigm," a budget rule that the AML budget not increase year over year "despite its profits and risk profile increasing significantly." The lesson for a CFO is about direction, not size: the program has to grow with the risk the assessment finds.
What the risk assessment itself costs, and what it steers
The annual BSA/AML risk assessment is a modest share of the program's cost and a decisive share of its direction. Take the sample bank, a $3.4 billion sponsor bank with 112 data points in six systems. Our estimate of the assessment by hand is about 25 working days, most of it copying; the solution's design target is four days, most of it the BSA officer's review.
Where the sample bank's risk assessment days go, by hand and with BSA/AML Risk Assessment
- Copy 112 data points from six systems15 d
- Score 38 categories, rate 41 controls3 d
- Rewrite last year's narrative4 d
- Check the draft1.5 d
- Committee and board packs1.5 d
- Confirm, review, resolve challenges, packs4 d
Where the copying days go: the agents' overnight run
Valued at the 2025 median wage for compliance officers, $38.81 an hour (O*NET 13-1041), and loaded at 1.42 for benefits, the multiplier FinCEN itself uses in its burden estimates, 25 days of one person's time costs about $11,000. Four days costs under $2,000. Against a median program cost of $414,300, the saving is real but small, about 2% of the program.
The larger effect is what the assessment steers. Every other dollar of the program, the alerts that get reviewed, the customers that get enhanced due diligence, the scenarios that get tuned, is allocated according to the risk the assessment finds. An assessment rebuilt once a year from a spreadsheet tells the bank where its risk was last September. One refreshed each quarter, rerunning only what moved, tells it where the risk is now. At the sample bank, the second-quarter refresh found 14 of 112 data points past their 15% threshold and re-scored 6 of 38 categories, leaving 32 untouched.
The action plans an assessment produces, with owners and dates
How can small banks reduce BSA costs?
Small banks reduce BSA costs mainly by putting less effort into low risk, which the rules increasingly allow, and by taking the mechanical hours out of the work that remains. The AML Act of 2020 already says programs should point more attention and resources at higher-risk customers and activities and less at lower-risk ones, and FinCEN's 2026 proposal would write that allocation into the program rule.
The supervisors are moving in the same direction. The OCC's community bank procedures, in force for examinations beginning February 1, 2026, emphasize examiner discretion to rely on satisfactory independent testing, to carry forward conclusions on the BSA officer and training for one cycle, and to decide "whether and to what extent to perform transaction testing" (OCC Bulletin 2025-37). FinCEN's proposal says a community bank may base its risk assessment on staff's direct knowledge of its products, customers and markets rather than on elaborate models, and need not spend on national priorities to which it has no identified exposure.
All of those savings run through the same document. A bank can only reduce effort on low risk it has shown to be low, with data an examiner can check. That is the case for an assessment where every rating opens its evidence; the comparison of templates, consultants and software weighs the ways to build one. See how the agents build it in BSA/AML Risk Assessment.
Questions people ask
How much do banks spend on AML compliance in total?
FinCEN estimates between $3.7 billion and $5.4 billion a year in program compliance across banks and credit unions with a federal regulator, and over $6 billion a year for the reporting and recordkeeping part of BSA burden across all institution types. The withdrawn 2024 proposal had put AML program and SAR costs at $5.1 billion to $7.5 billion a year.
Do larger banks spend more on AML in dollars?
Yes, much more in dollars and less as a share. The GAO's 11 banks ranged from about $14,000 to about $21 million in direct BSA costs in 2018, but the three largest spent under 1% of operating expenses against about 2% at the three smallest.
Is BSA the biggest compliance cost for community banks?
It is the second biggest. In the CSBS 2025 survey, money laundering accounted for 25% of community banks' compliance expense, behind safety and soundness at 27% and ahead of consumer protection at 23%.
What is the most expensive part of BSA compliance?
In the GAO's study, verifying customer identity (29% of direct costs) and reporting suspicious and other activity (28%) were the most costly areas on average. Personnel is the largest expense category within compliance generally, at more than 60% in the St. Louis Fed study.
Would FinCEN's 2026 proposal lower AML costs?
FinCEN does not claim it would. It says it cannot conclude that aggregate costs would fall, especially in the short run, and has no reason to expect them to rise, because the rule's flexibility lets banks move resources from lower to higher risk. The proposal is not yet final.
How common are BSA penalties for banks?
Rare at the top end: Treasury says about one percent of banks face AML/CFT enforcement actions each year, with five civil money penalties against banks since January 2024. Findings are far more common; the GAO reported about 23% of supervised banks cited for BSA violations each year in fiscal years 2015 to 2018.