How often must a bank update its BSA/AML risk assessment?

How often must a bank update its BSA/AML risk assessment? No regulation sets a frequency. The FFIEC BSA/AML Examination Manual says risk assessments are generally updated to reflect changes in the bank's products, services, customers and geographies, so that they stay an accurate picture of its risks, and adds: "there is no requirement to update the BSA/AML risk assessment on a continuous or specified periodic basis" (FFIEC, BSA/AML Risk Assessment). Most banks update once a year by habit, and examiners expect the assessment to be current when they arrive. FinCEN's April 2026 proposal, not yet final, would require an update "promptly" whenever a change significantly alters the bank's risk, without setting any calendar. Botminds' BSA/AML Risk Assessment builds the annual assessment and then refreshes it every quarter and on events, rerunning only what moved.

The timing examples use a fictional sample bank as it runs through the solution, Tessaly Community Bank, which launched instant payments on March 9, 2026. Every rule quoted is linked where it appears.

How often must a bank update its BSA/AML risk assessment? As often as it stops being accurate

A bank must update its BSA/AML risk assessment whenever the assessment no longer describes the bank's risk, and at least before examiners rely on it. That standard is looser than a calendar and stricter than it sounds. Under the FFIEC manual, examination scoping generally starts from the bank's own assessment, and examiners who find it inadequate build one of their own from whatever information they have. An assessment that predates a new product line is, for that product, inadequate.

The standard also cuts the other way. A bank whose products, customers and geographies have not changed does not need to rebuild its assessment because a year has passed; it needs to show that it checked. The OCC's community bank procedures put the examiner's question in exactly those terms: whether the bank "has a process for updating its BSA/AML risk assessment, as necessary." The beliefs in the table below are the ones that most often turn that process into a ritual, each checked against the text it is attributed to.

Is an annual BSA risk assessment required?

No. An annual cycle is a common practice, not a rule. FinCEN's own description in its 2026 proposal is accurate: many institutions maintain "a single, or standalone, risk assessment process," which is "generally conducted on an annual basis, results in a documented ML/TF risk assessment," and "may be appropriate under the proposal" (FinCEN, 91 FR 18704). What the proposal adds is that examiners would judge all of a bank's risk assessment processes together, not whether one standalone assessment is enough on its own.

The annual habit persists for good reasons. Boards meet on a calendar, examinations come on a cycle, and a fixed as-of date makes year-on-year comparison possible. The problem is not the annual document; it is relying on it alone. A risk that arrives in March and waits for a September as-of date and a November board meeting spends most of a year outside the assessment that is supposed to steer the program.

What triggers a risk assessment update?

A risk assessment update is triggered by any change that moves the bank's money laundering risk: new products, services or customer types, mergers and acquisitions, significant growth in an existing line, and changes outside the bank. The FFIEC manual gives the core examples: the bank "may need to update its BSA/AML risk assessment when new products, services, and customer types are introduced or the bank expands through mergers and acquisitions." FinCEN's 2026 proposal widens the list.

A financial institution may need to update its risk assessment when new products, services, and customer types are introduced; if existing products, services, and customer types undergo significant changes; when the financial institution adopts new risk mitigation technology; or if the financial institution as a whole expands or contracts through mergers, acquisitions, divestitures, dissolutions, and liquidations.

FinCEN, AML/CFT Programs notice of proposed rulemaking, April 2026

Two items in that list are easy to miss. Significant change in an existing product counts, so a partner program that doubles is a trigger even if nothing new launched. And so does adopting new risk mitigation technology: a new monitoring system or a new identity verification tool changes the controls side, which changes residual risk. The proposal also says banks may need to update "based on factors external to their operations," such as a national risk assessment that names a new threat. Treasury's 2026 assessment adds a merger-specific warning: acquired customers "would have been vetted and onboarded through different procedures," and the acquirer "might face difficulties in understanding and mitigating these customers' risks" (Treasury, 2026 NMLRA).

BSA/AML Risk Assessment: a trigger, scored before launch

How often is BSA independent testing required?

The rules set no frequency for independent testing either, and this is where the 12-to-18-month figure comes from. The FFIEC manual says: "There is no regulatory requirement establishing BSA/AML independent testing frequency," and the bank "may conduct independent testing over periodic intervals (for example, every 12-18 months) and/or when there are significant changes in the bank's risk profile, systems, compliance staff, or processes" (FFIEC, Independent Testing).

The two cycles are linked, because the manual expects independent testing to "review the bank's BSA/AML risk assessment, including how it is used to develop the BSA/AML compliance program." A bank that tests every 18 months and refreshes its assessment every quarter gives its tester six versions to compare, each showing what moved and why. That is better evidence than a single annual document, and it is what FinCEN's proposal asks testers to rely on: "objective criteria" rather than "their own subjective judgment."

Does the BSA risk assessment need board approval?

No rule requires the board to approve the risk assessment itself, but the board must approve the program it shapes, and most banks take both to the board together. The FFIEC manual says the compliance program must be in writing, approved by the board and recorded in the board minutes (FFIEC, Assessing the BSA/AML Compliance Program), a requirement that rests on each agency's rule, such as the FDIC's at 12 CFR 326.8 (12 CFR 326.8). For the assessment, the manual says only that it "should be provided to all business lines across the bank, the board of directors, management, and appropriate staff."

Board approval of the assessment is still a sensible choice. A board that has voted on the ratings cannot later say it did not know where the risk was, and examiners reading the minutes can see the assessment reached the people responsible for the program. FinCEN's proposal would loosen the program side: approval by "the board of directors, an equivalent governing body within the financial institution, or appropriate senior management." The sample bank keeps both steps, the BSA Committee first and then the board, and a refresh that moves a row goes back to the committee, while a refresh that moves nothing is reported, not re-approved.

Does the FFIEC require a specific risk assessment format?

No. The FFIEC manual accepts any method or format and leaves the design to bank management; its Appendix J, the quantity of risk matrix, is an optional aid, not a template (the template guide compares the formats banks use).

The freedom has a condition attached. The manual calls documenting the factors and their weighting sound practice, and tells examiners not to criticise individual risk or process decisions when the bank has a sound risk assessment process and has followed its own policies and procedures. That protection is also why supervisory guidance is not law: under the agencies' 2021 rules on the role of guidance, codified for the FDIC at 12 CFR part 302, examiners do not criticize a bank for "non-compliance" with guidance (12 CFR part 302). Choosing a format is the bank's call; following its own written process is not optional.

What a quarterly refresh looks like in practice

A quarterly refresh checks every data point against a change threshold and re-scores only the categories that moved. It keeps the annual document honest without rebuilding it four times a year. A refresh with a trail is the updating process the OCC's community bank procedures ask examiners to look for, in evidence (OCC Bulletin 2025-37, attachment).

BSA/AML Risk Assessment: refresh only what moved

The design choices behind the screen are the ones to copy, with or without software: a written threshold for each data point, a re-score limited to the categories it touches, a challenger reading the changed sentences, and a rule that any row that moves goes back to the committee. For the sample bank, the refresh also found the fintech partner programs row reaching High inherent risk in July, three months before the annual assessment confirmed it. How the inputs behind those thresholds are gathered is covered in the inputs a BSA/AML risk assessment tool needs; the proposal that would make prompt updates a rule is covered in the FinCEN AML program rule NPRM. See the refresh on a full assessment in BSA/AML Risk Assessment.

Questions people ask

BSA/AML risk assessments should be updated at least every how many months?

No rule fills in that blank. The FFIEC manual says there is no requirement to update on a continuous or specified periodic basis, and FinCEN's 2026 proposal sets no timeframe. Annual is the common practice; updates on significant change are what the texts actually ask for.

Is a BSA risk assessment required?

Not by a specific regulation today: the FFIEC manual calls it "not a specific legal requirement," while making it the starting point of the examination and saying examiners must build one if the bank's is missing or inadequate. FinCEN's April 2026 proposal would make risk assessment processes an explicit requirement for banks once a final rule takes effect.

How often should the OFAC risk assessment be updated?

The same principle applies: when the bank's sanctions exposure changes, such as new international products, correspondent relationships or customer geographies. Examiners review the OFAC risk assessment and related independent testing when they include OFAC in the scope of a BSA/AML examination, so it should be current when they arrive.

What if a bank misses an update after a new product launch?

It is a gap examiners can find, because the FFIEC manual names new products as a typical reason to update. Under FinCEN's 2026 proposal, an established program that is not kept current would be a maintenance problem, and the proposal ties enforcement to significant or systemic failures to maintain a program.

Should a quarterly refresh go to the board?

Only if it changes a rating the board approved, and even then many banks send it to the BSA or risk committee first. The sample bank's rule is that a refresh that moves a row goes back to the committee, while one that moves nothing is reported with the evidence that nothing moved.

Does a new national risk assessment require an update?

It should prompt a review. FinCEN's proposal says banks may need to update their risk assessment processes based on factors external to their operations, and Treasury's 2026 National Money Laundering Risk Assessment names threats, such as accounts opened with AI-generated identities, that map onto a bank's delivery channels.