BSA/AML software vendors: twelve cash reporting tests to run

BSA/AML software vendors are best judged on your own past cash days, not on their demos. They sell the systems a bank or credit union uses to meet its Bank Secrecy Act duties: identifying customers and rating their risk, monitoring transactions and working alerts into cases, filing suspicious activity reports, and reporting cash through currency transaction reports and exemptions. Buyers usually start with monitoring, because that is where the volume and the headlines are. Cash reporting is the better place to test a vendor, because its answers are not matters of opinion: on a given business day a CTR was owed or it was not, it named the right people or it did not, and it was accepted within 15 days or it was late. Botminds' CTR Filing & Exemptions is a solution for that part of the job, and the twelve tests below are the ones we would want any BSA/AML software vendor, ourselves included, to pass on a bank's own data.

Regulators do not tell banks which software to buy. FinCEN's April 2026 proposed program rule says so directly: it names no technology and requires none, and accepts that new tools will not suit every institution, smaller ones especially (FinCEN, proposed rule, 91 FR 18704). The proposal was still pending in October 2026. The standard examiners apply today is the outcome: reports that are complete, accurate and on time.

What do BSA/AML software vendors sell?

Systems that each do part of the work a bank's BSA/AML program requires. The program rule's pillars, internal controls, independent testing, a BSA officer, training and customer due diligence, are duties, not products; software supports the controls. A typical bank runs several systems: customer identification and risk rating at onboarding, transaction monitoring that raises alerts, case management where investigators decide on SARs, a filing tool for SARs and CTRs, and screening against sanctions lists, which is a separate legal regime usually bought alongside.

Cash reporting sits across several of those. It reads the same cash data as monitoring, uses the same customer records as due diligence, and files through the same BSA E-Filing System as SARs. That is why a product that is strong in monitoring can still be weak on CTRs: aggregation by business day, conductor capture and the exempt list are different problems from scoring alerts.

What should BSA/AML software do for cash reporting?

It should find every reportable cash day, produce a correct CTR for each, file and confirm it on time, keep the exempt list defensible, pass suspicious patterns to the people who decide on SARs, and leave a trail an examiner can follow. Each of those can fail silently, which is why the tests above ask for evidence on the bank's data. Two of them deserve a closer look, because they are where real failures happened.

The first is completeness. TD Bank's management could not reconcile the cash transactions that should have produced CTRs with the CTRs actually filed (FinCEN, TD Bank consent order). The second is data quality at the source: a product that files whatever the teller keyed will file "known customer". The rest of the list follows from the rules: aggregation by person and business day, Part I roles, exemptions narrowed to what the rule covers, five-year retention.

CTR Filing & Exemptions: every field with its source, checked before the batch

How do you evaluate BSA/AML software vendors?

Give it your past and grade it against what you know. For cash reporting the method is a back-test: load three months of past cash activity from every channel, let the software decide which CTRs were owed and what each should say, and compare that with what the bank filed. The OCC uses the same logic in examinations; its community bank procedures list "comparing filed CTRs against reportable transactions that can be identified on the bank's large cash transaction report" among examples of testing, and checking that reports such as SARs and CTRs are complete and accurate (OCC Bulletin 2025-37, attachment).

Grade both directions. A CTR the software finds that the bank did not file is either a miss by the bank or an error by the software, and someone has to say which. A CTR the bank filed that the software says was not owed usually means a rule written differently, such as a business-day cutoff or a common-ownership decision. Add a handful of seeded cases the vendor has not seen: a joint-account deposit, an employee depositing for two businesses, a night drop on a holiday weekend, an exempt grocer's settlement account. Then count.

Does BSA software file CTRs automatically?

It can submit them; it should not decide to. A product can build the batch file, submit it through BSA E-Filing and read the acknowledgment without anyone touching it. The control examiners look for is that the people who complete CTRs are not the ones who decide to file them, and that overrides of the aggregation need approval above the preparer. In practice, good software prepares and submits, and a person approves in between.

In CTR Filing & Exemptions the agents stack, read, draft and check, and submit only a batch the BSA officer has approved. A CTR specialist accepts every ID the agents read from an image, with a reason, and prepares the batch; the BSA officer cannot approve a batch containing a CTR she edited. The detail is in CTR automation: what agents may do, and what people still sign.

A person accepts what the software reads, and says why

Which BSA/AML software vendor is best for a community bank?

There is no single answer, and anyone who ranks vendors without your data is guessing. What differs for a community bank is proportion. Of the 4,238 FDIC-insured institutions at mid-2026, 3,190 had less than $1 billion in assets (FDIC, Quarterly Banking Profile, second quarter 2026). The OCC's community bank BSA/AML procedures, for banks up to $30 billion and in force for exams from 1 February 2026, emphasise examiner discretion on how much transaction testing to do (OCC Bulletin 2025-37). Lighter testing is not lighter obligation: every CTR rule applies to a $200 million credit union exactly as to a money-center bank.

Cost weighs more on small institutions. GAO's study of 11 banks found direct BSA compliance costs of "about $14,000 to about $21 million in 2018", about 2% of operating expenses at each of the three smallest against under 1% at each of the three largest; identity verification and suspicious and other activity reporting were the costliest areas, 29% and 28% of costs on average (GAO-20-574). The sample was not generalizable, but the direction is clear. For a community bank, the best software is the one whose setup it can complete with its own staff and whose results its BSA officer can explain to an examiner without the vendor in the room.

How much do BSA/AML software vendors charge?

Vendors rarely publish list prices, so price a bid against the work it changes. FinCEN's own estimate in its 2026 proposed rule is that "the size-weighted mean (median) bank or credit union currently spends approximately $598,700 ($414,300) on program compliance annually" (FinCEN, 91 FR 18704). That is an estimate built for a proposed rule, not a survey of software budgets, but it bounds the conversation: software that costs a large share of that figure has to remove a large share of the work.

For cash reporting the work is countable. Take your CTRs a year, your exempt persons, your branch requests for missing conductor details and your hours of morning review, and ask each vendor what each becomes. Budget for what sits outside any licence: connecting core, teller, ATM and imaging feeds, the back-test, and the time the BSA officer and internal audit spend understanding a new process before relying on it.

Model risk, AI and what the 2026 guidance changes

The model risk question changed in April 2026. The Federal Reserve, OCC and FDIC replaced their 2011 model risk guidance and rescinded the 2021 statement on BSA/AML systems (Federal Reserve, SR 26-2). The new guidance excludes simple calculations and rule-based processes from what counts as a model, is aimed mainly at banks over $30 billion, and leaves generative and agentic AI outside its scope (OCC Bulletin 2026-13). For cash reporting, that means aggregation by rule is ordinary software, while agents that read images or draft fields are governed by the bank's own controls rather than by a model validation template.

FinCEN's proposed program rule leans the same way. Among the factors it would weigh in enforcement decisions is whether a bank produced demonstrable results, "including effective use of artificial intelligence, federated learning, and other advanced monitoring tools" (proposed 31 CFR 1020.221(d)). That text is proposed, not in force. What a buyer should ask today is simpler: for every output an AI component produces, who checks it, against what, and where is that recorded.

Ask of every automated step: who checks it, against what, and where is that written down.

Where CTR Filing & Exemptions fits among BSA/AML software solutions, and where it does not

It fits the cash reporting and exemption part of a BSA program and nothing wider. Seven agents add up each person's business day across branches, ATMs and night drops, read missing conductor IDs from teller images, draft each CTR with the source of every field, check it against FinCEN's schema, file approved batches and read the acknowledgments, run the annual exemption reviews and hand near-line patterns to alert triage. It works with the core banking system, the teller system, the ATM network and night depository log, document imaging, BSA E-Filing and the bank's transaction monitoring system.

It does not replace the transaction monitoring system, case management or customer due diligence, and it does not decide SARs: when cash is kept just under the line across days, it sends the stacks to alert triage and shows the customer and the branch nothing. A SAR's existence may not be disclosed by any bank employee (31 CFR 1020.320(e)), and the hand-off is built around that rule.

Structuring goes to alert triage with the stacks, and the customer sees nothing

If your cash reporting already passes the twelve tests on your own data, you do not need it. If it does not, the quickest way to know is the back-test, and the eight-week go-live plan for CTR software shows where it sits.

Questions people ask

What are BSA/AML software solutions, in categories?

Customer identification and due diligence with risk rating; transaction monitoring and alert management; case management and SAR filing; currency transaction reporting and exemption management; 314(a) and 314(b) information requests; and sanctions screening, which is a separate legal regime often bought with them. Many vendors sell suites covering several.

Does a vendor's error excuse a late or wrong CTR?

No. The bank is the filer and answers for the report. TD Bank's consent order describes longstanding problems with a vendor used for CTR filing and still treats the late filings as the bank's violations.

What should BSA/AML software keep for examiners?

A copy of every filed report, kept five years and retrievable in a reasonable time, with the records that support it. BSA E-Filing keeps no copies for filers, so the bank's system is the only record. Examiners also read E-Filing correspondence and independent testing reports, so both should be easy to produce.

Is CTR software part of BSA/AML software?

Yes. CTRs and exemptions are BSA requirements, and most suites include a cash reporting module. Whether that module passes the tests on this page is a separate question from how good the suite's monitoring is.

How long should a BSA/AML software evaluation take?

For the cash reporting part, about as long as a three-month back-test takes to run and grade, plus seeded cases: a few weeks once the data is available. Monitoring evaluations take longer, because their answers need investigators' judgement to grade.