BSA/AML training program: what examiners review and how to build it

Short answer: A BSA AML training program has to reach every person whose duties require knowledge of the Bank Secrecy Act, including the board. Content should be tailored to each role and updated when rules or products change. Examiners following the FFIEC BSA/AML manual's training section look for materials, session dates, attendance, test results if you test, and a record of who missed training and what you did about it.

That last item is where banks and credit unions get caught. Courses are easy to buy. Showing that the teller course differs from the lending course, and that the three people who missed their deadline were chased and finished, is harder. In LMS Advisor you assign each role's modules with a due date and a mandatory flag, and the dated overdue report becomes your record of who missed training and when they caught up. Below: a role matrix, an evidence checklist and an overdue workflow, based on sources we reread in September 2026. It's a practitioner's guide, not legal advice.

What does the FFIEC manual expect from BSA/AML training?

The legal hook is short. The OCC's rule for national banks and savings associations, 12 CFR 21.21, lists four program elements, and the fourth is simply "provide training for appropriate personnel." The NCUA's version for federally insured credit unions, 12 CFR 748.2(c)(4), uses the same words. Both rules also require the written program to be approved by the board, and the NCUA rule adds that the approval must be reflected in the credit union's minutes.

The FFIEC manual fills in the detail, and it's what examiners work from. Read closely, its training section expects:

• Risk-based content. Training covers the parts of the BSA that are relevant to the bank and its risk profile: regulatory requirements, supervisory guidance and the bank's own policies, procedures and processes.
• Tailoring by operational area. The manual wants examples of money laundering and suspicious activity that fit each area. Its own examples: teller training should focus on large currency transactions and suspicious activity, while loan staff should learn how money gets laundered through lending arrangements.
• Targeted training for higher-risk lines. Lending, trust services, foreign correspondent banking and private banking are named as areas that may need their own material.
• Board and senior management training. Foundational training, plus updates on changes and new developments in the BSA.
• Specialist training for the BSA officer and staff. Periodic training relevant enough to keep them current.
• New hire coverage. An overview of the BSA's purpose and requirements, typically at orientation or reasonably soon after.
• Agents and outsourced training. Agents who perform BSA-related functions for the bank need training too, and if another institution or vendor delivers your training, you keep documentation of that.

Is BSA training required annually?

The manual doesn't set a fixed cycle. It asks for periodic training that incorporates changes to regulatory requirements, guidance, internal policies and the bank's products, services, customers and geographies. Most institutions run an annual refresher, but that alone falls short if you launch a new product in March and nobody is trained on it until December.

Who needs BSA/AML training, from tellers to the board?

The examiner procedure is blunt: confirm that everyone whose duties require knowledge of the BSA is in the program. In practice that net is wider than the compliance department. At a typical community bank or credit union it includes:

• Directors and senior management
• The BSA officer, BSA analysts and anyone who works alerts or drafts SARs
• Tellers, member service reps and branch managers
• New accounts and deposit operations staff (CIP, beneficial ownership, CDD)
• Consumer and commercial lenders, loan processors and underwriters
• Wire, ACH and international payments staff
• Trust, wealth management and private banking officers
• Correspondent banking and treasury management staff, where you offer those services
• Agents or third parties performing BSA functions on your behalf

The people most often left out have job titles that don't sound like compliance: the loan processor who sees a large cash paydown, the contractor covering a teller line. If they can spot suspicious activity, put them in scope and write down why.

A role-based BSA/AML training matrix

A matrix is the single document that shows an examiner your training is tailored. It maps each role to core content, role-specific content, how often it runs and what evidence you keep. Here's the version we'd start from. Adjust it to your own risk assessment, because the manual ties content to your risk profile, not to a template.

Role group	Core content	Role-specific content	Typical cadence	Evidence to keep
Board of directors	BSA purpose, program pillars, the institution's risk profile	Oversight duties, reading BSA reports, regulatory changes, exam findings	At onboarding, then annual briefing plus updates when rules change	Agenda, slides, minutes showing attendance, any questions raised
Senior management	Same as board	Risk appetite, resourcing the BSA function, escalation paths	Annual, plus change updates	Materials, attendance, quiz result if used
BSA officer and staff	Full regulatory requirements	SAR decisioning and narratives, CTR exemptions, OFAC, typologies, new FinCEN guidance	Ongoing: external conferences, webinars, certifications	Certificates, agendas, CE records from outside providers
Tellers and member services	BSA basics, red flags, escalation	Currency transaction reporting, structuring, cash-intensive customer behavior	At hire, annual refresher	Course version, completion date, test score
New accounts and deposit operations	BSA basics	CIP, CDD, beneficial ownership, account monitoring triggers	At hire, annual, and after procedure changes	Completion, test score, procedure version acknowledged
Lending	BSA basics	Laundering through loans: cash paydowns, unexplained collateral, third-party payments	At hire, annual	Completion, test score
Wire, ACH and payments	BSA basics	Funds transfer recordkeeping, OFAC screening, high-risk geographies	At hire, annual	Completion, test score
Trust, wealth and private banking	BSA basics	Complex ownership structures, source of wealth, PEP handling	At hire, annual	Completion, test score
Internal audit and independent testers	Full regulatory requirements	Testing methodology, sampling SAR and CTR files	Annual or before each test cycle	Materials, dates, outside training records
Agents and contractors in BSA roles	BSA basics	Whatever function they perform for you	Before they start, then annual	Their completion record, or documentation of the provider's training

From building these: keep the core module short and shared, then stack role modules on top. One long course for everyone is what the manual warns against. Version every module and record which version each person took. And give the board its own format. A short session at a board meeting where the BSA officer walks through the risk assessment and recent changes, with minutes recording who attended, is stronger evidence than a click-through module.

Testing: how do you prove people learned the material?

The manual doesn't require tests. It says to keep testing materials "if training-related testing is used by the bank." But a completion date only proves someone opened a course. A scored assessment is the easiest way to show understanding, and it gives you something to act on when a branch or department is weak.

What makes a BSA test worth keeping:

1. Scenario questions, not definitions. "A customer deposits $9,500 in cash on Monday and $9,000 on Tuesday. What do you do?" tells you more than "What does CTR stand for?"
2. Role-specific question pools. Tellers get currency questions, lenders get loan paydown questions. Draw each attempt from a pool so people can't pass answers down the hall.
3. A pass mark and a retake rule. Decide in advance what happens after a failed attempt: immediate retake, a required review lesson first, or a conversation with the BSA officer after two failures. Write it down in the training procedure.
4. Stored results per attempt. Keep the score, the date and the question set version, so you can show what a teller was actually tested on, not just "passed."
5. Item analysis once a year. A question most people miss means a bad question or bad training. Find out which before an examiner does.

What BSA training documentation do examiners ask for?

The manual lists the records directly: training and testing materials, the dates of training sessions, attendance records, and any failures of personnel to take required training on time, along with corrective actions taken. Here's how that turns into a file you can hand over.

• The written training procedure, including scope (who's in), cadence, pass marks and the escalation rule for overdue training.
• The role matrix above, dated, with the risk assessment it was built from.
• Every version of every module, with the dates each version was live. A slide deck from 2024 that was overwritten in 2025 is a gap.
• Test banks and pass marks by version.
• Completion records per person: name, role, branch or department, module and version, assigned date, due date, completion date, score.
• Attendance for live sessions, especially board and management briefings, tied to the minutes.
• The overdue and missed-training log with corrective actions (next section).
• Evidence of change-driven updates: what changed, who got the update and when.
• Third-party training documentation for agents or for any outside provider that delivers training for you.

The manual doesn't set a retention period for training records. Our training records retention guide covers how banks usually handle that and where BSA fits next to other US rules.

How should you handle missed training and corrective action?

Examiners don't expect a perfect completion rate. People go on leave, change roles or quit mid-course. What matters is that you noticed and acted. A written escalation path makes that routine:

1. Assign with a due date. Every assignment carries a due date and a mandatory flag. New hires get theirs on day one, with a due date inside your orientation window.
2. Remind before the deadline. A week out, the learner gets a reminder. The manager gets a list of their people who haven't started.
3. Report overdue on day one past due. The overdue report (LMS Advisor has one built in) goes to the BSA officer and each manager. This report, saved with its date, is your record of the failure.
4. Escalate at a fixed interval. For example, 14 days overdue goes to the department head. 30 days goes to senior management, and some institutions restrict system access or BSA-related duties until the training is done.
5. Log the corrective action. Person, module, due date, days overdue, reason, action taken, who approved it, completion date.
6. Report the totals upward. Summarize overdue counts and actions in the BSA officer's regular report to the board. That closes the loop and gives the board evidence of oversight.

Two failure modes we see in LMS setups: overdue records vanish when an admin clears old enrollments (close them with a status instead of deleting), and nobody owns the overdue report. Name the owner in the procedure.

What changes if the 2026 AML/CFT program proposals are finalized?

Program rules are being rewritten. On April 10, 2026, FinCEN published a proposed rule on AML/CFT programs that withdraws and supersedes its 2024 proposal. It keeps "an ongoing employee training program" as a required program component. The OCC, FDIC and NCUA proposed matching changes to their own program rules the same day, and the Federal Reserve followed with a separate proposal published July 9, 2026, which cites the other agencies' April 10 proposals. (For a readable walk-through of FinCEN's version, see Mayer Brown's analysis.)

The Fed's text is the clearest statement of where training is heading. Frequency and content "would depend on the bank's ML/TF risk profile and the roles and responsibilities of the persons receiving the training," and training is expected to cover internal policies, procedures and controls that reflect the bank's risk assessment. It also refers to employees and non-employees with roles in the AML/CFT program.

When we checked in September 2026, these were still proposals, so the current rules and the FFIEC manual apply. Check the Federal Register for a final rule before you rewrite your procedure. If your role matrix already points back to your risk assessment, you're ready for either version.

Broker-dealers: what does FINRA Rule 3310 require for AML training?

Broker-dealers answer to FINRA rather than the FFIEC agencies. FINRA Rule 3310 sets the AML program for member firms, and paragraph (e) requires the firm to "provide ongoing training for appropriate personnel." Like the bank rules, it names no fixed frequency.

Other parts of the rule shape the training file:

• Independent testing (3310(c)) runs annually on a calendar-year basis, or every two years for firms that don't execute transactions for customers or hold customer accounts. Expect the testers to look at training records as part of it.
• A named AML compliance officer (3310(d)) must be identified to FINRA. That person usually owns the training plan and needs ongoing training of their own.
• Customer due diligence (3310(f)) procedures should show up in the content for registered reps and operations staff.

FINRA's AML key topics page links its AML e-learning courses and an AML template for small firms. Pair the template with a role matrix for reps, operations, supervisors and the AML officer, and keep the same records a bank would.

How to run a BSA/AML training program in LMS Advisor

An LMS won't write your BSA content or decide what your risk assessment means for tellers versus lenders. LMS Advisor has no off-the-shelf course library, so you bring your own content, author it in the course builder, or upload SCORM packages from a BSA content vendor. What it does is carry the evidence load. Here is how the steps above map to it:

Program step	In LMS Advisor
Role matrix	Branches, departments and groups that mirror your org chart, with each role's modules assigned to its group
Assign with a due date	Course assignments with due dates and mandatory flags
Testing	Scored quizzes and exams drawn from question bank pools with difficulty levels (see assessments and quizzes)
Chasing slow starters	Email rules for people who never started or stalled mid-course, plus Slack or Microsoft Teams notifications. Deadline reminder emails send the week-out nudge once an admin switches those rules on.
Missed-training record	Overdue reports exported to CSV, Excel or PDF and filed with their date (see reporting and analytics)
Annual refresher	Course certificates with a validity you set in months (12 for an annual cycle), an expiring-soon status 30 days out, and renewal by retaking the course
Board briefings	Attendance taken by hand or by QR check-in
Changes to assignments and settings	Audit logs of admin activity

Some banks want training data kept inside their own environment. LMS Advisor runs in our cloud or self-hosted on your own server, with SAML SSO and SCIM so staff accounts follow your identity provider. It gives you the delivery and the records. Whether the program satisfies examiners still depends on your content, your written procedure and how you act on the overdue list.

For the wider picture, see our banking and financial services page and the compliance training solution. If you want to see how assignments and overdue reports would map to your own role matrix, you can set up a trial and test it with a pilot group.

Frequently asked questions

What are the BSA/AML training requirements for bank employees?

Banks must provide training for appropriate personnel as one of the four required elements of a BSA/AML program. The FFIEC manual expects that training to cover BSA requirements, supervisory guidance and internal policies, tailored to each operational area. Everyone whose duties require BSA knowledge should be included, from tellers to lenders to the board.

How often is BSA training required?

No federal rule sets a fixed interval. The FFIEC manual calls for periodic training that reflects regulatory, product and policy changes, and FINRA Rule 3310 requires "ongoing" training for broker-dealers. Most institutions run an annual refresher, with extra updates when something material changes.

Does the board need BSA/AML training?

Yes. The FFIEC manual says the board and senior management should receive foundational training and be kept informed of changes in the BSA. Directors don't need the same depth as operations staff, but they need enough to understand the institution's risk profile and oversee the program. Record their attendance in the minutes.

What BSA training documentation do examiners ask for?

Examiners expect training and testing materials, session dates, attendance records, and a record of anyone who failed to complete training on time, with the corrective action taken. In practice, keep the role matrix, module versions and per-person completion and score records too. A dated overdue report plus an action log covers the missed-training part.

Can LMS Advisor run a BSA/AML training program?

Yes, for delivery and evidence. LMS Advisor assigns role-based modules with due dates and mandatory flags, tests staff from question pools, reports who is overdue and exports those records for examiners, in our cloud or on your own server. It has no ready-made BSA courses, so you bring your own content or a vendor's SCORM packages, and your procedure and content still decide whether the program holds up.