AML training requirements come from 31 U.S.C. § 5318(h), which makes an ongoing employee training program one of four minimum components every covered financial institution must have in its anti-money laundering and countering-the-financing-of-terrorism (AML/CFT) compliance program.1Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority The other three are internal policies and controls, a designated compliance officer, and an independent audit function. Training sits at the same statutory level as suspicious activity reporting itself. An institution with policies on paper but no training on those policies has an incomplete program, and regulators treat an incomplete program the same as none at all.
Who the Training Requirement Covers
The Bank Secrecy Act’s definition of “financial institution” in 31 U.S.C. § 5312(a)(2) reaches well past banks and credit unions. It picks up brokers and dealers in securities or commodities, insurance companies, money transmitters, currency exchanges, casinos with annual gaming revenue above $1 million, dealers in precious metals and jewels, pawnbrokers, loan and finance companies, travel agencies, and businesses engaged in vehicle sales.2Office of the Law Revision Counsel. 31 USC 5312 – Definitions and Application of Title FinCEN treats entities conducting money transmission involving convertible virtual currencies as money services businesses, so they carry the same obligations.3Regulations.gov. Requirements for Certain Transactions Involving Convertible Virtual Currency
Which Employees Need Training
The bank regulation at 31 CFR 1020.210 requires training for “appropriate personnel,” which is doing real work in that sentence.4eCFR. 31 CFR 1020.210 – Anti-Money Laundering Program Requirements for Banks Everyone whose role touches compliance needs instruction, but not everyone needs the same instruction. Tellers, loan officers, and account-opening staff are most likely to encounter structuring attempts, inconsistent identification, or unusual transaction patterns, so their training focuses on recognition and escalation. Compliance officers need deeper coverage of filing obligations, regulatory updates, and investigative technique. Back-office personnel handling wires, account maintenance, or transaction monitoring need role-specific material.
FFIEC guidance states that training “should be tailored to each individual’s specific responsibilities.”5Federal Financial Institutions Examination Council. FFIEC BSA/AML Assessing the BSA/AML Compliance Program – BSA/AML Training A general awareness session fits administrative staff. Employees in international banking, private wealth management, or trade finance need intensive coverage of correspondent banking risks, beneficial ownership analysis, and sanctions screening. When the institution launches a new product line or enters a new geographic market, supplemental training on those specific risks should follow.
Board and Senior Management
Board members and senior management hold oversight responsibility for the program, and the FFIEC manual expects training to cover “the aspects of the BSA that are relevant to the bank and its risk profile.” Board members do not need to know how to file a SAR, but they need to understand the institution’s risk profile, the applicable regulatory expectations, and what a compliance failure could cost the organization and them personally.
What the Training Must Cover
The FFIEC examination manual identifies three content areas: BSA regulatory requirements, supervisory guidance, and the institution’s own policies and procedures. Within those areas, several topics show up on every well-built curriculum.
Red Flags and Structuring
Employees need to recognize the warning signs of money laundering. The most common pattern is structuring, where a customer breaks transactions into smaller amounts to stay below reporting thresholds. A customer depositing $9,900 in cash on consecutive days is the textbook example, but structuring also includes purchasing money orders or traveler’s checks in amounts just under the $10,000 currency transaction report threshold, or below the $3,000 recordkeeping threshold for monetary instrument purchases.6FFIEC BSA/AML InfoBase. FFIEC BSA/AML Appendices – Appendix G Structuring Other red flags include inconsistent identification, transactions with no apparent business purpose, unusual wire destinations, and rapid movement of funds through newly opened accounts. Training should use concrete scenarios rather than abstract descriptions.
Currency Transaction Reports and Suspicious Activity Reports
Federal law requires reporting of cash transactions exceeding $10,000 in a single business day on a Currency Transaction Report, and the obligation covers aggregated transactions by the same person.7FinCEN.gov. Notice to Customers: A CTR Reference Guide Staff need both the threshold and the aggregation rule, because two $6,000 deposits at different branches on the same day by the same customer trigger a CTR.
Suspicious Activity Reports work differently. No fixed dollar trigger automatically requires a SAR. Institutions must file when they detect suspicious transactions that may involve money laundering, tax evasion, or other criminal activity. Training must walk through the internal escalation process so front-line employees know to send concerns to the compliance officer rather than deciding on filings themselves, and staff must understand that they cannot tip off the customer about a filing.
The Safe Harbor
Employees often hesitate to escalate out of fear they will be sued if the customer turns out to be innocent. Under 31 U.S.C. § 5318(g)(3), any financial institution or employee that discloses a possible violation of law to the government “shall not be liable to any person under any law or regulation of the United States” or under any state law or contract for that disclosure. The statutory text does not condition the protection on good faith, and FinCEN has noted that most courts read it as providing unqualified immunity from civil liability for SAR filings.8Financial Crimes Enforcement Network. Federal Court Reaffirms Protections for Financial Institutions Filing Suspicious Activity Reports Covering this in training matters: employees who know they are shielded escalate; employees who do not self-censor.
The National AML/CFT Priorities
The Anti-Money Laundering Act of 2020 added a requirement that institutions incorporate government-wide AML/CFT priorities into their programs. FinCEN published eight:9FinCEN.gov. AML/CFT Priorities
- Corruption
- Cybercrime, including virtual currency considerations
- Domestic and foreign terrorist financing
- Fraud
- Transnational criminal organization activity
- Drug trafficking organization activity
- Human trafficking and human smuggling
- Proliferation financing
Not every priority is equally relevant to every institution. A community credit union faces different risks than an international correspondent bank. Training should identify which priorities apply to the institution’s risk profile and explain what those threats look like in practice.
Customer Due Diligence and Beneficial Ownership
Covered institutions must maintain written procedures for identifying and verifying beneficial owners of legal entity customers as part of the AML program.10eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers Staff need to know that a beneficial owner is any individual who owns 25 percent or more of the equity interests in a legal entity customer, or any single individual with significant managerial control. Account-opening employees need to know what information to collect, how to verify it, and when to escalate inconsistencies. The CDD Rule also requires risk-based ongoing monitoring, which means updating customer information and identifying suspicious transactions over the life of the relationship.
Training should also cover the current state of Corporate Transparency Act reporting. As of early 2025, FinCEN narrowed the scope of “reporting company” to entities formed under foreign law that have registered to do business in the United States, exempting domestic companies.11FinCEN.gov. Beneficial Ownership Reporting Outreach and Education Toolkit Outdated training in this area can lead to collecting information the institution is not required to gather, or missing information it is.
How Often Training Must Happen
FFIEC guidance says new staff should receive a BSA overview “during employee orientation or reasonably thereafter.” No hard federal deadline requires completion before a new hire touches a transaction, but a long gap between start date and initial training raises examiner questions. Most institutions treat onboarding training as a day-one or first-week priority.
Neither the BSA nor FinCEN regulations fix an annual cadence in the statute, but the expectation of regular refresher training is embedded in supervisory guidance. Most institutions adopt an annual schedule because it aligns with examination cycles and gives the compliance team a natural window to roll out updates. When new regulations take effect, FinCEN issues guidance, or an internal audit uncovers a gap, supplemental sessions outside the annual cycle are expected. Refresher training is also the right moment to address shifts in criminal tactics; an annual session that recycles a three-year-old deck signals a stale program even if it technically checks the “ongoing training” box.
Documentation and Retention
Delivering good training means nothing during an examination if the institution cannot prove it happened. The FFIEC manual lists what banks should document: training materials, testing materials where testing is used, dates of training sessions, attendance records, any failures of personnel to complete required training on time, and the corrective actions taken to address those failures. That last item is easy to overlook. Examiners are not only checking whether everyone completed training; they want to see that the institution noticed when someone did not and did something about it. An automated tracking system that flags overdue employees and logs the follow-up is the simplest way to satisfy this expectation.
The BSA generally requires institutions to retain records for at least five years, and most institutions apply that window to training documentation as well.12FFIEC BSA/AML InfoBase. FFIEC BSA/AML Appendices – Appendix P BSA Record Retention Requirements Records should be stored in a format that allows quick retrieval during an unannounced examination. Learning management systems are the standard approach because they log completions automatically, generate reports by department, and make it straightforward to pull records for a specific employee or date range.
Using Third-Party Training Providers
Many institutions outsource AML training to specialized vendors. Outsourcing the delivery does not outsource the responsibility. Before engaging a vendor, the institution should document its due diligence: verifying qualifications, confirming the curriculum covers the institution’s specific risk profile and regulatory obligations, and ensuring the content reflects current law. After training is delivered, the compliance team should review the materials and completion records rather than relying on vendor-generated reports alone. If an examiner asks what the training covers and the compliance officer can only say “we use a vendor,” that is not a sufficient answer. The officer needs to describe what the training covers, why it is appropriate for the institution’s risk profile, and how the institution verifies its quality.
Building a Risk-Based Program
The Anti-Money Laundering Act of 2020 reinforced that AML/CFT programs should be risk-based, with more resources directed to higher-risk customers and activities.13Federal Register. Anti-Money Laundering and Countering the Financing of Terrorism Programs Training should reflect the same principle. An institution where every employee receives identical generic training regardless of role and risk profile is not meeting the spirit of the requirement, even if it technically delivers “ongoing” training.
A sound approach starts with the institution’s risk assessment. Identify which products, services, customer types, and geographies carry elevated risk, then build the training around those findings. A bank with heavy international wire volume needs something different from a domestic credit union handling consumer deposits. Institutions operating where virtual currencies are relevant should incorporate red flags specific to those transactions, including privacy-enhancing tools, rapid cross-border transfers, and unhosted wallets. Regulators evaluate programs by whether they are “reasonably designed to ensure compliance with the BSA.”14FinCEN. Fact Sheet: Proposed Rule to Strengthen and Modernize Financial Institution AML/CFT Programs That standard gives institutions flexibility in design and delivery, and it also forecloses a checkbox approach: generic, stale, or disconnected training will get flagged no matter how many hours employees logged.
Penalties for an Inadequate Training Program
A deficient training program exposes the institution to civil money penalties under 31 U.S.C. § 5321, and those penalties scale with the nature of the violation.15Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
- Negligent violations: up to $500 per violation, with an additional penalty of up to $50,000 for a pattern of negligent activity.
- Willful violations: up to the greater of the amount involved in the transaction (capped at $100,000) or $25,000.
- Repeat offenders: up to three times the profit gained or loss avoided, or two times the maximum penalty for the underlying violation, whichever is greater.
These statutory figures are subject to annual inflation adjustments under the Federal Civil Penalties Inflation Adjustment Act. Training failures rarely stand alone in enforcement actions, but they are almost always cited as a contributing factor, because they make the rest of the program harder to defend. If an institution never taught its people the rules, regulators have a straightforward question about why anyone would expect those rules to be followed.16Financial Crimes Enforcement Network. Enforcement Actions