A BSA officer is the person a bank, credit union, or other covered financial business designates to run its day-to-day compliance with the Bank Secrecy Act and related anti-money laundering rules. Federal regulations require every covered institution to name at least one qualified individual to fill the role, and that person coordinates transaction reporting, sanctions screening, customer due diligence, staff training, and independent audits.1eCFR. 12 CFR 21.21 — Procedures for Monitoring Bank Secrecy Act (BSA) Compliance The job carries real authority inside the institution and real personal exposure when things go wrong.
Who Has to Appoint a BSA Officer
Appointing a BSA officer is a formal legal requirement. The board of directors of a bank or credit union must designate one or more qualified individuals to coordinate and monitor daily compliance, and the written compliance program itself has to be approved by the board and reflected in the meeting minutes.2eCFR. 12 CFR 208.63 — Procedures for Monitoring Bank Secrecy Act Compliance The requirement runs across regulators: the Office of the Comptroller of the Currency enforces it for national banks, the Federal Reserve for state-chartered member banks, the FDIC for state nonmember banks, and the NCUA for credit unions.3FFIEC BSA/AML InfoBase. Assessing the BSA/AML Compliance Program – BSA Compliance Officer
The obligation is not limited to traditional banks. Money services businesses, including money transmitters, check cashers, and currency exchanges, must designate someone to handle day-to-day BSA compliance, including required filings, program upkeep, and employee training.4eCFR. 31 CFR Part 1022 — Rules for Money Services Businesses Casinos and card clubs face the same requirement as part of their AML programs.5eCFR. 31 CFR Part 1021 — Rules for Casinos and Card Clubs If a vacancy opens up, the institution needs to move quickly. Operating without a designated officer can be treated as a program deficiency during an examination.
What a BSA Officer Actually Does
Currency Transaction Reports
When a customer conducts a cash transaction over $10,000 in a single day — a deposit, withdrawal, exchange, or transfer — the institution must file a Currency Transaction Report (CTR) with the Financial Crimes Enforcement Network (FinCEN).6FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Currency Transaction Reporting Multiple smaller cash transactions by the same person in one day that add up to more than $10,000 also trigger the requirement.7FinCEN. Notice to Customers: A CTR Reference Guide The BSA officer makes sure these reports are filed electronically within 15 calendar days of the transaction.
Suspicious Activity Reports
When activity looks unusual, lacks an obvious lawful purpose, or points to possible fraud or money laundering, the officer must ensure a Suspicious Activity Report (SAR) is filed with FinCEN. A SAR is due within 30 calendar days after the institution first detects facts that may warrant reporting. If no suspect has been identified by then, the institution can take another 30 days to identify one, but filing cannot be delayed beyond 60 calendar days total.8eCFR. 31 CFR 1020.320 — Reports by Banks of Suspicious Transactions For ongoing schemes such as active money laundering, the institution must also notify law enforcement immediately by phone.
SARs are strictly confidential. No one at the institution may tell a customer or any other unauthorized person that a SAR has been filed or that one exists. If the institution is subpoenaed for a SAR, it must refuse and notify FinCEN of the request.9eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions The BSA officer is responsible for making sure everyone in the organization understands that prohibition. In exchange, federal law provides a safe harbor: an institution or employee that files a SAR in good faith is shielded from civil liability for the disclosure.10Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
OFAC Sanctions Screening
Separate from BSA reporting, the officer typically oversees compliance with the Office of Foreign Assets Control (OFAC) sanctions program. That means screening customers and transactions against the Specially Designated Nationals (SDN) list. New accounts should be compared with OFAC lists before opening or shortly after, existing customers must be rescreened whenever the list is updated, and outgoing transactions like wire transfers and letters of credit must be checked before they go out.11FFIEC BSA/AML InfoBase. Office of Foreign Assets Control
Section 314(a) Requests
Under Section 314(a) of the USA PATRIOT Act, FinCEN sends biweekly notifications listing individuals or entities suspected of involvement in terrorism or money laundering. The institution must search its records and report back any matches. The BSA officer manages this process.12Financial Crimes Enforcement Network (FinCEN). FinCEN’s 314(a) Fact Sheet: 314(a) Facts and Figures
Customer Due Diligence and Beneficial Ownership
The officer runs the customer due diligence (CDD) program, which must cover four areas at a minimum: verifying customer identities, identifying the beneficial owners of business accounts, understanding the nature and purpose of each customer relationship, and ongoing monitoring to spot suspicious transactions and keep customer information current.13FinCEN.gov. Information on Complying with the Customer Due Diligence (CDD) Final Rule
When a legal entity such as a corporation or LLC opens an account, the institution must identify any individual who owns 25 percent or more of the entity, plus at least one person who controls it, and keep records of the beneficial ownership information collected.14eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers Higher-risk relationships call for enhanced due diligence. Federal guidance points to categories that commonly warrant deeper scrutiny, including foreign correspondent accounts, private banking relationships, politically exposed persons, and money services businesses.15FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Customer Due Diligence For those customers, the institution may need to gather additional information about source of funds and wealth, business operations, expected transaction volume, and geographic footprint.
Reporting to the Board
The BSA officer reports regularly to the board of directors, or a board committee, on the effectiveness of the compliance program and any significant issues. The board is responsible for making sure the officer has the authority, independence, and resources to run the program.16FFIEC BSA/AML InfoBase. BSA/AML Compliance Program Structures That reporting line creates direct accountability between the officer and the institution’s highest governing body.
Qualifications and Authority
The BSA officer must be competent in BSA regulations, skilled in running a compliance program, and knowledgeable about the institution’s specific risk profile: the customers it serves, the products it offers, and the geographies where it operates.3FFIEC BSA/AML InfoBase. Assessing the BSA/AML Compliance Program – BSA Compliance Officer Understanding the inherent risks of products like wire transfers, private banking, and international correspondent accounts matters, because these are common channels for illicit funds.
Authority is as important as expertise. The officer needs the power to challenge transactions, halt suspicious account openings, and request information from business lines without being overruled by revenue-focused managers. A workable budget for monitoring technology and qualified compliance staff is part of that authority.
No federal regulation mandates a specific credential, but two certifications are widely recognized in the field. The Certified Anti-Money Laundering Specialist (CAMS) designation, offered by the Association of Certified Anti-Money Laundering Specialists (ACAMS), is treated as the global standard for AML expertise; candidates must earn at least 40 eligibility credits through a combination of professional experience, education, and training before sitting for the exam. The Certified Financial Crime Specialist (CFCS) credential covers a broader range of financial crime topics across 12 core areas. Both require ongoing membership and continuing education to maintain.
Independent Testing, Training, and Monitoring
Independent testing has to be performed by people not involved in the institution’s day-to-day BSA functions, typically the internal audit department, outside auditors, or independent consultants. Smaller institutions without a dedicated audit function may use qualified staff who are not involved in the compliance area being reviewed.17FFIEC BSA/AML InfoBase. Assessing the BSA/AML Compliance Program – BSA/AML Independent Testing There is no hard regulatory frequency; testing should match the institution’s risk profile, though many institutions run it every 12 to 18 months and more often when the risk profile, systems, or compliance staffing change materially. Deficiencies uncovered during testing must be addressed promptly.
The officer also makes sure appropriate employees receive training tailored to their functions. A teller needs different instruction than a private banker or wire transfer specialist. The institution must document who was trained, when, and on what topics, since examiners review those records.17FFIEC BSA/AML InfoBase. Assessing the BSA/AML Compliance Program – BSA/AML Independent Testing
Most institutions use automated software to flag potentially suspicious transactions against pre-set rules and thresholds. The BSA officer oversees these systems and must confirm that filtering criteria are reasonable and that the programming has been independently validated.18FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements Access to the monitoring system must be limited, and any changes to assumptions or alert thresholds require sufficient oversight. When alerts fire, the compliance team has to review them and decide whether a SAR is warranted, which means staffing has to keep up with volume.
Personal Liability
BSA violations carry serious consequences for institutions and individuals. Federal law allows civil penalties of up to the greater of $25,000 or the amount involved in the transaction (capped at $100,000) for each willful violation by an institution, partner, director, officer, or employee.19Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties Because each unreported transaction or each day of noncompliance can count as a separate violation, penalties can pile up quickly.
Individual BSA officers can be held personally liable. FinCEN assessed a $450,000 civil money penalty against Michael LaFontaine, a former chief risk officer at a major national bank, for failing to act on significant AML program deficiencies. Among other problems, the bank had improperly capped the number of alerts its automated monitoring software could generate, so potentially suspicious transactions were never reviewed.20Financial Crimes Enforcement Network. FinCEN Penalizes U.S. Bank Official for Corporate Anti-Money Laundering Failures The case shows that regulators will pursue individual officers, not just institutions, when compliance failures stem from personal inaction.
The Anti-Money Laundering Act of 2020 also strengthened whistleblower protections. Employees who report BSA violations to the Treasury Department, the Attorney General, or their own employer are protected from retaliation, including discharge, demotion, and harassment. The law replaced the previous $150,000 cap on whistleblower awards with a mandatory payout of up to 30 percent of the government’s collection when sanctions exceed $1 million. For a BSA officer, that means compliance failures are more likely than ever to be reported from inside the organization.