BSA/AML Master Program Manual
Building a unified, risk-based foundation for financial integrity and regulatory trust.
The BSA/AML Master Program Manual establishes the foundation for a comprehensive, risk-based Anti-Money Laundering and Counter-Terrorist Financing framework. It defines governance, oversight, and control standards across all business lines and jurisdictions, aligning with the Bank Secrecy Act, USA PATRIOT Act, OFAC, FATF, and other global regulatory expectations.
This master policy integrates the Bank’s enterprise risk assessment, customer due diligence, transaction monitoring, and independent testing programs into a cohesive system designed to protect the integrity of the financial system. It serves as the anchor for the four supporting playbooks, Customer Onboarding & CDD/EDD, Transaction Monitoring, Independent Testing & Training, and the FMEA Risk Assessment Guide, ensuring consistency, accountability, and continuous improvement throughout the institution’s compliance ecosystem.
What This Playbook Covers
• Governance & Accountability – Board, senior management, and BSA Officer responsibilities.
• Core Program Pillars – Customer due diligence, transaction monitoring, suspicious activity escalation, training, independent testing.
• Risk Assessment – How the institution measures inherent and residual financial crime risk across products, geographies, customers, and delivery channels.
• Escalation & Reporting – How issues, SAR obligations, and regulatory concerns are surfaced, tracked, and remediated.
• Continuous Improvement – How gaps are identified, prioritized, and closed.
Program Purpose & Regulatory Framework
The BSA/AML Program establishes a unified, risk-based framework to safeguard the institution and the financial system from money laundering, terrorist financing, and related financial crimes.
It aligns the Bank’s obligations with the Bank Secrecy Act, USA PATRIOT Act, OFAC regulations, and FATF recommendations to ensure consistent, effective, and sustainable compliance.
Governance & Accountability
A Bank’s governance framework establishes clear lines of authority and oversight to ensure its BSA/AML Program operates effectively and independently. The Board of Directors holds ultimate accountability for compliance with all AML, CTF, and sanctions obligations. Senior Management and the BSA Officer execute day-to-day implementation, ensuring the Program is adequately resourced, risk-based, and responsive to regulatory expectations.
Governance operates through an integrated Three Lines of Defense model:
Board of Directors: Approves the AML Program and reviews key metrics, risk reports, and audit findings.
Senior Management: Implements Board directives, allocates resources, and promotes a culture of compliance across all business lines.
BSA/AML Officer: Oversees program design, policy updates, and regulatory engagement; ensures independence and direct access to the Board.
Committees: (e.g., AML Steering, SAR, Sanctions, Product Risk) provide structured oversight and decision support.
Internal Audit: Performs independent testing and validation of control effectiveness.
This structure ensures the Bank maintains a strong control environment, timely escalation of emerging risks, and documented accountability from Boardroom to business line.
BOARD OVERSIGHT & RESPONSIBILITIES
The Board of Directors sets the tone for the Bank’s culture of compliance and holds ultimate accountability for the effectiveness of the BSA/AML Program. Through formal approval and regular oversight, the Board ensures the Program remains aligned with enterprise risk appetite and regulatory expectations.
Key responsibilities include:
Policy & Framework Approval: Review and approve the BSA/AML Policy, risk assessment methodology, and governance framework annually.
Resource & Independence Assurance: Confirm the BSA/AML Officer and Compliance team possess adequate authority, expertise, and staffing to fulfill their duties independently.
Oversight & Reporting: Receive periodic briefings on AML risk exposure, SAR trends, regulatory developments, and testing results through Board and Committee reports.
Culture & Accountability: Promote an ethical environment that prioritizes financial crime prevention, data integrity, and transparent escalation of compliance concerns.
Through these functions, the Board reinforces accountability, transparency, and the integrity of the Bank’s compliance operations.
SENIOR MANAGEMENT RESPONSIBILITIES
Senior Management serves as the operational bridge between Board-level oversight and execution of day-to-day BSA/AML compliance. They are accountable for translating the Board’s directives into actionable programs, controls, and culture.
Key responsibilities include:
Program Implementation: Ensure all BSA/AML policies, procedures, and controls are implemented across lines of business and remain current with regulatory guidance.
Resourcing & Systems: Allocate sufficient staffing, technology, and training to maintain effective transaction monitoring, reporting, and due diligence processes.
Escalation & Issue Management: Promote timely identification and remediation of control gaps, ensuring all significant issues are escalated to the BSA Officer and Board committees.
Performance Oversight: Evaluate departmental compliance metrics, investigation timeliness, and testing outcomes to verify continuous adherence to AML requirements.
Culture of Compliance: Reinforce ethical behavior, ownership, and accountability at every level of the organization.
Senior Management’s leadership ensures that compliance objectives are integrated into daily operations, not treated as a standalone function.
BSA/AML OFFICER – ROLE & INDEPENDENCE
The BSA/AML Officer is responsible for the overall administration, maintenance, and effectiveness of the Bank’s enterprise-wide BSA/AML and Sanctions Program. This role serves as the central authority for financial crime compliance and ensures the Program remains risk-based, current, and responsive to regulatory expectations.
Core responsibilities include:
Program Oversight: Develop, implement, and maintain the BSA/AML Policy, procedures, and risk assessment framework.
Monitoring & Reporting: Ensure ongoing transaction monitoring, escalation, and SAR reporting processes operate effectively and independently.
Regulatory Liaison: Serve as the primary point of contact with regulators, auditors, and law enforcement on AML matters.
Governance & Communication: Provide regular briefings and metrics to the Board, Executive Management, and applicable oversight committees.
Continuous Improvement: Lead annual reviews, testing follow-up, and enhancements to ensure alignment with evolving risks and regulatory guidance.
The BSA/AML Officer’s authority, independence, and direct reporting line to the Board of Directors ensure objectivity, transparency, and accountability in all program operations.
CORE PROGRAM PILLARS
The Bank’s BSA/AML Program is structured around five interdependent pillars that form the foundation of an effective financial-crime compliance framework.
Each pillar is designed to identify, monitor, and mitigate money-laundering, terrorist-financing, and sanctions-related risks across the enterprise.
1. Customer Due Diligence (CDD) & Enhanced Due Diligence (EDD)
Verify identity, understand ownership structures, and assess risk at onboarding and throughout the customer lifecycle.
2. Transaction Monitoring & Suspicious Activity Reporting (SAR)
Detect, investigate, and report unusual activity using automated systems, data analytics, and investigative review.
3. OFAC & Sanctions Screening
Screen customers, counterparties, and transactions against restricted-party lists to ensure compliance with all U.S. and international sanctions regimes.
4. Independent Testing & Audit
Validate the design and effectiveness of program controls, governance, and technology through periodic reviews conducted by qualified, independent personnel.
5. Training & Awareness
Provide role-specific, risk-based training to employees, management, and directors to reinforce obligations and promote a culture of compliance.
Together, these pillars establish a comprehensive, risk-based defense that meets regulatory expectations and supports enterprise integrity.
CUSTOMER DUE DILIGENCE (CDD) & ENHANCED DUE DILIGENCE (EDD)
The Bank’s CDD and EDD framework ensures complete understanding of each institutional client’s ownership, structure, and activity before and during the relationship lifecycle. These controls confirm legitimacy, prevent misuse of accounts, and support compliance with all AML/CTF obligations.
CDD Procedures: Collect and verify formation and regulatory documents, beneficial ownership details, business purpose, and expected activity. Where structures are multi-layered (e.g., fund series, offshore vehicles), the Bank performs full-chain review and maintains records in a central system for five years. Ongoing monitoring triggers updates whenever ownership changes or activity diverges from expectations.
EDD Measures: For higher-risk clients or transactions, including PEPs, complex ownership, or high-risk jurisdictions, the Bank conducts enhanced investigation of ultimate beneficial ownership, source of wealth and funds, jurisdictional risk, and third-party reliance. EDD cases require BSA Officer approval and may escalate to the AML Steering Committee for final determination.
Treating CDD and EDD as continuous risk management processes, not one-time events, links onboarding directly to transaction monitoring, SAR reporting, and the enterprise-wide risk assessment.
SANCTIONS, PEP & ADVERSE MEDIA SCREENING
Effective screening protects the Bank from sanctions violations, reputational harm, and financial crime exposure.
This control framework ensures all clients, beneficial owners, intermediaries, and counterparties are screened against global watchlists, politically exposed persons (PEP) databases, and adverse media sources.
Key Components:
Sanctions Compliance: Comply with OFAC, UN, EU, UK HMT, and other global regimes. Screen all parties at onboarding, during reviews, and prior to transactions. Report any OFAC blockings or rejections within 10 days per 31 C.F.R. §§ 501.603–604.
Screening Quality: Use technology with fuzzy-matching, alias detection, and indirect-ownership logic; maintain complete and current data for accuracy.
PEP Screening: Identify PEPs and related persons; apply EDD for high-risk classifications (domestic, foreign, or international); obtain documented source-of-wealth/funds and AML Committee approval where warranted.
Adverse Media: Monitor for litigation, enforcement, corruption, or integrity risk across global and regional news and OSINT sources; document and risk-rate all findings prior to onboarding or renewal.
Escalation & Governance: Potential matches follow a documented escalation path with triage, enhanced review, and senior-level approval. Confirmed matches trigger SAR filings or sanctions blocking as required.
Integrated sanctions, PEP, and media screening creates a unified, real-time view of counterparty risk — feeding directly into client risk ratings, EDD, and transaction-monitoring thresholds.
TRANSACTION MONITORING & ALERT MANAGEMENT
The Bank employs a risk-based transaction monitoring program designed to detect, investigate, and report suspicious activity across all customer types, products, and geographies.
Monitoring integrates data analytics, typology-based scenarios, and continuous model tuning to ensure coverage of evolving financial crime risks.
Program Components:
Risk-Based Scenarios: Automated monitoring models identify patterns associated with layering, structuring, rapid movement of funds, and other typologies aligned with FFIEC and FinCEN guidance.
Data Integrity: Inputs from core banking, payment, and investment systems are validated for completeness and accuracy before analysis.
Alert Review & Disposition: Investigators evaluate alerts for reasonableness, corroborating information, and escalation criteria. Alerts are documented, tracked, and closed with management review.
SAR Determination: Potentially suspicious activity is escalated to the BSA Officer for decisioning. SARs are filed within 30 days (or 60 with justification) and retained for five years.
Quality Assurance: Independent sampling validates alert disposition quality, timeliness, and narrative sufficiency. Feedback informs scenario refinement and training needs.
Transaction monitoring is the connective control linking the Bank’s risk assessment, due diligence, and reporting functions — ensuring prompt detection, documentation, and remediation of suspicious behavior.
SUSPICIOUS ACTIVITY REPORTING (SAR) FRAMEWORK
The Bank’s SAR framework ensures timely identification, investigation, and reporting of transactions that may involve money laundering, terrorist financing, fraud, or other illicit activity. The process integrates governance, accountability, and quality controls to meet all BSA and FinCEN expectations.
Key Elements:
Escalation & Investigation: Alerts escalated from monitoring or other channels (e.g., referrals, adverse media, law enforcement requests) are assigned to investigators who assess facts, patterns, and intent.
Filing Standards: SARs are filed when known or suspected violations of law, transactions lacking apparent lawful purpose, or unusual activity exceeding reporting thresholds are detected.
Timeliness: SARs must be submitted within 30 calendar days of initial detection, or within 60 days when additional information is required.
Narrative Quality: Reports must clearly describe the who, what, when, where, and why of the suspicious activity, emphasizing analytical reasoning and pattern recognition.
Board & Management Reporting: The BSA Officer provides periodic summaries of SAR metrics, typologies, and trends to senior management and the Board.
Confidentiality: SARs and related communications are strictly confidential and may not be disclosed outside authorized channels.
The SAR process forms the cornerstone of the Bank’s financial crime reporting ecosystem—linking detection, escalation, and regulatory transparency.
INDEPENDENT TESTING & AUDIT
Independent testing provides assurance that the Bank’s BSA/AML Program is operating effectively, risk-based, and compliant with regulatory requirements.
Testing is performed by qualified, independent personnel with unrestricted access to records, systems, and staff.
Core Principles:
Independence & Objectivity: Reviews are conducted by internal audit or external parties not involved in daily program operations.
Scope & Frequency: Testing covers all core elements—risk assessment, CIP/CDD/EDD, transaction monitoring, sanctions screening, training, and reporting—on a 12- to 18-month cycle, adjusted for risk.
Methodology: Uses sampling, walkthroughs, data validation, and control design testing to evaluate operational effectiveness and regulatory alignment.
Reporting & Remediation: Findings are documented, risk-rated, and communicated to the Board Audit or Compliance Committee. Management must track corrective actions to resolution.
Continuous Feedback: Results from testing inform program updates, system tuning, and control enhancements.
Independent testing validates that the BSA/AML framework functions as designed and that identified gaps are promptly addressed, ensuring the Program remains strong, transparent, and exam-ready.
TRAINING & CULTURE OF COMPLIANCE
A strong culture of compliance begins with education, awareness, and accountability.
the Bank’s training framework ensures that every employee, officer, and director understands their role in preventing financial crime and maintaining the integrity of the institution.
Program Structure:
Board & Executive Training: Annual briefings on emerging regulatory trends, enforcement actions, and enterprise AML risk.
Employee Training: Role-specific modules addressing customer onboarding, transaction monitoring, sanctions, and escalation procedures.
Specialized Training: Tailored sessions for high-risk functions (e.g., private banking, correspondent banking, operations, and trade finance).
Frequency & Documentation: All training is mandatory, tracked through centralized systems, and refreshed annually or upon major regulatory change.
Culture & Reinforcement: Compliance leadership promotes a “speak-up” environment where ethical behavior and accountability are recognized and rewarded.
By embedding compliance awareness into every level of the organization, the Bank strengthens its defense against financial crime and fosters trust with regulators, clients, and the broader financial system.
CONTINUOUS IMPROVEMENT & TRANSITION TO PLAYBOOK 2
The Bank’s BSA/AML Program is designed for continuous evolution, integrating lessons learned, regulatory feedback, and emerging risks into every component of governance and control.
This adaptive cycle ensures the Program remains effective, efficient, and aligned with the institution’s strategic objectives and risk appetite.
Sustaining Improvement:
Ongoing Risk Assessment: Reassess inherent and residual risk at least annually or upon material business change.
Program Enhancements: Incorporate findings from independent testing, regulatory exams, and audit reports into updated policies, systems, and training.
Change Governance: All updates follow formal approval by the BSA Officer and Board-level committees to maintain accountability and traceability.
Metrics & Feedback Loops: Regular monitoring of KRIs, SAR trends, and issue management data supports continuous optimization.
The Bank’s governance framework establishes the foundation for a resilient, risk-based compliance culture.
Playbook 2 – Customer Onboarding & CDD/EDD Framework builds on this foundation, detailing how customer identification, risk rating, and due diligence processes operationalize the Program’s principles of integrity and accountability.