Independent testing of the Bank Secrecy Act and anti-money laundering (BSA/AML) program is the periodic, independent evaluation of whether a bank’s program to detect and report money laundering, terrorist financing and sanctions evasion is adequate and operating as required. United States regulations require every bank’s AML program to include it, alongside internal controls, a designated compliance officer, training and customer due diligence, and the Federal Financial Institutions Examination Council’s BSA/AML Examination Manual tells examiners how to assess it. In most banks internal audit performs the test, and its report is one of the first documents an examiner reads: a thorough, independent, risk-based test lets the examination lean on the bank’s own work; a thin one becomes a finding against the program and the function.
This guide gives the test in the shape the manual expects. It covers the regulatory basis and what independence means in practice, how to scope and size the test from the bank’s own risk assessment, each component of the program with the procedures, populations and samples for it (the risk assessment, customer due diligence and beneficial ownership, transaction monitoring and suspicious activity reporting, currency transaction reporting and recordkeeping, sanctions screening, monitoring models and rule tuning, training, information sharing and prior findings), how to report to the board, the findings examiners cite most, the proposals in 2026 that would change the program rules, and a worked example of a regional bank’s annual test. It extends the AML, KYC and compliance audits guide into the testing program itself and sits inside the banking guide‘s second-line coverage.
In this guide
- The regulatory basis and what independence means
- Scoping and sizing the test from the risk assessment
- Component 1: the bank’s BSA/AML risk assessment
- Component 2: customer due diligence and beneficial ownership
- Component 3: transaction monitoring, alerts, cases and SARs
- Component 4: currency transaction reporting and recordkeeping
- Component 5: sanctions screening
- Component 6: monitoring models and rule tuning
- Component 7: training, information sharing and governance
- Component 8: prior findings and regulatory matters
- Sampling and populations
- Reporting to the board and the examiner
- Findings examiners cite most
- What the 2026 proposals would change
- Worked example: Lakeshore Bancorp’s annual test
- Questions about BSA/AML independent testing
- Related guides
The regulatory basis and what independence means
The Bank Secrecy Act and its implementing regulations (for banks, 31 CFR 1020.210, with parallel rules from the banking agencies) require an AML program that, at a minimum, provides for a system of internal controls, independent testing of compliance, a designated individual responsible for coordinating and monitoring day-to-day compliance, training for appropriate personnel, and risk-based customer due diligence including beneficial ownership of legal entity customers. The FFIEC manual’s independent testing section describes what examiners expect: testing performed by internal audit or an outside party, by people independent of the BSA/AML function (not the BSA officer or staff who perform the compliance activities), with a scope and frequency commensurate with the bank’s risk profile (annually or every twelve to eighteen months in most banks, more often for high-risk institutions or after findings), covering the overall adequacy of the program and each of its components, with findings reported to the board or a committee and tracked to correction. Independence has three practical tests: the testers do not report to the BSA officer or perform any BSA function; they decide their own scope and sample; and their report goes to the audit committee without filtering by the compliance function. Where internal audit lacks AML expertise it may co-source the work, but the function remains responsible for scope, independence and the report.
Scoping and sizing the test from the risk assessment
| Scoping input | How it shapes the test |
|---|---|
| The bank’s BSA/AML risk assessment | Higher-risk products, customer types and geographies get larger samples and deeper procedures; the assessment itself is tested first so that the scoping is not built on a flawed map |
| Prior examination findings and the last independent test | Open and recently closed findings are re-tested; areas rated satisfactory last year may rotate to lighter coverage |
| Changes since the last test | New products, markets, systems (especially monitoring system changes), acquisitions, staffing turnover in the BSA function |
| Volumes | Alert and case volumes, SAR and CTR counts, new account openings, wire volumes set the populations |
| Regulatory priorities | FinCEN’s national AML/CFT priorities and agency statements; enforcement actions against peers |
| Mandated frequency | Annual for most banks; the test is scheduled so that its results reach the board before the next examination |
| Hours | A $9 billion regional bank’s full test typically runs 600 to 900 hours; a community bank’s 150 to 300; large banks run continuous programs with thousands |
Component 1: the bank’s BSA/AML risk assessment
The bank’s risk assessment is the document everything else depends on, and the test reviews it rather than accepts it. The procedures: confirm it follows the structure examiners expect (identification of the specific risk categories, meaning products and services, customers and entities, and geographic locations, followed by analysis of the information to assess the risk within each category); test the completeness of the product and customer inventories against the bank’s actual product list and the core system’s customer types; test the quantitative inputs (number of high-risk customers, wire volumes to high-risk jurisdictions, cash-intensive business counts) by re-performing three from source data; check that the assessment reflects changes since the last version (new products, markets, delivery channels); confirm that the conclusions drive the program (monitoring rules, CDD tiers and training reflect the identified risks); and confirm board approval and the review cycle. The assessment is a compliance risk assessment of a specific kind, and the compliance risk assessment guide’s tests of evidence and refresh apply to it. A risk assessment that lists the bank’s cash-intensive business customers at 240 when the core system shows 610 coded to those industry codes is the kind of fact this component produces, and it reshapes the rest of the test.
Component 2: customer due diligence and beneficial ownership
| Procedure | Population and sample | What is tested |
|---|---|---|
| Customer identification program (CIP) | New accounts opened in the period; sample across channels and customer types (40 to 60) | Identity information collected and verified per the CIP; documentary and non-documentary methods; exceptions resolved; records retained |
| Customer risk rating | New and existing customers; sample stratified by rating (high, medium, low) | Rating assigned by the methodology; inputs (industry, geography, products, expected activity) complete; high-risk customers identified correctly, tested by re-rating a sample from source data |
| Beneficial ownership | Legal entity accounts opened or renewed in the period | Ownership and control persons identified and verified at the thresholds the rule requires; certification obtained; updates on trigger events |
| Enhanced due diligence | All or a large sample of high-risk customers (politically exposed persons, cash-intensive businesses, money services businesses, foreign correspondent accounts, private banking) | EDD performed and documented; source of wealth and funds where required; senior approval; periodic review on schedule |
| Periodic review and refresh | High-risk customers due for review in the period | Reviews completed on time; backlog measured; expected versus actual activity compared |
| Expected activity and profile | Sample across ratings | Expected activity recorded and used by monitoring; material deviations investigated |
| Prohibited and restricted customers | Account openings in the period against policy prohibitions | No prohibited customer types onboarded; restricted types approved as policy requires |
Component 3: transaction monitoring, alerts, cases and SARs
Suspicious activity monitoring and reporting is where most examination findings arise and where the test spends the most hours. The chain runs from the monitoring system’s rules and thresholds, through the alerts they generate, the analyst’s disposition of each alert (closed or escalated to a case), the case investigation, the decision whether to file a suspicious activity report (SAR), the SAR’s completeness and timeliness, and continuing activity reviews. The procedures: obtain the alert population for the period and reconcile it to the system (the IPE tests); measure alert aging and backlog against the bank’s own standards; sample alerts closed without escalation (the highest-risk decision in the chain) and re-perform the disposition, judging whether the analyst’s reasoning and documentation support closure; sample cases that resulted in no SAR and re-perform the decision; sample filed SARs for completeness of the narrative (who, what, when, where, why, how), accuracy of the data fields and timeliness (the rule requires filing no later than 30 calendar days after the initial detection of facts constituting a basis for filing, extendable to 60 days where no suspect was identified); test continuing activity SARs at the required intervals; test referrals from branches, fraud, wires and other sources into the case system; test the quality assurance program over analyst decisions; and confirm SAR confidentiality controls (no disclosure of SAR filings outside the permitted channels; access restricted). The sample sizes are set per the sampling guide with the population’s risk in mind; closed alerts and no-SAR cases get the largest samples because an error there is an unreported crime. The payment operations guide covers the wire-specific controls that feed this chain.
| Decision point | Population (annual, $9 billion bank) | Typical sample | Error that matters |
|---|---|---|---|
| Alerts closed without escalation | 20,000 to 60,000 | 80 to 120, stratified by rule and analyst | Closure not supported by the documented review; pattern missed |
| Cases closed with no SAR | 1,500 to 4,000 | 60 to 80 | Decision not supported; investigation incomplete |
| SARs filed | 400 to 1,200 | 40 to 60 | Late filing; narrative or fields deficient; continuing activity missed |
| Referrals from other functions | Varies | 25 to 40 | Referrals not logged or not investigated |
| Quality assurance reviews | The QA function’s sample | Re-perform 20 | QA agreeing with poor decisions |
Component 4: currency transaction reporting and recordkeeping
Currency transaction reports (CTRs) are required for currency transactions above $10,000 by or on behalf of one person in one business day, aggregated across the bank, and must be filed within 15 calendar days; exemptions for eligible customers must be designated, reviewed annually and documented. The procedures: obtain the population of reportable transactions from the core system’s cash activity (not from the CTR system, which only knows what was reported) and reconcile the two to find unreported transactions; test aggregation logic across accounts, branches and channels; sample filed CTRs for accuracy and timeliness; test structuring detection (cash activity just below the threshold, in patterns, which belongs in the monitoring component but is checked here for completeness); test the exemption list for eligibility and annual review; test the funds transfer recordkeeping and travel rule compliance for wires at or above the $3,000 threshold (originator and beneficiary information collected, retained and transmitted); test monetary instrument records for cash purchases between $3,000 and $10,000; and test record retention (five years for most BSA records). These are mechanical tests with clear criteria, which makes them good candidates for full-population analytics in the query style rather than sampling.
Component 5: sanctions screening
The Office of Foreign Assets Control (OFAC) program is tested alongside the AML program and examined with it. The procedures: confirm the OFAC risk assessment and its integration with the BSA assessment; test that customers are screened at onboarding and the whole base rescreened when lists change, with evidence of list update timeliness; test transaction screening for wires, ACH where required and trade finance, including the fields screened and the fuzzy-matching settings; sample alerts closed as false positives and re-perform the disposition; test true matches for blocking or rejection, reporting to OFAC within the required period and annual reports of blocked property; test the governance of screening system changes and the periodic validation of matching logic; and confirm training and escalation. Screening systems are models and their tuning belongs in the next component; the test here is whether the program caught what it should have, tested by seeding known names where the bank’s testing environment allows.
Component 6: monitoring models and rule tuning
| Area | Procedure | Evidence |
|---|---|---|
| Rule inventory and coverage | Map the monitoring rules to the risk assessment’s typologies and to the bank’s products; identify risks with no rule | Rule inventory; risk assessment; gap list |
| Threshold and parameter governance | Changes to rules and thresholds approved, documented, tested before deployment, with the rationale and the expected effect on alert volume | Change log; approvals; pre- and post-change volumes |
| Tuning methodology | Above-the-line and below-the-line testing performed periodically: do alerts above thresholds produce SARs at a meaningful rate; would transactions just below thresholds have been suspicious | Tuning reports; sampling of below-the-line transactions |
| Data integrity | All transaction types and channels feed the monitoring system; completeness reconciled; customer risk ratings and expected activity flow through correctly | Feed reconciliations; exception reports |
| Model validation | The monitoring and screening systems are in the model inventory and validated under the bank’s model risk framework (the 2026 interagency guidance that replaced SR 11-7), with validation findings remediated | Model inventory; validation reports; the MRM audit |
| Vendor system changes | Vendor releases assessed for effect on rules; regression tested | Release notes; test evidence |
| Alert volume and productivity metrics | Alerts per rule, SAR conversion rate per rule, analyst productivity, used by management to tune | Metrics pack |
Component 7: training, information sharing and governance
Training is tested for coverage, content and currency: all appropriate personnel (frontline, operations, lending, BSA staff, the board) trained at the frequency policy requires, with role-specific content for higher-risk roles, completion tracked and exceptions followed up, and content updated for the bank’s risks and regulatory changes; the test samples completion records against the employee master and reads the material. Information sharing covers Section 314(a) requests (searched and responded to within the required time, with records) and voluntary 314(b) sharing where the bank participates (registration current, requests handled within the safe harbor). Governance covers the BSA officer’s qualifications, authority, independence and resources; board reporting (SAR activity summaries, program metrics, examination and audit status, at least quarterly in most banks); board approval of the program and the risk assessment; policies and procedures current and consistent with practice; and the BSA function’s own quality assurance. The audit committee calendar‘s bank variant places BSA reporting among the standing items, and the test confirms the committee saw what the program produced.
Component 8: prior findings and regulatory matters
Every open finding from the prior independent test, from examinations and from the BSA function’s own reviews is validated: remediated as described, with evidence an examiner can re-perform, and sustained over a period, using the issue validation discipline and the regulatory issue lifecycle. Matters requiring attention on BSA receive their own validation memos. Look-backs ordered by regulators (re-review of historical transactions after a monitoring gap) are tested for completeness of the period and population, the methodology, the SARs that resulted and the timeliness of the work. The test also examines how the function received and tracked findings during the year: a BSA program that closed its own findings on management’s word, without evidence, has an issue management finding on top of whatever it closed.
Sampling and populations
Three rules govern sampling in the test. Populations come from source systems, never from the compliance function’s own extracts alone, and are reconciled (alerts from the monitoring system’s database; cash transactions from the core; new accounts from the account master; SARs from the filing system against the case system). Samples are stratified by risk: closed alerts by rule and by analyst, customers by risk rating, SARs by type, so that the highest-risk decisions get the deepest coverage; a sample of alerts drawn at random from the whole population will be dominated by the low-value rules that generate volume. And mechanical tests (CTR completeness, travel rule fields, rescreening timeliness, training completion) are run on full populations by query rather than sampled, because the criteria are objective and the data is available. The sample size guide gives the statistical basis for the judgmental and attribute samples; the sampling memo records the population reconciliations, which examiners ask to see.
Reporting to the board and the examiner
The report states an overall conclusion on the adequacy of the program (examiners look for one), a conclusion for each component, the findings with ratings and root causes, the status of prior findings, and the scope, populations and samples in enough detail that an examiner can judge the test’s depth without the workpapers. It goes to the audit committee, with the BSA officer and the chief compliance officer present for the discussion, and it is written knowing that the examiner will read it: plain statements of what was tested and what was found, no language that could be read as minimizing, and no SAR-identifying detail (SAR confidentiality applies to the audit report as to everything else, so findings describe patterns and counts, never named subjects). The presenting to the committee guide covers the delivery; the severity guide covers the ratings, with the addition that in BSA testing a pattern of unsupported alert closures or late SARs is rated High whatever its dollar value, because the consequence is regulatory and the examiner will rate it that way.
Findings examiners cite most
| Finding | Component | What the test looks for |
|---|---|---|
| Risk assessment stale or inaccurate | 1 | Inventories not reconciled; quantitative inputs wrong; new products absent |
| CDD and EDD gaps | 2 | High-risk customers not identified; EDD missing or late; beneficial ownership not refreshed |
| Alert backlog and unsupported closures | 3 | Aging beyond standards; closures without documented reasoning; QA not catching it |
| Late or deficient SARs | 3 | Filing after 30 days from detection; narratives missing the essentials; continuing activity SARs missed |
| Monitoring coverage gaps | 6 | Products or channels not fed to the system; typologies with no rule; tuning never performed |
| Model governance weak | 6 | Monitoring and screening systems not validated; threshold changes unapproved |
| Staffing and resources | 7 | Analyst capacity below alert volume; turnover; BSA officer without authority |
| Independent testing inadequate | The test itself | Scope too narrow; samples too small; testers not independent; no overall conclusion; findings not tracked |
| Training not role-based or incomplete | 7 | Generic annual module; completion gaps in high-risk roles |
| Findings closed without evidence | 8 | Prior findings marked closed on management’s statement |
What the 2026 proposals would change
The Anti-Money Laundering Act of 2020 directed a modernization of program requirements, and in 2026 FinCEN and the federal banking agencies issued coordinated proposals to rewrite the program rules around effectiveness and risk: an explicit requirement for a risk assessment process that incorporates the government’s AML/CFT priorities, a direction to allocate resources toward higher-risk customers and activities rather than lower-risk ones, continued requirements for internal controls, independent testing, a designated officer (required to be located in the United States), training and customer due diligence, and board or senior management approval of the written program. The proposals were open for comment through the autumn of 2026 as this guide is written, with effective dates proposed for twelve months after any final rule, and an earlier 2024 proposal on the same subject was not finalized; the independent tester should check the current state of the rules before each annual test and should expect, if the proposals are adopted, to test the risk assessment process and the resource allocation decisions as program requirements in their own right rather than as examiner expectations. The FFIEC manual is revised periodically, and the test’s scope follows the current version.
Worked example: Lakeshore Bancorp’s annual test
Lakeshore Bancorp is a $9 billion publicly traded regional bank holding company used in examples across this site, with a lead bank supervised by the OCC, a compliance department of about forty including a BSA/AML team of fourteen, and a 22-person internal audit function that performs the independent test annually with 180 hours of co-sourced specialist support for the monitoring model component; the engagement is budgeted at 700 hours in the audit universe. The test described here ran in the twelve months before the OCC’s full-scope examination, scoped from the bank’s risk assessment and from two open findings of the prior test (alert aging; EDD periodic review backlog).
| Component | Population and sample | Result | Rating |
|---|---|---|---|
| Risk assessment | Full review; three quantitative inputs re-performed | Structure sound and board-approved; cash-intensive business count understated (310 in the assessment against 540 by industry code in the core); the new treasury management ACH origination product absent | Medium |
| CDD and beneficial ownership | 60 new accounts; 50 beneficial ownership certifications; all 212 high-risk customers for EDD and review timing | CIP exceptions 2 of 60 (resolved late); beneficial ownership complete; EDD periodic reviews: 31 of 212 past due (prior finding, improved from 68); expected activity recorded for 71 percent of high-risk customers | Medium (prior finding partially remediated) |
| Monitoring, alerts and SARs | 41,000 alerts reconciled; 110 closed alerts re-performed; 70 no-SAR cases; 50 SARs; 30 referrals | Alert aging within standard (prior finding closed); 6 of 110 closures not supported by the documented review, concentrated in one rule and two analysts; 2 of 70 no-SAR cases judged to warrant filing (filed during the test); 3 of 50 SARs filed after 30 days (34 to 41 days) because detection date was recorded at case opening rather than alert review; narratives adequate; QA had sampled 2 percent of closures and agreed with all | High (late SARs and unsupported closures) |
| CTR and recordkeeping | Full-population query of cash activity; 40 CTRs; exemption list; travel rule fields on 2,100 wires by query | No unreported CTRs; 1 CTR filed late; 2 exemptions without annual review; travel rule complete | Low |
| Sanctions | Rescreening logs; 60 false-positive closures; 3 true matches | List updates within 24 hours; closures supported; matches blocked and reported on time; fuzzy-matching threshold change in the period approved but not regression tested | Low (one observation) |
| Models and tuning | Rule inventory against typologies; change log; tuning reports; validation status | Two typologies from the risk assessment (trade-based laundering indicators; funnel account patterns) with no rule; below-the-line testing last performed 26 months earlier; monitoring system validated; screening system not in the model inventory | Medium |
| Training, 314, governance | Completion records against the employee master; 314(a) logs; board packs | Completion 97 percent; two lending officers overdue; 314(a) searches timely; board reporting quarterly with SAR metrics; BSA officer resources adequate for current volumes | Low |
| Prior findings | Two prior findings; one open OCC matter on third-party monitoring of a fintech partner | Alert aging closed on evidence; EDD backlog partially remediated; the OCC matter’s remediation validated and reported | As above |
The report concluded that the program was adequate overall with one High finding (SAR timeliness and unsupported alert closures, root cause a detection-date convention and a quality assurance sample too small to find a two-analyst pattern) and three Medium findings, and it reached the audit committee six weeks before the examination began. The examiners read it, re-performed ten of the 110 alert closures and agreed with the function’s conclusions, and scoped their own SAR review around the function’s sample; their report cited the SAR timeliness issue as a matter requiring attention, as the function had expected, and credited the bank’s independent testing as effective, which was the outcome the chief audit executive had designed the test to earn. The following year’s test confirmed the detection-date convention corrected, QA sampling raised to 10 percent with analyst-level reporting, the two missing rules deployed and tuned, and the screening system validated.
Questions about BSA/AML independent testing
Who can perform BSA/AML independent testing?
Internal audit or an outside party, provided the testers are independent of the BSA/AML function: they do not report to the BSA officer, perform no BSA duties, set their own scope and sample, and report to the board or audit committee. Internal audit may co-source specialist work while keeping responsibility for the test.
How often is independent testing required?
The rules require it without fixing a frequency; the FFIEC manual expects a frequency commensurate with risk, which in practice means annually or every twelve to eighteen months for most banks, and more often after findings or for high-risk institutions.
What should the test cover?
The overall adequacy of the program and each component: the risk assessment, customer due diligence and beneficial ownership, transaction monitoring and SAR decisioning, CTR and recordkeeping, sanctions screening, monitoring models and tuning, training, information sharing, governance and the status of prior findings.
How large should the samples be?
Large enough to find a pattern in the highest-risk decisions: typically 80 to 120 closed alerts stratified by rule and analyst, 60 to 80 no-SAR cases and 40 to 60 SARs for a regional bank, with mechanical tests such as CTR completeness run on the full population by query.
What is the SAR filing deadline?
No later than 30 calendar days after the initial detection of facts that may constitute a basis for filing, extendable to 60 days if no suspect was identified at detection. How the bank defines the detection date is one of the test’s most consequential questions.
How do examiners use the independent test?
They read the report and workpapers, re-perform selected procedures, and scope their own examination around a test they find reliable; a weak test is itself a finding against the program. The report is written knowing it will be read that way.
How will the 2026 rule proposals affect the test?
If finalized, the test will cover a required risk assessment process incorporating the national AML/CFT priorities and the bank’s resource allocation decisions as program requirements rather than examiner expectations. Testers should check the current state of the rules before each annual test.
Related guides
- Internal audit in financial services: AML, KYC and compliance audits — the overview this program extends.
- Internal audit in banking — the supervisory context.
- The bank internal audit universe — where the 700-hour entity sits.
- How to run a compliance risk assessment — the method behind the bank’s risk assessment.
- How to audit model risk management — monitoring and screening systems as models.
- MRAs, MRIAs and consent orders — what a BSA finding becomes.
- The lifecycle of regulatory issues — validating BSA matters.
- Issue validation in internal audit — evidence for closure.
- How to audit payment operations and wire transfers — the wire controls that feed monitoring.
- IPE testing — reconciling alert and transaction populations.
- Audit sample sizes — sizing the alert and case samples.
- Audit sampling memo template — recording populations and reconciliations.
- SQL for auditors — full-population tests for CTR and travel rule compliance.
- Financial statement fraud — the other reporting crime.
- Finding severity ratings — rating regulatory findings.
- Presenting to the audit committee — delivering the report.
- The audit committee annual agenda — BSA reporting as a standing item.
- What regulators really expect — the examiner’s view.
Leave a Reply