Five Common BSA/AML Exam Findings, and How to Avoid Them

Every BSA/AML examination is different, but the findings often look familiar. Across banks, credit unions, and fintech partner programs, the same weaknesses tend to appear: programs that look complete on paper but do not reflect how the institution actually operates.

The good news is that most of these findings are preventable. Below are five of the most common, what examiners typically look for, and practical steps to address each one before your next exam.

1. A risk assessment that does not reflect the institution

The BSA/AML risk assessment is the foundation of the entire program. When it is generic, outdated, or disconnected from the institution's actual business, every control built on top of it is weakened.

What examiners often find:

• Risk assessments copied from templates, with little analysis specific to the institution
• Products, services, delivery channels, customer types, or geographies missing or not evaluated
• No update after a new product launch, fintech partnership, merger, or rapid growth
• Risk ratings that do not connect to monitoring, due diligence, or staffing decisions

How to avoid it:

• Inventory every product, service, channel, customer segment, and geography, and assess each one
• Document the reasoning behind each risk rating, not just the rating
• Refresh the assessment at least annually and whenever the risk profile changes significantly
• Show clearly how the results drive controls, such as monitoring rules, enhanced due diligence, and resource allocation

2. Gaps in suspicious activity monitoring and SAR decisions

Monitoring systems and SAR processes must keep pace with the institution's size, complexity, and risk. Examiners look closely at whether alerts are reviewed thoughtfully, decisions are documented, and SARs are filed on time.

What examiners often find:

• Monitoring rules and thresholds that were never tuned or validated after implementation
• Products or data sources not fed into the monitoring system
• Alert backlogs and investigations that take too long to close
• Thin documentation explaining why an alert was closed without a SAR
• Late SAR filings. Generally, a SAR is due within 30 calendar days of initial detection of facts that may constitute a basis for filing, extended to no more than 60 days if no suspect has been identified

How to avoid it:

• Periodically tune and validate monitoring scenarios using your own data and risk assessment
• Confirm that every relevant product and data source feeds into monitoring
• Track alert and case aging, and staff appropriately to prevent backlogs
• Use consistent, well-documented decision rationales for both SAR and no-SAR decisions
• Monitor SAR timeliness as a key metric reported to management

3. Weak customer due diligence and enhanced due diligence

Customer due diligence (CDD) is how an institution understands its customers and the activity it should expect from them. Weaknesses here undermine monitoring, because unusual activity is hard to spot without a clear picture of what is normal.

What examiners often find:

• Customer risk ratings that are missing, inconsistent, or never updated
• Enhanced due diligence not performed, or not documented, for higher-risk customers
• Incomplete beneficial ownership information for legal entity customers
• No process to refresh customer information when risk indicators change

How to avoid it:

• Use a clear, documented customer risk rating methodology tied to your risk assessment
• Define what enhanced due diligence requires for each higher-risk category, and apply it consistently
• Build event-driven reviews so significant changes in customer activity trigger an update
• Test CDD files regularly for completeness and quality

4. Independent testing that is too narrow

Independent testing should give management and the board an objective view of whether the program actually works. When the scope is too narrow, or testing checks only whether policies exist, real weaknesses go undetected until an examiner finds them.

What examiners often find:

• A scope that does not cover all higher-risk areas, products, or business lines
• Little or no transaction testing to confirm that controls work in practice
• Questions about the independence or qualifications of the testers
• Prior findings that were never tracked to completion

How to avoid it:

• Set a risk-based scope, informed by the risk assessment, that covers all significant areas of the program
• Include meaningful transaction testing, not just policy and procedure review
• Use qualified testers who are independent of the BSA function, whether internal or external
• Track every finding to resolution, with owners and deadlines reported to the board or a board committee

5. Training, resources, and governance that fall short

A program is only as strong as the people running it. Examiners look at whether staff are trained for their actual roles, whether the BSA officer has the authority and resources needed, and whether the board is meaningfully engaged.

What examiners often find:

• One-size-fits-all training that does not reflect employees' roles or the institution's risks
• Board members who receive little BSA/AML training or reporting
• A BSA officer without sufficient staff, systems, or authority
• Management reporting that lacks meaningful metrics or trends

How to avoid it:

• Tailor training to job roles, such as frontline staff, operations, lending, and investigators, and update it as risks and regulations change
• Provide the board with periodic BSA/AML training and clear, risk-focused reporting
• Regularly evaluate whether the BSA function's staffing and systems match the institution's growth and risk
• Report key metrics, such as alert volumes, SAR timeliness, open findings, and high-risk customer counts, to management and the board

Looking ahead: an increasing focus on effectiveness

Regulators have increasingly emphasized that BSA/AML programs should be effective and risk-based, not just technically compliant. In April 2026, FinCEN, together with the FDIC, OCC, and NCUA, proposed significant changes to AML/CFT program requirements that would further emphasize directing resources toward higher-risk customers and activities. As of this writing, those changes are proposed and not yet final. Institutions should monitor their progress and consider whether their risk assessments, testing, and resource allocation decisions are well documented and defensible.

Whatever the final rules look like, the fundamentals remain the same: understand your risks, design controls that address them, test that those controls work, and document your decisions.

How COASO Risk Partners can help

COASO Risk Partners helps banks, credit unions, fintechs, and other financial institutions prepare for examinations with confidence. Our practitioners provide BSA/AML risk assessments, program reviews, independent testing support, monitoring system tuning, CDD/EDD file reviews, and remediation support for exam findings.

← Back to Insights