Introduction
Independent testing is one of the four pillars regulators expect from every AML program under the Bank Secrecy Act. Banks, credit unions, money services businesses, and increasingly fintechs and payments companies under sponsor bank agreements all face this requirement.
Yet many institutions still treat it as a check-the-box exercise. A surface-level review gets filed away, control gaps stay hidden, and the next exam surfaces an MRA or worse.
This article covers the regulatory requirements, who qualifies to perform testing, and how often it should happen. You will also get a practical step-by-step process and best practices that turn testing into a real risk management tool—not a paperwork exercise.
Key Takeaways
- Independent testing is legally required under the BSA, with no single universal frequency mandated by law
- Testers must have zero involvement in the function under review—internal audit, uninvolved staff, or outside specialists qualify
- FFIEC references 12-18 months as a common risk-based benchmark, adjusted for higher-risk profiles
- A defensible test covers risk assessment, policy adherence, SAR/CTR quality, monitoring, and prior finding remediation
- Results must go directly to the board or a designated committee, with documented corrective-action tracking
What Is BSA/AML Independent Testing?
Independent testing sits alongside three other required pillars: internal controls, a designated BSA officer, and ongoing employee training. Larger institutions add a fifth: risk-based customer due diligence. Independent testing is the mechanism that verifies the other pillars actually work.
The regulatory basis is layered:
- The Bank Secrecy Act itself (31 U.S.C. 5318(h)(1)(D)) requires an "independent audit function to test programs"
- The FFIEC BSA/AML Examination Manual sets examiner expectations for scope and depth
- Federal banking agency rules under 12 CFR (Federal Reserve, FDIC, NCUA, and OCC) each require independent compliance testing
- FinCEN's rule for money services businesses (31 CFR 1022.210(d)(4)) requires an independent review commensurate with risk
The FFIEC states its objective plainly. Examiners assess whether a bank has designed, implemented, and maintained an independent testing program adequate for its risk profile, and whether the overall BSA/AML program is effective.
Who Actually Needs This
This isn't limited to chartered banks. Credit unions, MSBs, and fintech or payments companies operating under sponsor bank partnerships or state money transmitter licenses all need to demonstrate program adequacy, whether to a federal examiner, a sponsor bank's risk team, or investors during due diligence.
Independent testing is not the same as day-to-day compliance monitoring. It's a periodic, evidence-based evaluation of the entire program, not real-time alert review or an internal QA spot-check performed by the same team that built the controls.
BSA/AML Independent Testing Requirements
Regulators don't just require testing to happen. They specify who can do it, where results must go, and what the review has to cover. Missing any of these three elements is a common reason exams flag a "deficient" independent testing function.
Who Can Perform the Test: The Independence Standard
The core rule is simple: testers cannot have been involved in the function they're reviewing. Someone who wrote the AML policy or delivered the training shouldn't be the one grading it.
Acceptable testers include:
- Internal audit staff
- Qualified employees uninvolved in the BSA/AML function being tested
- Outside consultants or CPAs with subject-matter expertise
FinCEN takes a more flexible stance for MSBs. A formal CPA audit isn't required. An employee can perform the review, provided that person is neither the designated compliance officer nor someone who reports directly to them.
This is where many growing fintechs and payments companies hit a wall. They don't yet have an internal audit function large enough to staff an independent review, so they lean on outside specialists, such as a CAMS-certified reviewer or a financial crime advisory partner, to fill that gap without creating a conflict of interest.
Reporting Structure and Governance
Findings can't stop at the compliance officer's desk. Regulators expect results reported directly to the board of directors or a designated committee made up primarily or entirely of outside directors.
Examiners verify this by pulling board minutes. If there's no documentation showing the board actually received and discussed testing results, that's a governance gap regardless of how good the underlying testing was.
The board and senior management are also expected to track identified deficiencies and document progress on corrective actions. A report that identifies problems but never gets revisited is only half the job.
Minimum Scope Elements Regulators Expect
A sufficient test needs enough breadth to support a conclusion on overall program adequacy. Examiners generally look for coverage of:
- Risk assessment alignment: does the program reflect the institution's actual risk profile?
- Policy and procedure adherence: are written procedures being followed in practice?
- CIP, CDD, and beneficial ownership compliance: are customer identification and due diligence obligations being met?
- SAR and CTR accuracy and timeliness: are filings complete and submitted on schedule?
- Transaction monitoring effectiveness: do alerts, thresholds, and escalation paths actually catch what they should?
- Training adequacy: is training tailored to specific roles and responsibilities?
- Remediation of prior findings: were previous exam or audit issues actually resolved?
For MSBs specifically, FinCEN's guidance points to policies, procedures, internal controls, recordkeeping, reporting, training, and tests of controls and transactional systems. Where gaps surface, the review should attach corrective recommendations.
How Often Should You Conduct Independent AML Testing?
There's no fixed number in the regulations. Both FFIEC guidance for banks and FinCEN guidance for MSBs use the same phrase: frequency should be "commensurate with risk profile." That's the direct, if unsatisfying, answer to how often testing is legally required.
That said, there's a practical benchmark worth knowing. FFIEC guidance references periodic intervals such as every 12-18 months as typical bank practice. FinCEN takes a similar risk-based approach for MSBs. Lower-risk businesses may not need annual reviews, while higher-risk operations may need testing more often than once a year.
Several triggers should move up your testing schedule regardless of your standard cycle:
- Rapid growth in transaction volume or customer base
- Launch of new products, services, or payment rails
- Geographic expansion into new markets or jurisdictions
- Findings from a prior exam or audit that need validation
- Turnover in compliance leadership or key BSA staff
If any of these apply to your organization right now, waiting for your next scheduled 12-18 month cycle probably isn't the right call.
Step-by-Step Process for Conducting Independent AML Testing
A defensible independent test follows a consistent process. Skipping steps, especially documentation review or remediation tracking, turns a real test into a check-the-box exercise.
Define scope and build a risk-based plan. Align testing scope to the institution's current BSA/AML risk assessment. Prioritize higher-risk products, customer segments, and geographies instead of spreading equal attention across everything.
Appoint qualified, independent testers. Select internal audit, uninvolved staff, or a third-party specialist with documented subject-matter expertise and no conflicting BSA responsibilities. A CAMS-certified reviewer is a common choice when internal bandwidth is limited.
Collect and review documentation. Gather policies, procedures, training records, SAR/CTR filings, and findings from the prior test or regulatory exam. This baseline shapes what needs closer scrutiny.
Perform transaction and file testing. Sample CDD/KYC files, SAR decision-making, and monitoring alerts to confirm controls work in practice, not just on paper.
Document findings and report to the board. Deliver a written report with an explicit conclusion on overall BSA/AML compliance adequacy, plus specific findings and recommended corrective actions.
Track remediation and validate fixes. Follow up in the next testing cycle to confirm deficiencies were actually resolved. Examiners specifically check for this closed-loop process. A finding that reappears unaddressed is a red flag.
Best Practices to Strengthen Your Independent Testing Program
Passing the exam and building a program that reduces risk aren't always the same thing. A handful of practices separate the two.
Treat testing as a strategic health check. Use findings proactively to refine risk appetite, alert thresholds, and staffing levels before an examiner points them out .
Bring in expertise when internal resources are thin. This is a common gap for growing fintechs and payments companies without a large internal audit function. Engaging a CAMS-certified reviewer or a specialized financial crime advisory partner such as Pillars FinCrime Advisory helps boards and compliance teams get programs audit-ready before an exam notice arrives—not after.
Close the loop between testing and program updates. Feed results directly into the next risk assessment refresh and policy review cycle. Treating each test as an isolated event wastes the value of the findings.
Keep documentation examiner-ready year-round. Maintain organized scope memos, workpapers, and remediation trackers continuously, not the week before an exam. Evidence of testing quality should be available any day, not just exam week.
Frequently Asked Questions
How often must an AML program be tested independently?
There's no single fixed rule. Both FFIEC and FinCEN require frequency to be risk-based, with roughly 12-18 months cited as a common benchmark for banks and more frequent testing expected for higher-risk businesses.
What are the requirements for an AML program?
The core pillars are written policies and procedures, a designated compliance officer, ongoing employee training, independent testing, and, for larger institutions, risk-based customer due diligence.
Who is qualified to conduct BSA/AML independent testing?
Internal audit, qualified staff uninvolved in the tested function, or an external consultant or CPA can all conduct testing, provided there's no conflict of interest or reporting relationship to the compliance officer.
Can the same employee who manages BSA compliance also perform the independent test?
No. The designated BSA/compliance officer and anyone reporting directly to them cannot conduct the independent review. That would violate the independence requirement.
What happens if independent testing findings aren't addressed?
Examiners specifically check whether management took timely corrective action on prior findings. Unresolved deficiencies can escalate into MRAs or enforcement action. The OCC's 2024 consent order against Bank of America cited independent-testing deficiencies alongside a failure to correct a previously identified CDD gap.
Do fintechs and payments companies need independent AML testing even without a bank charter?
Most operate under sponsor bank agreements or state money transmitter licenses that contractually or legally require a comparable independent AML program review, even without a federal charter of their own.
