BSA Advisory Services for MSBs

The five pillars are a designated BSA compliance officer, internal controls, ongoing employee training, independent testing, and customer due diligence. Together, they establish ownership, written processes, staff awareness, objective validation, and a risk-based understanding of customers. Many institutions also treat customer due diligence and beneficial ownership practices as central components of a mature program because they support monitoring and suspicious activity decisioning.

The Bank Secrecy Act is a U.S. law requiring covered financial institutions, including many MSBs, to help detect and prevent money laundering and other financial crime. BSA obligations can include maintaining an AML program, identifying customers, monitoring activity, filing required reports, retaining records, and responding appropriately to suspicious activity. Requirements should be applied through a documented, risk-based program suited to the business.

BSA stands for the Bank Secrecy Act. In banking and financial services, it commonly refers to the compliance framework used to meet anti-money-laundering, recordkeeping, reporting, and suspicious-activity obligations under the law. A BSA program typically includes governance, risk assessments, customer due diligence, transaction monitoring, training, independent testing, and escalation procedures for potential financial-crime concerns.

Most MSBs subject to FinCEN rules must develop and implement a written, risk-based AML program. The program should address internal controls, a designated compliance officer, training, independent review, and risk-based customer due diligence. The documentation should match the MSB’s products, geographies, customer types, transaction channels, and risk exposure rather than relying on a generic template.

An MSB should review its BSA and AML risk assessment at least periodically and whenever meaningful changes occur. Common triggers include new products, payment channels, customer segments, geographic exposure, bank partners, transaction volumes, or regulatory developments. A current risk assessment helps demonstrate why controls, monitoring rules, due diligence, and staffing decisions are appropriate for the organization’s present risk profile.

KYC requirements should be risk-based, but generally involve collecting identifying information, verifying identity using reliable methods, understanding the customer’s expected activity, screening for relevant risk, and maintaining records. Higher-risk customers may require enhanced due diligence, including additional ownership, source-of-funds, or business-purpose information. The exact process should align with applicable requirements and the MSB’s documented risk assessment.

A strong SAR narrative clearly explains who was involved, what occurred, when and where the activity took place, why it is suspicious, and how the activity was identified. It should present relevant transaction details, investigative findings, and any supporting context in a logical, factual sequence. Clear narratives and well-documented case files help support consistent decisioning and regulatory review.

Preparation begins with current policies, a documented risk assessment, evidence of training and independent testing, organized customer and transaction records, and clear governance. MSBs should also review monitoring alerts, SAR and CTR processes where applicable, sanctions-screening controls, and remediation of prior findings. Conducting a gap assessment before an examination can help identify documentation, control, and operational issues that need attention.