Credit Union BSA Rules & Shared Branching Compliance

Banks, federally insured credit unions, money services businesses, broker-dealers, casinos, and other entities defined as financial institutions under the Bank Secrecy Act must comply with applicable requirements. For credit unions, this generally means maintaining a written, risk-based BSA/AML program with a designated compliance officer, internal controls, training, independent testing, customer due diligence, monitoring, and required reporting.

A credit union remains responsible for maintaining an effective BSA program even when member transactions occur through shared branches or service providers. Responsibilities should be clearly documented for member identification, transaction records, monitoring data, suspicious activity escalation, OFAC screening, exception handling, and retention. Agreements and oversight should show that controls are appropriate for the arrangement and the credit union’s risk.

Shared branching can change how identification is performed operationally, but it does not eliminate the credit union’s obligation to maintain risk-based customer identification and due diligence controls. Credit unions should understand what identification data the shared branch collects, how it is validated, what information is available to the home institution, and how exceptions or potential red flags are escalated.

A credit union files a SAR when it knows, suspects, or has reason to suspect a transaction involves illegal activity, attempts to evade BSA requirements, lacks an apparent lawful purpose, or uses the institution to facilitate criminal activity. Filing thresholds and timelines vary by circumstance. A sound program documents investigations, decisions, supporting evidence, and any continuing-activity review.

A BSA risk assessment should be reviewed regularly and updated when material changes affect risk, such as new products, services, member segments, delivery channels, geographic exposure, shared branching arrangements, transaction volumes, or emerging fraud typologies. Many institutions conduct at least an annual review, while significant changes should trigger an earlier documented reassessment and corresponding control updates.

A complete BSA policy typically addresses governance, the BSA officer’s authority, risk assessment, customer identification and due diligence, transaction monitoring, SAR and CTR processes, OFAC screening, record retention, training, independent testing, vendor oversight, and board reporting. Procedures should translate policy requirements into specific workflows, responsibilities, escalation paths, evidence standards, and quality-control steps.

Yes. A fractional BSA officer can provide experienced leadership without the overhead of a full-time hire, helping with program oversight, governance, risk assessments, policy development, issue remediation, board reporting, and examination readiness. The engagement should define authority, reporting lines, availability, and responsibilities so the role is integrated into the credit union’s broader compliance and operational structure.

Begin by confirming that your risk assessment, policies, procedures, training records, independent testing results, monitoring documentation, SAR and CTR files, OFAC controls, and board reporting are current and internally consistent. Review prior findings, test whether remediation is sustainable, and organize evidence before requests arrive. Shared branching oversight, agreements, and escalation records should also be readily available.