BSA/AML/OFAC Policy Templates for Credit Unions

Bank Secrecy Act regulations require banks and other covered financial institutions, including credit unions, to maintain a written AML program. Core expectations include internal controls, a designated BSA compliance officer, ongoing training, independent testing, customer due diligence, recordkeeping, and required reporting such as Suspicious Activity Reports and Currency Transaction Reports. Programs should be risk-based and tailored to the institution’s products, services, members, and geographic exposure.

BSA requirements affect how a financial institution identifies customers or members, assesses risk, monitors transactions, investigates unusual activity, retains records, and files reports with FinCEN. They also influence board oversight, staff training, vendor management, and independent testing. A credit union should document its risk assessment and ensure its policies match actual operations, including digital channels, cash activity, wire transfers, and higher-risk relationships.

A complete policy should establish board-approved governance, the BSA officer’s authority, risk assessment methodology, member identification and due diligence standards, transaction monitoring, investigation procedures, SAR and CTR processes, OFAC screening, record retention, training, independent testing, and escalation protocols. It should also define roles, review frequency, and documentation standards so the program can be consistently applied and demonstrated during an examination.

Credit unions should review their BSA/AML risk assessment at least annually and whenever material changes occur. Relevant changes can include new products, digital banking capabilities, member segments, transaction volumes, geographic exposure, merger activity, third-party relationships, or emerging fraud typologies. The assessment should explain inherent risk, controls, residual risk, and how those findings inform monitoring, due diligence, training, and independent testing priorities.

OFAC compliance requires credit unions to screen relevant members, transactions, and counterparties against applicable sanctions lists and to investigate potential matches promptly. A program should address list updates, screening timing, alert escalation, false-positive documentation, blocking or rejecting transactions when required, reporting, and record retention. Effective calibration matters because overly broad screening can overwhelm staff while weak controls may miss true sanctions exposure.

The BSA officer is responsible for administering the institution’s BSA/AML program and helping ensure it operates as designed. Typical responsibilities include maintaining policies, coordinating risk assessments, overseeing monitoring and investigations, approving or filing reports, managing OFAC processes, delivering training, reporting to the board, and coordinating independent testing and examinations. The role needs sufficient authority, resources, access to information, and independence to escalate concerns effectively.

No. A sample template provides a starting structure, not a finished program or a substitute for legal advice. Each credit union must tailor its policy to its charter, products, delivery channels, member base, transaction activity, systems, staffing, and risk assessment. Leadership should review the completed policy with qualified compliance and, where appropriate, legal professionals before board approval and implementation.

Preparation starts with current, board-approved policies and a documented risk assessment that aligns with actual operations. Credit unions should maintain evidence of training, independent testing, monitoring and alert reviews, SAR and CTR decisioning, OFAC screening, corrective actions, and board reporting. Conducting a targeted gap assessment before an examination can identify unclear ownership, outdated procedures, weak documentation, or unresolved control issues early.