What AML training does the Bank Secrecy Act require of US financial institutions?

The US framework has three layers: a federal statute (the Bank Secrecy Act), regulations written by a Treasury bureau (FinCEN), and supervision by each sector's own regulator. For readers outside the United States, the closest analogy is a primary law plus sector specific regulations, but with examinations carried out by several agencies rather than one financial intelligence unit.

The Bank Secrecy Act (BSA) is the collective name for the Currency and Foreign Transactions Reporting Act of 1970 and the statutes that later amended it. FinCEN describes the BSA as authorizing the Department of the Treasury to impose reporting and other requirements on financial institutions to help detect and prevent money laundering. The Financial Crimes Enforcement Network (FinCEN) is the Treasury bureau that administers the BSA and writes its implementing rules, collected in 31 CFR Chapter X.

Examination is delegated. Banks are examined by their federal banking agency (the Federal Reserve, the FDIC, the OCC or the NCUA), broker-dealers by the Securities and Exchange Commission (SEC) and the Financial Industry Regulatory Authority (FINRA), and so on. This page states the position as at September 2026.

The statute requires every financial institution's AML program to include an ongoing employee training program. Section 5318(h)(1) of Title 31 of the US Code, added in 1992 and made mandatory by the USA PATRIOT Act of 2001, sets four minimum program components, which FinCEN's April 2026 proposed rule calls the "four pillars":

The Anti-Money Laundering Act of 2020 (AML Act), enacted on January 1, 2021 as part of the National Defense Authorization Act for Fiscal Year 2021, amended section 5318(h) to refer to countering the financing of terrorism (CFT) and required FinCEN to publish national AML/CFT priorities. FinCEN issued the first priorities on June 30, 2021: corruption, cybercrime, terrorist financing, fraud, transnational criminal organizations, drug trafficking organizations, human trafficking and smuggling, and proliferation financing.

Every FinCEN program rule includes a training requirement, but the wording differs by sector. The table summarizes the current text in the Electronic Code of Federal Regulations, which for banks has not changed since September 2020.

Banks must also meet the program rule of their federal banking agency, which carries the same training component (for example 12 CFR 21.21 for the OCC and 12 CFR 326.8 for the FDIC). Broker-dealers have a parallel self-regulatory requirement in FINRA Rule 3310(e), which requires members' AML programs to "provide ongoing training for appropriate personnel". FINRA lets firms count this training toward the Firm Element of FINRA continuing education.

Examiners expect training that is tailored to each person's responsibilities, covers the institution's own policies as well as the law, reaches the board and agents, and is documented. The most detailed public statement is the "BSA/AML Training" section of the FFIEC BSA/AML Examination Manual, used by US bank examiners.

• Scope. Training should cover BSA regulatory requirements, supervisory guidance, and the bank's internal BSA/AML policies, procedures and processes.
• Tailoring. Training should be tailored to each individual's responsibilities, with targeted training for higher risk business lines such as lending, trust services, foreign correspondent banking and private banking.
• New staff. An overview of the BSA is typically given at orientation or reasonably soon after.
• Compliance staff. The BSA compliance officer and compliance staff should receive periodic training to keep up with regulatory change and changes to the bank's risk profile.
• Board and senior management. They should receive foundational training sufficient to oversee the program, approve the written program and allocate resources.
• Examples. Training should include money laundering and suspicious activity examples relevant to each operational area, for example large currency transactions for tellers.
• Agents and third parties. Agents performing BSA functions should be trained; where another party provides training, documentation should be kept.

The manual also sets a documentation expectation that matters to any audit trail: banks should keep training and testing materials, dates of sessions, attendance records, and records of any failure to take required training on time together with the corrective action taken.

FinCEN has proposed, but not finalized, a rule to rewrite all its AML/CFT program rules, and it has delayed the new investment adviser rule to 2028. Both matter to training plans, but neither changes today's obligations.

In the 2026 proposal FinCEN says it "would generally expect training to cover the financial institution's internal policies, procedures, and controls, which should in turn reflect the results of the financial institution's risk assessment processes", and that frequency and content would depend on the institution's risk profile and each trainee's role. It also notes that institutions may need to train non-employees who have program roles. These statements are proposals, not binding rules, as at September 2026.

Map each examiner expectation to a role based learning outcome and to the record an examiner would ask to see. The table is illustrative and would need tailoring to the institution's risk assessment, products and sector rule. For the general method, see how to map training to compliance obligations.

Completion records alone rarely show that people can apply the rules. The distinction is covered in completion tracking vs competency verification, and record keeping for examinations in how to prepare training records for an audit.

No FinCEN program rule sets a fixed frequency or number of hours; the requirement is that training is ongoing and appropriate to the institution's risks. In practice, examiners look for training at onboarding, periodic refreshers, and updates when rules, products or the risk profile change. Many institutions choose an annual cycle for all relevant staff, but that is a common practice rather than a regulatory requirement. For setting intervals, see how to set mandatory training refresh cycles.

Knowledge Foundry models each program rule, examiner expectation and internal policy as nodes in a knowledge framework, linked to role based learning outcomes and assessment points. When FinCEN finalizes a program rule or updates its priorities, the affected training can be traced from those links. See how this applies to financial services organizations.