Small businesses that fall under the Bank Secrecy Act often assume that AML compliance is for big banks with dedicated compliance departments. That assumption is one of the most expensive mistakes in financial compliance. Regulators apply the exact same five-element framework to a 10-person MSB that they apply to a regional bank.
The five-element BSA framework is the same for a 10-person money services business as it is for a regional bank. Size is not a mitigating factor in enforcement, and "we're a small operation" has never been a successful defense against a civil penalty. Here's the practical checklist that every small business with BSA obligations needs to work through.
Element 1 — Written Policies and Internal Controls: Your program must be written, approved by senior management, and describe your actual practices. A 15-page policy that accurately reflects what your team does every day is more defensible than a 100-page document that sits on a shelf. Write it as if explaining your procedures to a new employee on their first day — specific, step-by-step, and honest about your actual workflow.
Element 2 — Customer Identification: At minimum, collect and verify the name, address, date of birth, and identification number of every customer who opens an account or conducts a reportable transaction. Document everything. "The customer seemed legitimate" is not a CIP record. You need copies of identification documents, verification steps, and a clear log of when they were collected.
Element 3 — Transaction Monitoring: You don't need expensive software at the small business level, but you do need consistent procedures. Your team needs to know what suspicious activity looks like in your specific business context, how to escalate internally, and what filing obligations follow a confirmed suspicion. A written transaction monitoring procedure that is actually followed beats an automated system that generates alerts nobody reviews.
Elements 4 and 5 — Annual Training and Independent Testing: Every employee who could encounter BSA-relevant activity needs annual training, and that training needs to be documented. Independent testing must happen regularly — for most small businesses, this means an annual third-party review of your program. These are the two elements most commonly skipped by small businesses, and the two most commonly cited in examination findings.
Tags
Sofia Delgado
Compliance Program Specialist Soflo Consulting
Specializes in BSA/AML program development and compliance training for regulated businesses nationwide from community banks and fintech startups to real estate professionals and money services businesses.
Key Takeaways
- 1Small businesses face the exact same five-element BSA standard as large financial institutions
- 2Written policies must describe actual practices — not aspirational ones
- 3Customer identification records require documentation, not just employee recollection
- 4Transaction monitoring can be manual at smaller scale but must be consistent and documented
- 5Independent testing and annual training are the two most commonly missing elements
Need Expert Guidance?
Put these insights into action. Schedule a free consultation with a Soflo Consulting compliance specialist.
Stay Ahead of Compliance
Get FinCEN updates, BSA/AML guidance, and federal compliance news delivered to your inbox no fluff.
