AML Program Documentation: Exactly What Examiners Want to See

BSA examiners evaluate your compliance program through its documentation. A program that is well-designed and actively managed but poorly documented will generate findings. A program that is adequately designed and consistently documented will generally pass examination. Documentation is not a substitute for a good program - but it is the lens through which examiners evaluate your program, and it must be organized, complete, and current.

The standard examination document request includes: your written AML program and all policies and procedures; your most recent risk assessment with the date of last update; training records for the past 24 months, including content, dates, and attendee names; CTR and SAR filing records for the past 24 months; independent testing reports for the past 24 months; customer due diligence records for a sample of customers; and board or senior management approval of the AML program.

Organization matters as much as completeness. Examiners who receive a disorganized pile of documents spend more time searching for what they need - and the time they spend searching is time they spend forming impressions about your program's maturity. A well-organized documentation package - with a clear table of contents, tabbed sections for each program element, and a cover memo that summarizes the program - signals that your compliance function is professionally managed.

The most commonly missing documentation items are: board or senior management approval of the AML program (required but frequently absent), independent testing reports (required but frequently not conducted), and training records for all covered employees (frequently incomplete for part-time or seasonal staff). Review your documentation against this list before any examination and address gaps proactively.

Currency is as important as completeness. A risk assessment from 2020, a training record from 2021, and an independent testing report from 2019 tell an examiner that your program is not being actively maintained. Every document in your examination package should have a date, and those dates should reflect a program that is being managed on an ongoing basis. If your documentation is stale, update it before the examination - not after.