In most cases, yes. A non-bank residential mortgage lender or originator that falls within the BSA category for loan or finance companies is expected to maintain an anti-money-laundering program, and employee training is one of the elements that program has to include. So the practical question is rarely whether to train. It is what the training actually covers, whether it is specific to mortgage work rather than generic bank content, and whether the records you keep would survive an examiner or a banking partner asking to see them. This page works through those three questions in order, and it ends with a way to check your own program before someone else does.

Who Is Covered

The BSA reaches a defined set of financial institution categories, and loan or finance companies are one of them. In practice that means a non-bank company that originates or funds residential mortgage loans, and in some structures a broker or an originator operating under one, can fall inside the category and inherit the program obligation that comes with it. The determination turns on the business model, how the company is licensed, who it funds for, and what it actually does, not on a job title on a business card.

That is why the answer differs so sharply between two people doing similar work. A loan officer employed by a depository institution sits under that bank's program. A loan officer at an independent mortgage bank sits under that company's. A broker whose files are funded by an investor may sit under one or both, depending on the arrangement. The entity holds the program; the individual works inside it.

Three caveats are worth stating plainly, because they are where people get this wrong. First, whether a particular company is covered depends on its facts, so confirm your own position with qualified counsel and your regulator rather than reasoning from a general article. Second, coverage can change when a company adds a product, opens in a new state, or changes how it funds loans. Third, the asymmetry matters: the program work is not enormous, and the cost of assuming you are out of scope when you are not is considerably larger than the cost of building the program a year early. If you are mapping your own coverage, the mortgage lenders and brokers compliance page lays out the industry picture, and our existing analysis of AML requirements for mortgage loan originators goes deeper on the program itself.

The Elements of a BSA/AML Program, and Where Training Sits

A program is not a single document. It is a small set of elements that have to work together, and most descriptions of it land on the same five:

• Written policies and procedures that describe what the company does to detect and report suspicious activity, and who is responsible for each step.
• A designated compliance officer with the authority to obtain records, review concerns, and escalate to ownership or management.
• Employee training, delivered on a schedule and documented, so the people touching files know what the procedures ask of them.
• Independent testing, meaning a review of the program by someone who is not the person running it.
• Customer due diligence, including knowing who the borrower actually is and who benefits from the transaction.

Training is the element that touches all the others every day. A policy nobody has read is a document, not a control. A compliance officer whose staff do not know when to escalate spends their time chasing things that should have been caught at intake. A due diligence standard that is understood only by the person who wrote it fails the moment that person is on vacation.

The inverse is equally true, and it is the part people skip. Training does not substitute for the other four elements. A lender with excellent training and no written procedures, no named compliance officer, and no independent review does not have a program. It has a well-informed team working without a framework, which is a harder position to defend than a plain gap, because it suggests the company knew what to do and did not build it.

Why Training Is the Element Most Often Underbuilt at Small Lenders

At small and mid-sized mortgage companies, the underbuilt element is almost always training, and the reasons are consistent enough to name.

It is the element with no document to point at. Policies live in a PDF. Independent testing produces a report. Customer due diligence shows up in the file. Training is a recurring calendar event that either happened or did not, and if nobody kept the evidence, the honest answer to "show me" is nothing. Many companies did the training and simply cannot prove it.

Experienced hires are assumed to know. Mortgage is a high-tenure industry, and a processor with fifteen years in the business is treated as already trained. They may be excellent at their job and still not know your escalation path, your suspicious activity definitions, or what you want them to do with an unusual third-party payor. Experience is not a training record.

The content is borrowed from banking. A generic AML course built around teller cash handling, branch currency reports and account opening covers ground that a mortgage lender barely touches. Staff sit through it, pass the quiz, and learn nothing they can apply to a loan file. The result is a document that satisfies a checkbox and a team that still cannot spot a straw buyer.

The people who need it most are not labelled compliance. Loan officers are the obvious audience. Processors, closers, funders, branch managers, marketing staff who handle inbound leads, and the person who opens the mail with a cashier's check in it are often left out, even though several of them touch exactly the transactions the program is meant to catch.

Turnover resets the clock. Sales roles churn. Every new hire who starts transacting before being trained is a gap, and a company that trains annually but onboards continuously will always have a slice of staff in the untrained window.

Nobody measured whether it worked. Completing a module is not the same as being able to recognize something. If the only evidence is a completion list with no assessment, an examiner can reasonably ask whether the training produced capability or attendance.

What the Training Has to Cover for Mortgage Staff

Content is where most programs lose their value, so it is worth being specific about what a mortgage audience actually needs to be able to do after the session.

Customer due diligence and beneficial ownership

Staff should be able to explain who the borrower is, who is providing the funds, and who benefits from the transaction. In mortgage work that means reading a file for gift funds with no documented relationship, an entity borrower whose principals are never identified, a purchase where the party bringing money is not on the application, or a power of attorney that appears late in the process. The training should teach the question to ask, not just the field to complete.

Mortgage fraud red flags

Fraud and money laundering overlap in this industry constantly, and staff need working familiarity with the patterns: straw buyers, occupancy misrepresentation, inflated values supported by a relationship between parties, rapid resale at a jump in price, undisclosed interested parties, altered or inconsistent income documents, mismatched identities, and transactions where the story in the file does not match the story in the documents. The point is not to turn every processor into an investigator. It is to make the odd file feel odd enough to escalate.

Structuring and unusual payment patterns

Mortgage staff see payments in forms that never look like a bank counter: cashier's checks, money orders, wires from third parties, multiple small deposits assembled to reach a down payment, funds arriving from an account held by someone unrelated to the borrower. Training should cover what a pattern looks like when it is being assembled to stay under a reporting threshold, and why the assembly itself is the signal rather than any single instrument.

OFAC screening

Staff should understand what sanctions screening is for, why it applies to parties beyond the borrower, and what happens when a potential match appears. In practice that means knowing that sellers, agents, entity principals and payors can all matter, that a screening result is not a conclusion, and that a hit goes to a named person rather than into a queue that nobody owns. Our broader writeup on the intersection of OFAC and AML is useful background reading for whoever delivers the session.

Escalation and the SAR decision

This is the section most often missing, and it is the one that converts training into program performance. Staff need to know what to do with a concern: who they tell, in what form, how quickly, what happens next, and that the decision to file or not file is made by someone with the authority to make it and is documented either way. They also need to understand that discussing a filing with the subject of it is prohibited, and that the prohibition does not stop at the compliance team. The BSA/AML Audit Simulator includes scenario questions that work well as a discussion prompt for this part of the session.

Recordkeeping

Staff should know what the file has to retain, where it goes, and how it is retrieved later. A concern that was escalated in a phone call and never written down did not happen, from a review standpoint. Training should connect the recordkeeping expectation to the specific documents and systems the company actually uses, not to a generic retention principle.

How Often to Train and How to Document It

There is no single frequency that applies to every company in every circumstance, and anyone who tells you otherwise is describing a convention rather than a rule. What examiners and banking partners tend to expect is a defensible cadence, applied consistently, with a reason behind it. In practice most mortgage companies land on an annual cycle for all staff, training for new hires before they handle files, and short refreshers when something changes: a new product, a new state, a new investor requirement, a pattern that showed up in a recent review.

The documentation is where programs quietly fail, so treat it as the deliverable rather than an afterthought. For each session, you want to be able to produce:

• Who was trained, by name and role, and who was not trained and why.
• What the content covered, with the materials or an outline attached.
• When it was delivered, and by whom.
• How understanding was checked, and what the results were.
• What each person acknowledged, and what changed in procedures as a result.

This is one place where the delivery mechanism matters more than most people expect. Soflo Consulting's training is video based and covers customer due diligence, suspicious activity reporting, OFAC and role-specific content, with progress tracking, completion records and downloadable certificates. Each certificate carries a unique barcode that lets a third party confirm it independently through the site's Verify a Certificate tool, which is useful precisely at the moment a banking partner or examiner asks whether a named employee actually completed the training rather than being listed on a spreadsheet.

What Examiners and Banking Partners Actually Ask For

These two audiences ask different questions, and a program built only for one tends to fail the other.

Examiners start from the program and work outward. Expect requests for the written program, the risk assessment behind it, the identity of the compliance officer, the training materials, the training log, and the independent review. The follow-up questions are the ones that separate a real program from a binder: who delivered the training, how did you test whether it was understood, what did you change as a result, and can I speak to a loan officer about what happens when they see something unusual. A lender whose staff answer that last question confidently is in a very different position from one whose staff point at the compliance officer.

Banking partners are doing counterparty diligence, and they usually want the same evidence in compressed form. Warehouse lenders, correspondent relationships and table funding arrangements all involve someone else taking on exposure to your origination, and their diligence team will ask for your AML policy, your training records, sample certificates, your risk assessment and the name of the person accountable for the program. Their incentive is straightforward: your gap becomes their finding. A company that can assemble that packet in an afternoon looks like a manageable counterparty. A company that needs two weeks to find out who was trained last year looks like a queue item, and sometimes like a reason to reduce a line.

The honest summary is that both audiences are asking the same underlying question in different language: is this program operating, or does it exist on paper. Training records are one of the fastest ways to tell the difference, because they cannot be produced retroactively.

Running This With a Small Team and No Compliance Department

Most mortgage companies in the United States do not have a compliance department. They have an owner, a branch manager, or an operations lead who also handles compliance, and the work has to fit inside a week that is already full. A few patterns make that realistic.

Give the element an owner by name. Not a committee, not "the team". One person who is accountable, with the authority written down and the time actually allocated. The most common structural failure at small lenders is a program with no owner, which is not a program.

Do not write the training yourself. Authoring AML content from scratch is slow, gets stale, and tends to reproduce whatever the author last read. Use structured content, then spend your own time on the part only you can do: making it specific to your products, your states, your systems, and your escalation path.

Find the gaps before someone else does. Run a self-assessment first. The BSA/AML Audit Simulator asks questions across the five BSA pillars and produces a scored gap report, which is a more useful starting point than guessing which element is weakest. Our AML Red Flag Library, with 427+ verified red flags across 13 industries searchable by FinCEN and FFIEC source, is a practical resource for building role-specific examples that staff will recognize from their own files.

Decide what you will not do in house. Bringing in outside help is usually the right call in a handful of situations: a banking partner has asked for documentation you do not have, an examination is scheduled, you are entering a new state or launching a product that changes your exposure, or the person who owned compliance has left. The rest of the time, a modest internal program with real records beats an ambitious one that never quite starts.

Soflo Consulting runs as an AML/BSA compliance platform plus professional services, which means the pieces can be taken in stages rather than all at once. Plans are Training Only, Training + Review (the most common choice, covering review of an existing AML/BSA program), Training + Creation (development of a program), and Banking Partner Readiness for companies preparing to answer exactly the diligence questions described above. Training and materials are available in English and Spanish, industries served include MSBs, mortgage lenders and brokers, fintechs, real estate, title, crypto and casinos among others, and the team can be reached at (737) 258-8804.

Where to Go Next

If you want to see how the training element would be covered for your team before committing to anything, the plans and pricing page sets out what each option includes, and the BSA/AML Audit Simulator is free and will tell you which of the five pillars is currently your weakest. Running the simulator first is the more useful order. It turns a general question about training into a specific one about your own program, and it gives you a documented baseline you can compare against after the work is done.

This article is general educational information about BSA/AML training for mortgage companies. It is not legal advice, and it does not determine whether your company is a covered institution. Coverage depends on your business model and licensing, and requirements change. Confirm your obligations with your own legal or compliance advisors and with your regulator.