---
title: "What must a bank's Bank Secrecy Act compliance program include? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources."
canonical: https://www.m-i-n-d.ai/minds/banking-compliance/bsa-compliance-program-requirements
jurisdiction: "US Federal"
last_verified: 2026-08-28
license: CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/
attribution: "Source: MIND (m-i-n-d.ai)"
---

# What must a bank's Bank Secrecy Act compliance program include? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources.

Under 12 CFR 21.21 (national banks and savings associations) and 12 CFR 208.63 (state member banks), a written BSA compliance program must be approved by the board of directors, noted in the minutes, and include: (1) internal controls, (2) independent testing, (3) a designated compliance officer, and (4) training for appropriate personnel, plus a customer identification program under 31 U.S.C. 5318(l) and 31 CFR 1020.220.

## Details / How it works

Each national bank, savings association, and state member bank must develop, administer, and maintain a written BSA compliance program reasonably designed to ensure and monitor compliance with the recordkeeping and reporting requirements of the Bank Secrecy Act (subchapter II of chapter 53 of title 31, United States Code) and the implementing regulations at 31 CFR Chapter X / 31 CFR Part 103. The program must be reduced to writing, approved by the board of directors, and reflected in the minutes. The program must also include a Customer Identification Program (CIP) implemented under 31 U.S.C. 5318(l) and 31 CFR 1020.220.

## Numbers & thresholds

| # | Required component | Source |
|---|--------------------|--------|
| 1 | System of internal controls to assure ongoing compliance | 12 CFR 21.21(d)(1); 12 CFR 208.63(c)(1) |
| 2 | Independent testing conducted by bank personnel or an outside party | 12 CFR 21.21(d)(2); 12 CFR 208.63(c)(2) |
| 3 | Designated individual(s) responsible for coordinating and monitoring day-to-day compliance | 12 CFR 21.21(d)(3); 12 CFR 208.63(c)(3) |
| 4 | Training for appropriate personnel | 12 CFR 21.21(d)(4); 12 CFR 208.63(c)(4) |
| 5 | Customer Identification Program (CIP) | 31 CFR 1020.220 |

## Exceptions & edge cases

Section 21.21 defines a "savings association" by reference to section 3 of the Federal Deposit Insurance Act, including federal savings associations, state-chartered savings and loan / building and loan / cooperative banks (other than cooperative banks that are state banks), and certain corporations the FDIC and Comptroller jointly determine to be operating substantially as a savings association. State member banks follow the parallel framework at 12 CFR 208.63, which references 31 CFR 103.121 for the CIP implementing regulation.

## Sources

- [1] U.S. Government Publishing Office / Office of the Comptroller of the Currency / Federal Reserve — 12 CFR 21.21 — Bank Secrecy Act compliance program requirements · https://www.ecfr.gov/current/title-12/section-21.21 · as of 2026-08-28
- [2] U.S. Government Publishing Office / Office of the Comptroller of the Currency / Federal Reserve — 12 CFR 208.63 — Procedures for monitoring Bank Secrecy Act compliance — state member banks · https://www.ecfr.gov/current/title-12/section-208.63 · as of 2026-08-28
- [3] U.S. National Archives, Electronic Code of Federal Regulations — 31 CFR 1020.220 — Customer identification program requirements for banks. · https://www.ecfr.gov/current/title-31/section-1020.220 · as of 2026-08-28