Bank Secrecy Act / Anti-Money Laundering (BSA/AML): every control, and what you already have

44 controls 89 frameworks share controls with it United States verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
AML/CTF Act 2006 (Australia)	23	measure it →
Florida Digital Bill of Rights (FDBR)	5	measure it →
FTC GLBA Safeguards Rule (16 CFR Part 314)	5	measure it →
APRA CPS 230 Operational Risk Management	4	measure it →
GHG Protocol	4	measure it →
IFRS 17	4	measure it →
India CERT-In Cyber Security Directions 2022	4	measure it →
Nevada Gaming Control Board Cybersecurity Requirements	4	measure it →
Nigeria Open Banking Regulatory Framework (CBN, 2023)	4	measure it →
US Gramm-Leach-Bliley Act (GLBA)	4	measure it →
3GPP 5G Security Architecture (TS 33.501)	1	measure it →
Armenia Law on Protection of Personal Data (2015)	1	measure it →

Every control

Code	Control	Also in
`BSA-AML-01`	AML Compliance Programme	1
`BSA-AML-02`	BSA Compliance Officer	1
`BSA-AML-03`	Independent Testing	1
`BSA-AML-04`	AML Training	1
`BSA-AML-05`	Customer Identification Program (CIP)	0
`BSA-AML-06`	Customer Due Diligence (CDD)	1
`BSA-AML-07`	Beneficial Ownership Identification	1
`BSA-AML-08`	Enhanced Due Diligence (EDD)	1
`BSA-AML-09`	Suspicious Activity Reporting (SAR)	1
`BSA-AML-10`	Currency Transaction Reporting (CTR)	1
`BSA-AML-11`	CTR Exemptions	0
`BSA-AML-12`	Monetary Instrument Recordkeeping	0
`BSA-AML-13`	Funds Transfer Recordkeeping (Travel Rule)	1
`BSA-AML-14`	OFAC Sanctions Screening	1
`BSA-AML-15`	Transaction Monitoring	1
`BSA-AML-16`	AML Risk Assessment	1
`BSA-AML-17`	Correspondent Account Due Diligence	0
`BSA-AML-18`	Private Banking Due Diligence	0
`BSA-AML-19`	Information Sharing 314(a)	0
`BSA-AML-20`	Voluntary Information Sharing 314(b)	0
`BSA-AML-21`	Recordkeeping and Retention	1
`BSA-AML-22`	Beneficial Ownership Reporting (Corporate Transparency Act)	0
`BSA-AML-23`	Section 311 Special Measures	0
`BSA-AML-24`	AML Programme Effectiveness (AMLA 2020)	0
`BSA-CDD-1`	Beneficial Ownership Identification	10
`BSA-CDD-2`	Beneficial Ownership Verification	0
`BSA-CDD-3`	Customer Risk Profiling	10
`BSA-CDD-4`	Enhanced Due Diligence (EDD)	1
`BSA-CIP-1`	Customer Identification Program (CIP)	1
`BSA-CIP-2`	Identity Verification	83
`BSA-CIP-3`	CIP Recordkeeping	1
`BSA-CTR-1`	Currency Transaction Reports	1
`BSA-CTR-2`	CTR Filing Deadline	0
`BSA-ENF-1`	Anti-Structuring Prohibition	10
`BSA-ENF-2`	Civil Money Penalties	1
`BSA-ENF-3`	Criminal Penalties	0
`BSA-REC-1`	Funds Transfer Recordkeeping (Travel Rule)	0
`BSA-REC-2`	Monetary Instrument Purchase Records	0
`BSA-REC-3`	Foreign Bank Account Reporting (FBAR)	0
`BSA-REC-4`	Information Sharing (Section 314)	0
`BSA-SAR-1`	Suspicious Activity Reports - Threshold	0
`BSA-SAR-2`	SAR Filing Deadline	0
`BSA-SAR-3`	SAR Confidentiality	9
`BSA-SAR-4`	SAR Recordkeeping	0

Tell me when Bank Secrecy Act / Anti-Money Laundering (BSA/AML) files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

System security plans
Standard operating procedures
Current-as-at dates and approval records
Revenue analysis
Exemption documentation
Annual applicability review
Policy referencing the control
Documented procedure
Evidence of operating effectiveness
Monitoring or review reports

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

no annual review named by 13 frameworks
Evidence not retained named by 5 frameworks
no annual refresh named by 5 frameworks
Shared or generic accounts retained named by 4 frameworks
Stale or dormant accounts not deprovisioned named by 4 frameworks
Access reviews skipped or rubber-stamped named by 4 frameworks

What this page is

A control-level reference for Bank Secrecy Act / Anti-Money Laundering (BSA/AML), drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition