Five Pillars of BSA Compliance: A Complete Overview

The Bank Secrecy Act requires covered financial institutions — including Money Services Businesses — to implement a written anti-money laundering compliance program. That program must be built on five core elements, commonly referred to as the Five Pillars of BSA Compliance.

Every fintech that qualifies as a covered financial institution must implement all five pillars. The absence of any pillar is a BSA program deficiency that will be cited as a finding in a regulatory examination. This guide covers what each pillar requires and how they work together to form a complete compliance program.

Pillar 1: Internal Controls

Internal controls are the policies, procedures, and operational mechanisms that prevent and detect potential BSA/AML violations. A comprehensive set of written internal controls is the foundation of the entire compliance program.

Internal controls must cover customer identification and verification procedures, customer risk rating methodologies, transaction monitoring processes, SAR filing procedures, CTR filing procedures for covered institutions, OFAC sanctions screening procedures, recordkeeping requirements, and employee escalation and reporting procedures.

Controls must be tailored to your specific business model and risk profile — a generic template lifted from another business is not sufficient and will be identified as such in an examination. Controls must also be implemented in practice — written controls that are not actually followed are not controls.

Pillar 2: Designated Compliance Officer

Every covered financial institution must designate an individual who is responsible for day-to-day BSA/AML compliance. This individual — commonly called the BSA Officer — must have sufficient knowledge and experience to manage the compliance program, adequate authority within the organization to enforce compliance decisions, and sufficient resources and access to fulfill their responsibilities.

For a detailed guide on BSA Officer responsibilities, qualifications, and costs, see our guide on what is a BSA compliance officer.

Pillar 3: Ongoing Employee Training

All employees who handle customer transactions or have BSA compliance responsibilities must receive ongoing training on the requirements of the AML program, how to identify and escalate suspicious activity, and their specific role-based obligations under the compliance program.

Training must be provided at a minimum annually. It must be role-specific — front-line transaction processors, compliance analysts, and senior managers all need training, but the content appropriate for each role differs. Training completion must be documented and retained.

Generic online training that is not tailored to your specific business model and the types of suspicious activity your customers present is typically identified as inadequate in examinations. Effective training includes examples relevant to your actual customer base and transaction patterns.

Pillar 4: Independent Testing

The BSA requires covered financial institutions to have their AML programs independently tested — audited — at a minimum every 12 to 18 months. Independent testing evaluates whether your program elements are in place and functioning as designed.

Independent testing must be conducted by someone who is independent of the compliance function — either an external firm or, for larger organizations, an independent internal audit function. Testing by compliance personnel who are responsible for the program being tested is not independent.

The testing must cover all material elements of the program — policies, KYC implementation, transaction monitoring, SAR filing quality, training records, and recordkeeping. The results must be documented and any findings must be tracked to remediation.

For a complete guide to the independent testing requirement, see our guide on AML independent review.

Pillar 5: Customer Due Diligence

The fifth pillar — added to the BSA program requirements through FinCEN's 2016 CDD Rule — requires covered institutions to implement formal Customer Due Diligence procedures including beneficial ownership collection for business customers.

CDD includes collecting and verifying the identity of customers, understanding the nature and purpose of customer relationships, conducting ongoing monitoring to detect suspicious activity, and collecting beneficial ownership information for legal entity customers.

For a detailed guide on the fifth pillar requirements, see our article on the fifth pillar of BSA compliance. For a full guide to CDD requirements, see our guide on what is customer due diligence.

How the Five Pillars Work Together

The five pillars are interdependent — each supports and reinforces the others. Internal controls define the procedures; the compliance officer implements and oversees them; training ensures employees follow them; independent testing validates that they work as designed; and CDD ensures that the program is applied to a well-understood customer base. A program that is strong in four pillars but deficient in one still has a BSA compliance gap.

Frequently Asked Questions

Are there businesses that only need some of the five pillars?

No. All five pillars are required for every covered financial institution. There is no provision that allows an institution to omit one pillar because the others are particularly strong. The five pillars are a minimum baseline — larger or higher-risk businesses typically need more robust implementations of each, but none can be omitted.

Do the five pillars apply to very small fintechs or startups?

Yes. The BSA does not exempt small businesses from the requirement to have a compliant AML program. A small fintech that qualifies as an MSB has the same five-pillar obligation as a large one. The implementation may be appropriately scaled to the business's size and risk profile — but all five pillars must be present.

How ComplyOne Helps

ComplyOne helps fintechs build five-pillar BSA compliance programs that satisfy regulatory requirements — from program design and documentation through implementation support, independent testing, and ongoing program management — through advisory services, compliance technology, or both.

Talk to the ComplyOne team to get started.

The information in this article is for general educational purposes and does not constitute legal or regulatory advice. Consult a qualified compliance professional for guidance specific to your situation.