A BSA officer's week is mostly assembly work. Pulling the account history behind an alert, checking whether three cash deposits aggregate past a threshold, matching a sanctions hit against a date of birth, chasing a refreshed beneficial ownership form. Each step is small. Together they eat the hours you need for the decisions only you can make.
This guide ranks that work for a US bank or credit union BSA/AML officer: what to hand to an AI employee first, what to hand over later, and what you keep. It sits beside our guide on what examiners ask about AI in BSA/AML programs, which covers the exam questions, and our AML automation hub, which covers the mechanics.
What should a BSA officer delegate to AI first?
How should you rank what to delegate?
Four tests sort the list. Apply them to each task in your program and delegate the highest scorers first.
- Volume.
How many times a week does a person repeat the task? Repetition is where the hours are. - Rule clarity.
Can the steps be written down so a new analyst would do them the same way? If two senior analysts would handle a case differently, the procedure is not ready for an agent. - Evidence value.
Does the task produce a record an examiner will ask for? Assembly work that is currently done in people's heads or spread across screens gains the most from a complete audit trail. - Risk if wrong.
What does an error cost, and how quickly would you catch it? Low-consequence, easily reviewed work goes first. Work that ends in a regulatory filing or a customer exit goes last, and the final decision stays human regardless.
What is the ranked delegation list?
- Alert investigation prep and case narrative assembly.
Highest volume, and the biggest gap between analyst time spent gathering facts and time spent judging them. The agent pulls account history, counterparties, prior alerts and KYC data into one case file, and drafts a factual summary. The analyst reads it and decides. Our piece on AML alert triage with AI goes through the mechanics. - CTR preparation and aggregation checks.
Banks must report currency transactions of more than $10,000 (31 CFR 1010.311), and multiple transactions by or on behalf of one person are treated as a single transaction under the aggregation rule (31 CFR 1010.313). Filing is due within 15 days after the transaction (31 CFR 1010.306). Aggregation and form population are arithmetic and field mapping, which makes them near-ideal. See the glossary entry on the currency transaction report. - Sanctions hit evidence gathering.
For each potential match the agent compares name, date of birth, address and identifiers against the list entry, and records what matched and what did not. A person clears or escalates. Our guide to OFAC sanctions screening automation covers the workflow. - CDD refresh and beneficial ownership updates.
Customer due diligence is the fifth pillar of the program rule, and it includes ongoing monitoring to "maintain and update customer information," including beneficial owner information for legal entity customers (31 CFR 1020.210). Agents can collect refreshed documents, compare them with what is on file, and flag changes. See KYC automation and the glossary entry on perpetual KYC. - 314(a) list searches.
When FinCEN sends a request, the institution must expeditiously search its records and report matches in the manner and time frame the request specifies. Unless the request says otherwise, the search covers current accounts, accounts held in the preceding twelve months, and recorded transactions in the preceding six months (31 CFR 1010.520). The search is mechanical. The match review and the response stay with your designated contact. - Lookbacks.
A lookback is a bounded review of past activity, usually after a monitoring gap or a rule change. It is a large block of repetitive case work with a defined end, which is why it scales well with an agent. See AML lookback review with AI. - SAR continuing-activity review reminders.
Track each filed SAR's review date, assemble activity since the last filing and queue the case for the analyst. The decision to file again is a person's. - Training and independent-test evidence packaging.
The program must include training and independent testing (31 CFR 1020.210). An agent can compile completion records, sample populations and the supporting files your independent tester requests.
The first four give most of the relief. Items five through eight are good second-wave candidates once your team trusts the first.
What stays with the BSA officer?
The program rule requires a designated individual or individuals responsible for coordinating and monitoring day-to-day compliance (31 CFR 1020.210). That accountability does not transfer to software. Five things stay with you:
- SAR filing decisions.
A bank must file within 30 calendar days of initial detection of facts that may constitute a basis for filing, with up to 60 days if no suspect was identified on the date of detection. The $5,000 threshold applies to banks (31 CFR 1020.320). The agent can have the case file complete on day two. Whether the facts amount to suspicion is yours. See the glossary entry on the suspicious activity report. - Risk assessment judgment.
An agent can assemble the product, geography and customer data. The conclusion about where your institution's risk sits is a judgment. - Board reporting.
Reports to the board and senior management reflect what you decided and why. The agent can supply the figures. - Examiner relationship.
Examiners want a person who owns the program. They will also ask about the AI, as set out in our examiner questions guide. - Tuning approvals.
Changes to scenarios, thresholds or the agent's procedure need your sign-off with a second person reviewing, because they change what the program sees.
What does the delegation table look like?
Task | Delegate to AI employee | Stays with BSA officer | Evidence produced |
|---|---|---|---|
Alert investigation prep | Gather account history, counterparties, prior alerts; draft factual summary | Disposition: close, escalate or refer | Case file with sources and timestamps |
CTR preparation | Aggregate cash by person and business day, populate the form, track the 15-day clock | Approve filing of exceptions and unusual cases | Aggregation worksheet, filing log |
Sanctions hit evidence | Compare identifiers to list entry, record matches and non-matches | Clear or block, and any OFAC report | Match comparison record |
CDD and beneficial ownership refresh | Request and collect documents, compare to file, flag changes | Customer risk rating changes, exits | Dated refresh record |
314(a) searches | Run the search against accounts and transactions in scope | Review matches, respond to FinCEN | Search log with date and scope |
Lookbacks | Work the population case by case to a standard template | Scope, methodology, conclusions | Case set and population reconciliation |
SAR continuing activity | Track review dates, assemble new activity | Decide whether to file again | Review calendar and activity summary |
Training and test evidence | Compile completions, samples and files | Program content, response to findings | Evidence binder |
SAR filing | Assemble facts and draft | The decision and the signature | Decision memo |
Model tuning | Run tests and prepare results | Approve the change | Approved change record |
What do the regulators expect when you use AI?
A model-risk expectation sits underneath all of this. The Federal Reserve's SR 26-2, "Revised Guidance on Model Risk Management," dated April 17, 2026, supersedes SR 11-7 and also SR 21-8, the 2021 interagency statement on model risk management for BSA/AML systems (Federal Reserve, SR 26-2). Check the OCC and FDIC versions that apply to your charter, and have your model risk owner confirm how the new guidance maps to your inventory.
On the rules themselves, FinCEN published a proposed rule on April 10, 2026 to reform AML/CFT program requirements, with comments closing June 9, 2026 (Federal Register, 2026-07033). It is a proposal, so the current text of 31 CFR 1020.210 is what you are examined against until a final rule says otherwise. Watch for it, because it may change how effectiveness is judged.
How Zamp Approaches BSA Operations Work
Zamp builds AI employees that run jobs end to end, with human approval gates and a full audit trail. For BSA operations, the agent follows a written procedure that names the sources it may read, the steps it takes and the point at which it must stop. It can assemble a case file or populate a CTR. It cannot file a SAR, clear a sanctions hit or change a customer's risk rating. Those steps wait for a named person.
When the agent meets something outside its procedure, such as records that conflict or an alert type it has not seen, it routes the case to a reviewer with the evidence attached. A reviewer's correction becomes a change to the procedure, which is tested and reviewed before it takes effect. Every action is logged, so when an examiner asks how an alert was resolved, you open the record. Banks with data-residency requirements can run the platform inside their own cloud account or on premises.
How should you start?
Start with one queue, usually alert investigation prep for a single scenario or CTR preparation, and run the agent beside your analysts. Review every case where the analyst and the agent disagree. Widen scope only when disagreements become rare, and write down the date and the evidence for each expansion, because that record is what you will show the examiner. Before you begin, confirm the procedure is written, an owner approves it and your model risk process has the agent in its inventory.
