Purpose of the Template
Recently, Bank of America faced a $1.21 billion fine from three financial regulators, and soon after, Sen. Elizabeth Warren questioned whether criminal charges should be pursued. This situation signals a clear message for your team: civil penalties might not be the end of the story. Political pressure can escalate an AML failure to criminal prosecution.
This template is a structured memo and checklist your BSA Officer can use quarterly to inform senior management and the board. Its purpose is to evaluate whether your AML/CFT Framework can withstand scrutiny from prosecutors, not just examiners. While examiners ask if you have controls, prosecutors want to know who knew what, when, and what actions were taken. This template focuses on that critical question.
It doesn't predict enforcement outcomes or replace legal advice. Use it to identify and document gaps before they become someone else's discovery.
Prerequisites
Before starting the review, gather:
- Your current AML/CFT Framework policy and board-approved risk assessment
- The last 12 months of board and compliance committee minutes
- Open and closed audit and exam findings, with remediation status and dates
- Backlog reports for alerts, investigations, and Suspicious Activity Report decisions
- Records of escalation to the MLRO or BSA Officer on high-risk matters
- Access to outside counsel to ensure the memo can be routed under privilege where needed
Assign one owner. Without a named owner, the review won't last beyond its second quarter.
The Template
Copy the text below into your document and replace bracketed fields.
CRIMINAL EXPOSURE REVIEW, [Institution], [Quarter/Year]
Prepared by: [BSA Officer] Reviewed by: [General Counsel / Outside Counsel] Privilege status: [Confirm with counsel]
Section 1. Knowledge and Notice Log
List every instance where a red flag reached management: audit finding, exam observation, internal escalation, whistleblower report, or law enforcement inquiry.
| Date | Issue | Who was informed | Decision made | Remediation due | Status |
|---|---|---|---|---|---|
| [ ] | [ ] | [ ] | [ ] | [ ] | [Open/Closed/Overdue] |
Why it matters: Knowledge is the pivot between a compliance failure and a potential willful violation. This log shows whether known problems were fixed or left unaddressed.
Section 2. Repeat and Unresolved Findings
For each finding that has appeared more than once or remains open past its committed date, record: original date, number of recurrences, cause of delay, and the named executive accountable.
Why it matters: Repeated findings with no remediation can escalate a penalty into a criminal case.
Section 3. Monitoring and Filing Integrity
Confirm for the period:
- Transaction Monitoring Rules were reviewed against current risk assessment on [date]
- Alert backlog at period end: [count], oldest alert age: [days]
- Every Suspicious Activity Report decision, including decisions not to file, has a written rationale
- Continuing Activity SARs were filed on schedule where activity persisted
- Filings were submitted through the BSA E-Filing System within regulatory deadlines
- Currency Transaction Report filings reconciled to source data
Why it matters: Documented, reasoned decisions indicate a functioning process. Undocumented ones do not.
Section 4. Resourcing and Independence
Record AML headcount, open vacancies, budget requests made, and budget requests denied, with reasons. Confirm the BSA Officer has direct board access and that no business-line executive can override a filing or exit decision.
Why it matters: Denied resource requests preceding a failure are among the first documents investigators seek.
Section 5. Board and Senior Management Reporting
List what the board received this quarter: metrics, backlog, exam findings, and any escalated customer relationships. Note whether bad news was reported plainly.
Why it matters: An informed board shows oversight. A board that wasn't informed may indicate a reporting failure or concealment.
Section 6. High-Risk Relationship Decisions
For customers retained after adverse information, record: the adverse information, Customer Risk Rating before and after, who approved retention, and the rationale.
Why it matters: Retaining relationships despite known red flags is a common theme in serious cases.
Section 7. Attestation and Action Plan
List each gap, owner, deadline, and the date the board will review progress. The BSA Officer signs; the executive owner countersigns.
Customizing the Template
Scale it to your risk. A community bank can combine Sections 3 and 6 into a single page. A multi-entity group should run the template per legal entity, then consolidate.
Match your products. Add rows to Section 3 for product-specific obligations, such as Travel Rule Compliance if you handle qualifying transfers, or Name Screening results if sanctions exposure is significant.
Set your own thresholds. The template leaves backlog limits and review frequencies blank. Define them in policy first, then measure against them. It's better to document a threshold you set and breached than one you never set.
Align with counsel. Consult counsel on whether to run the review under privilege and how to store it. Don't assume the answer.
Keep language factual. Write "alert backlog exceeded policy threshold for 45 days," not "we were a bit behind." Plain, dated statements protect everyone.
Validation Steps
- Run a reconstruction test. Pick one closed high-risk investigation and rebuild the decision trail from the log alone. If you can't tell who decided what and why, fix the record-keeping first.
- Test the escalation path. Submit a simulated red flag and confirm it reaches the BSA Officer and the board within your stated timeline.
- Cross-check the log against reality. Compare Section 1 against internal audit reports and exam letters. Any finding missing from your log means your tracking is incomplete.
- Challenge overdue items. Select three overdue remediation items and ask the accountable executive to explain the delay in writing.
- Get independent review. Have internal audit or an outside party sample the completed template annually.
The goal isn't a clean report. It's a record showing that when your institution learned of a problem, it acted. That record is your best defense against both the fine and the question that follows it.
