Compliance operations is the day-to-day work behind a bank's or credit union's regulatory obligations: reviewing alerts, investigating, filing reports, keeping records and showing examiners the work. Much of it behaves like fixed overhead, so it weighs most on the smallest institutions.[1]
FinCEN estimates that a bank or credit union spends about $598,700 a year on its anti-money laundering program alone, as a size-weighted average, and $414,300 at the median.[2] This guide covers what compliance costs, where the hours go, what the 2025–2026 relief changed, and which work AI coworkers can take on.
What is compliance operations?
Compliance operations is the work that turns a compliance program into daily practice: the reviews, investigations, filings, records and evidence that show the program works. Policy says what the institution will do. Operations is the doing, and the proof.
The institutions doing it are mostly small. As of June 30, 2026, there were 3,818 community banks, 90% of FDIC-insured institutions, with about 91 full-time-equivalent staff each on average across every function.[3] Of the 4,214 federally insured credit unions, 748 had more than $500 million in assets.[4]
Why does compliance cost small banks more?
Because much of it is fixed. Every bank's BSA program needs internal controls, independent testing, a person or people responsible for day-to-day compliance, training and customer due diligence, whatever its size.[5] Every new rule has to be read, assessed and written into procedures once, however many customers it touches.
The smaller the bank, the larger the share of spending that goes to compliance
Compliance cost as a share of noninterest expense, by asset size (bars run to 10%); 469 community banks, 2014 data[6]
Show the data for The smaller the bank, the larger the share of spending that goes to compliance
| Asset size | Share of noninterest expense | Average cost | Banks |
|---|---|---|---|
| Under $100M | 8.7% | $163,800 | 113 |
| $100M–$250M | 5.9% | $268,500 | 154 |
| $250M–$500M | 5.3% | $483,600 | 121 |
| $500M–$1B | 4.2% | $764,200 | 45 |
| $1B–$10B | 2.9% | $1,843,500 | 36 |
The pattern has held. Across ten years of surveys by the Conference of State Bank Supervisors (CSBS), 2015–2024, the smallest community banks spent roughly 11% to 15.5% of payroll on compliance, against 6% to 10% at the largest.[1]
How much does compliance cost community banks?
There is no single official figure, and FinCEN says public data on compliance costs are scarce.[2] The best estimates come from FinCEN, CSBS's annual survey of community banks, and GAO.
Money laundering rules take a quarter of community banks' compliance cost
Share of total compliance cost by area of regulation; simple average of responses to the 2026 survey, which 330 banks under $10 billion answered (2025 in the data table)[7][8]
Show the data for Money laundering rules take a quarter of community banks' compliance cost
| Area | 2026 survey | 2025 survey |
|---|---|---|
| Safety and soundness | 25.9 | 27.2 |
| Money laundering | 25.0 | 24.9 |
| Consumer protection | 20.7 | 22.5 |
| Applications and reporting | 10.5 | 9.9 |
| Community Reinvestment Act | 10.3 | 10.2 |
| All other | 7.5 | 5.4 |
- $3.7 billion to $5.4 billion a year: FinCEN's estimate of what banks and credit unions with a federal regulator spend on AML programs in total, from end-2024 data.[2]
- Over $6 billion a year: FinCEN's estimate of the reporting and recordkeeping part of BSA compliance alone, in aggregate.[2]
- 29% and 28% of BSA compliance cost went to verifying customers' identity and to reporting suspicious and other activity, the two costliest areas, on average across the 11 banks in GAO's review of 2018 costs.[9]
These figures measure different things in different years and samples, so compare them with care. GAO's 11 banks are not a representative sample.
Where do compliance hours go?
Compliance hours go to eight kinds of work, from alert review to keeping up with new rules. Most of the cost is people: salaries and benefits made up about three-fifths of community banks' compliance spending in CSBS's 2025 survey.[8]
Alert review and case building
Every monitoring alert has to be reviewed, and the ones that look real become cases: account history, counterparties and prior activity pulled together for a decision. More in AML transaction monitoring and SAR investigations.
SAR decisions and filing
Deciding whether to file, writing the narrative, filing through BSA E-Filing, and keeping the SAR and its supporting documentation for five years.[10] Deadlines and narratives are in SAR filing.
Currency transaction reports
A CTR is generally due within 15 days of each cash transaction over $10,000, and copies are kept for five years.[11] Filers sent FinCEN 21.5 million of them in fiscal 2025.[12] Exemptions add their own reviews.
Customer due diligence
Understanding each customer relationship well enough to build a risk profile, monitoring it, keeping customer information current on a risk basis, and knowing the beneficial owners of business customers.[5]
Fraud disputes and Regulation E
A consumer's claim of an unauthorized or incorrect electronic transfer must generally be investigated within 10 business days, or up to 45 days if the account is provisionally credited.[13]
HMDA data
Mortgage lenders that report under HMDA keep a loan/application register of 110 data fields and file it by March 1 each year.[14][15] Checking every field against the loan file is a project of its own; see HMDA reporting.
Exam preparation
Before each exam your team assembles the risk assessment, board reports, prior findings, independent testing results, training records and samples of cases and filings. For banks, the law generally requires a full-scope, on-site exam every 12 months, and lets the agencies stretch that to 18 months for qualifying banks under $6 billion; the agencies estimate 4,016 institutions may now qualify for the longer cycle.[16]
Regulatory change management
Reading each new rule, guidance and network rule, deciding whether it applies, and updating policies, procedures, systems and training by the effective date.
What FinCEN's estimate leaves out
FinCEN breaks SAR work into six stages: maintaining a monitoring system, reviewing alerts, turning alerts into cases, reviewing the case, documenting the decision, and filing. Its estimate of about 1.98 hours per SAR covers the last three. The first three, where alerts are cleared and cases are assembled, are left out because FinCEN lacks granular data on them.[17][18] Those are the stages where the gathering happens.
What changed for community banks in 2025 and 2026?
A good deal changed, though most of it is guidance and the largest change is still a proposal. The main changes that touch compliance workload, in date order:
| Change | When | What it means |
|---|---|---|
| OCC model risk clarification (Bulletin 2025-26) | Oct 6, 2025 | OCC guidance doesn't require community banks to validate models every year; frequency and scope can follow risk.[19] |
| Interagency SAR FAQs | Oct 9, 2025 | No requirement to document a decision not to file, and no separate review required after a SAR to see whether activity continued. The 90/120-day continuing-activity cadence is optional, and activity near $10,000 alone doesn't require a SAR.[20] |
| OCC community bank BSA exam procedures (Bulletin 2025-37) | Exams from Feb 1, 2026 | Examiners have discretion to rely on satisfactory independent testing, to carry forward prior conclusions on training and the BSA officer for one cycle when risk hasn't changed significantly, and to limit transaction testing.[21] |
| Beneficial ownership relief | Feb 13, 2026 | A business customer's beneficial owners are identified and verified when it first opens an account, not at every new account, unless the information looks unreliable or risk-based due diligence calls for it.[22] |
| AML/CFT program proposal | Apr 7, 2026 (proposed) | Would require effective, risk-based programs and focus enforcement on significant or systemic failures. Comments closed June 9, 2026; it isn't final.[2] |
| Interagency model risk guidance (OCC Bulletin 2026-13) | Apr 17, 2026 | Rescinds the 2021 BSA/AML model risk statement, excludes simple calculations and deterministic rule-based processes from the definition of a model, and says it is most relevant to banks over $30 billion. Generative and agentic AI are outside its scope.[23] |
| SAR confidentiality statement | Sept 2, 2026 | SAR confidentiality doesn't stop a bank from talking with customers about potentially fraudulent transactions, suspicious activity or account closures.[24] |
| 18-month exam cycle to $6 billion (interim final rule) | Effective Sept 14, 2026 | Qualifying banks under $6 billion can be examined every 18 months instead of every 12. The threshold was $3 billion.[16] |
OCC Bulletins 2025-26 and 2025-37 apply to OCC-supervised banks. The 2026 model risk guidance and the exam-cycle rule cover banks supervised by the OCC, the Federal Reserve and the FDIC; the NCUA isn't a party to either. The SAR FAQs, the beneficial ownership relief and the SAR confidentiality statement reach credit unions too.
The reporting rules themselves haven't moved: a SAR is still due 30 calendar days after initial detection (up to 60 if no suspect has been identified).[10] The SAR FAQs say they don't alter any BSA legal or regulatory requirement.[20]
Bankers have noticed the shift. In CSBS's 2026 survey, 62% of community bankers rated regulation an extremely or very important external risk, down from 75% a year earlier and 89% in the 2024 survey. Many also worried the relief may be short-lived.[7]
How to reduce compliance overhead
- Keep the risk assessment current. It decides where your hours should go. FinCEN's 2026 proposal would require a risk assessment process that reviews FinCEN's AML/CFT priorities, and says a community bank's may appropriately be more streamlined or qualitative.[2]
- Write the SAR guidance into policy. Decide where you'll stop separate post-filing reviews or fixed 90/120-day cycles, and how short a no-SAR note can be. Where you do document, the FAQs say a short, concise statement will likely suffice in most cases.[20]
- Measure the work. Count alerts, cases, handling times, disputes and filings every month. Workload data is how you show the team fits the risk, and the baseline for any automation.
- Keep exam evidence ready all year. When evidence is filed as the work happens, an exam request becomes a retrieval job.
- Track regulatory change in one inventory. Source, effective date, whether it applies, owner and sign-off, reported to the board. It's also where relief gets used: a change you haven't written into procedures saves nothing.
- Automate the gathering, not the decision. Keep a person accountable for every decision, and keep a log of what any tool did and why.
Why compliance work takes so long
Deciding is rarely the slow part. Gathering is. The evidence for one alert, dispute or exam request sits across several systems, each with its own search and export. When every item takes that long, the work gets rationed: alerts wait, reviews get sampled, and the record gets written after the fact.
- 1Core banking
- 2Transaction monitoring
- 3Case management
- 4KYC / CDD files
- 5BSA E-Filing
- 6Loan origination
- 7Email and shared drives
How AI coworkers can help
Socratix AI coworkers can take on the gathering. For each alert, dispute or request, they can pull the evidence from every system that holds it into one case, assess it against your policies, and hand your team a recommendation with the reasoning laid out. Your team still makes every call, and every step is logged for the examiner.
The work keeps growing: filers sent FinCEN 4.8 million SARs in fiscal 2025, up from 4.3 million in fiscal 2022.[12] Your team can't hire its way out of that queue. AI coworkers can do the gathering on every item, so the people you have can spend their time on the decision.
Community banks are moving that way: in CSBS's 2026 survey, 53% were piloting AI or making limited use of it in specific functions, and 59% of those using or planning it named regulatory compliance and BSA/AML monitoring.[7] Regulators have opened the door: FinCEN's 2026 proposal says institutions that responsibly experiment with innovative technologies won't face added enforcement risk solely for using them.[2]
- GatherCan pull the evidence for each alert, case, dispute or exam request — transactions, account history, due diligence, prior cases and filings — from the systems that hold it, into one case.
- AssessCan check it against your policies, your risk assessment and the typologies that apply, and watch the clocks: SAR deadlines, dispute windows, filing dates.
- RecommendCan propose the next step — close, escalate, file or ask for more — with the evidence, a plain-language reason and, when a SAR is warranted, a draft narrative. Your analyst decides.
- LearnCan learn from each decision — your policies, your risk appetite, your team's judgment — and log every step for the examiner.
Related guides
- BSA compliance The Bank Secrecy Act program: pillars, reports, records and the 2026 rule changes.
- SAR investigations From alert to case to decision: how a suspicious activity investigation runs.
- SAR filing Deadlines, the narrative, continuing activity and confidentiality for suspicious activity reports.
- HMDA reporting Who must report, the data fields, the March 1 deadline, edits and resubmission.
Compliance operations FAQ
How many compliance staff does a community bank need?
No rule sets a number. The BSA program rule requires a program the bank implements and maintains, with an individual or individuals designated to coordinate and monitor day-to-day compliance. Size the team from your own workload data: alert and case volumes, handling times, dispute counts and the pace of regulatory change.
What does the 18-month exam cycle expansion mean?
Since September 14, 2026, a bank or savings association with less than $6 billion in assets can be examined every 18 months instead of every 12 if it is well capitalized, rated 1 or 2, not under a formal enforcement action and hasn't changed control in the past 12 months, among other conditions. The threshold had been $3 billion, and the agencies estimate about 188 more institutions may now qualify. They can still examine any bank more often. It's an interim final rule from the OCC, the Federal Reserve and the FDIC, implementing a July 2026 amendment to the Federal Deposit Insurance Act, so it doesn't cover credit unions.
Will FinCEN's 2026 AML proposal lower compliance costs?
Not necessarily in total. FinCEN's own analysis expects its main effects to be reallocative: who spends, and on what, would change, but total program spending may not fall. It would focus enforcement on significant or systemic failures once a program is properly established, and, as proposed, would take effect 12 months after a final rule, which hasn't been issued.[2]
Do regulators allow AI in bank compliance programs?
Yes, with governance. In 2018 the federal banking agencies, FinCEN and the NCUA said pilot programs shouldn't by themselves draw supervisory criticism, and that AI finding activity existing processes missed won't automatically mean those processes were deficient. The April 2026 interagency model-risk guidance leaves generative and agentic AI out of its scope, and the agencies plan a request for information on AI. Expect examiners to look at oversight, testing, and who makes each decision.[25][23]
What does it cost to get BSA compliance wrong?
Most often, findings rather than fines. GAO found the federal banking agencies cited about 23% of the banks they supervise for BSA violations each year in fiscal 2015–2018 exams; only a small share involved program weaknesses that could require formal enforcement action. FinCEN's 2026 proposal would focus enforcement on significant or systemic failures once a program is properly established.[9][2]
Can a community bank outsource BSA compliance work?
Much of it. Independent testing, for example, may be done by bank personnel or an outside party. But the program stays the bank's: the 2023 interagency guidance on third-party relationships says using a third party doesn't diminish a bank's responsibility to comply, and it expects risk management across each relationship, from planning and due diligence to contract, monitoring and termination.[5][26]
Sources
- 1.Conference of State Bank Supervisors, Too Small to Scale: What 10 Years of Data Say About Community Bank Compliance Costs (CSBS survey years 2015–2024) · Nov 13, 2025
- 2.FinCEN, Anti-Money Laundering and Countering the Financing of Terrorism Programs, proposed rule, 91 FR 18704 (cost estimates at 18733–34) · Apr 10, 2026
- 3.FDIC, Quarterly Banking Profile, Second Quarter 2026 · data as of Jun 30, 2026
- 4.NCUA, Quarterly Credit Union Data Summary, 2026 Q2 · data as of Jun 30, 2026
- 5.eCFR, 31 CFR 1020.210, Anti-money laundering program requirements for banks · current
- 6.Federal Reserve Bank of St. Louis, Scale Matters: Community Banks and Compliance Costs, The Regional Economist (469 banks, 2014 data from the 2015 CSBS survey) · Jul 14, 2016
- 7.Conference of State Bank Supervisors, 2026 CSBS Annual Survey of Community Banks (330 banks under $10 billion; self-selected sample, simple averages) · 2026
- 8.Conference of State Bank Supervisors, 2025 CSBS Annual Survey of Community Banks (268 banks under $10 billion; simple averages) · 2025
- 9.GAO, Anti-Money Laundering: Opportunities Exist to Increase Law Enforcement Use of Bank Secrecy Act Reports, and Banks' Costs to Comply with the Act Varied (GAO-20-574; 11 banks, 2018 data, not generalizable) · Sept 2020
- 10.eCFR, 31 CFR 1020.320, Reports by banks of suspicious transactions · current
- 11.eCFR, 31 CFR part 1010, subpart C: 1010.311 (filing obligations for reports of transactions in currency) and 1010.306 (filing of reports) · current
- 12.FinCEN, Year in Review for FY 2025 (fiscal-year counts, all filers) · 2026
- 13.eCFR, 12 CFR 1005.11, Procedures for resolving errors (Regulation E) · current
- 14.Federal Reserve, FDIC and OCC, Designated Key HMDA Data Fields (lists the loan/application register's 110 data fields) · Oct 2017
- 15.eCFR, 12 CFR 1003.5, Disclosure and reporting (Regulation C) · current
- 16.OCC, Federal Reserve and FDIC, Expanded Examination Cycle for Certain Small Insured Depository Institutions and U.S. Branches and Agencies of Foreign Banks, interim final rule, 91 FR 58009 · Sept 14, 2026
- 17.FinCEN, SAR information collection renewal: the six stages of SAR work and the PRA burden estimate, 85 FR 31598 · May 26, 2020
- 18.FinCEN, SAR information collection renewal: 1.98 hours per SAR, 4,367,197 SARs filed in 2022, 89 FR 9913 · Feb 12, 2024
- 19.OCC, Bulletin 2025-26, Model Risk Management: Clarification for Community Banks · Oct 6, 2025
- 20.FinCEN, Federal Reserve, FDIC, NCUA and OCC, Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements · Oct 9, 2025
- 21.OCC, Bulletin 2025-37, Community Bank Minimum BSA/AML Examination Procedures · Nov 24, 2025
- 22.FinCEN, FinCEN Issues Exceptive Relief to Streamline Customer Due Diligence Requirements (relief from identifying and verifying beneficial owners at each account opening) · Feb 13, 2026
- 23.OCC, Bulletin 2026-13, Model Risk Management: Revised Guidance (with the Federal Reserve and FDIC) · Apr 17, 2026
- 24.FinCEN, FinCEN, Agencies, Issue Joint Statement on Suspicious Activity Report Confidentiality Considerations Regarding Communications with Customers · Sept 2, 2026
- 25.Federal Reserve, FDIC, FinCEN, NCUA and OCC, Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist Financing · Dec 3, 2018
- 26.Federal Reserve, FDIC and OCC, Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920 · Jun 9, 2023
This guide is general information, not legal advice.
