November 7, 2026

Credit Union BSA Programs: Running It With Two People

Axle Team

Key takeaways

NCUA's rule sets four program minimums. A two-person team can meet all of them, but only if the BSA officer stops doing work a system or a partner can do.
Small is the norm, not the exception: NCUA counts most federally insured credit unions as small entities, with a median of five full-time staff.
Automate the high-volume, low-judgment work first: CTR aggregation, OFAC and 314(a) list matching, and first-pass alert review.
Share testing and training through a collaborative arrangement or CUSO. Do not try to share the BSA officer.

Credit union BSA compliance with a small team: what the rule actually requires

Credit union BSA compliance with a small team is achievable because the regulation sets minimums, not headcount. Under 12 CFR 748.2, every federally insured credit union needs a written, board-approved program with internal controls, independent testing, a designated BSA officer, and training. Two people can run that if the work is scoped to risk.

Here is the core text:

"Such compliance program shall at a minimum— (1) Provide for a system of internal controls to assure ongoing compliance; (2) Provide for independent testing for compliance to be conducted by credit union personnel or outside parties; (3) Designate an individual responsible for coordinating and monitoring day-to-day compliance; and (4) Provide training for appropriate personnel."
— 12 CFR 748.2(c), via LII

The same section requires that the program be written, approved by the board, and reflected in the minutes. Small teams sometimes lose an exam finding on that last clause alone.

You are not unusual. In the April 2026 interagency AML/CFT program proposal, NCUA reported that as of the third quarter of 2025, 2,553 federally insured credit unions (58.9% of those it supervises) had under $100 million in assets, and the median small credit union had five full-time equivalent employees (91 FR 18304). That proposal is not final as of this writing, so 748.2 as it stands is what examiners test against.

Split the work: who does what on a two-person team

A common failure in small programs is the BSA officer acting as analyst, filer, trainer, and policy writer at once. Segregate by decision, not by task volume.

Risk assessment and board reporting — BSA officer: Owns. BSA analyst / specialist: Supplies data. Automate or share: No.
Alert review (TM, screening) — BSA officer: Escalations and SAR decisions. BSA analyst / specialist: First-pass review. Automate or share: First pass can be automated.
CTR filing and aggregation — BSA officer: Reviews exceptions. BSA analyst / specialist: Files. Automate or share: Aggregation automated.
OFAC and 314(a) list checks — BSA officer: Clears true hits. BSA analyst / specialist: Runs searches. Automate or share: Matching automated.
SAR narrative — BSA officer: Approves and files. BSA analyst / specialist: Drafts. Automate or share: Drafting assisted.
Training — BSA officer: Sets curriculum. BSA analyst / specialist: Tracks completion. Automate or share: Shareable.
Independent testing — BSA officer: Responds to findings. BSA analyst / specialist: Supports. Automate or share: Must be independent: outsource or share.

The officer's job is judgment and accountability. Anything repeatable belongs with the analyst or a system.

What to automate first

Automate in order of volume times rule-boundness, not in order of what a vendor demoed best.

CTR aggregation. Multiple same-day cash transactions across branches and shared branching are easy to miss by hand and easy for software to catch.
Sanctions and 314(a) matching. List matching is mechanical. Human time belongs on the handful of potential matches, not the searches. Axle's sanctions screening agent, Baley, works the potential-match queue with documented rationale.
First-pass alert review. For most small credit unions the TM queue is not huge, but each alert takes real time to research. First-pass review that pulls account history, member profile, and prior alerts into one file saves the most analyst hours.
SAR narrative drafting. Drafting is assisted; filing decisions stay with the officer.

Practitioner insight: at a five-person shop, the BSA officer is often also the person members call about a held check. Before buying anything, log a week of the officer's time in 30-minute blocks. In small credit unions the bottleneck is rarely alert volume; it is context-switching. The first automation win is whatever removes the most interruptions from the officer's calendar, which is often 314(a) and OFAC clearing, not monitoring.

Sharing resources, CUSOs, and what you cannot share

The 2018 interagency statement on sharing BSA resources, which NCUA co-issued, explicitly contemplates small institutions pooling staff and tools:

"Collaborative arrangements as described in this statement generally are most suitable for banks with a community focus, less complex operations, and lower-risk profiles for money laundering or terrorist financing."
— Interagency Statement on Sharing Bank Secrecy Act Resources (Oct. 3, 2018)

"Banks" in that statement includes credit unions under the BSA definition. The statement names internal controls work, independent testing, and training as shareable. It is cautious on the BSA officer, warning that sharing one "may not be appropriate" given SAR confidentiality and the need to coordinate each institution's day-to-day compliance.

Credit union service organizations are the natural vehicle for this. Before you contract with a CUSO for BSA work, confirm the activity fits the permissible-activity list in NCUA's CUSO rule (12 CFR part 712), and paper the arrangement like any other third-party relationship: contract, board oversight, periodic performance review. Responsibility stays with your credit union regardless.

For independent testing specifically, the 2026 proposal repeats the point: banks "with less complex operations and lower risk profiles may consider utilizing a shared resource as part of a collaborative arrangement to conduct testing, as long as the testing is independent" (91 FR 18304).

NCUA exam prep for a small shop

NCUA examiners work from the FFIEC BSA/AML Examination Manual. For a two-person team, exam prep is mostly retrieval. Have these ready before the first-day letter:

Board-approved BSA program and the minutes showing approval.
Current risk assessment, with the date and the data behind it.
Independent test report, scope, and your responses to each finding.
Training records. The FFIEC manual expects documentation of "attendance records and any failures of personnel to take the required training in a timely manner, as well as any corrective actions taken" (FFIEC, BSA/AML Training).
Alert and SAR decision files, including documented decisions not to file.
Contracts and oversight records for any CUSO or shared-resource arrangement.

If you are weighing whether automation pays for itself at your size, the Axle ROI calculator models it on your own alert and CTR volumes.

FAQ

What are the NCUA BSA program requirements?

12 CFR 748.2 requires a written, board-approved BSA program with internal controls, independent testing, a designated BSA officer, and training, plus a customer identification program under 31 CFR 1020.220.

Can a small credit union share a BSA officer with another credit union?

The 2018 interagency statement says sharing a BSA officer may not be appropriate, citing SAR confidentiality and day-to-day coordination. Sharing testing, training, and internal-control work is the safer route.

Can the BSA officer perform the independent test?

No. The test must be independent of the function being tested. Small credit unions typically use an outside firm or a qualified person at another institution under a collaborative arrangement.

Run a full program without adding headcount

Axle's AI agents take first-pass alert review, screening, and SAR drafting off a small team's plate, while decisions stay with your BSA officer. See the Axle platform.

See how Axle's agents work

Axle's AI agents investigate compliance alerts and document every decision for your analysts to review.

See Axle in action

The Alert Queue

Get the next issue in your inbox

Every other Tuesday, one short read for compliance and risk teams.

Every other Tuesday. No pitches. Unsubscribe anytime.

Credit Union BSA Programs: Running It With Two People

Related reading

See how Axle's agents work

Get the next issue in your inbox

More from the blog