TL;DR: Credit union compliance software has to carry the BSA program NCUA reviews at every examination, for a membership limited by field of membership, under a board that approves the program in the minutes, with the credit union that houses the account still accountable for shared-branch activity. As of December 31, 2025, NCUA's Quarterly Credit Union Data Summary counted 4,287 federally insured credit unions, $2.43 trillion in assets, and 144.7 million members. Of those credit unions, 739 had assets greater than $500 million.
The Program NCUA Examines Every Cycle
Credit union compliance software is the set of systems a credit union uses to run its BSA program and to show how each decision was made. NCUA's BSA resources state that all credit unions must comply with BSA regulations. 12 U.S.C. § 1786(q)(2) requires NCUA to review the BSA compliance program during each examination. FinCEN administers the BSA and receives the filings. The credit union keeps the program.
12 CFR 748.2 requires a written AML/CFT program, approved by the board and recorded in the minutes, tailored to the credit union's money-laundering and terrorist-financing risk. NCUA's examiner guide lists what that program contains: internal controls, independent testing, a designated individual responsible for day-to-day compliance, training, a customer identification program, customer due diligence, and beneficial ownership procedures for legal entity customers. The five pillars of an AML program are that skeleton. Field of membership, the shape of the board, and shared branching change what the skeleton has to hold.
Four Facts That Change the Buy
Field of membership
Field of membership decides who may join and use the credit union's products. NCUA's field-of-membership page describes three federal charter types: single common bond, multiple common bond, and community. An occupational group, an association, an underserved area, and a well-defined local community are different eligibility tests. Federal credit unions need NCUA approval before the field changes, including a merger that imports another credit union's membership.
CIP asks whether the person is who they claim to be. Field of membership asks whether the charter allows that person, or that legal entity, to become a member. Employer letters, association proof, and address evidence answer the second question, and document fraud on credit union membership files is a separate control. The compliance record still stores the eligibility decision, the evidence, and the charter basis. When the field expands, the scenarios have to move with it.
A volunteer board
At a federal credit union, 12 U.S.C. § 1761(c) and 12 CFR 701.33 allow only one board officer to be compensated as an officer of the board. Other officials are not paid for the board or committee duties they were elected or appointed to perform. State-chartered credit unions follow state law on official compensation. NCUA examiners confirm that the board approved the written AML/CFT program and recorded that approval in the minutes. The examiner guide expects the board to receive foundational BSA training and notice when supervisory guidance changes.
SAR notice is the narrow part of that oversight. NCUA's examiner guide, citing 12 CFR 748.2(c)(4), requires senior management to notify the board or a designated committee promptly when a SAR is filed. Identifying details generally stay out of that report because of SAR confidentiality under 12 CFR 748.1(d)(5). The pack a director can read states the fact of the filing, the product or channel, whether the account is a repeat, and that the support is retained. The narrative stays with the BSA officer.
Shared branching
Shared branching lets a member transact at another credit union. The host processes the transaction. The credit union that houses the account keeps the BSA duty. NCUA's examiner procedures on reporting and recordkeeping state that SAR requirements apply to activity conducted through a shared branch network. A network agreement may define what information is shared about suspicious activity. The housing credit union remains responsible for the SAR. The same split applies when the agreement assigns the CTR to one party: the housing credit union still has to see that the report is filed.
Cash taken at a host credit union counts toward the $10,000 CTR threshold in 31 CFR 1010.311, due within 15 days under 31 CFR 1010.306. Monitoring limited to the home teller line misses that cash. Examiners review shared branching reports, so those reports belong in the same case as home-branch activity.
One designated officer
12 CFR 748.2(c)(3) requires the board to designate an individual to coordinate and monitor day-to-day BSA compliance. NCUA's examiner guide says examiners assess whether that officer has the knowledge, authority, independence, and resources to administer the program, and whether staffing is adequate for the transaction volume. The quarterly summary does not report BSA headcount. It does show that 739 of 4,287 federally insured credit unions had assets above $500 million, leaving 3,548 at or below that threshold.
NCUA Letter to Credit Unions 18-CU-04 (October 2018) points collaborative BSA arrangements toward institutions with a community focus, less complex operations, and a lower-risk profile. Each institution remains responsible, and sharing a BSA officer can be difficult because SARs are confidential. AML compliance solutions for community banks cover the bank-charter version of this staffing load. A credit union adds charter eligibility and shared-branch accountability, and the designation still sits with a person.
What to Demand, in This Order
Rank the tests in the order an examiner opens them: the program, the reports, who was allowed to join, then the file that proves the work.
BSA/AML monitoring and the decision to file
FinCEN § 1020.210 requires monitoring for suspicious activity across products and services, including shared-branch activity. 12 CFR 748.1 sets the thresholds examiners test: insider abuse in any amount; criminal violations aggregating $5,000 or more when a suspect can be identified; criminal violations aggregating $25,000 or more regardless of suspect; and transactions of $5,000 or more that may involve a federal crime, evade the BSA, or lack an apparent lawful purpose once the facts have been reviewed. The SAR goes through FinCEN's BSA E-Filing system within 30 days of detection, or 60 days if no suspect is identified.
For an automated alert, NCUA's guide says the detection date can be the day the alert was reviewed or the day the investigation was completed. The case should record which date the credit union used. Sound practice, in that same guide, is to document the reason for not filing, the escalation after repeat SARs, and the point at which an account is considered for closure. Community bank BSA exam preparation walks that reconstruction under a bank charter. The credit union file also shows field-of-membership eligibility and any shared-branch activity behind the decision. NCUA's guide expects the credit union to understand any automated monitoring it relies on.
Sanctions screening with a block path
OFAC obligations sit in 31 CFR Chapter V. NCUA's chartering manual expects a federal credit union to keep a policy for blocking, freezing, or prohibiting transactions with persons and countries on the Specially Designated Nationals list, and to obtain that list on a regular basis. Screening has to reach members, beneficial owners of legal-entity members, and transactions that arrive through a host branch. The list date stays on the record, next to the block, reject, or clear.
KYC, KYB, and the charter test
CIP under 12 CFR 748.2 says how identity is verified. Customer due diligence under FinCEN § 1020.210 is risk-based and ongoing. Beneficial ownership under FinCEN § 1010.230 applies when the member is a legal entity, and the policy should name who handles 314(a) requests. The membership decision and the charter basis belong on that same record.
What Stays with People
Independent testing has to be independent. The 2018 sharing statement allows one institution's personnel to test another's program, provided the tester did not write the procedures or deliver the training under review. Training under 12 CFR 748.2(c)(4) has to reach the board, senior management, and anyone whose duties require BSA knowledge, matched to the job. A completion report shows attendance. Examiners still look for whether staff know the credit union's own red flags.
Software can assemble the shared-branch activity, pull the list date, draft the chronology, and hold the detection date in one field. The officer still decides whether the activity has an apparent lawful purpose, and still faces the examiner. Compliance automation for community banks runs into the same boundary. The credit union still designates a person, still records the board's approval, and still files through FinCEN's BSA E-Filing system.
Where Sphinx Fits
Sphinx is one option for the case-work portion of this stack. Sphinx agents work inside the systems a BSA analyst already uses, review the same data, and record the reasoning on each decision so the file can be examined. Across Sphinx customers, production results include an 80% reduction in case review time and 98% of cases resolved same-day. Sphinx is SOC 2 Type II certified and GDPR compliant. Those figures describe case throughput for Sphinx customers. The designated BSA officer, the board approval in the minutes, and the housing credit union's duty to file remain in place.
Frequently Asked Questions
What should a credit union look for in compliance software?
Look for monitoring and SAR decisions with a recorded detection date, CTR aggregation that includes shared-branch cash, sanctions screening with the list date retained, CIP and beneficial ownership plus field-of-membership eligibility, and a board notice that omits SAR identifying details. The designated BSA officer still owns the program under 12 CFR 748.2.
Who files the SAR when a member uses shared branching?
The credit union that houses the account reports the suspicious activity. A network agreement may describe what information is shared, and it may assign who files the CTR. The housing credit union still confirms the CTR goes out when cash in or cash out exceeds $10,000 in a day. Examiners review shared branching reports for credit unions that participate.
How does a volunteer board oversee BSA software?
The board approves the written AML/CFT program, and the approval goes in the minutes. Directors receive foundational BSA training. When a SAR is filed, senior management notifies the board or a designated committee promptly, generally without the identifying details, under 12 CFR 748.1(d)(5).
Do credit unions and community banks need the same AML software?
Both need monitoring, screening, CIP, and a file an examiner can re-perform. A credit union also records field-of-membership eligibility and shared-branch transactions. Federal credit union boards operate under 12 CFR 701.33, so the board pack has to be readable in a meeting.
Does NCUA require a specific compliance vendor?
NCUA does not prescribe a vendor. It requires a written, board-approved program commensurate with the credit union's risk, and it reviews that program at each examination under 12 U.S.C. § 1786(q)(2). Examiners also look at whether the credit union understands the technology it uses for automated monitoring.
.png)
