Pass the exam before it's scheduled.
AML, KYC, BSA — the alphabet only matters if it's translated into things your people actually do on a Tuesday.
I spent three decades on the receiving end of bank examinations — federal and state examiners, internal audit, external audit, each with their own checklists and their own coffee preferences. Here is the single most useful thing all those years taught me: the companies that pass exams aren't the ones with the thickest manuals. They're the ones where the manual and the Tuesday match.
An examiner's basic move never changes. They read your policy, then they pull a sample and check whether reality agrees with it. Policy says payment-detail changes are verified by phone; they pull ten changes and ask for the call logs. Policy says new clients are screened; they pick a client and ask to see the screening. The gap between the binder and the Tuesday is, almost by definition, the finding.
Auditors don't catch companies doing bad things, mostly.
They catch companies describing themselves inaccurately.
Most owners I work with aren't banks and never will be. But the alphabet is coming to them anyway — through their bank's questionnaires, their payment processors, their insurers, their bigger customers' vendor-compliance forms, and for some, regulators directly. If you've noticed your bank asking more questions than it used to: yes, it is, and it isn't going to stop.
The translation
Here's what the acronyms actually ask of a normal company, in plain English:
KYC — know who you're dealing with. Before money moves to or from a new counterparty, somebody spends ten minutes confirming they exist and writes down what they saw. (Note No. 2 is this entire discipline in miniature.)
AML — notice money behaving strangely. Could anyone in your shop name what "strange" looks like for your business — the customer who overpays and asks for a refund to a different account, the invoice round-tripped through a third party? Naming it is most of the job.
BSA — keep records that would let someone reconstruct what happened.Not a warehouse of paper. Just: if a serious person asked about any transaction from last year, could you tell the story with documents within a day?
The mistake I see — constantly — is buying a policy template, putting names in the blanks, and filing it. That's renting a description of someone else's company. When the questionnaire or the examiner arrives, the binder describes procedures your people have never heard of, and now the gap is in writing, with your signature on it. A thin set of procedures your team actually follows beats a thick set they've never read, every single time, in front of every audience that matters.
So: readiness, not panic. Take whatever compliance promise you've already made — to your bank, your processor, your insurer — and run the examiner's move on yourself. Read the promise, pull five real examples, see if the Tuesday matches. Where it doesn't, you've either got a procedure to simplify or a promise to rewrite. Doing this on a quiet afternoon in July is cheap. Doing it the week the exam is scheduled is not.