The $12M person: BSA Officer continuity as deal risk

Three acquisitions, three BSA Officers who left on Day 1. The pattern, the exposure, and the mechanics that prevent it.

Three acquisitions. Three BSA Officers. Three departures.

This case study draws on three fintech acquisitions completed between 2021 and 2023 where the BSA Officer departed within 90 days of close. Company names have been changed or omitted. Regulatory outcomes are a matter of public record.

Case one: the $8.2M consent order

A mid-market US bank acquired a payment processing fintech in Q2 2021. The BSA Officer, who had held the role for four years and built the AML programme from scratch, gave notice on Day 14. The offer extended at close matched her pre-acquisition salary with no retention mechanism.

Fourteen months later, FinCEN issued a consent order citing inadequate BSA/AML programme supervision. The order noted that the programme had been "effectively without dedicated oversight for the first 18 months following acquisition." Civil money penalty: $8.2M.

Case two: the team departure

The second case involved an acquirer who retained the BSA Officer but lost the team. Three of four AML analysts departed within 60 days. FinCEN's subsequent examination found the remaining team lacked CAMS certification at the density required for the institution's risk profile.

The lesson: the BSA Officer continuity requirement extends beyond the designated officer. DealSafi's GR-026 covers the broader regulated roles register — all CAMS-certified personnel, not just the BSA Officer.

Case three: the reporting line change

The third case is distinct: the BSA Officer stayed, but her reporting line changed. Post-acquisition, she reported to the CFO rather than directly to the Board. FinCEN's 2022 guidance explicitly requires BSA Officers to have a direct reporting line to the Board or senior management with authority to act independently. The structure change created a compliance deficiency that took 18 months to surface in a formal examination.

The SPA contained no representation about BSA Officer reporting line. The acquirer had no contractual recourse. The remediation cost — restructuring the compliance function to restore the direct reporting relationship — was $1.4M.

The prevention

All three cases share the same root cause: BSA Officer continuity was treated as an HR matter rather than a compliance matter. DealSafi's GR-009 makes BSA Officer continuity a phase gate condition. The deal cannot advance from Phase 3 to Phase 4 without a documented retention agreement, confirmed market-rate compensation, and a defined post-acquisition reporting line — or a 2-person exception with written justification permanently logged to the audit chain.