Explanation
Using self-hosted wallets, or wallets that are stored on the user's computer, is one of the tactics that may be used to finance terrorism with virtual assets such as Bitcoin. By creating many different donation addresses that are updated continuously, law enforcement will have a harder time tracing transactions. It is also important to note that using the same donation address across multiple donation campaigns and media types, as well as forming relationships with virtual asset service providers that have strong KYC processes in place, can draw attention from law enforcement and should be avoided.

According to the Anti-Money Laundering Specialist (the 6th edition) by ACAMS, an institution's anti-money laundering program should be reassessed at least annually to ensure that it is current, effective, and compliant with the applicable laws and regulations. The reassessment should include a review of the institution's risk assessment, policies and procedures, internal controls, training, and independent testing. The reassessment should also consider any changes in the institution's products, services, customers, geographic locations, or business environment that may affect its exposure to money laundering and terrorist financing risks1.
The other options are not consistent with the best practices of maintaining an up-to-date anti-money laundering program. For example:
The program should be evaluated and updated at least every six months by the Board of Directors.
While the Board of Directors has the ultimate responsibility for overseeing the institution's anti-money laundering program, it is not required to evaluate and update the program every six months. This may be too frequent and impractical, especially for large and complex institutions. The Board of Directors should, however, approve the program and any significant changes, and ensure that senior management implements and enforces the program effectively1.
The program should be reviewed by a federal law enforcement officer for gaps in controls. While federal law enforcement agencies may conduct investigations or examinations of the institution's anti-money laundering program, they are not responsible for reviewing the program for gaps in controls. This is the role of the institution's internal audit function or an external independent party, who should conduct periodic testing of the program's adequacy and effectiveness1.
The program should be sent to the institution's government regulator on a periodic basis. While the institution's government regulator may request or review the institution's anti-money laundering program as part of its supervisory or enforcement activities, the institution is not obligated to send the program to the regulator on a periodic basis. The institution should, however, report any suspicious or unusual transactions or activities to the relevant authorities, such as the Financial Crimes Enforcement Network (FinCEN) or the Office of Foreign Assets Control (OFAC)1.
References:
Anti-Money Laundering Specialist (the 6th edition) by ACAMS

According to Section 313 of the USA PATRIOT Act, U.S. financial institutions are prohibited from maintaining correspondent accounts for foreign shell banks, which are banks that have no physical presence in any country and are not affiliated with a regulated financial group. Therefore, a non-U.S. bank must provide the name and address of all shell banks that it maintains accounts for, if any, to its U.S. correspondent. This is to ensure that the U.S. financial institution does not indirectly provide services to shell banks, which pose a high risk of money laundering and terrorist financing.
According to Section 319 (b) of the USA PATRIOT Act, U.S. financial institutions that provide a correspondent account to a foreign bank must maintain records of the owners of the foreign bank and the name and address of a U.S. person who is authorized to receive service of legal process for records regarding the correspondent account. This is to facilitate the access of U.S. law enforcement authorities to information related to the correspondent account in case of an investigation or a subpoena.
The other two options, B and C, are not required by the USA PATRIOT Act, although they may be part of the due diligence or enhanced due diligence procedures that U.S. financial institutions apply to their foreign correspondent accounts, as per Section 312 of the USA PATRIOT Act.
References:
USA PATRIOT Act
FACT SHEET for Section 312 of the USA PATRIOT Act Final Regulation and Notice of Proposed Rulemaking US PATRIOT ACT CAMS Exam: USA PATRIOT Act Requirements for Opening a Correspondent Account Reference: https://www.sec.gov/about/offices/ocie/amlsourcetool.htm

According to the BSA/AML Manual1, a financial institution's board of directors and senior management are ultimately responsible for ensuring that the institution has a comprehensive and effective BSA/AML compliance program and oversight framework. This includes ensuring that the institution timely identifies, reports, and responds to suspicious activity involving its products, services, customers, or employees.
Therefore, when an anti-money laundering specialist is concerned that several suspicious transaction reports will discuss potential illegal activity of bank employees, the immediate concern for the institution is to ensure no delay in informing the board of directors and senior management of the situation, as well as the actions taken or planned to address the risks and mitigate the potential harm. The board and senior management should be kept informed of the status and outcome of any internal or external investigations, as well as any regulatory or law enforcement inquiries or actions, related to the suspicious activity involving bank employees.
References:
BSA/AML Manual1
Suspicious Activity Reporting - Overview2
Suspicious Activity Report (SAR) Basics3
What's Suspicious? Here's How Banks Apply the Smell Test4