The Bank Secrecy Act and AML rules explained

The Bank Secrecy Act (BSA) is the main US anti-money laundering (AML) law. Despite the name, it does not require banks to keep customer information secret. It does the reverse: it lets the Treasury Department require banks and other financial businesses to keep records and file reports that help law enforcement detect and prevent money laundering and related crimes. AML compliance in the United States is largely a matter of meeting BSA obligations.

This guide explains the law’s structure, the reports it requires, who is covered, how a compliance program is built and where to find authoritative guidance.

In brief

• The BSA is the common name for the Currency and Foreign Transactions Reporting Act of 1970, its amendments and related statutes. It is also called “BSA/AML”.
• Financial institutions must keep certain records and file reports, including reports of cash transactions over $10,000 aggregated per day.
• Institutions must report suspicious activity that may indicate money laundering, tax evasion or other crimes.
• The Financial Crimes Enforcement Network (FinCEN), a bureau of the Treasury, administers the BSA.
• Banking regulators examine banks for compliance, and violations can lead to civil and criminal penalties.

What the law is for

Criminals who earn money through fraud, drug trafficking, corruption or other offenses need to move and spend it without revealing its source. Financial institutions are the gateways for that movement. Congress responded by turning institutions into a source of information: they must record certain transactions and tell the government when they see something suspicious. The reports feed databases that investigators use to trace funds and build cases.

FinCEN describes the BSA as the authority that allows the Treasury to require financial institutions and other businesses to file reports and meet other requirements that help detect and prevent money laundering. Over the years, statutes such as the USA PATRIOT Act and the Anti-Money Laundering Act of 2020 have added requirements to the original framework.

The main requirements

Recordkeeping

Institutions must keep records of specified transactions, such as certain cash purchases of negotiable instruments like cashier’s checks and money orders. They must also retain information about funds transfers above stated thresholds and keep records long enough to meet regulatory retention periods. The rules are in Chapter X of Title 31 of the Code of Federal Regulations, which is available on the eCFR.

Currency transaction reports

A currency transaction report (CTR) is filed for cash transactions over $10,000 in a single day, counting multiple transactions by or for the same person as one. CTRs are routine and do not imply wrongdoing. Customers sometimes try to avoid them by splitting deposits into smaller amounts, a practice called structuring. Structuring is itself a federal offense, even if the money is legitimate, and it can trigger a suspicious activity report.

Suspicious activity reports

A suspicious activity report (SAR) is filed when an institution detects activity that may point to money laundering, tax evasion or other crimes. Banks have a specific filing duty under regulations that set thresholds and timelines, and other covered businesses have their own rules. Two features of SARs are worth knowing. They are confidential: an institution generally may not tell a customer that a SAR has been filed. And the institution that files in good faith receives a safe harbor from civil liability for the disclosure.

AML program

Covered institutions must establish a written AML program. Regulators generally describe the minimum elements as a system of internal controls, independent testing, a designated compliance officer and training for staff. Rules also require risk-based customer due diligence, which our guide to know-your-customer requirements covers separately.

Other reports

The BSA also covers reports of foreign bank and financial accounts filed by US persons with overseas accounts, reports of transport of currency across borders, and special measures under Section 311 of the PATRIOT Act. Different forms and agencies are involved, so the specifics depend on the activity.

Who is covered

“Financial institution” in the BSA is defined broadly. Banks and credit unions are covered, along with broker-dealers, mutual funds, futures commission merchants, introducing brokers in commodities, money services businesses, casinos and card clubs, insurance companies that issue certain products, and others. Each category has its own rule, which states what program and reporting duties apply. FinCEN’s website lists each sector’s regulations.

Some businesses are covered because of what they do rather than what they are called. A firm that transmits money for the public may be a money services business even if it does not describe itself that way. Registration with FinCEN is required for money services businesses, with limited exceptions.

How AML programs work in practice

A mature program typically has these parts.

Risk assessment. The institution identifies the products, customers, geographies and delivery channels that expose it to money laundering risk, and ranks them. The program then allocates more attention to higher-risk areas.

Customer onboarding. The institution verifies identity and, for legal entities, identifies beneficial owners, as the customer due diligence rule requires.

Transaction monitoring. Software and analysts look for patterns that deviate from a customer’s expected behavior, such as rapid movement of funds, transactions with no apparent purpose or activity inconsistent with a business profile.

Case management and reporting. Alerts are reviewed, investigated and either closed with documented reasoning or escalated into a SAR.

Sanctions screening. Although sanctions compliance is administered by the Office of Foreign Assets Control (OFAC) rather than by the BSA itself, institutions usually integrate screening into the same operations.

Governance and testing. Boards and senior management oversee the program, and an independent party tests it.

Who enforces the rules

FinCEN issues regulations and can assess civil money penalties. The federal banking agencies, including the Federal Reserve, the OCC and the FDIC, examine banks for BSA compliance and can take supervisory and enforcement actions. The IRS examines many nonbank businesses on FinCEN’s behalf. The SEC and the CFTC oversee broker-dealers and futures firms. The Department of Justice prosecutes willful violations.

Penalties can include fines, orders to improve programs, restrictions on business activities and, for individuals, criminal liability. Public enforcement actions often cite failures in transaction monitoring, SAR filing or program governance.

FinCEN guidance

FinCEN publishes regulations, advisories, rulings, FAQs and guidance to explain how rules apply. FinCEN guidance does not always carry the force of a regulation, but regulators and institutions treat it as an authoritative statement of expectations. Advisories on topics such as human smuggling, elder financial exploitation or ransomware describe red flags and ask institutions to use specific key terms in SAR narratives so that investigators can find them.

Because guidance and regulations change, practitioners should check FinCEN’s website and the eCFR for current text rather than rely on summaries, including this one.

Common misconceptions

“Banks must report every $10,000 deposit as suspicious.” A CTR is a routine report triggered by amount. A SAR is a judgment about suspicion. Different forms, different triggers.

“The BSA targets only big banks.” It applies to many sizes and kinds of businesses, with requirements scaled to risk and sector.

“Customers can ask whether a SAR was filed.” Generally no. SAR confidentiality is a core feature of the system.

“Structuring is fine if the money is clean.” Splitting transactions to avoid a report can be a crime regardless of the source of funds.

“AML and sanctions compliance are the same.” They overlap in practice but rest on different laws and agencies.

A worked example

A small business owner deposits cash from daily sales. On one day the deposits total more than $10,000 across two branches. The bank aggregates them and files a CTR. No suspicion is implied, and the owner does nothing wrong.

Later, the bank notices that the account begins receiving frequent wire transfers from unrelated parties abroad, which are quickly sent onward, and the customer cannot explain the business reason. The bank’s monitoring raises an alert. After investigating, the compliance officer decides the activity is suspicious and files a SAR within the required time. The bank does not tell the customer. FinCEN makes the report available to law enforcement agencies, which may or may not open a case.

FAQ

What does BSA stand for?

Bank Secrecy Act. It is the shorthand for the Currency and Foreign Transactions Reporting Act and related laws that form the basis of US AML regulation.

What is the cash reporting threshold?

Financial institutions file CTRs for cash transactions exceeding $10,000 in a daily aggregate. Check FinCEN for the current rule text.

Do SARs have a dollar threshold?

Thresholds depend on the type of institution and the facts. Banks have specific dollar triggers in some situations and must also report certain insider abuse regardless of amount. Check the applicable regulation.

Is a SAR an accusation of a crime?

No. It is a report of suspicious activity for investigators to evaluate. Filing does not mean wrongdoing occurred.

Where can I find the actual rules?

The BSA regulations are in 31 CFR Chapter X on the eCFR, and FinCEN’s website provides statutes, guidance and forms.