Anti-money laundering requirements under the Bank Secrecy Act obligate covered financial institutions and certain non-bank businesses to build a written compliance program, verify customer identity, monitor and report suspicious or large cash transactions to FinCEN, screen against federal sanctions lists, and keep the supporting records for five years. The framework rests on the BSA, has been expanded by the USA PATRIOT Act and the Anti-Money Laundering Act of 2020, and carries civil fines, criminal prison terms up to ten years, and bonus clawbacks for willful failures.
Who the Rules Reach
The BSA’s definition of “financial institution” is broad.1Office of the Law Revision Counsel. 31 US Code 5311 – Declaration of Purpose It covers commercial banks, credit unions, savings associations and their holding companies, broker-dealers, mutual funds, insurance companies offering cash-value or investment products, and futures commission merchants.
The USA PATRIOT Act extended coverage to non-bank businesses that move cash or value.2FinCEN. USA PATRIOT Act Money services businesses — currency exchangers, check cashers, money transmitters, and sellers of prepaid access — carry the same core obligations as banks. Casinos with annual gaming revenue above $1,000,000 are classified as financial institutions by statute.3Office of the Law Revision Counsel. 31 US Code 5312 – Definitions and Application Dealers in precious metals, precious stones, or jewels who buy or sell more than $50,000 in covered goods a year must maintain a written AML program.4eCFR. 31 CFR 1027.210 – Anti-Money Laundering Programs for Dealers in Precious Metals, Precious Stones, or Jewels The Anti-Money Laundering Act of 2020 directed FinCEN to study whether dealers in antiquities and art should be brought in as well.5FinCEN. Anti-Money Laundering Act of 2020
The Five Program Pillars
Every covered institution must build and maintain an AML program with four elements set by statute and a fifth added by rule: internal policies, procedures, and controls; a designated compliance officer; ongoing employee training; independent testing; and customer due diligence procedures that include beneficial ownership identification.6Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority7FinCEN. Information on Complying with the Customer Due Diligence Final Rule
Written Policies and Internal Controls
Program documents must be tailored to the institution’s actual risk profile. A community bank with local depositors faces different risks than an international wire transfer service, and the written controls need to reflect that. The policies explain how staff will detect and escalate suspicious activity, meet record-keeping obligations, and apply procedures consistently. Regulators want evidence the controls function day to day, not a binder on a shelf.
BSA/AML Compliance Officer
One individual must be designated to run the program. That person needs authority, resources, and independence from revenue-generating lines. Examiners look for direct reporting to the board or senior management and for adequate staffing and technology. Understaffing the compliance function is one of the fastest ways to draw criticism.
Training and Independent Testing
Relevant employees must be trained on red flags, reporting duties, and internal procedures. Training happens on a regular schedule and is documented. New hires need it promptly; existing staff need refreshers as rules change. Independent testing is a separate obligation: a qualified third party, or an internal group with no role in compliance, evaluates whether the program is catching what it should.
Customer Due Diligence and Beneficial Ownership
The CDD rule imposes two layers. The institution must understand each customer relationship well enough to build a risk profile, and for legal entity customers it must identify and verify any individual who owns 25% or more, plus at least one individual who controls or manages the entity, such as a CEO or managing member.7FinCEN. Information on Complying with the Customer Due Diligence Final Rule Ongoing monitoring is also required, with customer information updated on a risk basis when material changes appear.
This beneficial ownership obligation at account opening is separate from the Corporate Transparency Act’s BOI reporting to FinCEN. In March 2025, FinCEN issued an interim final rule removing BOI reporting for all U.S.-formed companies, limiting it to foreign entities registered to do business in the United States.8FinCEN. FinCEN Removes Beneficial Ownership Reporting Requirements for US Companies and US Persons The CDD rule’s collection obligation at account opening did not change.
Customer Identification at Account Opening
Before opening any account, the institution must collect and verify identifying information under its Customer Identification Program. For individual customers, the minimum data points are name, date of birth, a residential or business street address (an APO/FPO box is acceptable if the person has no street address), and an identification number — a Social Security Number or other taxpayer identification number for U.S. persons, or a passport, alien identification card, or other government-issued document number for non-U.S. persons.9eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
For legal entity customers, the institution collects the entity’s legal name, physical business address, employer identification number, and formation details, then uses a beneficial ownership certification form to capture the same data points for each qualifying owner and controlling person. Information must be verified against unexpired government-issued documents, and the methods and results documented. A mismatch between the name on an identification document and the name the customer provides should be caught at intake, not during a filing.
CTRs and SARs
Two reports do the heavy lifting under the BSA: Currency Transaction Reports and Suspicious Activity Reports. They have different triggers and different judgment levels.
Currency Transaction Reports
Any transaction in currency — physical cash, not checks or wires — exceeding $10,000 triggers a CTR.10eCFR. 31 CFR 1010.311 – Filing Obligations for Financial Institutions The report is filed within 15 calendar days of the transaction through the FinCEN BSA E-Filing System.11eCFR. 31 CFR 1010.306 – Filing Obligations CTRs are mechanical. If the cash crosses $10,000, you file. Multiple transactions by or on behalf of the same person that together exceed $10,000 in a single business day also trigger the requirement.
Suspicious Activity Reports
SARs require judgment. When facts suggest a transaction involves funds from illegal activity, is designed to evade BSA requirements, or lacks a lawful purpose consistent with the customer’s profile, the institution must file. The deadline is 30 calendar days from the date suspicious activity is first detected. If no suspect has been identified at detection, the institution gets another 30 days to try, but filing cannot be delayed beyond 60 calendar days from initial detection.12eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
The institution cannot tell the customer a SAR has been filed or is being considered. Tipping off a customer can compromise a law enforcement investigation and expose the institution and its employees to liability. The filing is confidential, and supporting documentation must be available to law enforcement on request without alerting the subject.
All BSA reports are submitted electronically through FinCEN’s BSA E-Filing System, which supports individual and batch filings and returns electronic confirmation on submission.13FinCEN. Bank Secrecy Act Filing Information14Financial Crimes Enforcement Network. BSA E-Filing System
OFAC Sanctions Screening
AML compliance does not end with BSA reporting. Institutions must also screen customers, transactions, and counterparties against the Specially Designated Nationals list maintained by the Treasury Department’s Office of Foreign Assets Control. All U.S. persons, including financial institutions, are prohibited from transacting with individuals and entities on the SDN list.
Unlike SAR filing, OFAC violations can carry strict liability. An institution can face penalties for a prohibited transaction even if the violation was unintentional. Most institutions run automated screening at account opening, during periodic reviews, and whenever the list is updated. Failing to screen, or screening against an outdated list, is a common examination finding.
Record Retention
Records required under BSA regulations must be retained for five years.15eCFR. 31 CFR 1010.430 – Record Retention That covers CTR and SAR filing confirmations, CIP documentation, beneficial ownership certifications, and the supporting records behind each filed report. Records must be stored so they can be produced within a reasonable time. For CIP records, the retention clock starts when the account is closed, not when it is opened, so active long-term accounts can accumulate years of documentation that must be preserved.16FFIEC BSA/AML InfoBase. Appendix P – BSA Record Retention Requirements A gap in records creates a presumption that something was wrong, even when the underlying transactions were legitimate.
Penalties for Noncompliance
BSA penalties come in both civil and criminal forms, and they stack.
Civil Penalties
A financial institution or individual that willfully violates the BSA or its regulations faces a civil penalty of up to the greater of $100,000 or $25,000 per violation. Negligent violations are capped lower, at up to $500 per violation, or up to $50,000 for a pattern of negligent conduct. For violations of international counter-money laundering provisions, the penalty runs from two times the transaction amount up to $1,000,000.17Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties No inflation adjustment was applied for 2026, so the amounts remain at 2025 levels.
Criminal Penalties
Willful violations carry criminal fines up to $250,000 and imprisonment up to five years. When the violation occurs as part of a pattern of illegal activity involving more than $100,000 in a 12-month period, or while the person is simultaneously violating another federal law, the maximum fine doubles to $500,000 and the prison term extends to ten years.18Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties Most high-profile prosecutions land in the enhanced tier.
Enforcement actions commonly include consent orders requiring the institution to overhaul its compliance program, submit to ongoing monitoring, and sometimes restrict new account activity until regulators are satisfied. The operational cost often exceeds the fine itself.
Bonus Clawback and Whistleblower Exposure
Convicted individuals now face profit disgorgement, and any partner, director, officer, or employee of a financial institution convicted of a BSA violation must repay bonuses received during the calendar year of the violation or the following year.18Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties The AMLA also created a whistleblower program modeled on the SEC’s: when the government collects more than $1 million in monetary sanctions through a BSA enforcement action, qualifying whistleblowers are entitled to an award of between 10% and 30% of the amount collected. FinCEN issued a proposed rule in early 2026 to implement the program’s mechanics.5FinCEN. Anti-Money Laundering Act of 2020 Insiders now have a direct financial incentive to report program failures.
Residential Real Estate Reporting Is Currently Suspended
FinCEN finalized a rule that would require certain professionals involved in non-financed residential real estate closings to report information about the transaction, the buyer entity, and the beneficial owners of transferee entities.19FinCEN. Residential Real Estate Rule As of mid-2026, a federal court order has suspended enforcement. Reporting persons are not currently required to file real estate reports with FinCEN and face no liability for not doing so while the order remains in effect. The rule could take effect once the litigation resolves, so institutions and professionals touching real estate closings should watch FinCEN’s website for updates.