A banking regulatory compliance checklist covers eight federal obligation areas: Bank Secrecy Act reporting, anti-money laundering monitoring, customer identification, fair lending and mortgage disclosures, Home Mortgage Disclosure Act data reporting, Gramm-Leach-Bliley privacy and information security, cybersecurity incident notification, and the Community Reinvestment Act. Penalties for missing the mark run from $500 for a negligent Bank Secrecy Act error to $500,000 and ten years in prison for willful violations tied to a pattern of illegal activity. Every department in the institution touches at least one of these regimes, and most touch several.
Bank Secrecy Act Reporting
The Bank Secrecy Act, codified at 31 U.S.C. § 5311, is the foundation of federal anti-money laundering enforcement in banking.1Office of the Law Revision Counsel. 31 U.S. Code 5311 – Declaration of Purpose Banks have to run risk-based programs that track large cash movements, flag unusual activity, and report both to the Financial Crimes Enforcement Network.2FinCEN.gov. The Bank Secrecy Act
Two filings do most of the work:
- Currency Transaction Report (CTR): required for any cash transaction over $10,000 in a single day, including multiple transactions by the same person that add up past that threshold.3FinCEN. Notice to Customers: A CTR Reference Guide
- Suspicious Activity Report (SAR): required when a bank detects activity that may involve fraud, money laundering, or other criminal conduct. File electronically within 30 calendar days of first identifying the suspicious facts. If no suspect can be identified, the window extends to 60 days.4FFIEC. Suspicious Activity Reporting – Overview
Deliberately breaking up transactions to duck the $10,000 threshold is a federal crime called structuring. A customer who splits a $15,000 deposit into two visits to avoid a CTR faces up to five years in prison, a fine of up to $250,000, or both. If the structuring involves more than $100,000 over twelve months or accompanies another federal offense, both the prison term and the fine double.3FinCEN. Notice to Customers: A CTR Reference Guide Banks have an independent duty not to tip off customers about reporting thresholds in ways that encourage structuring.
Customer Identification and Due Diligence
Section 326 of the USA PATRIOT Act added customer identification requirements to the BSA. Banks must have reasonable procedures to verify the identity of anyone opening an account, keep records of the information used to verify, and check whether the person appears on any government-provided lists of known or suspected terrorists.5Department of the Treasury. Financial Crimes Enforcement Network – Customer Identification Programs for Certain Banks Information collected must include name, address, and other identifying information, though the specific documents accepted can vary by account type and by how the account is opened.6Financial Crimes Enforcement Network. USA PATRIOT Act
Due diligence continues past account opening. Banks must monitor for patterns that suggest layering or moving funds through multiple accounts to disguise their origin. An effective program uses automated transaction screening calibrated to the bank’s risk profile, with human review of flagged activity before a SAR decision. The compliance officer running the program should maintain a written compliance manual, and all BSA-related records must be retained for at least five years.7Regulations.gov. FinCEN Rulemaking – BSA Recordkeeping
Filing BSA Reports Electronically
All BSA forms go through the FinCEN BSA E-Filing System. FinCEN stopped accepting paper filings in 2013.8FinCEN. Bank Secrecy Act Filing Information The system supports both individual filings and batch uploads for institutions with high CTR or SAR volume.9Financial Crimes Enforcement Network. BSA E-Filing System
After a successful submission, the system generates a confirmation page with a unique tracking ID, the date and time of submission, and the submitter’s information.10FFIEC. Appendices – Appendix T – BSA E-Filing System Archive that confirmation alongside a copy of the filed report. These records become the evidence during exams that filings were timely and complete.
Fair Lending and Mortgage Disclosures
The Truth in Lending Act (15 U.S.C. § 1601) requires lenders to give borrowers clear, standardized information about the cost of credit before they commit to a loan.11Office of the Law Revision Counsel. 15 U.S.C. 1601 – Congressional Findings and Declaration of Purpose Regulation Z splits mortgage disclosure into two pieces with different timing rules. The Loan Estimate must be delivered no later than three business days after the lender receives the borrower’s application.12eCFR. 12 CFR 1026.19 – Certain Mortgage and Variable-Rate Transactions The Closing Disclosure must reach the borrower at least three business days before closing.13Consumer Financial Protection Bureau. TILA-RESPA Integrated Disclosure FAQs Mixing up the two is one of the more common findings examiners flag.
The Equal Credit Opportunity Act (15 U.S.C. § 1691) bars creditors from discriminating against applicants based on race, color, religion, national origin, sex, marital status, or age. It also prohibits penalizing applicants whose income comes from public assistance or who have exercised their rights under consumer protection law. When a lender takes adverse action, the applicant is entitled to a written statement explaining the specific reasons.14Office of the Law Revision Counsel. 15 U.S.C. 1691 – Scope of Prohibition Vague form letters citing “insufficient credit history” without more detail do not satisfy the requirement; the notice must contain the actual reasons the application was denied.
Regulation B requires lenders to keep records of every application for 25 months after notifying the applicant of the decision, including denied applications. Business credit applications from companies with over $1 million in gross revenue have a shorter retention period of 60 days unless the applicant asks for an extension.15eCFR. 12 CFR 1002.12 – Record Retention Consumer Financial Protection Bureau enforcement can produce civil money penalties and restitution orders to affected borrowers.
HMDA Data Reporting
Banks that originate or purchase mortgage loans must collect and publicly disclose transaction-level data under the Home Mortgage Disclosure Act (12 U.S.C. § 2803).16Office of the Law Revision Counsel. 12 U.S.C. 2803 – Maintenance of Records and Public Disclosure The data includes the number and dollar amount of loans originated and applications received, broken down by census tract. HMDA data is one of the primary tools regulators and the public use to spot potential fair lending problems.
Each institution files its annual loan-application register through the CFPB’s HMDA platform. The filing must include the institution’s Legal Entity Identifier, the street address of each property, the relevant census tract, and the mortgage loan originator’s NMLS identifier. The 2026 filing season deadline for on-time submissions, covering the prior year’s data, was March 2.
Privacy and Information Security
The Gramm-Leach-Bliley Act (15 U.S.C. § 6801) creates an ongoing duty to protect the security and confidentiality of customers’ nonpublic personal information.17Office of the Law Revision Counsel. 15 U.S.C. 6801 – Protection of Nonpublic Personal Information Two operational components carry the law: privacy notices and safeguards.
On the privacy side, banks must explain what personal information they collect and whether they share it with outside parties.18Federal Trade Commission. Gramm-Leach-Bliley Act Institutions that have not changed their privacy policies and only share information under limited statutory exceptions are exempt from delivering annual notices.19Federal Register. Amendment to the Annual Privacy Notice Requirement Under the Gramm-Leach-Bliley Act – Regulation P Banks that change their sharing practices or share more broadly must still send annual notices and give customers the right to opt out.
On the security side, the FTC’s Safeguards Rule requires an information security program with administrative, technical, and physical safeguards. Customer information must be encrypted on internal systems and during transmission, with an alternative-controls option only where encryption is genuinely not feasible and approved by the institution’s Qualified Individual. Employees need security awareness training with regular refreshers, and staff with hands-on responsibility for the program need specialized, ongoing training on emerging threats.20Federal Trade Commission. FTC Safeguards Rule – What Your Business Needs to Know
Cybersecurity Incident Notification
A joint federal banking rule requires institutions to notify their primary federal regulator as soon as possible, and no later than 36 hours, after the bank forms a good-faith belief that a qualifying incident has occurred.21Federal Deposit Insurance Corporation. Computer-Security Incident Notification – Notification by Banks to Federal Regulators The trigger is not any computer security event but a “notification incident,” meaning one that has materially disrupted or is reasonably likely to materially disrupt:
- Core banking operations, where the bank can no longer deliver products or services to a significant portion of its customer base in the ordinary course of business.
- A critical business line whose failure would cause a material loss of revenue, profit, or franchise value.
- Operations whose disruption could pose a threat to the financial stability of the United States.
The 36-hour clock starts when the bank forms the good-faith belief, not when the incident first occurs. That means escalation procedures need to move incident reports from IT to senior leadership fast enough for compliance to make the notification judgment and file on time. Separately, many states impose their own deadlines for notifying affected consumers of data breaches, so parallel notification tracks are usually needed.
Community Reinvestment Act
The Community Reinvestment Act (12 U.S.C. § 2901) requires federal regulators to evaluate whether a bank is meeting the credit needs of its entire community, including low- and moderate-income neighborhoods.22Office of the Law Revision Counsel. 12 U.S.C. 2901 – Congressional Findings and Statement of Purpose Regulators weigh the CRA evaluation when a bank applies for new branches, mergers, or other deposit-facility approvals, so a poor rating can block growth plans directly.
Evaluation method depends on asset size. For examinations beginning in 2026, the thresholds are:
- Small bank: assets below $1.649 billion as of December 31 of either of the prior two calendar years.
- Intermediate small bank: assets of at least $412 million but below $1.649 billion.
- Large bank: assets of $1.649 billion or more as of December 31 of both of the prior two calendar years.23FFIEC. Community Reinvestment Act – CRA Asset-Size Thresholds
Small banks face a streamlined evaluation focused on their lending record. Large banks undergo a more comprehensive review. Any bank may elect to be evaluated under the large bank framework, but it must first collect and report at least one full year of CRA loan data. Each written evaluation includes a public section with the bank’s CRA rating, searchable through the FFIEC’s online database.24FFIEC. CRA Ratings
Penalties for Noncompliance
BSA penalties scale with severity and intent. A financial institution that negligently violates any BSA provision faces a civil penalty of up to $500 per violation. For willful violations, the cap jumps to the greater of $100,000 per transaction or $25,000.25Office of the Law Revision Counsel. 31 U.S.C. 5321 – Civil Penalties Violations involving special measures or certain anti-money laundering program requirements can reach $1,000,000 per offense.
Criminal penalties are steeper. A person who willfully violates BSA requirements faces up to $250,000 in fines, up to five years in prison, or both. If the violation is part of a pattern of illegal activity involving more than $100,000 in a twelve-month period, or accompanies another federal crime, the maximum jumps to $500,000 and ten years. Individuals convicted of BSA offenses must forfeit any profit from the violation, and officers or employees of financial institutions must repay any bonuses received during the year of the violation or the year after.26Office of the Law Revision Counsel. 31 U.S.C. 5322 – Criminal Penalties
Fair lending violations under ECOA and TILA can produce CFPB enforcement actions, class-action lawsuits, and orders requiring restitution to affected borrowers. GLBA and Safeguards Rule violations carry their own civil penalties and can lead to a loss of institutional licensing. A single failure rarely stays in one lane: a weak customer identification program can trigger BSA penalties, OFAC sanctions exposure, and reputational damage that shows up in the next CRA evaluation.