To prevent money laundering, a financial institution has to follow the federal framework built on the Bank Secrecy Act and expanded by the USA PATRIOT Act: adopt a written AML compliance program, verify every customer’s identity, monitor accounts for suspicious activity, file the required cash and suspicious activity reports on time, and screen against U.S. sanctions lists. Knowing how to prevent money laundering is not optional guidance; it is a set of specific legal duties, and falling short can bring civil penalties in the hundreds of thousands of dollars per incident and, for willful violations paired with other illegal conduct, up to $500,000 in fines and ten years in prison.
Which Businesses These Rules Cover
The Bank Secrecy Act defines “financial institution” much more broadly than most people expect. Commercial banks, credit unions, thrift institutions, and U.S. branches of foreign banks are the obvious ones. The definition also reaches SEC-registered broker-dealers, insurance companies, money services businesses, casinos with annual gaming revenue above $1 million, dealers in precious metals or jewels, and the U.S. Postal Service.1FFIEC BSA/AML InfoBase. FFIEC BSA/AML Manual – Appendix D Statutory Definition of Financial Institution Currency exchanges, pawnbrokers, loan companies, travel agencies, vehicle dealers, and any business that transmits funds are covered as well. The Treasury Department can also designate additional business types whose cash transactions are useful for tracking criminal or tax activity.
If a business handles significant cash or moves money for customers, it likely has AML obligations. Assuming these rules apply only to banks is a common mistake that leads directly to enforcement action.
The Four Required Parts of an AML Program
Section 352 of the USA PATRIOT Act requires every covered institution to build an anti-money laundering program with four minimum components: written internal policies and controls, a designated compliance officer, an ongoing employee training program, and an independent audit function to test whether the program actually works.2FinCEN. USA PATRIOT Act All four have to be in place. An institution missing any of them is out of compliance whether or not any laundering happens.
The compliance officer needs real authority. This person owns prevention activities day to day, serves as the primary contact for regulators, and ensures every reporting deadline is met. The independent audit, usually run by an outside consultant or an internal team that reports outside the compliance function, tests the monitoring systems and identifies gaps before examiners do.
Tailoring the Program to Actual Risk
Federal regulators expect the program to match the institution’s own risk profile. A community bank serving local retail customers is not exposed to the same laundering risks as an international wire transfer business. A sound risk assessment identifies the specific categories that fit the institution’s products, services, customers, and geography, then analyzes those categories to find where exposure is greatest.3FFIEC BSA/AML InfoBase. BSA/AML Risk Assessment That analysis drives how closely different account types are monitored and which customers get extra scrutiny. There is no mandatory update schedule, but the assessment should be refreshed when the institution adds products, enters new markets, or sees meaningful shifts in its customer base.
Know the Customer Before Opening the Account
Before an account opens, the institution must collect enough information to confirm the customer is who they claim to be. That means, at minimum, full legal name, date of birth, a residential or business street address, and an identification number. For U.S. persons the identification number is a Social Security number, individual taxpayer identification number, or employer identification number. For non-U.S. persons a passport number, alien identification card number, or other government-issued document number will do.4FFIEC BSA/AML Manual. Assessing Compliance with BSA Regulatory Requirements – Customer Identification Program Verification usually involves reviewing unexpired government-issued identification such as a driver’s license or passport. This is the Customer Identification Program, and it blocks anonymous entry into the financial system.
Beneficial Owners of Legal Entities
Corporations and LLCs create layers that can hide the person actually controlling the money. Under 31 CFR 1010.230, a financial institution must identify every individual who directly or indirectly owns 25 percent or more of a legal entity customer’s equity interests, and at least one individual with significant managerial control such as a CEO, CFO, or general partner.5eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers Depending on the structure, up to four equity owners plus one control person may need to be identified and verified.
Financial institutions are also prohibited from maintaining correspondent accounts for foreign shell banks, meaning foreign banks with no physical presence in any country and no affiliation with a regulated banking group. Covered institutions have to take reasonable steps to make sure their correspondent accounts are not being used to indirectly serve such entities.6eCFR. 31 CFR 1010.630 – Prohibition on Correspondent Accounts for Foreign Shell Banks
Reporting Large Cash Transactions
Any cash transaction over $10,000 triggers a mandatory Currency Transaction Report. That includes deposits, withdrawals, currency exchanges, and other cash payments or transfers. The CTR must be filed electronically through the BSA E-Filing System within 15 calendar days of the transaction.7Financial Crimes Enforcement Network (FinCEN). FinCEN Currency Transaction Report Electronic Filing Instructions
The threshold is not viewed transaction by transaction in isolation. If the institution knows that multiple cash transactions by or on behalf of the same person total more than $10,000 in a single business day, they must be aggregated and reported as one.8FinCEN.gov. Currency Transaction Report Aggregation for Businesses with Common Ownership That aggregation rule is what makes structuring detectable.
Structuring
Structuring is deliberately breaking up cash transactions to stay under the $10,000 threshold. The textbook example is a person depositing $9,500 in cash at three different branches on the same day. Under BSA regulations, it is illegal to cause or attempt to cause a financial institution to fail to file a CTR, or to structure transactions to evade the reporting requirement.9FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Currency Transaction Reporting When a bank suspects structuring, it must file a Suspicious Activity Report on top of any CTRs the transactions themselves generated.
Exemptions
Not every large cash transaction requires a CTR. Banks, government agencies, and companies listed on major national stock exchanges (along with their majority-owned subsidiaries) qualify for automatic exemption. Other established business customers that routinely handle large cash amounts can qualify for a discretionary exemption if they have conducted at least five reportable transactions per year, have been customers for at least two months, and do not derive more than half their revenue from activities that would make them ineligible.10Financial Crimes Enforcement Network. Guidance on Determining Eligibility for Exemption from Currency Transaction Reporting Requirements
Monitoring Transactions for Red Flags
Ongoing account monitoring is where most laundering schemes are caught. Automated systems compare each transaction against the customer’s established profile and flag anything that does not fit. A retail shop that suddenly receives six-figure wire transfers from overseas entities unrelated to its supply chain stands out. So does a dormant account that abruptly starts processing high-volume transfers.
Common red flags include rapid movement of funds in and out of an account with no apparent business purpose, transactions involving jurisdictions with weak regulatory oversight, and patterns suggesting the customer is acting on behalf of an undisclosed third party. Monitoring should be calibrated to the risk assessment, with higher-risk products and customer types getting more intensive screening.3FFIEC BSA/AML InfoBase. BSA/AML Risk Assessment
The Funds Transfer Travel Rule
For wire transfers and other funds transmittals of $3,000 or more, the originating institution must include specific information that “travels” with the payment through the banking system: sender name, address, and account number, along with recipient identifying information and the receiving institution’s identity.11FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Funds Transfers Recordkeeping The rule builds an audit trail law enforcement can follow across institutions. Intermediary banks must pass the information along to the next institution in the chain.
Geographic Targeting Orders
FinCEN periodically issues Geographic Targeting Orders that impose extra reporting duties on specific industries in specific locations. The most prominent example targets all-cash real estate purchases by legal entities. Under the current order, title insurance companies must file a report when a legal entity buys residential property above certain thresholds without external financing from a lender that has its own AML obligations. Thresholds vary by location, ranging from $50,000 in some areas to $300,000 in others.12Financial Crimes Enforcement Network (FinCEN). Geographic Targeting Order Covering Title Insurance Company These orders address a well-known laundering method: shell companies buying real estate with dirty cash, then selling to produce apparently legitimate proceeds.
Filing Suspicious Activity Reports
When an institution detects activity suggesting possible money laundering, tax evasion, or other financial crimes, it must file a Suspicious Activity Report with FinCEN. For banks, the trigger is a transaction of at least $5,000 in funds where the bank knows or suspects the transaction involves proceeds of illegal activity, is designed to evade BSA requirements, or has no apparent lawful purpose.13eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
SARs are filed electronically through the BSA E-Filing System within 30 calendar days of the date the institution first detects facts that may warrant a report.14Financial Crimes Enforcement Network. Suspicious Activity Reports (SARs) If no suspect has been identified at detection, the institution gets an additional 30 days to try to identify one, but the total delay cannot exceed 60 calendar days.13eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions Ongoing laundering schemes require the institution to notify law enforcement immediately by phone in addition to filing the SAR.
Confidentiality
Tipping off the subject of a SAR is a federal violation. The institution and its employees cannot tell a customer that their activity has been reported. Internal access to SAR information should be limited to those who need it for compliance work.
Safe Harbor for Good-Faith Filings
Federal law shields institutions and employees who file SARs in good faith. Under 31 U.S.C. 5318(g)(3), the financial institution and its directors, officers, employees, and agents have broad immunity from civil liability for making the disclosure, whether the SAR was required or voluntary.15FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Suspicious Activity Reporting The protection removes the fear that reporting could expose the institution to a defamation or breach-of-contract claim from the customer.
Record Retention
After filing, the institution must keep a copy of the SAR and all supporting documentation for at least five years, stored so records can be retrieved within a reasonable timeframe during examinations or law enforcement inquiries.16eCFR. 31 CFR 1010.430 – Nature of Records and Retention Period
Sanctions Screening Through OFAC
Alongside BSA duties, every institution must avoid processing transactions involving individuals, entities, or countries subject to U.S. economic sanctions administered by the Treasury Department’s Office of Foreign Assets Control. No specific software is mandated, but the requirement not to do business with a sanctioned target or fail to block their property is absolute.17Office of Foreign Assets Control. Frequently Asked Questions In practice, institutions screen customers and transactions against OFAC’s Specially Designated Nationals and Blocked Persons list, and no transaction closes before screening is complete.
When property belonging to a sanctioned person or entity is identified, the institution must block it and report to OFAC within 10 business days.18eCFR. 31 CFR 501.603 – Reports of Blocked, Unblocked, or Transferred Blocked Property Civil penalties for sanctions violations are adjusted annually for inflation. As of 2025, the maximum civil penalty under the International Emergency Economic Powers Act, which authorizes most modern sanctions programs, is $377,700 per violation. Penalties under the Foreign Narcotics Kingpin Designation Act can reach $1,876,699.19Federal Register. Inflation Adjustment of Civil Monetary Penalties These are civil figures. Criminal prosecution for willful sanctions violations can carry far steeper consequences.
Enhanced Due Diligence for Higher-Risk Customers
Standard identification is not enough for every account. Some customer categories require enhanced scrutiny by rule. The clearest example is senior foreign political figures: current or former high-ranking government officials, senior military officers, leaders of major political parties, and top executives of government-owned businesses in foreign countries. The requirement reaches their immediate family members, close associates, and entities formed for their benefit.20FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Due Diligence Programs for Private Banking Accounts
For private banking accounts held by or for the benefit of these individuals, the institution’s due diligence program must be reasonably designed to detect transactions that may involve proceeds of foreign corruption. Beyond that mandatory category, institutions typically apply enhanced procedures to other higher-risk customer types based on their own risk assessments, such as shell companies, international business corporations, and customers operating in industries with heavy cash usage or weak regulatory environments.
Information Sharing With Law Enforcement and Peers
Section 314(a) of the USA PATRIOT Act lets law enforcement ask financial institutions to search their records for accounts or transactions connected to specific subjects of terrorism or money laundering investigations. When FinCEN transmits a request, the institution must search expeditiously and report back within the specified timeframe.21eCFR. 31 CFR Part 1010 Subpart E – Special Information Sharing Procedures To Deter Money Laundering and Terrorist Activity Information gathered this way is protected and cannot be used for other purposes.
Section 314(b) sets up a separate, voluntary framework that lets financial institutions share information with each other to identify and report potential money laundering or terrorist financing. Participating institutions get safe harbor protection for sharing customer information with other participants. Both mechanisms break down the information silos launderers exploit when they spread activity across multiple banks.
What Noncompliance Costs
Penalties run on two tracks: civil and criminal. On the civil side, inflation-adjusted penalties for willful BSA violations range from $71,545 to $286,184 per violation as of 2025. Even negligent violations carry a penalty of up to $1,430 each.22Federal Register. Inflation Adjustment of Civil Monetary Penalties The amounts are adjusted annually, and when violations span thousands of transactions over months or years, the totals compound quickly. Some banking organizations have paid civil money penalties in the hundreds of millions for systemic compliance failures.
Criminal penalties are steeper. A person who willfully violates the BSA faces up to $250,000 in fines and five years in prison. If the violation occurs alongside another federal crime or as part of a pattern of illegal activity involving more than $100,000 over 12 months, the maximum jumps to $500,000 and ten years.23Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties Individuals convicted must forfeit any profits from the violation, and financial institution employees face mandatory repayment of bonuses received during the year of the violation or the year after.
The money laundering offense itself carries even harsher consequences. Under 18 U.S.C. 1956, knowingly conducting a financial transaction with proceeds of illegal activity to promote further crime or conceal the source of the funds is punishable by up to $500,000 or twice the value of the property involved, whichever is greater, and up to 20 years in prison.24Office of the Law Revision Counsel. 18 USC 1956 – Laundering of Monetary Instruments The penalty applies to anyone involved in the transaction, not only the person whose criminal activity produced the money. For compliance officers and institutions, the line matters: facilitating laundering through negligence is a BSA violation, but knowingly participating in it is a federal felony with a 20-year ceiling.