CFT in banking stands for Combating the Financing of Terrorism: the body of federal laws, regulations, and internal bank controls that require financial institutions to detect and block funds moving toward terrorist organizations. In practice, it means your bank must verify who you are, screen every transaction against government watch lists, report activity that looks suspicious, and freeze any assets tied to designated terrorists. These obligations run through nearly every account a U.S. bank opens and every wire it processes.
How CFT Differs From Anti-Money Laundering
CFT is usually spoken of alongside anti-money laundering (AML), and banks run the two through overlapping compliance programs. The problems they address are not the same. Money laundering disguises the origin of illegally obtained funds so they look legitimate. Terrorist financing often runs in the opposite direction: the money starts clean. Salaries, business profits, and charitable donations can all be redirected toward terrorist operations without ever touching an illegal source.
The Treasury Department has flagged charitable organizations as particularly vulnerable, since terrorist groups can exploit nonprofits to raise funds and move support under the cover of legitimate humanitarian work.1U.S. Department of the Treasury. Anti-Terrorist Financing Guidelines: Voluntary Best Practices for U.S.-Based Charities Because the money’s source may be perfectly legal, CFT compliance forces banks to look beyond where funds came from and ask where they are going, who receives them, and what they will be used for. That forward-looking focus is what sets CFT apart from traditional AML work.
The Laws Behind CFT
The main U.S. statute is the Bank Secrecy Act (BSA), spread across Title 31 and Title 12 of the U.S. Code. The BSA requires financial institutions to keep records of certain transactions, report cash transactions over $10,000, and report suspicious activity that may indicate money laundering, tax evasion, terrorist financing, or other crimes.2FinCEN. The Bank Secrecy Act The USA PATRIOT Act, passed after September 11, 2001, expanded the BSA by adding customer identification rules and enhanced due diligence procedures aimed specifically at terrorist financing.
On the criminal side, 18 U.S.C. 2339B makes it a crime to knowingly provide material support or resources to a designated foreign terrorist organization, with a maximum of 20 years in prison, or life if someone dies. The same statute places a direct obligation on banks: any institution that becomes aware it holds funds in which a foreign terrorist organization has an interest must retain control of those funds and report them to Treasury. A bank that knowingly fails to do so faces a civil penalty of $50,000 per violation or twice the amount involved, whichever is greater.3Office of the Law Revision Counsel. 18 USC 2339B – Providing Material Support or Resources to Designated Foreign Terrorist Organizations A companion statute, 18 U.S.C. 2339A, covers material support for acts of terrorism more broadly, with a maximum of 15 years, or life if death results.4Office of the Law Revision Counsel. 18 USC 2339A – Providing Material Support to Terrorists
What Banks Actually Have to Do
Identify Every Customer
Before a bank can watch for suspicious activity, it has to know who its customers are. Section 326 of the USA PATRIOT Act requires every financial institution to run a Customer Identification Program (CIP) that verifies the identity of anyone opening an account. At minimum, the bank collects name, address, and other identifying information, and checks that person against government-provided lists of known or suspected terrorists.5Federal Register. Customer Identification Programs, Anti-Money Laundering Programs, and Beneficial Ownership
For business accounts, FinCEN’s Customer Due Diligence rule requires banks to identify and verify any individual who owns 25 percent or more of the entity, plus at least one individual who controls it.6FinCEN. Information on Complying with the Customer Due Diligence Final Rule The point is to prevent someone from hiding behind a shell company. These checks aren’t one-time events. Banks refresh customer information periodically and adjust risk profiles when transaction patterns shift.
Screen Against the SDN List
Every transaction gets screened against the Specially Designated Nationals and Blocked Persons (SDN) list, maintained by Treasury’s Office of Foreign Assets Control (OFAC). The SDN list names individuals, front companies, and other entities designated under sanctions programs, including terrorism-related designations. U.S. persons are barred from transactions with SDNs, and any property in which an SDN has an interest must be blocked.7U.S. Department of the Treasury. Specially Designated Nationals and the SDN List
Automated software compares customer names and transaction details against the list in real time. Partial matches, like sharing a common surname with a designated person, can trigger holds and delays. A match on only one component of a name does not count as a valid hit, and institutions are expected to use reasonable judgment before escalating. When a true match is confirmed, the bank must immediately freeze the associated assets and report. There is no discretion. The funds stay blocked until OFAC authorizes release.
File Suspicious Activity Reports
Beyond sanctions screening, banks run continuous monitoring for activity that doesn’t fit a customer’s established pattern. Rapid transfers to high-risk jurisdictions, deposits structured just below the $10,000 reporting threshold, and sudden spikes in wire volume are typical triggers. When review confirms the activity looks suspicious, the bank must file a Suspicious Activity Report (SAR) with FinCEN.
Deadlines are strict. A SAR must be filed within 30 calendar days of first detecting facts that could warrant a report. If no suspect has been identified by then, the bank gets another 30 days, with an outer limit of 60 days from initial detection. For situations involving terrorist financing or active money laundering, the bank must also notify law enforcement by phone immediately, in addition to filing the SAR.8Financial Crimes Enforcement Network. FinCEN SAR Electronic Filing Instructions
Two features matter here. Federal law shields banks from civil liability for filing a report, so a customer cannot sue a bank for reporting suspicious activity. And the bank is legally prohibited from telling the customer that a report was filed. No bank employee or officer, current or former, may disclose that a transaction was reported or reveal information that would tip the customer off. Government employees who learn of the report are bound by the same rule.9Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
Pass Information Along With Wire Transfers
When a bank sends a wire transfer of $3,000 or more, BSA regulations require it to pass identifying information about sender and recipient to the receiving institution. This is the Travel Rule, and it ensures a chain of identifying data follows the money between banks regardless of whether cash is involved.10FinCEN. Funds Travel Regulations: Questions and Answers Without it, a terrorist financier could route funds through intermediary banks and strip identifying details at each hop. The receiving bank uses that information to run its own screening before completing the transaction.
Penalties When Banks Get It Wrong
For willful BSA violations, a financial institution faces a civil penalty of up to $100,000 per transaction or $25,000, whichever is greater. Negligent violations carry a lower ceiling of $500, but a pattern of negligent violations can push that to $50,000.11Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties Per-violation figures compound fast when a bank processes millions of transactions.
In October 2024, TD Bank agreed to a $3.1 billion combined penalty to resolve BSA enforcement actions, with roughly $1.3 billion going to FinCEN in the largest civil penalty ever imposed on a depository institution. That figure reflects years of systemic compliance failures across millions of transactions, not a single missed report.
Individuals who willfully violate BSA requirements face up to five years in prison and a $250,000 fine. If the violation is part of a broader pattern of illegal activity involving more than $100,000 in a 12-month period, the maximum rises to 10 years and $500,000. The Anti-Money Laundering Act of 2020 added that convicted individuals must forfeit any profit from the violation, and bank officers or employees must repay bonuses received during the violation year or the year after.12Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties
What CFT Looks Like From the Customer Side
If you’ve been asked for extra identification when opening an account, had a wire delayed, or been told a transaction is “under review,” CFT rules are usually why. Banks aren’t holding things up by preference. Federal law requires them to screen every transaction and verify every customer, and the consequences of getting it wrong are severe.
The common friction points are predictable. You’ll need government-issued ID, a Social Security number, and proof of address to open any account. Business accounts require naming the individuals who own or control the entity. International wire transfers run slower because sanctions screening happens on both ends. And if your name resembles one on the SDN list, you may face a temporary hold while the bank investigates. These situations almost always resolve once the bank confirms you’re not the person listed, but the process can take days.
You won’t be notified if the bank files a SAR about your account. That silence is legally mandated, not a courtesy choice. If your account is frozen because of a confirmed OFAC match or a compliance investigation, you’ll know something is wrong, but the bank won’t explain in any real detail.
Challenging a Wrongful Flag or Blocked Account
False positives and mistaken designations do happen, and resolving them is not quick. There are two main paths.
You can apply for an OFAC license to release blocked funds. OFAC accepts electronic applications through its website and reviews each on a case-by-case basis, often consulting with other agencies. The application needs a detailed description of the underlying transaction and copies of supporting documentation. There is no formal appeal if a license is denied, though OFAC may reconsider for good cause, such as changed circumstances or new evidence.13U.S. Department of the Treasury. OFAC Licenses
If you or your business has actually been placed on the SDN list, you can file a petition for administrative reconsideration under 31 C.F.R. 501.807. The petition goes to OFAC by email and must present arguments or evidence that the designation rested on incorrect information, that you were misidentified, or that the circumstances behind the listing no longer apply. OFAC may also weigh remedial steps you’ve taken, such as severing ties with sanctioned parties or implementing compliance reforms.14eCFR. 31 CFR 501.807 – Procedures Governing Delisting From the SDN List The review is iterative, with OFAC often requesting more documentation. There is no fixed timeline, and resolution commonly takes months to over a year. If a petition is denied, judicial review is available through a federal district court lawsuit under the Administrative Procedure Act.