What Is the Bank Secrecy Act? Reporting Rules and Penalties

The Bank Secrecy Act is the 1970 federal statute — formally the Currency and Foreign Transactions Reporting Act — that requires banks and a range of other financial businesses to keep records, verify customers, and file reports with the government to help detect money laundering, tax evasion, and terrorist financing.¹ Compliance duties fall into a handful of categories: an anti-money laundering program, currency and suspicious activity reports, customer identification, and foreign account reporting. Penalties run from a few hundred dollars for a negligent slip to 10 years in federal prison for a willful violation.

Who Has to Comply

The regulatory definition of “financial institution” at 31 CFR 1010.100 reaches well past traditional banks. It covers securities brokers and dealers, money services businesses (money transmitters, check cashers, and currency exchangers), casinos with more than $1 million in gross annual gaming revenue, card clubs, futures commission merchants, introducing brokers in commodities, mutual funds, and entities supervised by federal or state bank regulators.²

The underlying statute reaches further still. Insurance companies are named as financial institutions in the statute itself, and dealers in precious metals, precious stones, or jewels have their own set of BSA program rules.³ The BSA also imposes an individual filing duty on any U.S. person with foreign financial accounts above a threshold, discussed below.

The Anti-Money Laundering Program

Every covered financial institution must build and maintain a written anti-money laundering (AML) program. Under 31 U.S.C. 5318(h), the program must include four pillars at a minimum:⁴

Internal policies, procedures, and controls that spell out how the institution identifies, monitors, and reports suspicious activity.
A designated compliance officer with day-to-day responsibility for BSA compliance.
Ongoing employee training so frontline staff and management can recognize red flags and know their reporting duties.
Independent testing, performed by someone outside the compliance team, to evaluate whether the program actually works.

Examiners look at all four during regulatory reviews. An institution that files every report on time but has no written procedures, or hasn’t trained its staff in two years, is still out of compliance.

Currency Transaction Reports

A financial institution must file a Currency Transaction Report (CTR) for any cash transaction, or set of related cash transactions, exceeding $10,000 in a single business day. That covers deposits, withdrawals, and currency exchanges involving physical cash or coin, whether one customer brings in a single sum or conducts several transactions that add up past the threshold.⁵ The institution collects the customer’s identification, including a Social Security number and government-issued ID, and files the CTR electronically with FinCEN within 15 calendar days of the transaction.⁶ Intent doesn’t matter. A customer’s innocent explanation for the cash does not remove the filing obligation.

Some routine cash activity is exempt. Banks can designate certain customers as “exempt persons” and skip the CTR for their regular cash transactions. Phase I exemptions are automatic and cover other banks, government agencies, and companies listed on major stock exchanges (with their majority-owned subsidiaries). Phase II exemptions cover non-listed commercial businesses and payroll customers that regularly handle large amounts of cash and have held an account at the bank for at least two months, with annual review required and several industries ineligible, including real estate, gaming, law, accounting, vehicle sales, and pawn brokerage.⁷

Customer Identification at Account Opening

Section 326 of the USA PATRIOT Act requires every bank to run a Customer Identification Program (CIP) as part of opening any new account.⁸ Before opening the account, the bank collects at minimum the customer’s full legal name; date of birth (for individuals); a residential or business street address, or the principal place of business for entities; and an identification number, which for U.S. persons is a taxpayer identification number and for non-U.S. persons can be a passport number, alien identification card number, or another government-issued document number.⁹ The bank then verifies the information, usually against a government-issued photo ID such as a driver’s license or passport.

Suspicious Activity Reports

Beyond automatic CTR filings, institutions have to monitor customer behavior and file a Suspicious Activity Report (SAR) when a transaction lacks any lawful purpose or legitimate business explanation. For banks, a SAR is required when the suspicious transaction involves $5,000 or more and the bank knows or has reason to suspect that the funds come from illegal activity, that the transaction is designed to evade BSA reporting, or that it has no apparent economic rationale.¹⁰

Once suspicious activity is detected, the SAR must be filed within 30 calendar days. If no suspect has been identified by then, the institution gets an additional 30 days to investigate, but filing cannot be delayed beyond 60 days from initial detection.¹¹ SARs are confidential; the institution cannot tell the customer a report has been filed.

Structuring Is Its Own Crime

Breaking up a cash transaction to stay under the $10,000 CTR threshold is not just a red flag for the bank. It is independently illegal for the customer. Under 31 U.S.C. 5324, it is a crime to structure or assist in structuring any transaction to evade BSA reporting requirements, including causing an institution to fail to file a required report, causing it to file a report with material errors, or breaking up transactions to duck the threshold.¹² Someone who makes four $3,000 deposits over a week specifically to avoid a CTR has committed a federal offense, even if the money itself is clean.

Foreign Account Reporting (FBAR)

The BSA also reaches individuals who bank overseas. A U.S. person with a financial interest in, or signature authority over, foreign financial accounts whose aggregate value exceeds $10,000 at any time during the calendar year must file FinCEN Form 114, the FBAR.¹³ Reportable accounts include foreign bank accounts, brokerage accounts, and mutual funds. Whether the account produces taxable income is irrelevant; the trigger is the account value.

Non-willful FBAR violations carry a civil penalty of up to $10,000 per account per year under the statute. Willful violations jump to the greater of $100,000 or 50 percent of the account balance at the time of the violation.¹⁴ With inflation adjustments, the non-willful cap is roughly $16,500 and the willful cap exceeds $165,000 per violation as of the 2025 figures, which remain in effect for 2026.¹⁵ The numbers compound quickly for someone with multiple unreported accounts over several years.

Recordkeeping

Covered institutions must retain BSA-mandated records — CTRs, SARs, CIP documentation, and supporting transaction data — for at least five years, stored so they can be produced within a reasonable time on request from regulators or law enforcement.¹⁶ “We filed it but can’t find it” is not a defense examiners accept.

Civil Penalties

FinCEN enforces the BSA through a tiered civil penalty structure that turns on whether the conduct was negligent or willful. Congress has required annual inflation adjustments since 2015, and no new adjustment was issued for 2026, so the amounts effective January 2025 remain current.

Negligent Violations

An institution that negligently fails to comply faces a statutory penalty of up to $500 per violation, with an additional penalty of up to $50,000 for a pattern of negligence on top of the per-violation fines.¹⁴ After inflation adjustments, the per-violation cap is approximately $1,430 and the pattern-of-negligence cap exceeds $111,000.¹⁵

Willful Violations

Willful violations carry much harsher consequences. The statute sets the civil penalty at the greater of $25,000 or the amount of the transaction, with the transaction-based figure capped at $100,000.¹⁴ After inflation adjustments, the effective range runs from roughly $71,500 to $286,000 per violation.¹⁵ Violations of special due diligence requirements or prohibitions on correspondent accounts for shell banks can carry penalties exceeding $1.7 million per incident. Both the institution and individual employees, including compliance officers and branch managers, can face civil liability.

Criminal Penalties

Criminal prosecution is reserved for willful violations. A person who willfully violates BSA requirements faces up to $250,000 in fines, up to five years in federal prison, or both.¹⁷

If the violation happens while the person is also breaking another federal law, or as part of a pattern of illegal activity involving more than $100,000 within a 12-month period, the maximum penalties double to up to $500,000 in fines and up to 10 years in prison.¹⁷ Structuring charges carry the same criminal exposure as other willful BSA offenses. Criminal liability reaches individuals, not only institutions, and compliance officers and executives who knowingly looked the other way are regularly named as defendants.

1
Internal Revenue Service. Bank Secrecy Act
2
eCFR. 31 CFR 1010.100 – General Definitions
3
eCFR. 31 CFR Part 1027 – Rules for Dealers in Precious Metals, Precious Stones, or Jewels
4
Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
5
Financial Crimes Enforcement Network. Notice to Customers: A CTR Reference Guide
6
FFIEC BSA/AML InfoBase. Currency Transaction Reporting
7
eCFR. 31 CFR 1020.315 – Transactions of Exempt Persons
8
Financial Crimes Enforcement Network. USA PATRIOT Act
9
eCFR. 31 CFR 1020.220 – Customer Identification Program
10
FFIEC BSA/AML InfoBase. Suspicious Activity Reporting
11
eCFR. 12 CFR 208.62 – Suspicious Activity Reports
12
Office of the Law Revision Counsel. 31 USC 5324 – Structuring Transactions to Evade Reporting Requirement Prohibited
13
Internal Revenue Service. Report of Foreign Bank and Financial Accounts (FBAR)
14
Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
15
eCFR. 31 CFR 1010.821 – Penalty Adjustment and Table
16
eCFR. 31 CFR 1010.430 – Nature of Records and Retention Period
17
Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties