The Bank Secrecy Act is the main federal law the United States uses to fight money laundering, terrorist financing, and other financial crimes. Passed in 1970, it requires banks, credit unions, broker-dealers, casinos, money service businesses, and other financial entities to verify who their customers are, keep records, and report large or suspicious transactions to the government. Some of its duties fall on individuals too, particularly anyone who holds money offshore or moves cash across the border.
Cash Transaction Reports Over $10,000
When a customer makes a cash transaction of more than $10,000 in a single business day, the financial institution has to file a Currency Transaction Report (CTR) with the Financial Crimes Enforcement Network (FinCEN).1Office of the Law Revision Counsel. 31 USC 5313 – Reports on Domestic Coins and Currency Transactions Deposits, withdrawals, currency exchanges, and other physical cash movements all count. Several smaller cash transactions in a single day at the same institution get added together: the rule is designed to capture the total, not just one large transfer.
Some customers are exempt. Government agencies, publicly traded companies on major exchanges, and majority-owned subsidiaries of those companies generally qualify automatically.2FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Transactions of Exempt Persons Banks can also designate certain established private business customers as exempt, though businesses in industries like vehicle sales, real estate, gaming, pawn shops, and law or accounting practices are not eligible.
Suspicious Activity Reports
A separate report captures behavior that looks wrong even when it doesn’t hit the cash threshold. Financial institutions must file a Suspicious Activity Report (SAR) when they detect a transaction that seems to lack a legitimate purpose or that may involve money laundering, fraud, or terrorist financing.3Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority For banks the general trigger is $5,000 or more where the institution knows, suspects, or has reason to suspect something is off.4eCFR. 12 CFR 21.11 – Suspicious Activity Report Money service businesses have a $2,000 threshold for certain transactions.
The customer is never told a SAR has been filed. In exchange for that silence, federal law gives the institution and its employees a safe harbor: any party that files a SAR, whether required or voluntary, is shielded from civil liability for the disclosure and for not tipping off the person named.5Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority The protection covers former employees and contractors and applies under both federal and state law.
What Individuals Have to Report
Some obligations fall on people directly, not just on the institutions holding their money.
Foreign Accounts (FBAR)
Any U.S. person with a financial interest in or signature authority over foreign financial accounts must file a Report of Foreign Bank and Financial Accounts (FBAR) if the combined value crosses $10,000 at any point during the year. “U.S. person” includes citizens, residents, corporations, partnerships, and trusts. The report is filed electronically on FinCEN Report 114 and is due April 15, with an automatic extension to October 15 that requires no separate request.6Internal Revenue Service. Report of Foreign Bank and Financial Accounts (FBAR)
The penalties are heavy. A non-willful violation can draw a civil penalty of up to $10,000 per report (adjusted annually for inflation; the 2026 figure is higher). The U.S. Supreme Court held in 2023 that this penalty applies per unfiled report, not per account. A willful failure can bring a penalty of up to the greater of $100,000 or 50 percent of the account’s highest balance, along with possible criminal prosecution.
Carrying Cash Across the Border (CMIR)
Anyone physically carrying, mailing, or shipping more than $10,000 in currency or monetary instruments into or out of the country must file a Report of International Transportation of Currency or Monetary Instruments (CMIR).7U.S. Customs and Border Protection. Money and Other Monetary Instruments The threshold covers cash, traveler’s checks, and certain endorsed money orders. The form is filed with U.S. Customs and Border Protection at the time of transport. Failing to report, or lying on the form, can lead to seizure of the funds and criminal charges.
Structuring: The Trap for Ordinary Customers
The law makes it a crime to break up transactions into smaller amounts specifically to stay under the $10,000 CTR threshold.8GovInfo. 31 USC 5324 – Structuring Transactions to Evade Reporting Requirement Prohibited Depositing $9,500 on Monday and $9,500 on Tuesday, when you would otherwise have deposited $19,000 at once, is structuring.
The money does not have to be dirty. Even entirely legitimate funds can support structuring charges if the person intentionally split the transactions to avoid the report. A standard conviction carries up to five years in prison and a fine; if the structuring is tied to other illegal activity involving more than $100,000 in a 12-month period, the maximum climbs to ten years.8GovInfo. 31 USC 5324 – Structuring Transactions to Evade Reporting Requirement Prohibited Civil penalties can equal the full amount of the structured transactions.9Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
Customer Identification and Recordkeeping
Before opening an account, a bank must collect specific identifying information from every customer under its Customer Identification Program. At a minimum:
- Full legal name
- Date of birth for individuals
- Residential or business street address
- Taxpayer identification number — a Social Security number for U.S. persons, or a passport number, alien identification number, or other government-issued document number for non-U.S. persons
The bank then verifies the information, usually by reviewing a government-issued photo ID.10eCFR. 31 CFR 1020.220 – Customer Identification Program Requirements for Banks
For legal-entity customers like corporations and LLCs, the Customer Due Diligence rule has required banks to identify any individual owning 25 percent or more of the entity, along with anyone who controls it.11Financial Crimes Enforcement Network. Information on Complying with the Customer Due Diligence (CDD) Final Rule FinCEN issued exceptive relief in early 2026 temporarily suspending the beneficial ownership identification requirement at new account opening, so this area is in flux and institutions should check current FinCEN guidance. Due diligence continues after account opening: banks are expected to monitor activity against the customer’s profile and update their assessment when patterns shift.
Records of transactions and customer identification must be kept for at least five years and stored so law enforcement can access them within a reasonable time.12eCFR. 31 CFR 1010.430 – Nature of Records and Retention Period A separate “travel rule” applies to wire transfers of $3,000 or more: the sender’s name and address, the amount, the execution date, and the identities of both institutions must ride along with the transfer, plus the recipient’s information where available.13eCFR. 31 CFR 1010.410 – Records to Be Made and Retained by Financial Institutions Cash purchases of bank checks, cashier’s checks, money orders, and traveler’s checks between $3,000 and $10,000 also trigger recordkeeping requirements on the buyer.14eCFR. 31 CFR 1010.415 – Purchases of Bank Checks and Drafts, Cashier’s Checks, Money Orders and Traveler’s Checks
The AML Program Every Institution Must Maintain
Every covered financial institution has to build and maintain a written anti-money laundering program with four required elements:
- Written internal policies and procedures covering transaction monitoring and report filing
- A designated compliance officer with the authority and resources to run the program
- Ongoing employee training on warning signs and reporting duties
- Independent testing by an outside auditor or a separate internal unit not involved in day-to-day compliance
No regulation fixes the schedule for independent testing. Federal guidance ties frequency to the institution’s risk profile, generally every 12 to 18 months, with more frequent reviews when problems have surfaced or the compliance system has changed significantly.15FFIEC BSA/AML InfoBase. Assessing the BSA/AML Compliance Program – BSA/AML Independent Testing
Penalties for Violations
Penalties scale with intent, and they can hit both institutions and individuals.
On the civil side, negligent violations by a financial institution carry a penalty of up to $500 per violation, or up to $50,000 when the negligence is part of a pattern. Willful violations can reach the greater of $25,000 or the amount involved, capped at $100,000, and willful failure to report cross-border currency transportation can draw a penalty equal to the full unreported amount.9Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
Criminal exposure is significant. A willful violation of the reporting or recordkeeping requirements carries up to five years in prison and a fine of up to $250,000. When the violation is committed alongside another federal crime or as part of a pattern involving more than $100,000 in 12 months, the maximum doubles to ten years and $500,000.16GovInfo. 31 USC 5322 – Criminal Penalties
Who Enforces the Law
FinCEN, a bureau of the U.S. Department of the Treasury, is the primary administrator. It collects and analyzes the reports institutions file, supports law enforcement investigations, tracks trends in financial crime, and can impose penalties on institutions that fail to comply.17Financial Crimes Enforcement Network. FinCEN’s Legal Authorities
Day-to-day examinations are delegated. The IRS handles non-bank financial institutions like casinos and money service businesses.18Internal Revenue Service. 4.26.9 Examination Techniques for Bank Secrecy Act Industries The Office of the Comptroller of the Currency reviews national banks and federal savings associations.19OCC.gov. Bank Secrecy Act (BSA) and Anti-Money Laundering (AML) Examinations The FDIC covers the state-chartered banks it supervises.20FDIC. Examination Processes and Procedures Between them, these agencies build overlapping oversight across the financial system.