Bank Secrecy Act (BSA)

What is the Bank Secrecy Act?

The BSA, enacted in 1970 and amended many times since, is the foundation of US anti-money laundering law. Congress states its purposes in 31 U.S.C. 5311: to require reports and records that are highly useful in criminal, tax and regulatory investigations, and to prevent money laundering and terrorist financing through reasonably designed, risk-based programs at financial institutions. The Treasury's Financial Crimes Enforcement Network (FinCEN) administers it through regulations in 31 CFR Chapter X, with banks covered mainly in Part 1020 and general rules in Part 1010.

What reports does the BSA require?

Two filings define day-to-day BSA work. A currency transaction report (CTR) is required for each deposit, withdrawal, exchange or other payment or transfer involving more than $10,000 in currency (31 CFR 1010.311). It is filed with FinCEN within 15 days of the transaction (31 CFR 1010.306). Breaking up cash activity to stay under that threshold is called structuring and is a separate offense under 31 U.S.C. 5324.

A suspicious activity report (SAR) is required when a transaction conducted or attempted by, at or through a bank involves or aggregates at least $5,000 and the bank knows, suspects or has reason to suspect it involves illegal funds, is designed to evade BSA requirements, or has no apparent lawful purpose (31 CFR 1020.320). A bank files within 30 calendar days of initial detection, or up to 60 days if no suspect is identified. SARs are confidential, and a bank may not disclose one or reveal that one exists.

What records does the BSA require?

Records required by Chapter X are generally kept for five years (31 CFR 1010.430), in a form accessible within a reasonable time. Banks keep copies of each CTR and SAR and its supporting documentation for five years. For funds transfers of $3,000 or more, banks keep specified originator and payment-order information (31 CFR 1020.410), and the same threshold applies to passing that information along under the travel rule in 31 CFR 1010.410. Banks also retain records of certain extensions of credit and cross-border transfers above $10,000.

What are the pillars of a BSA/AML program?

Under 31 CFR 1020.210, a bank satisfies the program requirement of 31 U.S.C. 5318(h) with a written program that includes:

• A system of internal controls to assure ongoing compliance.
• Independent testing for compliance, by bank personnel or an outside party.
• A designated individual or individuals responsible for coordinating and monitoring day-to-day compliance, commonly called the BSA officer.
• Training for appropriate personnel.
• Risk-based procedures for ongoing customer due diligence, including understanding the nature and purpose of customer relationships and ongoing monitoring to identify and report suspicious transactions.

The program also sits alongside the customer identification program (31 CFR 1020.220) and the beneficial ownership rule for legal entity customers (31 CFR 1010.230).

How does the BSA relate to AI in compliance?

Regulators have said they welcome responsible innovation in BSA/AML compliance, including artificial intelligence, as long as banks keep meeting their obligations. AI can help with alert triage, narrative drafting and lookbacks, but filing decisions and sign-off stay with people. Our guides cover AML alert triage, SAR narrative drafting and lookback reviews.

Frequently asked questions

What is the Bank Secrecy Act in simple terms?

It is the US law that makes banks and other financial institutions keep certain records and report cash transactions over $10,000 and suspicious activity to FinCEN, so investigators can detect money laundering and terrorist financing.

What is the difference between the BSA and AML?

The BSA is the specific statute and its regulations. Anti-money laundering (AML) is the broader practice of preventing laundering, which includes BSA compliance plus related laws such as sanctions rules.

Who enforces the Bank Secrecy Act?

FinCEN administers the BSA. Federal banking regulators such as the OCC, Federal Reserve and FDIC examine banks for compliance, and violations can bring civil and criminal penalties.

What is the CTR threshold under the BSA?

A CTR is required for currency transactions of more than $10,000, filed within 15 days. Multiple cash transactions the bank knows are by or on behalf of one person are aggregated within a business day, and structuring to avoid the report is illegal.