Bank Secrecy Act (BSA)

The Bank Secrecy Act (BSA) is the name commonly used for a group of U.S. statutes and regulations that require covered financial institutions and certain other businesses to keep specified records, file reports, and maintain controls that help authorities detect money laundering, terrorism financing, tax evasion, and other financial crime. The framework began with the Currency and Foreign Transactions Reporting Act of 1970 and has been amended many times.

The BSA does not impose one identical checklist on every financial business. Banks, broker-dealers, mutual funds, money services businesses, casinos, dealers in precious metals, and other covered sectors can have different program, reporting, registration, and recordkeeping rules.

Key Takeaways

• FinCEN administers BSA regulations in 31 CFR Chapter X, while federal and state regulators may examine or enforce compliance for institutions they supervise.
• A Currency Transaction Report generally concerns covered currency activity over USD 10,000 in a business day, including required aggregation.
• Suspicious Activity Report rules use institution-specific thresholds, categories, and timing; they are not limited to transactions over USD 10,000.
• A CTR or SAR is a regulatory report, not a judicial finding that a customer committed a crime.
• Customer identification, due diligence, beneficial-ownership, AML/CFT program, and information-sharing duties depend on the covered institution and rule.
• SARs and their existence are subject to strict confidentiality rules; customer communication must follow applicable law and policy.
• Current regulations, form instructions, exemptions, and official guidance control a filing decision.

What the BSA Framework Includes

The BSA authorizes Treasury to require records and reports considered useful for criminal, tax, regulatory, intelligence, and counterterrorism purposes. Its modern framework includes statutes, FinCEN regulations, sector-specific rules, filing instructions, exemptions, administrative rulings, and guidance.

Common obligations include:

The term “BSA/AML” is often used operationally, but the BSA is not the federal criminal money-laundering statute itself. Money-laundering offenses also appear in Title 18 of the U.S. Code.

CTR and SAR Are Different

Multiple cash transactions must generally be aggregated when the institution knows they are by or on behalf of the same person and total more than USD 10,000 in cash in or cash out during one business day. Cash deposits and withdrawals are assessed separately rather than netted.

SAR rules are different. Covered institutions apply the rule for their sector, investigate alerts, document relevant facts, and file when the applicable criteria are met. A low-value pattern can be reportable, while a large transaction can be legitimate and require only routine reporting.

Worked Example: Cash Activity and Suspicion

Assume a bank customer deposits USD 6,200 in cash at one branch and USD 5,300 at another branch for the same business on the same business day.

The bank knows both deposits are on behalf of the same business, so the cash-in total is USD 11,500. Subject to the current rules and any valid exemption, the bank generally files a Currency Transaction Report. That filing does not mean the deposits are unlawful.

Now assume the customer first asked how to avoid a report, changed a planned USD 11,500 deposit into smaller transactions, used several people, and gave inconsistent explanations. Those additional facts may warrant a suspicious-activity review for possible Structuring a Deposit. The bank should preserve evidence, apply its SAR rule, and avoid telling the customer whether a SAR was or will be filed.

The controls produce separate decisions:

1. aggregate covered cash for the CTR test;
2. determine whether an exemption applies;
3. analyze the broader pattern under the SAR rule;
4. retain supporting records and investigation evidence; and
5. continue risk-based monitoring where appropriate.

Customer and Beneficial-Ownership Controls

BSA regulations require specified covered institutions to identify customers and, for defined legal-entity accounts, obtain and verify information about relevant beneficial owners. The rules do not mean that every owner of every business account is treated identically.

An effective process distinguishes:

• the customer that opens or owns the account;
• individuals authorized to act for the customer;
• natural persons who satisfy the applicable ownership or control definition;
• intermediaries, counterparties, and beneficiaries in transactions; and
• changes that alter the customer’s expected activity or risk.

Customer due diligence supports monitoring, but identity verification alone does not establish the source of funds or prove that future transactions are legitimate.

BSA Reports and Records

The BSA framework includes more than CTRs and SARs. Depending on the person and activity, it can involve foreign-account reports, cross-border monetary-instrument reports, cash reports by trades or businesses, money-services-business registration, records for funds transfers or monetary instruments, and other filings.

Each report has its own filer, trigger, form, deadline, exemptions, and retention requirements. Businesses should not copy a bank procedure into another sector without checking that sector’s Chapter X rule.

Supporting documentation matters. FinCEN guidance says institutions must retain SAR supporting documentation and provide it to FinCEN or appropriate law-enforcement or supervisory agencies upon request under the applicable rules. The institution’s case file should explain the transactions, parties, analysis, filing decision, and source records without unsupported accusations.

Oversight and Enforcement

FinCEN is a bureau of the U.S. Treasury and administers the BSA regulatory framework. It receives and analyzes BSA data, issues rules and guidance, and can take enforcement action.

It is inaccurate to describe FinCEN as the only BSA authority. Federal banking agencies, the SEC, FINRA, the CFTC, the IRS, state supervisors, and other authorities can have examination or enforcement roles depending on the institution. Criminal matters are handled through the relevant law-enforcement and prosecutorial process.

Consequences can include remediation, supervisory findings, civil money penalties, restrictions, and criminal exposure where statutory elements are met. The legal basis and responsible authority must be identified rather than inferred from the BSA label alone.

Common Mistakes

Calling every transaction over USD 10,000 suspicious. A CTR is generally threshold-based and does not itself imply wrongdoing.

Saying SARs are filed regardless of amount. Thresholds and categories vary by institution and rule; some reportable situations can be below common thresholds.

Assuming the BSA applies identically to every financial firm. Program and reporting rules are sector-specific.

Telling a customer that a SAR was filed. SAR confidentiality requires controlled handling and escalation.

Treating customer identification as complete AML analysis. Identity, expected activity, ownership, transactions, counterparties, and changes can all matter.

Using an old form or threshold. Regulations, exemptions, filing instructions, and guidance can change.

How to Verify a BSA Requirement

1. Identify the exact legal entity and covered institution category.
2. Locate its regulations in 31 CFR Chapter X.
3. Identify the transaction, account, customer, and report involved.
4. Check thresholds, aggregation rules, exemptions, and deadlines.
5. Review current FinCEN forms, instructions, rulings, and guidance.
6. Check the relevant regulator’s examination manual or rulebook.
7. Preserve the facts, analysis, disposition, and filing evidence.

Official Sources

• FinCEN: The Bank Secrecy Act identifies the principal statutes and summarizes reporting and recordkeeping purposes.
• FinCEN: 31 CFR Chapter X organizes current BSA regulations by industry and requirement.
• FinCEN: SAR Supporting Documentation explains retention and production of records supporting a SAR.
• FFIEC BSA/AML Examination Manual provides interagency examination guidance for banks; it is not a substitute for the regulation.

Related Terms

• Anti-Money Laundering (AML): The broader system of laws and controls addressing money-laundering risk.
• Currency Transaction Report (CTR): A report for covered U.S. currency activity over the threshold.
• Know Your Customer (KYC): Customer identity and due-diligence controls used within financial compliance.
• Enhanced Due Diligence (EDD): Additional review for relationships presenting elevated risk.
• Watch List: A screening or monitoring list whose source determines its legal effect.
• Beneficial Ownership: The economic or controlling interest behind nominal ownership.

FAQs

This article provides general U.S. financial-compliance education, not legal or compliance advice. Apply the current rule, institution type, facts, forms, and official instructions to a specific decision.