Three dates shaped the act:
- 26 October 1970. The Currency and Foreign Transactions Reporting Act became law, with record and report duties for banks.
- 26 October 2001. The USA PATRIOT Act amended it, adding the account holder identification rule behind today's customer identification program.
- 1 January 2021. The AML Act of 2020, enacted as Division F of the fiscal year 2021 National Defense Authorization Act, rewrote the purpose clause.
Together they make the BSA the base of the US anti money laundering laws: the reports, the records and the program that each covered firm runs.
What is the Bank Secrecy Act, and what is its purpose?
The name covers several statutes. FinCEN says the 1970 act, its amendments and the related statutes "have come to be referred to as the Bank Secrecy Act (BSA)", codified at 12 U.S.C. 1829b and 1951 to 1960 and at 31 U.S.C. 5311 to 5314 and 5316 to 5336. FinCEN's rules under it fill 31 CFR Chapter X.
The purpose clause, 31 U.S.C. 5311, asks for reports or records "highly useful in" criminal, tax or regulatory investigations, risk assessments or proceedings, and in intelligence work against terrorism. Picture a bank that files a currency transaction report on a $15,000 cash deposit (illustrative): years later, that one form can show an investigator where the cash entered the banking system.
FinCEN adds that the BSA is sometimes called an anti money laundering (AML) law, or jointly "BSA/AML", which is why US banks give their programs that name. Sanctions programs run by OFAC rest on other statutes, so a sanctions check is a separate duty.
Who has to comply with the Bank Secrecy Act?
The act reaches "financial institutions" as FinCEN's rules define them, and each type has its own part of 31 CFR Chapter X, with part 1010 holding the rules they share:
- Banks (part 1020). Commercial banks, savings associations and credit unions; the bank SAR and program rules sit here.
- Casinos and card clubs (part 1021). A casino is covered once its gross annual gaming revenue exceeds $1 million (31 CFR 1010.100).
- Money services businesses (part 1022). Money transmitters, check cashers and dealers in foreign exchange among them, with a lower SAR floor than banks.
- Brokers or dealers in securities, and mutual funds (parts 1023 and 1024). Each part carries its own program and SAR sections.
- Insurance companies (part 1025). Only for the covered products the part defines.
- Futures commission merchants and introducing brokers (part 1026).
- Parts 1027 to 1031. Dealers in precious metals, stones or jewels, credit card system operators, loan or finance companies, the housing government sponsored enterprises and people involved in real estate closings.
- Investment advisers (part 1032). Covered from 1 January 2028, the date FinCEN set when it delayed the adviser rule on 2 January 2026.
Which reports does the BSA require, and when?
Table 1. The BSA's core reporting obligations and records, stage by stage (31 CFR Chapter X, as of October 2026).
| Stage | Trigger | Report and clock | Who decides |
|---|---|---|---|
| Account opening | A new customer at a bank | A customer identification program record of identity and verification | The bank, under its written CIP |
| Cash over the line | Cash in or out over $10,000 in one business day (31 CFR 1010.311) | CTR within 15 days (31 CFR 1010.306) | No judgment: the amount triggers it |
| Unusual activity | At least $5,000, alone or in aggregate, at a bank (1020.320), or $2,000 at an MSB (1022.320), where the firm knows, suspects or has reason to suspect one of the rule's grounds, such as illicit funds | SAR within 30 calendar days of initial detection; 60 at most when no suspect is identified | The firm, on its own review |
| Cash received by a business | Over $10,000 in cash in one or related transactions (31 CFR 1010.330) | Form 8300 by the 15th day after receipt (IRS rule) | The business that took the cash, not its bank |
| Foreign accounts | Aggregate value over $10,000 at any time in the calendar year (FinCEN) | FBAR by April 15, automatic extension to October 15 (FinCEN notice) | The US person with a financial interest in, or signature authority over, the accounts |
| Every record | Any record Chapter X requires | Kept five years (31 CFR 1010.430) | The firm |
The currency transaction report is mechanical: several cash transactions by or for one person count as one when they total more than $10,000 in a business day (1010.313). The suspicious activity report rests on judgment. The FBAR is a BSA report to FinCEN, separate from FATCA's Form 8938 tax filing.
FinCEN and the federal banking agencies drew the line between the first two in their SAR FAQs of 9 October 2025 (Question 1). Activity at or near the $10,000 line, without more, "is not information sufficient to require the filing of a SAR". A single $9,800 deposit (illustrative) is no SAR on its own. Splitting cash to evade the CTR, which the FAQs call structuring, is unlawful under the BSA.
The four clocks start from four different events: the cash transaction for a CTR, the day a business receives cash for a Form 8300, initial detection for a SAR and the calendar year for the FBAR. Even the rule book lags. 31 CFR 1010.306(c) still prints June 30 for the FBAR, while a 2015 statute moved the date to April 15.
What must a BSA/AML program include?
A bank's program must include, at a minimum, five elements (31 CFR 1020.210), and the board of directors approves it:
- Internal controls that assure ongoing compliance, so each report in Table 1 actually gets made.
- Independent testing by bank staff or an outside party. Banks call it the "BSA audit", and the rule sets no frequency for it.
- One or more designated individuals who coordinate and monitor compliance each day.
- Training for the staff who need it.
- Ongoing customer due diligence, risk based: the purpose of each relationship, a customer risk profile and monitoring that finds and reports suspicious transactions.
The rule gives the third element no title. US banks call that person the BSA officer or BSA/AML compliance officer.
Chapter X keeps each of those records on file for five years, retrievable within a reasonable time. complead, formerly Sanction Scanner, records alerts, dispositions, reason codes and approvals as they happen and drafts SARs from the case trail for regulatory reporting; a named person at the firm reviews and signs each report before it is sent.
Who enforces the BSA, and what are the penalties?
FinCEN, a Treasury bureau, calls itself the act's "designated administrator" in its history of the AML laws. It writes the Chapter X rules, the reports are filed with it, and its Office of Enforcement can assess civil money penalties. Examiners check each firm: the OCC, for one, examines national banks, federal savings associations and the federal branches and agencies of foreign banks for BSA compliance.
Under 31 U.S.C. 5322, a willful violation is a crime: the court can fine up to $250,000, imprison up to five years, or both. Both ceilings double, to $500,000 and 10 years, for a person also violating another US law, or whose violation is part of a pattern of illegal activity worth more than $100,000 within 12 months.
Civil penalties under 31 U.S.C. 5321 are adjusted for inflation by rule, most recently on 17 January 2025 (90 FR 5629).
In its 13 October 2026 resolution with FinCEN, Bank of America admitted that it willfully violated the BSA, and FinCEN assessed a $1.2 billion penalty. Alongside it, the OCC assessed a $750 million civil money penalty for the bank's "deficient and ineffective" BSA/AML compliance program.
FinCEN's 2026 notices on the act
FinCEN's Federal Register items this year on the program and reporting rules include:
- 1 April. FinCEN proposed a whistleblower rule for tips on BSA and sanctions violations.
- 10 April. FinCEN proposed a new program rule, with comments closed on 9 June, and an AML program rule for payment stablecoin issuers.
- 22 June. A CIP rule for those issuers was proposed.
- 14 August. FinCEN's final rule revising beneficial ownership reporting under the Corporate Transparency Act took effect on publication.
Three things to do this week:
- Name the BSA officer on file and the date the board last approved the program.
- Test the four clocks in Table 1 against the dates in the case system.
- Read the 10 April 2026 proposal against the current risk assessment.
Related terms
- Suspicious activity report. A filing to FinCEN on a transaction the firm knows or suspects is illicit.
- Currency transaction report. The report on cash over $10,000 in one business day.
- Customer identification program. The BSA rule for verifying a new bank customer's identity.
- AML compliance officer. The person who runs the AML program; in a US bank, often the BSA officer.
- USA PATRIOT Act. The 2001 law whose Title III amended the BSA.
- Corporate Transparency Act. The 2021 law behind beneficial ownership reporting to FinCEN.
How this entry was checked. Every amount and filing deadline here comes from the rule that sets it, read on 29 October 2026: 31 U.S.C. 5311, 5321, 5322 and 5323, the parts of 31 CFR Chapter X cited in Table 1, the IRS Form 8300 regulation, FinCEN's pages on the act, its history and the FBAR, its SAR FAQs of 9 October 2025 and FBAR due date notice of 6 March 2019, the OCC's BSA page, FinCEN's 13 October 2026 release on Bank of America, and the Federal Register notices of 17 January 2025 and of 2 January, 1 April, 10 April, 22 June and 14 August 2026. The definition follows FinCEN's description of the act and the wording of 31 U.S.C. 5311; the cash deposits are illustrative. The author, Onur Taner (Customer Success Manager at complead), wrote the entry, and the reviewer, Ufuk Gürdaş, Compliance Specialist, traced each figure back to its section. Last reviewed: 30 October 2026.
