---
title: Bank Secrecy Act Requirements
description: An overview of the legal requirements and obligations under the Bank Secrecy Act for financial institutions.
keywords: [Bank Secrecy Act, financial institutions, anti-money laundering, currency reporting, customer identification]
category: law
---

## Overview of the Bank Secrecy Act

The Bank Secrecy Act (BSA), also known as the Currency and Foreign Transactions Reporting Act, is a United States federal law that requires financial institutions to assist government agencies in detecting and preventing money laundering.[^1] Enacted in 1970, the BSA imposes a number of recordkeeping and reporting requirements on covered financial institutions, including banks, credit unions, money services businesses, and other entities that handle large sums of currency.[^2] The primary goal of the BSA is to create a paper trail for large cash transactions that can be used by law enforcement in the investigation of financial crimes, such as tax evasion, money laundering, and the financing of terrorist activities.[^3]

## Reporting and Recordkeeping Requirements

The BSA and its implementing regulations require covered financial institutions to report certain transactions and maintain records of customer information and activity. The key reporting and recordkeeping requirements include:

1. **Currency Transaction Reports (CTRs)**: Financial institutions must file a CTR with the Financial Crimes Enforcement Network (FinCEN) for each deposit, withdrawal, exchange of currency, or other payment or transfer, by, through, or to the financial institution, that involves a transaction in currency of more than $10,000.[^4]

2. **Suspicious Activity Reports (SARs)**: Financial institutions must file a SAR with FinCEN for any transaction (or pattern of transactions) conducted or attempted by, at, or through the financial institution that involves or aggregates to $5,000 or more in funds or other assets, and the financial institution knows, suspects, or has reason to suspect that the transaction (or a pattern of transactions) (1) involves funds derived from illegal activities or is intended or conducted to hide or disguise funds or assets derived from illegal activities; (2) is designed to evade any requirements of the BSA; or (3) has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage, and the financial institution knows of no reasonable explanation for the transaction after examining the available facts.[^5]

3. **Customer Identification Program (CIP)**: Financial institutions must implement a written CIP that, at a minimum, includes procedures for verifying the identity of customers opening new accounts, maintaining records of the information used to verify the customer's identity, and determining whether the customer appears on any lists of known or suspected terrorists or terrorist organizations.[^6]

4. **Recordkeeping**: Financial institutions must maintain records of the identification information obtained through the CIP, as well as records of funds transfers, purchase of monetary instruments, and other transactions involving more than $10,000 in currency.[^7]

Failure to comply with the BSA's reporting and recordkeeping requirements can result in significant civil and criminal penalties for the financial institution and its employees.[^8]

## Customer Due Diligence and Enhanced Due Diligence

In addition to the core BSA requirements, financial institutions must also conduct customer due diligence (CDD) and, in certain circumstances, enhanced due diligence (EDD) on their customers.

CDD requires financial institutions to understand the nature and purpose of the customer relationship in order to develop a customer risk profile and monitor the customer's transactions for suspicious activity.[^9] This includes obtaining information on the customer's identity, sources of wealth and funds, and the purpose and intended nature of the account or relationship.

EDD is required for "high-risk" customers, such as foreign political figures, their family members, and close associates (collectively known as "politically exposed persons" or PEPs), as well as customers from high-risk geographic locations or engaged in high-risk activities.[^10] EDD measures may include obtaining additional information on the customer's background, source of wealth and funds, and the reasons for the proposed transactions.

Failure to conduct adequate CDD or EDD can also result in civil and criminal penalties for the financial institution.

## Anti-Money Laundering Program Requirements

The BSA also requires financial institutions to establish and maintain an effective anti-money laundering (AML) program designed to monitor and detect suspicious activity and ensure compliance with the BSA's reporting and recordkeeping requirements.[^11] The key elements of an AML program include:

1. **Internal policies, procedures, and controls**: The financial institution must develop and implement written policies, procedures, and internal controls reasonably designed to ensure ongoing BSA compliance.

2. **Designation of a compliance officer**: The financial institution must designate a qualified individual to serve as the BSA/AML compliance officer responsible for overseeing the institution's AML program.

3. **Ongoing employee training**: The financial institution must provide training for appropriate personnel on BSA requirements and how to identify and report suspicious activity.

4. **Independent testing**: The financial institution must conduct periodic independent testing of its AML program to ensure its effectiveness and compliance with the BSA.

Failure to maintain an adequate AML program can result in civil and criminal penalties, as well as regulatory enforcement actions against the financial institution.

## Enforcement and Penalties

The BSA is enforced primarily by FinCEN, which is a bureau of the U.S. Department of the Treasury, as well as other federal banking regulators, such as the Federal Reserve, the Federal Deposit Insurance Corporation, and the Office of the Comptroller of the Currency.[^12] Violations of the BSA can result in both civil and criminal penalties.

Civil penalties can include fines of up to $100,000 per violation for financial institutions and up to $50,000 per violation for individuals.[^13] Criminal penalties can include fines of up to $1 million and imprisonment of up to 10 years for willful violations.[^14] In addition, financial institutions that fail to comply with the BSA may face regulatory enforcement actions, such as cease and desist orders, civil money penalties, and the revocation of their charters or licenses.

[^1]: 31 U.S.C. § 5311 et seq.
[^2]: 31 C.F.R. § 1010.100(t).
[^3]: Ratzlaf v. United States, 510 U.S. 135, 143 (1994).
[^4]: 31 C.F.R. § 1010.311.
[^5]: 31 C.F.R. § 1020.320.
[^6]: 31 C.F.R. § 1020.220.
[^7]: 31 C.F.R. § 1010.410.
[^8]: 31 U.S.C. § 5321, 5322.
[^9]: 31 C.F.R. § 1020.210(b)(5).
[^10]: 31 C.F.R. § 1010.610.
[^11]: 31 C.F.R. § 1020.210.
[^12]: 31 U.S.C. § 5318(a).
[^13]: 31 U.S.C. § 5321(a).
[^14]: 31 U.S.C. § 5322.