The Bank Secrecy Act Explained: What It Requires and How It Is Enforced

The Bank Secrecy Act (BSA) is the foundation of United States anti-money laundering (AML) law. Despite the name, it reaches well beyond banks. This guide explains what it is, how it is built, which reports it creates, and how it is enforced, using the Financial Crimes Enforcement Network (FinCEN) and the Department of Justice as sources. For accountants, the practical rules are covered in our separate guide, US AML requirements for CPAs: the BSA, Form 8300 and OFAC. This is general information, not legal advice.

What the Bank Secrecy Act is

FinCEN describes the BSA as the common name for the Currency and Foreign Transactions Reporting Act of 1970, its amendments and related statutes. It authorises the Treasury Department to impose reporting and other requirements on financial institutions and other businesses to help detect and prevent money laundering. FinCEN, a Treasury office, publishes and administers the regulations, guidance and filing information. The page notes that the BSA's provisions sit in several parts of the US Code, including 12 U.S.C. 1829b and 1951 to 1960 and 31 U.S.C. 5311 to 5314 and 5316 to 5336, and that FinCEN moved its regulations from 31 CFR Part 103 to 31 CFR Chapter X on 1 March 2011.

The Department of Justice's criminal resource manual, an archived page that may be out of date, describes two parts. Title I deals with record retention by financial institutions. Title II, re-enacted in 1982 as 31 U.S.C. 5311 to 5322 under the title "Records and Reports on Monetary Instruments Transactions", deals with reporting. The USA PATRIOT Act and the Anti-Money Laundering Act of 2020 are listed by FinCEN as related resources, but we did not read what each changed, so this guide does not describe them.

What the BSA requires

According to FinCEN, the core obligations are:

• keeping records of cash purchases of negotiable instruments;
• filing Currency Transaction Reports (CTRs) for cash transactions above $10,000 in a daily aggregate amount; and
• filing Suspicious Activity Reports (SARs) on activity that may indicate money laundering, tax evasion or other crimes.

FinCEN's page also lists registration of money transmitting businesses, reports on coins and currency received in nonfinancial trades or businesses, and beneficial ownership information reporting among the statutes' subjects. The beneficial ownership reporting rules have changed. Our guide to FinCEN ending beneficial ownership reporting for US companies explains the position and its effect on know-your-customer work. The DOJ page adds that financial institutions must keep certain records for up to five years.

The main reports and who files them

FinCEN's forms and filing page lists the following, all filed electronically through BSA E-Filing since 1 April 2013:

• CTRs, filed by financial institutions (31 CFR 1010.311) and, separately, by casinos and card clubs (31 CFR 1021.311).
• SARs, filed by banks (31 CFR 1020.320), securities and futures firms, casinos and card clubs, and money services businesses (31 CFR 1022.320).
• Money services business registration (31 CFR 1022.380).
• The Report of International Transportation of Currency or Monetary Instruments (FinCEN Form 105), for transporting more than $10,000 into or out of the United States (31 CFR 1010.340).
• Form 8300, filed by any person in a trade or business that receives more than $10,000 in cash in one transaction or related transactions (31 CFR 1010.330). This is the form most likely to touch an accounting practice.
• The Report of Foreign Bank and Financial Accounts (FBAR), for US persons whose foreign accounts exceed $10,000 in aggregate at any time in the year (31 CFR 1010.350).

FinCEN's page does not give filing deadlines, so check the regulation for each form before relying on a date.

How the BSA is enforced

FinCEN's page lists the enforcement tools in the statute: civil penalties (31 U.S.C. 5321), criminal penalties (31 U.S.C. 5322), injunctions (31 U.S.C. 5320), a ban on structuring transactions to evade reporting (31 U.S.C. 5324), bulk cash smuggling (31 U.S.C. 5332), search and forfeiture of monetary instruments (31 U.S.C. 5317), and whistleblower incentives and protections (31 U.S.C. 5323). The page does not state penalty amounts, and neither do we, because the figures are adjusted over time.

The DOJ page says FinCEN handles civil enforcement and the Department of Justice prosecutes criminal violations, and recommends considering the money laundering offences in 18 U.S.C. 1956 and 1957 alongside the BSA where they apply. For the information-sharing provisions that FinCEN runs with financial institutions, see our guide to FinCEN sections 314(a) and 314(b).

What we could not confirm

• The current text of the AML programme and customer due diligence requirements for each type of institution.
• Current civil and criminal penalty amounts.
• What the USA PATRIOT Act and the Anti-Money Laundering Act of 2020 each added.
• Filing deadlines for each form.

Suggested next steps

These are our suggestions, not requirements. Work out whether your business is a "financial institution" under FinCEN's rules or only a trade or business that files Form 8300. Keep a note of which of the reports above you could ever be asked to file. For team training on AML, see our CPD courses.

Frequently asked questions

Is the Bank Secrecy Act only for banks?

No. FinCEN says it applies to financial institutions and other businesses, and Form 8300 applies to any person in a trade or business that receives more than $10,000 in cash.

What is the cash reporting threshold?

Currency Transaction Reports are for cash transactions above $10,000 in a daily aggregate amount, according to FinCEN.

Who enforces the Bank Secrecy Act?

FinCEN handles civil enforcement and the Department of Justice prosecutes criminal violations, according to the DOJ's archived overview.