US AML Requirements for CPAs: Form 8300, OFAC and the BSA

If you work in a US accounting firm, you may have heard that anti-money laundering (AML) rules do not really apply to CPAs. That is partly true and partly misleading. CPA firms are not, as a category, required to run the full AML program that banks and broker-dealers must run. But specific laws still reach accountants: the cash reporting rule on IRS Form 8300, sanctions rules enforced by the Office of Foreign Assets Control (OFAC), and criminal money laundering and structuring laws that apply to anyone. This guide explains what applies to a US CPA today, what does not, and what to build into your firm's procedures. It is general information, not legal advice.

Are CPAs covered by the Bank Secrecy Act?

The Bank Secrecy Act (BSA) is the main US AML law, and it is enforced through the Financial Crimes Enforcement Network (FinCEN). It places AML program, customer identification and suspicious activity reporting duties on "financial institutions" such as banks, broker-dealers, money services businesses and casinos. Public accounting firms are not on that list in the way that banks are, so a CPA firm does not have to file Suspicious Activity Reports (SARs) or adopt a formal BSA/AML program simply because it is a CPA firm.

That has been a live policy question for years. In 2022, for example, the House adopted language in the ENABLERS Act proposal that would have extended Bank Secrecy Act duties to people who provide accounting or legal services connected with entity formation, trust services or third-party payments, according to law firm Arnold & Porter. We have not found evidence that this extension has become law, so check FinCEN's website for the latest position before you rely on this page. If the rules change, firms that already have good client due diligence in place will be well placed.

Even where no rule forces a CPA to file a SAR, there are good reasons to behave as if you were exposed. Professional standards on integrity and objectivity, the risk of being used to launder money unknowingly, and the possibility of criminal liability if a firm knowingly assists a transaction involving criminal proceeds all point the same way.

Form 8300: reporting large cash payments

The rule most likely to touch a CPA firm is the requirement to report cash. Under the IRS's Publication 1544, anyone in a trade or business who receives more than $10,000 in cash in one transaction, or in related transactions, must file Form 8300 with the IRS. The IRS lists businesses such as attorneys, real estate brokers and dealers as examples. It does not name accountants in that list, but the rule applies to any trade or business, so an accounting firm that receives a large cash payment from a client is covered.

Key points from the IRS publication:

• What counts as cash. US and foreign currency always count. Cashier's checks, bank drafts, traveler's checks and money orders can count as cash in certain situations. Personal checks do not.
• Related payments are combined. Payments within a 24-hour period are treated together, and payments more than 24 hours apart can be combined if they are part of a connected series. Installment payments are totaled over a 12-month period.
• Deadline. File within 15 days after the payment that takes the total over $10,000. You must also give the payer a written or electronic statement by 31 January of the following year, and keep a copy of each form for five years.
• Structuring is a crime. Breaking up cash payments to avoid a report, or helping a client do so, can bring criminal penalties. The IRS publication warns about this directly.

The IRS says a firm may be able to file electronically through FinCEN's BSA E-Filing System. Penalty amounts are adjusted over time, so confirm the current figures on irs.gov rather than relying on older guides. The IRS publication is dated 2014, although the page was last reviewed in 2026, so always check the latest IRS instructions for Form 8300.

OFAC sanctions apply to every US person

Unlike the BSA, US sanctions law has no exemption for accountants. OFAC administers sanctions that prohibit US persons from dealing with listed individuals, entities and, in some programs, whole jurisdictions. Sanctions liability is generally strict, which means a firm can breach the rules without knowing, for example by accepting a payment or providing services for a client owned by a sanctioned person. A practical sanctions screen at client onboarding, repeated when ownership changes, is the simplest control. Our guide to sanctions screening for accountants explains how to set one up.

Beneficial ownership: what changed with the Corporate Transparency Act

Many CPA firms advise clients on entity formation and used to help them file beneficial ownership reports under the Corporate Transparency Act (CTA). On 21 March 2025 FinCEN issued an interim final rule that exempted all domestic companies and US persons from CTA reporting, leaving only foreign entities registered to do business in the US in scope, according to a National Law Review summary. FinCEN said it planned to issue a final rule later, so confirm the current status on FinCEN's site. Whatever happens with the filing rule, knowing who owns and controls a client is still basic good practice. See our guide to ultimate beneficial ownership for accountants.

Investment advisers and FinCEN's delayed rule

CPAs who also run or work for SEC-registered investment advisers or exempt reporting advisers should note that FinCEN adopted a rule in August 2024 that would bring these advisers into the BSA framework. The effective date was originally 1 January 2026. Treasury announced a delay in July 2025, and FinCEN's order of 5 August 2025 exempted covered advisers until 1 January 2028 while it revisits the rule, according to law firm Crowell. Advisers should keep watching for the revised text.

What a sensible CPA firm AML procedure looks like

Even without a legal obligation to file SARs, most firms benefit from a short written procedure. A workable version covers six areas:

• Client acceptance. Identify the client and the real owners, understand the purpose of the engagement, and decline work you cannot explain.
• Risk flags. Complex ownership with no clear reason, unexplained cash, payments from third parties, high-risk jurisdictions and requests to move money through the firm's accounts are all red flags.
• Cash handling. A rule that nobody accepts more than a set amount of cash without partner approval, and that Form 8300 triggers are checked every time.
• Sanctions screening. At onboarding and when circumstances change.
• Escalation. One named partner who reviews concerns and decides what to do next, including whether to get legal advice or contact law enforcement.
• Training and records. Annual refreshers for fee earners and a file showing what checks you carried out. Our AML guide for accountants walks through the basic concepts if your team is new to them.

Frequently asked questions

Does a CPA have to file a Suspicious Activity Report?

Not as a requirement of being a CPA firm, because accounting firms are not currently listed as BSA financial institutions in the way banks are. A CPA who works inside a bank or other covered institution will be covered through that employer's program.

Does Form 8300 apply to payments by wire or card?

No. The IRS defines cash for this purpose as currency, and in some situations certain monetary instruments. Wire transfers, card payments and personal checks are not cash for Form 8300.

Can I tell a client I have filed a Form 8300?

Yes. The payer must be told in writing by 31 January of the following year that a form was filed. Telling a client about a SAR, by contrast, is generally prohibited where a SAR duty applies.

Do CPAs need AML training?

We have not found a federal rule that requires AML training for CPA firms as such, but training is a sensible control for any firm that handles client money or advises on structures. Browse our CPD and CPE courses for options.

The short version: CPAs are not treated like banks, but cash reporting, sanctions and criminal law still apply. Build a small, written procedure now, and watch FinCEN for any change to the professional-services rules.