The Bank Secrecy Act is the 1970 US law that first required financial institutions to keep records and report certain transactions to help detect money laundering. It is the statute nearly every other US AML obligation traces back to, and the yardstick examiners measure your program against.
What is the BSA, in plain English?
The Bank Secrecy Act, despite its name, is not about keeping secrets; it is about ending them. Passed in 1970 and formally the Currency and Foreign Transactions Reporting Act, it made banks keep records and file reports that give the government visibility into money movement. It is the foundation of the entire US anti-money-laundering regime.
Almost every obligation a US compliance team handles descends from the BSA: currency transaction reports for large cash, suspicious activity reports for unusual behaviour, customer identification, ongoing monitoring, and the requirement to maintain a written AML program with the classic pillars. When a rule seems to appear from nowhere, it usually traces back to this statute.
Over the decades the BSA has been amended and strengthened, most notably by the USA PATRIOT Act after 2001 and the Anti-Money Laundering Act of 2020. Those laws did not replace the BSA; they built on it. So the BSA is best understood as the backbone, with later reforms bolted on top.
What the BSA requires
The statute and its rules create a handful of core duties every covered institution carries:
- Identify — Know your customer. Institutions must verify customer identity and, for many, identify the beneficial owners behind legal-entity accounts.
- Report — File CTRs and SARs. Large cash transactions trigger currency transaction reports; suspicious activity triggers suspicious activity reports.
- Record — Keep the records. Recordkeeping rules, including for funds transfers, preserve a trail investigators can follow later.
- Program — Run a written AML program. A risk-based program with internal controls, a compliance officer, training, and independent testing is mandatory.
Who enforces the BSA?
Who | Their role |
FinCEN | The administrator of the BSA. It writes the regulations, receives the reports, and can bring enforcement. |
Federal banking agencies | The OCC, Federal Reserve, and FDIC examine banks for BSA compliance using shared FFIEC standards. |
Other functional regulators | Agencies like the SEC, CFTC, and IRS supervise BSA compliance for the sectors they oversee. |
The reporting institution | Carries the day-to-day duty to file, keep records, and run a genuine program, not just hold a policy document. |
What it looks like in practice
In practice
A regional bank grows quickly and its monitoring system falls behind. Alerts pile up unreviewed, and a cluster of structured cash deposits, each kept just under the reporting threshold, goes unreported for months.
At the next exam, the reviewers cite the bank for failing to file suspicious activity reports and for weak internal controls, both BSA program duties. The bank faces a consent order requiring it to clear the backlog, hire staff, and bring in an independent tester. Every element cited traces straight back to the BSA framework.
Why it matters to operators
The BSA is the source code of US AML. When you understand it, the rest of the regime stops feeling like a pile of disconnected requirements and starts to look like a single system. Knowing that CTRs, SARs, customer due diligence, and program pillars all flow from one statute helps you explain why a control exists, which is exactly what examiners and auditors want to hear.
It also frames how later laws fit. The PATRIOT Act added correspondent-banking and information-sharing rules; the AMLA modernized priorities and whistleblower incentives. Both are amendments to the BSA world, so a team that knows the base statute can absorb each new layer without relearning the whole regime.
Operator notes
- Program pillars are non-negotiable. Controls, a designated officer, training, and independent testing are the minimum examiners expect, plus customer due diligence.
- Structuring is a BSA offense. Splitting cash to dodge the CTR threshold is itself illegal and a classic SAR trigger.
- Recordkeeping is examined too. Missing funds-transfer or identification records is a finding even when no report was required.
- Amendments compound. The PATRIOT Act and AMLA add duties on top; treat them as extensions of the BSA, not separate regimes.
- Trace the lineage. When a requirement looks arbitrary, mapping it back to the BSA usually explains its purpose.
Quick questions
Why is it called the Bank Secrecy Act if it fights secrecy?
The name refers to piercing the secrecy criminals rely on. It requires institutions to keep records and report transactions so that hidden money movement becomes visible to authorities.
What is the difference between a CTR and a SAR?
A currency transaction report is filed for cash transactions above a set threshold and is largely automatic. A suspicious activity report is filed when behaviour looks suspicious, regardless of amount, and requires judgment.
Who administers the BSA?
FinCEN is the administrator; it writes the rules and receives reports. Banking and functional regulators examine institutions for compliance, and several agencies can bring enforcement.
How did the PATRIOT Act change the BSA?
It expanded the BSA with rules on customer identification, correspondent banking, and information sharing, and broadened who must comply. It strengthened rather than replaced the original statute.
Does the BSA apply beyond banks?
Yes. Money services businesses, casinos, broker-dealers, and other financial institutions defined in the rules also carry BSA obligations, supervised by their functional regulators.
Is the BSA still the current law?
Yes. It remains the foundational statute, continually amended. The AMLA of 2020 is the most recent major update, but the core framework is still the BSA.