Bank Secrecy Act Guide: US AML Obligations for Banks and Fintechs

The Bank Secrecy Act is the backbone of US anti-money laundering law, and most enforcement cases against banks and fintechs come down to the same few failures: weak customer identification, unmonitored transactions and late or missing suspicious activity reports. This guide sets out who the Act covers, the core obligations in FinCEN's regulations at 31 CFR Chapter X (the AML programme, the Customer Identification Program, currency transaction reports, suspicious activity reports, beneficial ownership and recordkeeping), what examiners look for, the penalties, and where the rules stand after FinCEN's April 2026 proposal to rewrite programme requirements. It also covers what the rules mean for the automated decisioning, AI agents and machine identities that now run onboarding and monitoring. It is written for BSA officers, compliance leads, fintech and banking-as-a-service product owners, and the security and identity teams that build the systems behind them. Our AML programme and transaction monitoring guide covers monitoring design in general; this page goes deep on the US law itself. Regulatory text was checked on 8 November 2026.

Key takeaways

• The BSA is a family of rules, not one statute: it is the informal name for the Currency and Foreign Transactions Reporting Act of 1970 and its amendments, codified mainly at 31 U.S.C. 5311 onwards and implemented by FinCEN in 31 CFR Chapter X.
• Five programme elements for banks: internal controls, independent testing, a designated BSA officer, training and risk-based customer due diligence, as set out in 31 CFR 1020.210.
• Hard numbers drive day-to-day operations: currency transactions of more than $10,000 trigger a CTR, suspicious activity of at least $5,000 triggers a SAR for banks, SARs are due 30 calendar days after initial detection (never more than 60), and most records are kept for five years.
• The programme rule is being rewritten: FinCEN issued a notice of proposed rulemaking on 7 April 2026 for "effective" risk-based AML/CFT programmes; as of 8 November 2026 FinCEN lists no final rule, so the current text still applies.
• Automation does not move accountability: the bank, not the vendor or the model, files late SARs and pays penalties, so the service accounts, API keys and AI agents in the KYC and monitoring chain need the same governance as the people they replaced.

Scope: who and what is covered

The FinCEN overview lists the statutory base as 12 U.S.C. 1829b, 12 U.S.C. 1951-1960 and 31 U.S.C. 5311-5314 and 5316-5336, with regulations moved from 31 CFR Part 103 into 31 CFR Chapter X on 1 March 2011. Chapter X is organised by industry: Part 1010 holds general provisions that apply to every "financial institution" in the BSA sense, and industry parts add specific rules.

Fintech position: a fintech that is not itself a bank usually meets the BSA in one of two ways. Either it is an MSB with its own programme, registration and reporting duties, or it sits in front of a partner bank that holds the accounts. In the second model the partner bank remains responsible for CIP, monitoring and SAR filing, and will push those duties to the fintech by contract and oversee them. Reliance on another institution for CIP is allowed only under the conditions in 31 CFR 1020.220 (see below), so contract terms alone do not transfer the obligation.

Key obligations

The AML programme (the pillars)

31 CFR 1020.210 requires banks to have a written AML programme that includes, at a minimum:

• Internal controls: a system of internal controls to assure ongoing compliance with the BSA and Chapter X.
• Independent testing: testing for compliance by bank personnel or an outside party.
• Designated individual: one or more people responsible for coordinating and monitoring day-to-day compliance, usually called the BSA officer.
• Training: training for appropriate personnel.
• Customer due diligence: risk-based procedures that include understanding the nature and purpose of customer relationships to build a customer risk profile, and ongoing monitoring to identify and report suspicious transactions and, on a risk basis, maintain and update customer information, including beneficial owner information for legal entity customers.

For banks without a federal functional regulator the section also requires board (or equivalent) approval and a copy for FinCEN on request. Federally regulated banks meet the requirement by complying with their regulator's programme rule, which carries the same core elements.

Customer Identification Program (CIP)

31 CFR 1020.220 sets the minimum CIP. Before opening an account the bank must obtain four items: name, date of birth (individuals), address (a residential or business street address for individuals, with narrow alternatives such as an APO/FPO box) and an identification number (a taxpayer identification number for US persons; for non-US persons a TIN, passport number and issuing country, alien ID card number or other government document number). Verification must happen within a reasonable time after opening, by documentary methods (an unexpired government photo ID for individuals; articles of incorporation, business licence, partnership agreement or trust instrument for entities), non-documentary methods (contacting the customer, checking consumer reporting agencies, public databases or references with other institutions, obtaining a financial statement), or both. The procedures must say when the bank will not open an account, what the customer may do while verification is pending, when to close the account and when to file a SAR.

The bank must also check customers against federal lists of known or suspected terrorists or terrorist organisations designated by Treasury, give customers adequate notice before opening that it is requesting identity information, and keep CIP records. It may rely on another financial institution for CIP only if reliance is reasonable, the other institution is subject to an AML programme rule and a federal functional regulator, and it signs a contract to certify each year that it has implemented its programme and performs the CIP steps. The Identity Proofing and KYC Guide covers the verification technology itself.

Beneficial ownership

Under 31 CFR 1010.230 covered institutions identify and verify the beneficial owners of legal entity customers: each individual who directly or indirectly owns 25 percent or more of the equity interests (up to four people) and one individual with significant responsibility to control, manage or direct the entity, such as a CEO, CFO, managing member or general partner. Pooled investment vehicles and certain nonprofits are subject only to the control prong. FinCEN's AML Act page lists CDD exceptive relief issued on 13 February 2026, so check its current scope before you change refresh rules. For screening workflows see CDD, EDD, PEP and sanctions screening.

Reports and records

SAR confidentiality: no bank, director, officer, employee or agent may disclose a SAR or any information that would reveal its existence. This matters for system design: case management tools, analytics platforms and AI assistants that can see SAR data are inside the confidentiality boundary, and their logs, prompts and exports must be treated the same way.

Structuring: breaking transactions up to avoid a CTR is itself a crime under 31 U.S.C. 5324, which is why structuring patterns are one of the first scenarios in any monitoring library.

What examiners use

Federal banking examiners work from the FFIEC BSA/AML Examination Manual. Its sections follow the exam itself: Scoping and Planning, BSA/AML Risk Assessment, Assessing the BSA/AML Compliance Program, Developing Conclusions and Finalizing the Exam, Assessing Compliance with BSA Regulatory Requirements, Office of Foreign Assets Control, Program Structures, and Risks Associated with Money Laundering and Terrorist Financing. Read the risk assessment and compliance programme sections before an exam; they show how examiners scope transaction testing from your own risk assessment.

Timeline and current status

What the April 2026 proposal changes: FinCEN has published a fact sheet on the proposal; law firm summaries (secondary sources, not FinCEN text) describe four core pillars with risk assessment placed inside internal policies, procedures and controls, a requirement that programmes be "effective", a split between deficiencies in programme design (establishment) and in implementation (maintenance), and an enforcement focus on significant or systemic failures rather than isolated issues. Comments were due 60 days after Federal Register publication. Until a final rule is published, plan against the current 1020.210 text and treat the proposal as direction of travel. Dates and status here are as FinCEN listed them on 8 November 2026 and may change.

Enforcement and penalties

• Criminal penalties: under 31 U.S.C. 5322 a willful violation carries a fine of up to $250,000, up to five years' imprisonment, or both. If the violation happens while violating another US law, or as part of a pattern of illegal activity involving more than $100,000 in a 12-month period, the maximum rises to $500,000, up to ten years, or both.
• Civil penalties: FinCEN can assess civil money penalties under 31 U.S.C. 5321; amounts are adjusted for inflation, so check FinCEN's current table rather than an old figure.
• Prudential action: the OCC, FDIC, Federal Reserve and NCUA enforce BSA programme requirements through consent orders, cease-and-desist orders and penalties, and partner-bank consent orders commonly restrict new fintech programmes until controls are fixed.
• Individual liability: BSA officers and executives can face individual penalties and bars, which is why the designated individual needs real authority and resources.

The pattern behind large cases is consistent: monitoring rules that do not cover all products or volumes, alert backlogs that push SARs past 30 days, and onboarding controls weakened to hit growth targets. Each one is a control failure you can measure.

What it means for AI agents and non-human identities

The BSA says nothing about technology choices, but every obligation above now runs through machines: identity verification APIs, screening services, monitoring engines, case management and, increasingly, AI agents that draft SAR narratives or triage alerts. The regulation still holds the institution responsible, so the machine layer is part of the programme.

Inventory these identities like any other: every API key used to call an identity verification vendor, every service account that writes to the monitoring engine and every agent with case-management access should have an owner, a purpose and a rotation date. The NHI Discovery guide covers how to find them.

Compliance steps

1. Confirm your BSA status. Decide whether you are a bank, MSB, broker-dealer or a service provider to one, and map which 31 CFR parts apply. Fintechs should get this in writing from counsel and from the partner bank.
2. Write the risk assessment first. Score products, customers, channels and geographies, and use the national AML/CFT priorities as an input. The FFIEC manual expects testing scope to follow this document.
3. Build the programme around the five elements. Name the BSA officer with authority to escalate, document internal controls, set the training plan by role and book independent testing.
4. Implement CIP and beneficial ownership. Capture the four CIP data elements, define documentary and non-documentary verification paths, the pending-verification rules and the customer notice, and record verification results and discrepancy resolution.
5. Prove monitoring coverage. Reconcile every product and payment rail into the monitoring engine, tune scenarios (including structuring), and set alert ageing targets that leave time to file inside 30 days.
6. Automate CTR and SAR workflows with human sign-off. Aggregate currency per business day, track the 15-day CTR and 30/60-day SAR clocks, and keep SAR data inside the confidentiality boundary.
7. Govern the machines. Inventory service accounts, keys and agents in the KYC and monitoring chain; restrict and log them; validate models and rules before production.
8. Test, then fix. Run independent testing at least on the cadence your regulator expects, track findings to closure, and re-test.
9. Track the rulemaking. Assign someone to watch FinCEN's AML Act page for the final programme rule and agency alignment rules, and plan a gap assessment when it lands.

Common failure patterns

• Monitoring gaps by product: a new card, wire or crypto product goes live before its data reaches the monitoring engine.
• SAR backlogs: alert queues grow during growth phases and SARs breach the 30-day clock, which examiners find quickly.
• Thin CIP at the fintech front end: the partner bank relies on a fintech's onboarding without meeting the 1020.220 reliance conditions or testing it.
• Static risk ratings: customer risk profiles set at onboarding and never refreshed against actual behaviour.
• Unowned integrations: verification and screening API keys shared across environments with no owner, so a revoked or leaked key breaks or bypasses controls without anyone noticing.

Practitioner checklist

• Document which 31 CFR Chapter X parts apply to you and to each partner.
• Keep a current, board-approved risk assessment and AML programme.
• Verify CIP captures name, date of birth, address and ID number before account opening.
• Reconcile monthly that 100 percent of transaction volume reaches monitoring.
• Track metrics: SARs filed within 30 days (target 100 percent), alert ageing, CTRs filed within 15 days, CIP exceptions open, and independent testing findings overdue.
• Restrict SAR data to named roles and approved systems, including AI tools.
• Give every service account, API key and agent in the AML chain an owner and rotation date.
• Keep five years of CIP, beneficial ownership and SAR records retrievable for examiners.
• Review FinCEN's rulemaking status each quarter.

Standards and references

• FinCEN: The Bank Secrecy Act
• 31 CFR 1020.210: Anti-money laundering program requirements for banks
• 31 CFR 1020.220: Customer identification program requirements for banks
• 31 CFR 1020.320: Reports by banks of suspicious transactions
• 31 CFR 1010.230: Beneficial ownership requirements for legal entity customers
• 31 U.S.C. 5322: Criminal penalties
• FFIEC: BSA/AML Examination Manual
• FinCEN: AML/CFT Program NPRM fact sheet (April 2026)
• FinCEN: Anti-Money Laundering Act of 2020

Related NHI Mgmt Group resources: AML programme and transaction monitoring · CDD, EDD, PEP and sanctions screening · FATF Recommendations Guide · EU AML Regulation and AMLA Guide · Identity Proofing and KYC Guide. This guide summarises the Bank Secrecy Act and FinCEN regulations and is not legal advice.