Bank Secrecy Act Reporting Requirements for Financial Institutions

The Bank Secrecy Act (BSA) imposes mandatory reporting obligations on U.S. financial institutions to help detect money laundering and terrorism financing. The core requirements are currency transaction reports (CTRs) for large cash deposits, suspicious activity reports (SARs) for unusual patterns, and customer identification programs (CIPs) to verify who customers are. Failure to comply carries civil and criminal penalties.

Currency Transaction Reports (CTRs)

Banks file a Currency Transaction Report whenever a single customer or related parties deposit or withdraw $10,000 or more in cash within a single business day. The threshold is low by design—the intent is to cast a wide net and create a traceable record of large cash movements.

A CTR includes the customer’s name, address, taxpayer ID, account number, date, amount, and the type of currency. If $25,000 comes in on Monday and another $30,000 on Friday from the same customer, two separate CTRs are filed. The bank must file within 15 days of the transaction.

The $10,000 figure is adjusted annually for inflation, but has remained effectively flat in practice. It is important to note that structuring—deliberately breaking deposits into smaller amounts to avoid the CTR threshold—is itself illegal under the BSA, even if each individual transaction is under $10,000. A customer depositing $8,000 three times in one week with the intent to dodge reporting faces criminal liability.

Suspicious Activity Reports (SARs)

A SAR flags activity that is unusual, potentially illegal, or consistent with money laundering, even if no single transaction meets the CTR threshold. A customer making multiple small transfers to high-risk jurisdictions, a sudden surge in account activity that contradicts their profile, or repeated failed login attempts followed by wire transfers are all grounds for a SAR.

SARs have a lower trigger—$5,000 and suspicious circumstance—and they are far more subjective than CTRs. Banks maintain SAR review programs staffed by compliance officers trained to spot patterns. A construction business that suddenly receives deposits from overseas, a small business shifting profits through dozens of micro-transactions, or a retail customer opening accounts at multiple branches in a single day are common SAR scenarios.

The deadline is 30 days from when the bank becomes aware of the suspicious activity. SARs are filed confidentially with the Financial Crimes Enforcement Network (FinCEN), part of the Treasury Department. Unlike CTRs, which are routine administrative filings, SARs can trigger law enforcement investigation.

Customer Identification Programs (CIPs)

The BSA requires financial institutions to verify the identity of customers and maintain records. A CIP is the formal program that banks use to collect and validate customer information. At a minimum, this includes:

• Full legal name
• Date of birth
• Address
• Government-issued ID number (Social Security Number, Employer ID, passport, etc.)

Banks cross-reference this information against watchlists maintained by FinCEN and the Office of Foreign Assets Control (OFAC) to ensure customers are not terrorists, sanctions targets, or known money launderers. If a match occurs, the account is blocked and a report is filed.

For business customers, CIPs extend to beneficial ownership verification—identifying the natural persons who ultimately control or profit from a company. The Corporate Transparency Act (enacted in 2023) tightened beneficial ownership reporting, requiring ownership structures to be disclosed and kept current.

Who must comply

The BSA applies to banks, thrift institutions, credit unions, money services businesses (including remittance companies and currency exchangers), broker-dealers, casinos, and certain insurance companies. Smaller entities like check cashers and pawn shops have lighter obligations but still file SARs and CTRs above thresholds.

Money transfer services face particularly stringent rules because of the inherent risk of cross-border payments. A wire transfer service that fails to verify customer identity and screen against OFAC lists faces not only financial penalties but potential shutdown of its license.

Enforcement and penalties

The Securities and Exchange Commission, the Federal Reserve, the Office of the Comptroller of the Currency (OCC), and state banking regulators conduct BSA audits. Civil penalties range from $5,000 to $250,000 per violation. A bank with thousands of CTRs filed late or with inadequate controls can face multimillion-dollar settlements.

Criminal penalties apply to willful violations—executives who knowingly ignore BSA obligations face up to five years in prison and substantial fines. Several major banks have paid settlements in the billions for systemic BSA failures, particularly for missing CTRs and SARs linked to sanctioned countries or known money launderers.

Banks also maintain BSA programs with dedicated compliance officers, annual audits, and staff training. The cost of compliance is substantial, but so are the risks of non-compliance.

The tension between privacy and enforcement

BSA reporting sits at the intersection of law enforcement and financial privacy. Customers generally do not know when a SAR has been filed on their account—the bank is prohibited from disclosing it. This allows law enforcement to investigate without tipping off suspects, but it also means innocent customers can find their accounts frozen or scrutinized without full transparency.

Some argue the system casts too wide a net and flags benign activity as suspicious. Others argue that the thresholds are outdated and miss more sophisticated laundering. Most financial institutions view BSA compliance as a non-negotiable cost of operating, and the reporting regime has become routine infrastructure.

See also