BSA compliance.

BSA compliance is a financial institution's program for meeting the Bank Secrecy Act and FinCEN's rules under it. For a bank or credit union, that means a written, board-approved anti-money laundering program,⁠[2]⁠[3]⁠[4] currency transaction reports and suspicious activity reports filed on time, and records kept for five years where examiners and law enforcement can reach them.⁠[5] The Bank Secrecy Act was enacted in 1970 and has been amended several times since.⁠[6]

Who enforces the BSA?

FinCEN, a bureau of the Treasury, administers the BSA and has overall authority for enforcing it. It delegates examinations to each institution's regulator: the OCC, the Federal Reserve, the FDIC or the NCUA.⁠[5] Each of those agencies also has its own BSA program rule, and their examiners work from the FFIEC BSA/AML Examination Manual.⁠[3]⁠[7]⁠[8]⁠[4]⁠[9]

What are the penalties for BSA violations?

Willful violations are federal crimes, punishable by up to five years in prison and a $250,000 fine, or up to 10 years and $500,000 when they're part of a pattern of illegal activity involving more than $100,000 in a 12-month period.⁠[10] Civil penalties apply to willful violations, and smaller ones to negligent violations.⁠[11] In October 2024, FinCEN assessed a $1.3 billion penalty against TD Bank, the largest against a depository institution in Treasury and FinCEN history, as part of resolutions the Justice Department put at about $3.09 billion.⁠[12]⁠[13]

FinCEN counts how many BSA reports arrive each year and how often they're searched.

• More than 63.9 million searches of BSA data were run in fiscal 2025 by the federal, state and local agencies with access, FinCEN reports.⁠[1]
• About 5.4% of the CTRs filed from 2014 through 2023 were accessed by law enforcement in FinCEN's BSA Portal, the GAO found.⁠[14]
• About $598,700 a year is FinCEN's estimate of what a bank or credit union spends on AML program compliance (size-weighted mean; the median is $414,300), from end-2024 data.⁠[6] Where those hours go is covered in Compliance operations.

A SAR counts a report, not a loss.

A BSA program has five required parts, often called pillars: internal controls, independent testing, a BSA officer, training and customer due diligence. FinCEN's rule lists all five for banks and credit unions (31 CFR 1020.210(a)(2)). Each regulator's own rule requires the first four, and requires the program to be written, approved by the board and noted in the minutes (12 CFR 21.21, 208.63, 326.8 and 748.2).⁠[2]⁠[3]⁠[7]⁠[8]⁠[4]

Is a written BSA risk assessment required?

Not by a specific regulation today. The FFIEC manual says writing it down is sound practice and has examiners start their scoping from it.⁠[20] FinCEN's April 2026 proposal would make it a requirement: assess the risks of your products, services, distribution channels, customers and geographies, take in FinCEN's AML/CFT priorities, and update it promptly when your risk profile changes significantly.⁠[6]

Would the 2026 proposal change the pillars?

It would regroup them into four: internal policies, procedures and controls, now including risk assessment and customer due diligence; independent testing; a U.S.-based officer accessible to FinCEN and the bank's regulator; and ongoing training. The proposal would also focus enforcement on “significant or systemic” failures to implement a program, not isolated or technical ones.⁠[6]

The two reports a bank files most are the currency transaction report, due within 15 days, and the suspicious activity report, due within 30. Two more clocks run alongside them: 314(a) requests and CTR exemptions.

314(a) information requestTwo weeks from the request

FinCEN posts law enforcement requests every two weeks, naming subjects suspected of terrorism or money laundering. The bank searches for accounts they held in the past 12 months and transactions in the past six, and reports any match. If nothing matches, it doesn't reply. The request itself is confidential.

31 CFR 1010.520(b)(3) · FinCEN 314(a) fact sheet⁠[5]⁠[21]

Currency transaction report (CTR)15 days from the transaction

A bank files a CTR for each deposit, withdrawal, exchange or other transfer of currency of more than $10,000. Cash transactions the bank knows are by or for the same person count as one when the cash in, or the cash out, totals more than $10,000 in a business day, across all domestic branches. Breaking up cash to evade a CTR is structuring, a federal crime punishable by up to five years in prison, or 10 in aggravated cases.

31 CFR 1010.311, 1010.313, 1010.306(a)(1) · 31 U.S.C. 5324⁠[5]⁠[22]

Suspicious activity report (SAR)30 calendar days from detection

A SAR is due 30 calendar days after the bank first detects facts that may support one, or up to 60 if no suspect has been identified. Violations that need immediate attention, such as ongoing money laundering, also call for a phone call to law enforcement. Thresholds, the narrative and continuing activity are covered in SAR filing.

31 CFR 1020.320(b)(3)⁠[23]

CTR exemption designation30 days from the first reportable transaction

Banks don't file CTRs on cash transactions with exempt persons: other banks, government agencies, listed companies and their subsidiaries, and eligible businesses or payroll customers that frequently move more than $10,000 in cash. All but banks and government bodies must be designated on FinCEN Form 110 within 30 days of the first reportable transaction, and the eligibility of companies, businesses and payroll customers reviewed at least once a year.

31 CFR 1020.315(b)–(d)⁠[2]

Is the $10,000 CTR threshold going up?

Not yet. Treasury set the threshold by regulation in 1972 and has never adjusted it for inflation. The GAO calculated it would have been about $72,880 in 2023 if it had been, and that an inflation-adjusted threshold would have cut CTR filings by at least 90% a year since 2014.⁠[14] As of October 2026, the rule still reads more than $10,000.⁠[5]

Generally five years. FinCEN's rules require BSA records to be kept for five years and stored so they can be retrieved within a reasonable time (31 CFR 1010.430(d)).⁠[5]

Most of the changes take work off the program rather than add to it, and none of them moves a reporting threshold.

The 2026 program rule is still a proposal. FinCEN proposed that it take effect 12 months after a final rule is issued; until then, today's rules apply.⁠[6]

Examiners scope a BSA exam from your risk assessment, then assess whether each pillar works in practice.⁠[20]

• Keep the risk assessment current. It should drive your controls. Revisit it when you add products, services, customer types or markets.⁠[20]
• Aggregate cash the way the rule does. Count cash in and cash out separately, across all domestic branches. Night, weekend and holiday deposits count on the next business day.⁠[5]
• Refresh customer information by risk, not by calendar. Ongoing due diligence means updating customer information, beneficial owners included, on a risk basis.⁠[2]⁠[19]
• Test independently, and close what testing finds. Testers report straight to the board or a committee, and exceptions should be documented and reported promptly.⁠[16]

Why BSA work takes so long

Most BSA decisions are quick once the picture is complete. Getting the picture is the slow part: a CTR, a 314(a) match, a due diligence refresh or an examiner's request each needs facts from several of these systems. When every item takes that long, your BSA officer spends the week assembling evidence instead of running the program.

Socratix AI coworkers can take on the gathering. For each alert, cash report, due diligence refresh or examiner request, they can pull the evidence from every system into one case, check it against your policies and risk assessment, and hand your team a recommendation with the reasoning laid out. Your BSA officer and analysts still make every call.

The October 2025 SAR FAQs were written to let institutions “focus resources on activities that produce the greatest value to law enforcement.”⁠[24] The rules keep changing, and your team doesn't get bigger. AI coworkers can do the gathering — every item, around the clock — so your BSA officer can run the program instead of the queue. FinCEN's 2026 proposal says institutions that responsibly experiment won't face added risk of a significant supervisory or enforcement action “solely based on the use of innovative technologies.”⁠[6]

1. GatherCan pull the customer's identification and due diligence file, beneficial owners, account and cash activity, wires, prior alerts, CTRs and SARs from the systems that hold them, into one case.
2. AssessCan check the activity against the customer's profile, your risk assessment and policies, aggregate cash the way the CTR rule does, and watch the CTR, SAR and 314(a) clocks.
3. RecommendCan recommend close, escalate, file or refresh — with the evidence, a plain-language reason, and a draft SAR narrative when one is warranted. Your analyst decides.
4. LearnCan learn from each decision — your policies, your risk appetite, your team's judgment — and log every step for the examiner.

Related guides

• AML transaction monitoring How monitoring works, why most alerts are false positives, and what examiners expect.
• SAR investigations From alert to case to decision: how a suspicious activity investigation runs.