What is the Bank Secrecy Act? The rules, the reports, and why it reaches beyond the US.

The Bank Secrecy Act is the 1970 US law that requires banks and other financial firms to help the government detect and prevent money laundering, by keeping records and filing reports on certain transactions. It is the foundation of the US anti-money-laundering system, and despite the name, it is about disclosure, not secrecy.

The cost of failing it is enormous. In October 2024 TD Bank pleaded guilty and agreed to pay more than $3 billion for Bank Secrecy Act and money-laundering failures, becoming the first US bank to plead guilty to conspiring to fail to maintain a compliant anti-money-laundering programme. The law is more than half a century old, and it still produces some of the largest penalties in finance. 

What the Bank Secrecy Act is

Passed in 1970 under its formal name, the Currency and Foreign Transactions Reporting Act, the BSA was built on a simple idea: banks see the money move, so banks should keep the records and flag the activity that helps law enforcement follow it. Every anti-money-laundering rule the US has added since, including the AML programme requirements introduced by the USA PATRIOT Act, sits on top of that 1970 foundation.

The law is administered by the Financial Crimes Enforcement Network, or FinCEN, part of the US Treasury. FinCEN writes the reporting rules, receives the reports, and, with the banking regulators, enforces compliance. It takes in millions of reports a year and passes the intelligence to law enforcement, which is the whole point of the system: turn the banks’ visibility into leads investigators can act on. For a firm, the BSA is a whole programme it has to build, run and prove, not a single filing.

What the BSA requires

The BSA turns on two reports and a programme to produce them.

The first is the Currency Transaction Report. A bank has to file a CTR with FinCEN for any cash transaction of more than $10,000 in a single day, aggregating multiple transactions by the same customer. It is a blunt instrument, but it creates a paper trail for large cash movements that would otherwise be invisible.

The second is the Suspicious Activity Report. When a firm spots activity it suspects involves money laundering or other crime, it files a SAR with FinCEN, generally above a threshold of $5,000 for a bank, or $2,000 for a money-services business. Unlike the CTR, the SAR is a judgement call, which is why the quality of a firm’s monitoring and its analysts matters so much.

Behind both reports sits the BSA/AML programme the PATRIOT Act made mandatory. A firm has to maintain internal controls and policies, appoint a designated compliance officer, train its staff, and arrange independent testing, the four pillars examiners look for. It also has to run customer due diligence, screen customers against sanctions lists, and keep records, typically for five years. Those requirements are the working core of BSA compliance, and a gap in any of them is what an examiner writes up.

Who the BSA applies to 

The BSA reaches well beyond retail banks. It binds banks and credit unions, but also money-services businesses such as money transmitters and currency exchanges, broker-dealers, casinos, and, increasingly, the fintechs and crypto firms that FinCEN treats as money-services businesses. A payments start-up moving customer funds carries the same core obligations as a bank, even without a banking licence.

That breadth is deliberate. Money laundering follows the path of least resistance, so the law casts the reporting net across every kind of firm that touches the flow of funds. For a fintech, the practical consequence is that a US money-transmitter registration brings a full BSA AML programme with it, not a lighter version.

Structuring: the offence built into the $10,000 line

The CTR threshold created its own crime. Because a cash transaction over $10,000 triggers a report, criminals break large sums into smaller deposits kept just under the line, a practice known as structuring, to avoid leaving a record.

Structuring is itself illegal under the BSA, whether or not the underlying money is dirty, and spotting it is one of the classic triggers for a Suspicious Activity Report. A run of $9,000 deposits across several days or branches is exactly the pattern a monitoring system is tuned to catch, because the effort to stay under the threshold is itself the red flag.

How a US law reaches banks in London and Dubai

This is the part that matters most to a reader outside the US. The Bank Secrecy Act is a US statute, but its reach follows the US dollar. A bank anywhere in the world that clears dollars, or holds a correspondent account with a US bank, is exposed to US anti-money-laundering enforcement, even with no American retail branch.

The clearest proof is HSBC. In 2012 the UK-headquartered bank paid $1.9 billion to settle US charges over anti-money-laundering and sanctions failures, after its US operations were used to move hundreds of millions of dollars in drug-cartel proceeds. It was a British bank, penalised under US law, because its business ran through the US financial system. For a compliance team in London, the Gulf or anywhere else that touches dollar clearing, the BSA is very much their rulebook too.

The mechanism is correspondent banking. Most cross-border dollar payments pass through a US bank at some point, and when they do, US anti-money-laundering rules attach to them. A bank in Frankfurt, Lagos or Dubai that never files a single US report can still find its US correspondent relationships, and with them its access to dollar clearing, at risk if its home-country controls are weak. That is why global banks run their financial-crime programmes to US standards even where local law asks for less.

The fines that define the law

 Enforcement is what gives the BSA its weight, and the numbers have grown. The TD Bank case in 2024 is the current high-water mark: more than $3 billion in penalties, a guilty plea, and a finding that the bank had left roughly 92 per cent of its transaction activity unmonitored for years, allowing criminal networks to launder hundreds of millions of dollars through it. FinCEN imposed a multi-year monitorship on top of the fine.

The HSBC settlement above, at $1.9 billion, was the record in its day and remains the case that established how far US enforcement would reach into a foreign bank. Between them, the two cases show what regulators punish. It is the state of the whole programme, not a single missed report, that brings the penalty, and the lesson for a firm is that BSA compliance is judged on whether the system works rather than on whether the paperwork exists. 

The UK and UAE equivalents

The BSA is the US model, but every major market runs its own version, and a firm operating across borders answers to several at once.

In the UK, the equivalent framework is the Proceeds of Crime Act 2002 and the Money Laundering Regulations 2017, backed by the Sanctions and Anti-Money Laundering Act 2018, which keep the UK aligned with international standards.

In the UAE, the current basis is Federal Decree-Law No. 10 of 2025, which replaced the earlier 2018 AML law and tightened the regime after the country’s period on the Financial Action Task Force grey list. The mechanics differ, but the shape is the same everywhere: know your customer, monitor the activity, report the suspicion, keep the records.

FAQs

What is the Bank Secrecy Act in simple terms?

It is the 1970 US law that requires financial firms to keep records and file reports, such as reports on large cash transactions and suspicious activity, to help the government detect money laundering. It is the foundation of the US anti-money-laundering system. 

What reports does the BSA require?

Two main ones: a Currency Transaction Report for cash transactions over $10,000 in a day, and a Suspicious Activity Report when a firm suspects money laundering or other crime, generally above $5,000 for a bank.

What is structuring under the BSA?

Breaking a large cash sum into smaller deposits kept under the $10,000 reporting threshold to avoid triggering a Currency Transaction Report. Structuring is itself a crime under the BSA and a common trigger for a Suspicious Activity Report. 

Does the Bank Secrecy Act apply to non-US banks?

In effect, yes. A foreign bank that clears US dollars or holds a US correspondent account is exposed to US enforcement. HSBC, a UK bank, paid $1.9 billion under US anti-money-laundering law in 2012. 

Who enforces the Bank Secrecy Act?

FinCEN, part of the US Treasury, administers the BSA and receives the reports, working with the federal banking regulators and the Department of Justice on enforcement. 

Next read

The BSA is the US member of a family of AML regimes the firms we cover have to run in parallel. For the rest of our regtech and compliance coverage, see the Compliance hub.