Bank Secrecy Act requirements on one page, section by section

The Bank Secrecy Act requirements for a bank come down to six duties: run a written anti-money laundering program, report cash over $10,000 in a business day, report suspicious activity of $5,000 or more, keep certain records for five years, identify customers and the owners of business customers, and answer FinCEN's information requests. Each lives in a specific section of 31 CFR Chapter X, the Treasury regulations that implement the Act, with its own threshold and deadline, and most of them did not change in 2025 or 2026. The difficulty is not the list but the layers on top of it: agency rules, the FFIEC examination manual, FinCEN's rulings and FAQs, and each institution's procedures, all with different dates. Botminds' BSA/AML Manual Search answers staff questions across those layers with the rule cited beside the institution's own procedure, and this page is the map it answers from.

Section numbers are to 31 CFR unless marked otherwise, as the eCFR stood on October 22, 2026. Product examples come from a fictional sample credit union, Norrell Federal Credit Union.

What does the Bank Secrecy Act require of a bank?

The Act requires a bank to prevent, detect and report money laundering through a risk-based program, to file reports on large cash and suspicious transactions, to keep records that make transactions traceable, and to share information with law enforcement when asked. The statute states its own purpose, rewritten by the Anti-Money Laundering Act of 2020, in five clauses.

require certain reports or records that are highly useful in criminal, tax, or regulatory investigations, risk assessments, or proceedings; or intelligence or counterintelligence activities, including analysis, to protect against terrorism

31 U.S.C. 5311, declaration of purpose, clause (1), as added by the Anti-Money Laundering Act of 2020

The other clauses name the program ("reasonably designed risk-based programs"), the tracking of criminal money, risk assessment, and "frameworks for information sharing" among institutions, regulators and law enforcement (31 U.S.C. 5311). Every duty on the one-page table serves one of them, and the reports are used: FinCEN counted more than 63.9 million searches of BSA data by authorized users in fiscal 2025 (FinCEN Year in Review, FY2025).

Who is subject to the Bank Secrecy Act?

Every "financial institution" as 31 CFR 1010.100(t) defines it, a list that starts with banks and runs through broker-dealers, money services businesses, casinos, card clubs, insurance companies, mutual funds and dealers in precious metals, among others. "Bank" itself, in 1010.100(d), covers commercial banks, savings associations and thrifts, credit unions "organized under the law of any State or of the United States," foreign banks' U.S. offices and others. Each type has its own part of Chapter X; banks and credit unions follow part 1020 and the general rules in part 1010.

Above the Treasury rules sit the banking agencies' own program rules, 12 CFR 21.21 for the OCC, 208.63 for the Federal Reserve, 326.8 for the FDIC and 748.2 for the NCUA, which require the same program and let each agency examine for it. Above all of it sits the statute in title 31 of the U.S. Code and 12 U.S.C. 1829b.

The AML program: the five pillars and their 2026 status

The "five pillars" are the five minimum elements of a bank's AML program in 31 CFR 1020.210: a system of internal controls, independent testing, a designated BSA officer, training for appropriate personnel, and risk-based customer due diligence. The first four come from the banking agencies' program rules, which date from 1987; the fifth came with FinCEN's customer due diligence rule, effective July 11, 2016 with compliance required from May 11, 2018, and requires understanding the nature and purpose of customer relationships to build a customer risk profile, and ongoing monitoring.

FinCEN's April 2026 proposal would rewrite the rule around four pillars, with customer due diligence folded into internal controls and risk assessment processes made an explicit requirement (91 FR 18704). Comments closed June 9, 2026, and no final rule had been published by late October. Until one is, the five pillars stand. What training owes each seat under the fourth pillar is mapped in BSA training requirements, seat by seat.

What are the Bank Secrecy Act reporting requirements?

A bank files two reports routinely and others when they apply. The currency transaction report is due for cash in, or cash out, of more than $10,000 in one business day, adding up multiple transactions the bank knows are by or for the same person (1010.311, 1010.313), and must be filed within 15 days (1010.306). The suspicious activity report is due for transactions of $5,000 or more where the bank knows, suspects or has reason to suspect one of the listed kinds of illegal activity, within 30 days of initial detection, extendable to 60 to identify a suspect (1020.320).

Three details catch staff out. Debits and credits are added separately; cash in is never netted against cash out. Splitting cash to stay under $10,000 is structuring, a crime in any amount under 31 U.S.C. 5324, and the bank's question then becomes whether to file a SAR, not a CTR. And on near-threshold cash, the October 2025 FAQs say transactions near $10,000 are not, by being there, enough to require a SAR; the trigger is reason to suspect the transactions are designed to evade the report (SAR FAQs, Q1). Exempt customers, designated on FinCEN Form 110 under 1020.315, drop out of CTR filing but never out of SAR monitoring.

What are the Bank Secrecy Act record keeping requirements?

A bank keeps records that let a transaction be traced, and keeps them five years. The general rule, 1010.430(d), sets five years for every record the chapter requires and asks that records be accessible within a reasonable period. The specific duties include funds transfers of $3,000 or more under 1020.410(a), cash purchases of monetary instruments from $3,000 to $10,000 under 1010.415, extensions of credit over $10,000 under 1010.410(a), and copies of every CTR and SAR filed, with the SAR's supporting documentation.

The clock starts at different events for different records, such as the date of filing for a SAR and the date an account closes for identity records, which is where most retention confusion begins. BSA record retention: 7 years? 10? The rule says 5 takes each record and its clock in turn.

Knowing the customer: CIP and beneficial ownership

Two rules govern who the customer is. The customer identification program rule, 1020.220, requires a bank to collect identifying information before opening an account, verify the customer's identity "within a reasonable time after the account is opened," check government lists, and keep identity records for five years after the account closes. The beneficial ownership rule, 1010.230, requires identifying and verifying the beneficial owners of legal entity customers when a new account is opened.

The bank's beneficial ownership rule is easy to confuse with the Corporate Transparency Act's company reporting rule, which changed. FinCEN's August 14, 2026 final rule confirmed that U.S. companies do not have to report their U.S. owners to FinCEN (91 FR 52508). That rule concerns what companies file with FinCEN; it did not remove 1010.230, which still appears in the eCFR as a bank's account-opening duty.

Information sharing under 314(a) and 314(b)

Section 314(a) is compulsory. Every two weeks FinCEN posts lists of subjects named by law enforcement; a bank searches accounts maintained in the preceding 12 months and transactions in the preceding 6 months (1010.520) and reports only matches, within two weeks of posting per FinCEN's fact sheet, which adds that a 314(a) match is a lead only, never a substitute for a subpoena or other legal process (FinCEN 314(a) fact sheet). The request itself is confidential.

Section 314(b) is voluntary: institutions that file a notice with FinCEN, renewed every year, may share information with each other about suspected money laundering or terrorist financing under a safe harbor (1010.540).

Confidentiality and penalties

The confidentiality rule reaches every employee. Under 1020.320(e), no bank, director, officer, employee or agent may disclose a SAR or anything that would show one exists, and a bank asked for one, even by subpoena, must decline and notify FinCEN. That is why a teller's words to a member are a compliance matter, and why the sample credit union's answers give only the words its procedure allows.

Violations carry civil and criminal penalties. The basic civil penalty in 31 U.S.C. 5321(a)(1), adjusted for inflation in January 2025, ranges from $71,545 to $286,184, with $1,430 per negligent violation and up to $111,308 for a pattern of negligent activity (FinCEN, 90 FR 5629). Criminally, a willful violation can bring a fine of up to $250,000 or five years in prison, rising to $500,000 or ten years when part of a pattern of illegal activity over $100,000 in a year (1010.840).

BSA/AML Manual Search drafts the referral and applies the confidentiality rule in one screen

What is 31 CFR 1020?

31 CFR part 1020 is FinCEN's set of Bank Secrecy Act rules for banks, including credit unions. It has six subparts: definitions; programs, with the AML program rule (1020.210) and customer identification (1020.220); reports, with CTR aggregation and exemptions (1020.313 to 1020.315) and the SAR rule (1020.320); records (1020.410); special information sharing (1020.500 and 1020.540); and special standards of diligence for correspondent and private banking accounts (1020.610 and 1020.620).

Part 1020 points back to part 1010 for most of the detail, so a full answer usually cites both: the CTR obligation is in 1010.311 and its aggregation rule in 1010.313, while the bank-specific SAR rule is in 1020.320. A tool that searches only one part gives half answers.

Every rule family BSA/AML Manual Search answers from, each with the date of the copy used

Who decides which of those sources binds when they disagree, a regulation, a FinCEN ruling, an FAQ or the manual, is the subject of FinCEN rulings, FAQs and guidance: what actually binds a bank.

Questions people ask

What are the five pillars of the Bank Secrecy Act?

Internal controls, independent testing, a designated BSA officer, training for appropriate personnel and risk-based customer due diligence, the minimum elements of a bank's AML program under 31 CFR 1020.210. The fifth came with FinCEN's customer due diligence rule, with compliance required from May 2018. An April 2026 proposal would fold it into internal controls, but that proposal is not final.

Does the Bank Secrecy Act apply to credit unions?

Yes. The definition of "bank" in 31 CFR 1010.100(d) includes credit unions organized under state or federal law, and federally insured credit unions must also meet the NCUA's program rule at 12 CFR 748.2. They file CTRs and SARs and keep records on the same terms as banks.

Is OFAC compliance part of the Bank Secrecy Act?

No. Sanctions compliance comes from separate laws administered by Treasury's Office of Foreign Assets Control, with its own regulations in 31 CFR Chapter V. The FFIEC examines both together and its manual has an OFAC section, but the rules, thresholds and record periods differ.

When was the Bank Secrecy Act passed?

In 1970, as Title II of Public Law 91-508, which the regulations still cite in their penalty section. It has been amended many times since, most broadly by the USA PATRIOT Act of 2001 and the Anti-Money Laundering Act of 2020, which rewrote the statute's statement of purpose.

Do Bank Secrecy Act requirements change often?

The core rules for banks change rarely: the CTR and SAR rules for banks were unchanged through 2026. Guidance, FAQs and examination procedures change more often, as with the SAR FAQs of October 2025 and the OCC's community bank procedures of February 2026. The 2026 changes are sorted there into final and proposed.