CTR automation: what agents may do, and what people still sign

CTR automation means letting software do the mechanical work of currency transaction reporting: adding up each person's cash for the business day across every branch, ATM and night drop, filling the FinCEN CTR, checking it against the filing schema, chasing a missing ID and watching the 15-day deadline. All of that can be automated, and at most banks part of it already is. What cannot be handed over are the judgements the rules assign to the bank and its people: accepting that an identity is right, deciding to file, designating or revoking an exempt person, and deciding whether a pattern is suspicious. Botminds' CTR Filing & Exemptions uses agents for the first list and leaves the second with a CTR specialist and the BSA officer, with every step on an audit trail.

The reason to be precise is that CTR work is mostly volume. FinCEN received 20,564,724 CTRs from 15,468 filers in calendar 2022 and costs each at about eight minutes, which comes to 2.74 million hours a year (FinCEN, 89 FR 7767). Most of those minutes are mechanical. The errors that have cost banks most were not.

Can CTR filing be automated?

Yes, most of it, and Congress has asked for more. The Anti-Money Laundering Act of 2020 told Treasury to review CTR and SAR requirements, including "whether the process for the electronic submission of reports could be improved", for example by "allowing greater integration between financial institution systems and the electronic filing system to allow for automatic population of report fields", while not "bypassing the obligation of each reporting financial institution to assess the specific risk of the transactions reported" (AML Act, section 6204(b)(2)(H)). That one clause is the shape of good CTR automation: fill the fields automatically, keep the institution's own assessment.

Aggregation software is old news. The 2021 interagency statement on model risk for BSA/AML systems, now rescinded, gave "systems used to aggregate cash transactions occurring at the bank's branches for the purposes of filing Currency Transaction Reports" as an example of what "likely would not be considered" a model (interagency statement, April 2021). Its replacement, issued on 17 April 2026, excludes deterministic, rule-based processes from the definition of a model altogether, and leaves generative and agentic AI outside its scope (OCC Bulletin 2026-13). The rule-based adding-up is, in other words, ordinary software. Agents that read images and draft fields sit outside that guidance, which makes the bank's own controls around them matter more, not less.

What is CTR automation, step by step?

It is a chain in which each step either produces something a person checks or waits for a person's decision. Take a sample credit union, the fictional Norrell Federal Credit Union, on Thursday 8 October 2026. Overnight, the agents stacked 11,640 cash transactions by member and business day: 9,180 at teller windows, 2,214 at ATMs and 246 through night drops. Twenty-three members crossed $10,000; 21 drafts were complete by morning and two were waiting on a branch. Fourteen more came near the line. Calloway Auto Repair took in $8,000 and paid out $6,000; because cash in and cash out are added separately and never netted, no CTR was owed.

By the time the CTR specialist opens the day, the work left is judgement: one ID reading to check against an image, two branch answers to wait for, one exemption review to decide. She prepares the batch, the BSA officer approves it, and the E-Filing Clerk submits it and pins each BSA ID from the acknowledgment. How the agents add up one member's business day is a page of its own.

The maker prepares; the approve button is not hers

What parts of CTR filing need a person?

Four kinds of decision need a person: accepting evidence, deciding to file, approving an exception to the rules the system applies, and anything about suspicion. The FFIEC examination manual is direct about the second: "employees who complete CTRs generally should not also be responsible for the decision to file the reports", and any staff action that overrides the currency aggregation system should be approved by the BSA compliance officer or senior management (FFIEC BSA/AML Manual, Currency Transaction Reporting). An agent that completes a CTR is, for this purpose, the employee who completed it.

Can software designate exempt persons?

Software can prepare a designation; the decision to treat a customer as exempt is the bank's. The exemption rule requires a bank to "take such steps to assure itself that a person is an exempt person", meeting the standard of a reasonable and prudent bank and writing down the basis for its conclusion (31 CFR 1020.315(e)(1); the guide to the annual exemption review shows what that file looks like). FinCEN's guidance adds that "the decision to exempt, or to retain or revoke a customer's exemption, should be made by the bank in accordance with its risk-based anti-money laundering policies, procedures, and controls" (FinCEN, FIN-2012-G003).

Examiners apply the same separation to exemptions as to CTRs: "employees who complete DOEPs generally should not also be responsible for the decision to file the reports" (FFIEC BSA/AML Manual, Transactions of Exempt Persons). In the solution, the Exemption Reviewer lays out each test with its evidence and proposes keeping, narrowing or revoking; the CTR specialist prepares the change; the BSA officer approves. No exemption changes on one person's say, and none on an agent's. The annual review as a file an examiner can test shows what that evidence looks like.

Does a CTR exemption stop SAR monitoring?

No. An exemption removes the duty to file CTRs on the exempt person's covered transactions and nothing else. "Nothing in this section relieves a bank of the obligation, or reduces in any way such bank's obligation, to file a report required by § 1020.320", the SAR rule. The regulation's own example of what should prompt one is an exempt customer whose total cash activity jumps sharply from one year to the next (31 CFR 1020.315(h)(1)). For non-listed businesses and payroll customers, the bank must also maintain a monitoring system "reasonably designed to detect" such transactions, and review how it applies to each exempt account at every annual review.

This is a place where automation helps quietly. An exempt person's cash still flows through the stacking, so it can be counted, trended and compared year on year even though no CTR is drafted. On the sample credit union's Thursday, nine exempt persons made 31 transactions that were not reported, and each one was still counted.

Automation should make an exempt customer's cash more visible, not less. The report stops; the watching does not.

Who is responsible for CTR accuracy?

The bank, whatever software it uses. The filing rule says "all information called for in such forms shall be furnished" (31 CFR 1010.306(d)), and enforcement orders treat a system defect as the bank's failure. Two recent ones show how automated CTR processes fail, and neither involved a clever criminal defeating a control. They involved software that was never checked against what it should have caught.

At Capital One, an internal system assigned a "cash" code to customer withdrawals so they would reach CTR reporting, and "failed to assign this 'cash' code to armored car cash shipments" for some customers. FinCEN found the result was "approximately 50,000 reportable cash transactions totaling over $16 billion" left unreported over more than three years (FinCEN, Capital One assessment). At TD Bank, the bank "learned that its CTR application failed to verify whether an identifier (e.g., social security number) was collected within a CTR" in 2019, "considered it a low priority", and the defect was still open in 2021; late in the period, "nearly half of its CTR batch filings were not successfully sent to FinCEN" (FinCEN, TD Bank consent order).

Both failures share a cause: nothing compared what the system reported with what it should have reported. The fix is reconciliation, and examiners test for it: matching filed CTRs to the bank's own large cash report is one of the transaction tests the OCC's community bank procedures describe (OCC Bulletin 2025-37, attachment). Any CTR automation should be able to run that comparison every day, on every channel, including the ones coded differently.

What CTR automation leaves for the examiner

It should leave a trail an examiner can re-perform: for each CTR, which transactions made the stack, where each field came from, who accepted each reading and why, who prepared the batch, who approved it and what FinCEN acknowledged. Copies of CTRs, designations and their supporting records are kept for five years. The audit trail in CTR Filing & Exemptions records every action by a person or an agent with who, what, when, why and the evidence.

Every step by a person or an agent, with the reason and the evidence

Supervisors are signalling openness to this kind of tooling, with conditions. FinCEN's April 2026 proposed AML/CFT program rule says responsible experimenting with new technology would not, on that ground alone, add to an institution's enforcement risk (FinCEN, proposed rule, 91 FR 18704). The rule is still a proposal: comments closed on 9 June 2026 and no final rule had been published by late October 2026. It changes nothing about who signs a CTR.

How banks automate cash reporting without losing control

The banks that do this well automate in the order of risk: first the arithmetic, where software is simply more reliable than people, then the drafting, then the chasing, and they keep every decision point a named person's. The controls below are the ones examiners and enforcement orders point to.

That is the pattern Botminds' CTR Filing & Exemptions follows: seven agents with a written list of what each may never do, a maker and a checker on every batch and every exemption change, and settings that change only when the BSA officer approves a new version. Whether that is worth buying depends on your own volumes and failure points; the tests BSA/AML software should pass on cash reporting are a way to find out on your own past cash days.

Questions people ask

Is CTR aggregation software a model under the 2026 model risk guidance?

Usually not. The April 2026 guidance from the Federal Reserve, OCC and FDIC excludes deterministic rule-based processes from the definition of a model, and adding up cash by person and business day is rule-based. It also leaves generative and agentic AI outside its scope, so a bank governs those through its own controls.

Can a CTR be filed without anyone reviewing it?

Nothing in the regulation names a reviewer, but the FFIEC manual expects that employees who complete CTRs are not the ones who decide to file them, and examiners look for that separation. Filing what a system produced with no one checking is how defects like TD Bank's missing identifiers persisted for years.

Does automating CTRs reduce the number filed?

Not by itself, and it can raise it. GAO reported that automation has increased the number of CTRs filed, particularly aggregated ones, according to bank and credit union representatives. The number filed is set by the rules and the bank's exemptions, not by the software.

What happens to a CTR when a branch never sends the missing ID?

The report still has to be filed within 15 days. For a critical field the filer either provides the information or deliberately checks "Unknown", and the gap is documented. In the sample settings of the solution, an open CTR escalates to the BSA officer on day 7 and to the chief executive's office on day 10, well before day 15.

Who answers to the examiner for an agent's mistake?

The bank, through the people who accepted, prepared and approved the work. That is why every agent output that reaches a CTR passes a named person, and why the audit trail records the agent's version and the person's reason together.