The CTR exemption annual review, as a file an examiner can test

The CTR exemption annual review is the check a bank must make "at least once each year" that an exempt listed company, listed-company subsidiary, non-listed business or payroll customer "remains eligible for an exemption", together with a review of the suspicious-activity monitoring on each account of a Phase II customer (31 CFR 1020.315(d)). It is the price of not filing currency transaction reports on a customer's routine cash, and it is what an examiner tests when they sample exemptions. Botminds' CTR Filing & Exemptions builds each review as a file: every test of the rule, the evidence for it, and the decision, prepared by a CTR specialist and approved by the BSA officer.

The review is easy to do badly because the rule names the outcome, not the paperwork. A bank must take the steps "a reasonable and prudent bank would take and document" to assure itself that a person is exempt, and "document the basis for its conclusions" (31 CFR 1020.315(e)(1)). A one-line note that says "still eligible" documents nothing an examiner can test. The file below does.

What is a CTR exemption annual review?

It is the yearly confirmation that a designated exempt person still meets the test it was designated under. The 2008 exemption rule, in force since 5 January 2009, ended the biennial re-filing of designations for Phase II customers and kept the yearly check: "an annual review of these customers must still be conducted" (FinCEN, December 2008). For a Phase II customer the rule adds a second duty to the same review: look at how the bank's monitoring system applies "to each existing account" of the exempt person.

Not every exempt person needs one. Banks, federal, state and local government departments and agencies, and bodies exercising governmental authority are Phase I customers that need neither a designation nor an annual review. Listed companies and their 51%-owned subsidiaries need both, because a listing can end. Non-listed businesses and payroll customers need both, because the tests depend on how they behave. The difference is set out in how to tell a Phase 1 from a Phase 2 exempt person.

How often must CTR exemptions be reviewed?

At least once a year for each exempt person who needs a review, and sooner when the bank learns something that changes the answer. The rule's safe harbor is built around the annual cycle: "absent any specific knowledge of information indicating that a customer no longer meets the requirements of an exempt person", a bank satisfies the rule by continuing to treat the customer as exempt "until the completion of that customer's next required periodic review" (31 CFR 1020.315(g)(2)).

The phrase "specific knowledge" does the work. Once the bank has reason to believe the customer does not qualify, or that a transaction is not the exempt person's own, the protection is gone; the rule withdraws it from a bank that has reason to believe the customer no longer meets the criteria (1020.315(g)(1)(ii)). Some changes end an exemption on their own: a listed company's status "ceases once such entity ceases to be listed", and a subsidiary's once the listed parent owns less than 51% (1020.315(i)). A bank that hears of a delisting in March should not wait for a review due in October.

What documentation is needed for CTR exemptions?

Enough for an examiner to reach the same conclusion from the file alone. For each test, the file should name the source the bank relied on and when it checked it. The rule allows specific sources for some tests: for a listing, any published listing, a stock symbol guide, SEC EDGAR or the exchange's own site; for a subsidiary, an authenticated officer's certificate, IRS Form 851 or the parent's annual report or Form 10-K (31 CFR 1020.315(e)(3)–(4)).

The 50% test needs the most care. FinCEN's guidance, as the FFIEC manual summarizes it, is that the bank "must consider and maintain materials and other supporting information" showing its determination was reasonable, based on "the nature of the customer's business, the purpose of the customer's accounts, and the actual or anticipated activity in those accounts" (FFIEC BSA/AML Manual, Transactions of Exempt Persons). Banks disagree about how much is enough. GAO found that although FinCEN's 2008 rule said banks need not keep separate documentation for determinations already supported by other BSA work, some of the bankers it interviewed still thought Phase II exemptions needed more (GAO-25-106500). Keeping the evidence beside each test settles the argument.

The test most reviews miss: cash that belongs to someone else

A Phase II exemption covers the customer's own cash through its exemptible accounts and nothing more. The rule's limitation is short: "a transaction carried out by an exempt person as an agent for another person who is the beneficial owner of the funds" is not covered (31 CFR 1020.315(f)). Grocery stores and gas stations are exactly the businesses that add a money transmitter's counter, which is why GAO reported banks holding back from exempting non-listed businesses with any ineligible line of business: working out and watching how much of the business it is takes too long (the guide to CTR-exempt businesses covers the test).

In the sample file, the money order counter passes the revenue test easily: its fees are 6.2% of Cedar Basin's gross revenue. But the cash it collects is the money transmitter's, and it lands in a separate settlement account. Nine deposits, $41,300 since March, were never the grocer's to exempt. The narrowest fix keeps the exemption on the operating account and reports the settlement account's cash. On two days since March that account alone went over $10,000, so two reports are owed late, and the agent drafts them for the BSA officer to decide how to file.

CTR Filing & Exemptions: the review argues each test, and proposes the narrowest fix

The three options are shown side by side with their consequences, so the decision is the BSA officer's, made on the evidence.

What happens if a CTR exemption was wrong?

It depends on whether the customer stopped qualifying or never qualified. If a customer that met the tests in an earlier year fails one at a timely annual review, FinCEN's answer is that the bank "should document its determination of ineligibility and cease to treat the customer as exempt", and it "is not required to back file CTRs" for that customer (FinCEN, FIN-2012-G003). FinCEN's own example is a non-listed business that "conducted only four reportable currency transactions during the year under review".

An exemption that was improper from the start is different. The FFIEC manual says the bank "must begin filing CTRs on reportable transactions", may revoke by filing a DOEP report with "Exemption Revoked" checked, and should ask FinCEN's Resource Center whether to backfile the currency transactions it failed to report (FFIEC BSA/AML Manual). Transactions that were never covered, such as the agent's cash in the sample, are reportable whatever the exemption says; the manual's CTR section notes that in most cases a bank can submit late CTRs without asking FinCEN first (FFIEC, Currency Transaction Reporting). What late filing can cost is the subject of CTR late filing penalties.

When must a DOEP be revoked?

Never, strictly: FinCEN's guidance says "banks have never been required to formally revoke an exemption using the DOEP report". The duty is to stop treating the customer as exempt and start filing. FinCEN still explains why a voluntary revocation helps, because silence misleads. Its example is an exempt business with no reportable transactions for a year: if the exemption stays on file, "a law enforcement agent investigating the company would likely conclude incorrectly from the lack of CTR filings that the customer is still being treated as exempt" (FIN-2012-G003, section I).

A sound policy revokes whenever an exemption ends for a reason a reader of the data could not otherwise see, and always when an exemption was improper. It also records who decided: the FFIEC manual asks examiners to look for segregation of duties in the exemption process, and a revocation prepared and decided by one person is the weak point they look for (FFIEC).

What do examiners check on CTR exemptions?

They check that each exempt customer still qualifies, by looking at the customer's actual cash. The OCC's community bank procedures, in force for exams beginning 1 February 2026, list as an example of testing "determining whether eligible Phase II CTR-exempt customers (or nonlisted businesses) have been exempted appropriately by reviewing annual reportable cash transactions" (OCC Bulletin 2025-37, attachment). Under the same procedures, testing is sized to the bank's risk and may be lighter at lower-risk banks, but exemptions are an easy sample to draw.

The FFIEC manual adds three things examiners may read: correspondence from the BSA E-Filing System about DOEP filings, recent independent testing or audit reports, and the controls around the process, including whether those who complete DOEPs also decide to file them. A review file with each test's evidence, two names and a date answers all three. The sample credit union's third-quarter examiner file contains nine DOEP filings and 38 annual reviews, each with its evidence.

Exempt persons stay in view on the cash day, unreported but counted

How long the review takes, and where the hours go

By hand, most of a review is gathering: the account history, the count of reportable days, the registry check, the financial statements, the monitoring report. Botminds estimates about two hours per review at a credit union the size of the sample, with about 140 a year: some 280 hours, most of it collecting rather than judging. That is our estimate, not a measured result.

The agents' part is the gathering and the first argument: each test laid out with its source, a proposal and its alternatives. The CTR specialist checks it and prepares it; the BSA officer decides. The time saved is not the point of the file, though. The point is that the decision can be tested by someone who was not there. For the case for exempting more customers in the first place, see why banks file CTRs on businesses they could exempt.

Questions people ask

Do banks have to review Phase I exemptions every year?

Only for listed companies and their subsidiaries, where the review confirms the listing or the 51% ownership. Other banks and government bodies need neither a DOEP filing nor an annual review under the 2008 rule. All exempt persons still fall under the bank's suspicious-activity monitoring.

Does the annual review have to be on the anniversary of the designation?

The rule requires a review at least once each year, not on a particular date. Many banks review all exempt persons in one month, but a review done more than a year after the last one leaves the bank outside the safe harbor for the gap.

Can we keep an exemption for a customer we filed a SAR on?

Yes. FinCEN's guidance says a bank is not required to stop treating a person as exempt because a transaction was reported in a SAR. The decision to keep or revoke follows the bank's risk-based policies, and the SAR duty continues either way.

Do we need to re-file Form 110 every year?

No. The biennial renewal ended with the 2008 rule, effective 5 January 2009. The DOEP is a one-time filing; the annual review is kept in the bank's own records, unless the customer restructures and a new designation is needed.

Do you need to backfile CTRs after a wrong exemption?

Not when a properly exempted customer stopped qualifying and the bank found it at a timely annual review. When an exemption was improper from the start, the FFIEC manual says to ask FinCEN's Resource Center whether to backfile, and transactions that were never covered, such as cash deposited for another person, are reportable regardless.

Who should sign the annual review?

Someone other than the person who prepared it, with authority to decide: usually the BSA officer or a delegate. The FFIEC manual tells examiners to look for segregation of duties in the exemption process, and a review with one name on it is harder to defend.