Anti Money Laundering and the BSA: One System

BSA is the statute, AML is the work it demands. What the Bank Secrecy Act requires, who enforces it, and what a bank's compliance program must contain.

Published	14 October 2026

What BSA/AML means in banking

People in banking say "BSA/AML" as one word. The two halves are not the same thing, and the difference matters.

AML stands for anti money laundering. It is the work: spotting dirty money, reporting it, keeping records that hold up. BSA stands for the Bank Secrecy Act, the federal law that makes that work a legal duty.

The statute's own name is longer. § 1010.100 says the Currency and Foreign Transactions Reporting Act and related statutes have come to be referred to as the Bank Secrecy Act. So BSA is the shorthand for a set of laws, and AML is what those laws force a bank to do. One is the rulebook. The other is the practice.

New to the field? Start with a plain answer to what is AML anti money laundering. Then come back to the law.

Who administers the Bank Secrecy Act

A law needs an administrator. FinCEN's page says the Financial Crimes Enforcement Network acts as the designated administrator of the Bank Secrecy Act.

The duty began in 1970. FinCEN's history page says the Bank Secrecy Act of 1970 set recordkeeping and reporting rules for individuals, banks and other financial institutions.

The crime itself came later. FinCEN's page says the Money Laundering Control Act of 1986 established money laundering as a federal crime. So the reporting duty came first, and the criminal charge followed.

What the compliance program must include

The FFIEC manual sets out the parts. It says banks must set up and keep procedures that are reasonably designed to assure and monitor compliance with BSA rules.

The manual then names what the program must provide. A system of internal controls to assure ongoing compliance. Independent testing done by bank staff or an outside firm. A person or people named to watch day-to-day compliance. And a customer identification program with risk-based procedures.

That last piece is a program pillar of its own. The AML program guide sets out each of these parts.

Why written policies alone are not enough

A bank can write a perfect binder and still fail. The FFIEC manual says written policies, procedures, and processes alone are not sufficient for an adequate BSA/AML compliance program.

A policy means nothing if no one does the work. The internal controls have to work in the systems, and the independent testing has to check that they do.

Independent testing is the check that the controls still do what the policies promise.

How the program matches the bank's risk

The manual does not ask every bank for the same program. It says the BSA/AML compliance program should match the bank's money laundering and terrorist financing risk profile.

Banks face different risks. The program is supposed to scale to them. That judgment starts with an AML risk assessment of where the bank's own products and customers sit.

What the BSA requires banks to report and record

The program exists to carry out duties the Act created. FinCEN's advisory says BSA reporting refers to legal requirements for financial institutions and certain businesses to report certain financial transactions to FinCEN.

Two of those reports are the currency transaction report and the suspicious transaction report. FinCEN's advisory says a currency transaction report covers a transaction in currency of more than $10,000 in aggregate per business day. § 1020.320 requires every bank to file a report of any suspicious transaction relevant to a possible violation of law or regulation.

Records have a retention period too. § 1010.430 says all records required by the chapter shall be retained for a period of five years.

The full bank secrecy act reporting and recordkeeping rules are what this program runs. The program is the frame. The reports and records are the output.

How compliance is examined

The examination closes the loop. § 1020.320 says FinCEN or its delegatees examine banks for compliance with this section, and failure may violate the Bank Secrecy Act.

The FFIEC manual describes what examiners leave behind. It says BSA/AML exam findings must go in the report of examination or supervisory letters. It also says examiners should write down a first assessment of the bank's BSA/AML compliance program when their review is done.

So the examiner reviews the program and writes the assessment down. That is the whole system. A law. An administrator. A program. And someone who checks.