What the Bank Secrecy Act Is and What It Requires

The Bank Secrecy Act is the foundation of US anti-money laundering rules. Where it came from, who runs it, and what it makes banks and money services businesses do.

Published	14 October 2026

Ask what the Bank Secrecy Act is and the regulations answer with a name you may not expect. § 1010.100 says the Currency and Foreign Transactions Reporting Act and related statutes have come to be referred to as the Bank Secrecy Act. The BSA is that body of law, plus the rules written under it.

FinCEN's history page says the Bank Secrecy Act of 1970 set recordkeeping and reporting rules for individuals, banks and other financial institutions. That is the whole design in one line. The law makes financial businesses write things down and tell the government about certain transactions.

Who administers the BSA

FinCEN runs it. FinCEN's page says the Financial Crimes Enforcement Network acts as the designated administrator of the Bank Secrecy Act. § 1010.100 says FinCEN means the Financial Crimes Enforcement Network, a bureau of the Department of the Treasury.

Its job is broader than paperwork. FinCEN's advisory says its mission is to safeguard the financial system from illicit use and combat money laundering and its related crimes including terrorism.

The rules are checked, not just written. § 1020.320 says FinCEN or its delegatees examine banks for compliance with this section, and failure may violate the Bank Secrecy Act. The BSA sits inside the wider body of anti money laundering law.

What the BSA requires: reporting

FinCEN's advisory says BSA reporting refers to legal requirements for financial institutions and certain businesses to report certain financial transactions to FinCEN. Two of those reports follow.

The first is the currency transaction report. FinCEN's advisory says it covers a transaction in currency of more than $10,000 in aggregate per business day. The CTR currency transaction report page covers that report in full.

The second is suspicious activity reporting. § 1020.320 requires every bank to file a report of any suspicious transaction relevant to a possible violation of law or regulation. The FFIEC manual says suspicious activity monitoring and reporting are critical internal controls.

Where do the reports go? § 1010.306 says reports required by §§ 1010.311, 1010.313, 1020.315, 1021.311 and 1021.313 shall be filed with FinCEN, unless otherwise specified. § 1010.306 also says forms for those reports may be obtained from the BSA E-Filing System.

What the BSA requires: recordkeeping

Kept records are the other half of the law. § 1010.430 says all records required by the chapter shall be retained for a period of five years.

The rule is flexible about where records come from. § 1010.430 says records required by the chapter may be those made in the ordinary course of business by a financial institution. Where nothing exists, § 1010.430 says a financial institution must prepare a written record if no record is made in the ordinary course of business.

Storage has a test. § 1010.430 says records must be filed or stored so they are accessible within a reasonable period of time. A box no one can find does not pass.

Some records are named one by one. § 1010.430 requires a retained copy of both the front and back of each check, draft, or similar instrument. § 1010.410 requires financial institutions to keep a record of each extension of credit over $10,000, except credit secured by real property. § 1010.410 applies its transmittal of funds recordkeeping rules to nonbank financial institutions for transmittals of $3,000 or more.

What the BSA requires: AML programs

Reporting and recordkeeping do not run themselves.

For money services businesses, § 1022.210 requires each money services business to develop, implement, and maintain an effective anti-money laundering program. § 1022.210 also says the program must incorporate policies, procedures, and internal controls reasonably designed to assure compliance with the chapter. The BSA anti money laundering page covers what a bank's compliance program must include.

For banks, the program rule reaches into customer knowledge. § 1020.210 says customer due diligence includes understanding the nature and purpose of customer relationships to develop a customer risk profile.

Money services businesses also register. § 1022.380 says each money services business, whether or not licensed by any State, must register with FinCEN. § 1022.380 also says it is unlawful to do business without complying with 31 U.S.C. 5330 and this section.

How the BSA grew into today's AML framework

The 1970 law did not stay still. FinCEN's history page says the Money Laundering Control Act of 1986 made money laundering a federal crime.

The rules also provide for information sharing. FinCEN's advisory says institutions sharing information under the section 314(b) safe harbor may share information about suspected terrorist financing or money laundering. § 1010.520 says FinCEN may require any financial institution to search its records for accounts or transactions with a named individual, entity, or organization. § 1010.520 also says a financial institution must search for transactions by or for a named suspect during the preceding six months. A match must be reported to FinCEN in the manner and time frame FinCEN's request specifies. The FinCEN 314 page covers both programs.