U.S. Regulatory Expertise

Bank Secrecy Act and its implementing regulations

The Bank Secrecy Act (BSA) is the foundation of U.S. anti-money laundering law. Its implementing regulations, in Chapter X of Title 31 of the Code of Federal Regulations, apply to banks, credit unions, money services businesses, broker-dealers, casinos, and other financial institutions. The Anti-Money Laundering Act of 2020 updated the BSA and emphasized risk-based, effective programs.

The BSA requires covered institutions to maintain an AML/CFT program, keep certain records, and file reports with the Financial Crimes Enforcement Network (FinCEN). For banks, the program rests on internal controls, independent testing, a designated BSA officer, training, and risk-based customer due diligence.

What it means for your program

• A BSA/AML risk assessment that reflects the institution’s products, customers, and geographies
• Internal controls, independent testing, and training scaled to that risk
• A qualified BSA officer with the authority and resources to manage the program
• Record keeping and reporting that can be relied on in an examination

USA PATRIOT Act

Title III of the USA PATRIOT Act strengthened the BSA after 2001. Key provisions include customer identification program (CIP) requirements under Section 326, which set minimum standards for verifying the identity of customers who open accounts, and due diligence requirements under Section 312, including enhanced due diligence for certain correspondent accounts for foreign financial institutions and private banking accounts for non-U.S. persons.

The Act also prohibits correspondent accounts for foreign shell banks, and created the information-sharing framework under Section 314: Section 314(a) requests from FinCEN to financial institutions, and voluntary Section 314(b) sharing between institutions.

What it means for your program

• A written CIP with clear verification methods and procedures for when identity cannot be verified
• Due diligence and enhanced due diligence for foreign correspondent and private banking relationships
• Timely, documented responses to Section 314(a) requests
• A considered decision, and procedures, on Section 314(b) participation

FinCEN requirements: CDD Rule, SARs, and CTRs

FinCEN administers the BSA and issues its regulations, guidance, and advisories.

Customer Due Diligence (beneficial ownership) Rule. Requires covered institutions to identify and verify the beneficial owners of legal entity customers at account opening, to understand the nature and purpose of customer relationships to develop a customer risk profile, and to conduct ongoing monitoring and keep customer information current on a risk basis.

Suspicious activity reports (SARs). Institutions must report suspicious activity that meets regulatory thresholds. A bank SAR is generally due within 30 calendar days of initial detection of facts that may constitute a basis for filing, extended to no more than 60 days if no suspect has been identified. SAR confidentiality must be protected.

Currency transaction reports (CTRs). Institutions must report cash transactions of more than $10,000 in a business day, including multiple transactions by or on behalf of the same person that together exceed that amount.

What it means for your program

• Beneficial ownership procedures that are applied consistently and documented
• Customer risk profiles that inform monitoring and due diligence
• Alert and case management that supports well-reasoned, timely SAR decisions
• CTR aggregation, exemption, and filing controls that are tested

FinCEN’s April 2026 proposed AML/CFT program rule

In April 2026, FinCEN issued a proposed rule to reform AML/CFT program requirements, and federal banking agencies issued companion proposals. The proposal would place greater emphasis on effective, risk-based programs grounded in each institution’s own risk assessment, and on how supervisors evaluate programs. It replaces an earlier proposal from 2024, which FinCEN withdrew.

As of October 2026, this is a proposed rule and is not final. Current program requirements remain in effect, and the final rule may differ from the proposal.

What it means for your program

• Track the rulemaking and any final rule, including effective dates
• Use the proposal’s direction to strengthen the risk assessment as the basis of the program
• Avoid building program changes around proposed text that may change

OFAC sanctions compliance

The Office of Foreign Assets Control (OFAC), part of the U.S. Department of the Treasury, administers and enforces U.S. economic and trade sanctions. U.S. persons, including financial institutions, must block or reject transactions involving sanctioned persons, entities, and jurisdictions, and report them to OFAC. Civil liability is strict, meaning a violation can occur without intent.

OFAC’s Framework for OFAC Compliance Commitments describes the components of an effective sanctions compliance program: management commitment, risk assessment, internal controls, testing and auditing, and training. Under OFAC’s 50 Percent Rule, entities owned 50 percent or more, in the aggregate, by blocked persons are also treated as blocked.

What it means for your program

• A sanctions risk assessment that reflects customers, products, geographies, and payment flows
• Screening of customers, counterparties, and transactions, with calibrated fuzzy-matching
• Clear procedures to block, reject, and report, and to escalate potential matches
• Ownership analysis that addresses the 50 Percent Rule

FFIEC BSA/AML Examination Manual and supervisory expectations

The Federal Financial Institutions Examination Council (FFIEC) BSA/AML Examination Manual sets out the procedures examiners use to assess BSA/AML and OFAC compliance programs. It is also a practical guide for institutions preparing for an examination.

Banks and credit unions are examined by their primary federal regulator: the Office of the Comptroller of the Currency (OCC) for national banks and federal savings associations, the Federal Deposit Insurance Corporation (FDIC) for state non-member banks, the Federal Reserve for state member banks and bank holding companies, and the National Credit Union Administration (NCUA) for federally insured credit unions. State regulators examine state-chartered institutions and many money services businesses.

What it means for your program

• Programs that can be explained and evidenced against the manual’s procedures
• Examination readiness: document requests, management interviews, and a clear story of the program
• Credible remediation of findings, with progress reporting to the board

Fraud risk management frameworks

The COSO/ACFE Fraud Risk Management Guide, issued by the Committee of Sponsoring Organizations of the Treadway Commission and the Association of Certified Fraud Examiners, is a widely used framework for managing fraud risk. It is built on five principles: fraud risk governance, fraud risk assessment, fraud control activities, fraud investigation and corrective action, and fraud risk management monitoring.

For financial institutions, fraud and AML programs increasingly overlap, because many fraud schemes generate suspicious activity reporting obligations and share data, systems, and investigative skills.

What it means for your program

• A fraud risk assessment across channels, products, and customer types
• Preventive and detective controls proportionate to the risks identified
• Investigation and corrective action processes, coordinated with BSA/AML
• Ongoing monitoring of how well fraud controls are working