Bank Secrecy Act (BSA): A Compliance Guide

The Bank Secrecy Act (BSA) requires covered financial institutions to maintain records and report certain financial activity to help government agencies detect and investigate money laundering and other financial crimes. Its requirements include maintaining an effective anti-money laundering program, identifying and reporting suspicious activity when required, and keeping records of covered transactions. The specific obligations vary by institution type and the activities it conducts.

Meeting these requirements takes more than generating alerts or filing reports. Financial institutions need clear procedures, trained staff, reliable monitoring, and documented decisions that support appropriate follow-up. For professionals looking to strengthen their understanding of financial regulations and compliance responsibilities, the Certified Compliance Professional certification can provide a useful foundation. This guide explains what the BSA requires, where institutions commonly make mistakes, and how to manage compliance from customer onboarding through reporting.

What is the Bank Secrecy Act (BSA)?

The Bank Secrecy Act is a federal law that requires financial institutions to keep certain records and file certain reports so that authorities can detect and prevent money laundering, terrorist financing, and other financial crime. The name can sound backwards, since the law is really about reducing secrecy in the financial system. Together with later laws that expanded it, the BSA forms the backbone of what is commonly called anti-money laundering, or AML, compliance.

The Treasury Department's Financial Crimes Enforcement Network, known as FinCEN, administers the law, and federal regulators examine institutions for compliance. Examiners generally expect a program that fits the institution's size, products, customers, and locations, and they expect it to work in practice, not only on paper.

Who is covered

Banks, credit unions, broker-dealers, money services businesses, casinos, and other types of financial businesses can all be subject to BSA requirements. The specific obligations depend on the kind of institution and the activities it carries out. A business that adds a new product or enters a new line of service can pick up new obligations without noticing, so each organization should confirm its status with legal counsel and recheck it as the business changes.

The core of a BSA/AML program

A BSA/AML program is generally expected to be written, approved by senior leadership, and based on risk. While the exact requirements vary by institution type, the program is commonly described as resting on several elements:

• Internal controls that fit the institution's risks

• A designated BSA officer with real authority and access to leadership

• Ongoing training for the right people

• Independent testing of the program

• Customer due diligence, including understanding who owns and controls business customers

Everything starts with a risk assessment. An institution looks at its products, services, customer types, geographies, and delivery channels, and asks where it is most exposed to misuse. The answers shape how much monitoring, due diligence, and staffing each area needs. A risk assessment that is written once and filed away loses value quickly, so it should be refreshed whenever the business changes.

Knowing your customer

Understanding who the customer is and how they are likely to use an account is the foundation of the whole program. At account opening, institutions generally verify identity using reliable information and documents, and they keep records of how that was done. Identity verification tools can help streamline this process by checking customer information and supporting consistent onboarding procedures. Financial institutions can also explore HireValid for identity verification and background screening solutions that may support their onboarding workflows.

Customers who present higher risk call for deeper review. That might mean more information about the source of funds, a closer look at expected activity, or more frequent updates over time. The point is not to treat customers with suspicion. It is to match the level of scrutiny to the level of risk and to document the reasoning. A file that shows what was known, what was asked, and why a decision was made protects the institution and supports better monitoring later.

Reporting and recordkeeping

Reporting is the most visible part of the BSA, and the one where deadlines and accuracy matter most.

Currency transaction reports and suspicious activity reports

Institutions generally file reports on large cash transactions, and they file separate reports when they detect activity that appears suspicious. The first kind is based on a defined trigger. The second calls for judgment: staff must decide whether activity lacks a clear business or lawful purpose, shows signs of evasion, or otherwise looks unusual for the customer. Good suspicious activity reports are clear, specific, and written so that someone who has never seen the file can follow what happened and why it mattered.

One pattern deserves special mention. Breaking up transactions to avoid a reporting trigger, often called structuring, is a problem regardless of where the money came from. Staff should be trained to recognize it, and systems should be built to surface it.

Keeping suspicious activity reports confidential

The existence of a suspicious activity report is generally confidential, and institutions may not tip off the subject. This affects everyday behavior. Employees should know not to mention a report to a customer, and sharing within the institution should be limited to people who have a need to know. Casual conversation in a hallway can be a violation, so confidentiality belongs in training and in system access rules.

Recordkeeping

The BSA also requires institutions to keep certain records, including information connected to specific transactions and transfers. Retention periods and content requirements vary by record type, so institutions should maintain a records schedule and confirm it with counsel. Records need to be retrievable quickly, since regulators and law enforcement may ask for them on short notice.

Monitoring and alert handling

Transaction monitoring is where a program meets reality. Systems apply rules or models to flag activity, and analysts review the alerts to decide whether more action is needed. The weak points are predictable. Rules that no longer match the business produce too many meaningless alerts or miss meaningful ones. Heavy queues push analysts toward quick closures. Notes are too thin to show why a decision was made.

Strong programs treat alert handling as a craft. They tune rules against actual risk, give analysts clear procedures and enough time, require meaningful documentation, and test the results. A good test of the documentation is simple: could an examiner read the note a year later and understand the decision?

Related obligations

The BSA does not stand alone. Sanctions screening, which checks customers and transactions against government lists of restricted parties, is a separate obligation, but it is closely related and often handled by the same teams and systems. Information-sharing arrangements, requests from law enforcement, and other regulatory requirements also interact with BSA work. A program that treats these as one coordinated effort tends to be more consistent than one that runs them as separate silos.

Common BSA mistakes

The mistakes are familiar. The risk assessment is out of date. Customer files are thin or inconsistent. Monitoring rules are not tuned. Alerts are closed with minimal notes. Suspicious activity reports are late or vague. Training is generic and untested. The BSA officer lacks authority or resources. New products launch without a compliance review. Third parties perform part of the process without oversight. Each can look like a small gap. Together they form the pattern that leads to examination criticism, remediation projects, and, in serious cases, enforcement action. Consequences vary with the facts, so consult counsel about exposure.

Clear communication: the marketing side of BSA compliance

Marketing and BSA meet more often than most teams realize. New products, digital onboarding flows, partnerships, and promotional campaigns all change who the institution attracts and how activity looks. A campaign that brings in a wave of new accounts is also a wave of new risk to assess.

Teams that borrow habits from a digital marketing course, such as understanding the audience, measuring what a campaign delivers, and testing how messages are received, can help both sides. Explain to customers in plain language why information is requested, so due diligence feels like part of good service and not an obstacle. Bring compliance into campaign and product planning early, so risks are weighed before launch. And track where new customers come from, since the source of an account is a useful piece of context for monitoring.

Building a BSA compliance program

A reliable program has an owner, written procedures, trained staff, and regular testing. It should reach every part of the institution that opens accounts, moves money, or touches customer information, including third parties.

Governance, training, and systems

Give the BSA officer real authority, a direct line to senior leadership, and enough staff and tools to do the work. Brief the board regularly, since leadership accountability is part of what examiners look for. Train people by role: front-line staff on recognizing unusual activity and keeping reports confidential, onboarding teams on identification and due diligence, analysts on alert review and documentation, and managers on escalation.

Technology carries much of the load. Onboarding platforms, monitoring tools, case management, and reporting systems must work together so that information flows without gaps. People who understand how these systems connect, a skill built through tech certifications, can find problems such as customer data that does not carry over into monitoring or alerts that never reach a case file.

Records and access controls matter as well. Ideas from deep tech certifications, like secure storage, access permissions, and tamper-evident logs, support a reliable trail showing who reviewed what, when, and with what conclusion, while protecting the confidentiality of sensitive reports.

Independent testing and review

An independent review lets an institution find weaknesses before an examiner does. Look at the following:

• The risk assessment against current products, customers, and channels

• A sample of customer files for identification and due diligence quality

• Monitoring rules, alert queues, and the quality of closure notes

• Timeliness and clarity of suspicious activity and cash transaction reports

• Training completion, confidentiality practices, and third-party oversight

Write down what you find and how you fix it. A habit of documented testing shows good faith and makes the next examination smoother.

Building compliance expertise on your team

BSA compliance reaches onboarding, operations, technology, marketing, fraud, and legal, so ownership is easy to blur. Giving the people who run the program formal training helps. The Certified Compliance Professional certification suits people who handle day-to-day compliance tasks like monitoring, documentation, and follow-through, which describes much of the work behind alert review and reporting.

Conclusion

The Bank Secrecy Act asks financial institutions to know their customers, watch for misuse, and report what matters. Confirm which obligations apply to your business. Build a written, risk-based program with a capable BSA officer, solid internal controls, and real training. Verify customers and understand higher-risk relationships. File accurate and timely reports, keep them confidential, and keep good records. Tune monitoring, document decisions, coordinate with sanctions work, and test the program independently.

Strong BSA compliance comes from clear governance, trained staff, well-configured systems, thoughtful communication, and regular testing. Set those up once, and a pattern in the data becomes a conversation that gets noticed instead of an alert that gets closed.

Frequently asked questions

1. What is the Bank Secrecy Act (BSA)?

It's a federal law that requires financial institutions to keep records and file reports that help detect and prevent money laundering, terrorist financing, and other financial crime.

2. What is anti-money laundering (AML) compliance?

It's the set of laws, policies, and controls institutions use to detect and prevent money laundering. The BSA is the backbone of AML compliance in the United States.

3. Who administers and enforces the BSA?

The Treasury Department's FinCEN administers it, and federal regulators examine institutions for compliance.

4. Who must comply with the BSA?

Banks, credit unions, broker-dealers, money services businesses, casinos, and other financial businesses, depending on their type and activities. Confirm your status with counsel.

5. What are the elements of a BSA/AML program?

Commonly internal controls, a designated BSA officer, ongoing training, independent testing, and customer due diligence.

6. What does a BSA officer do?

Oversees the program day to day, with the authority, resources, and access to leadership needed to manage risk and respond to problems.

7. What is a BSA/AML risk assessment?

A review of products, services, customers, geographies, and channels to find where the institution is most exposed to misuse, used to shape controls.

8. What is a customer identification program?

Procedures for verifying a customer's identity at account opening using reliable information and documents, and for keeping records of how it was done.

9. What is customer due diligence?

Gathering and reviewing information to understand a customer, their expected activity, and their risk, with deeper review for higher-risk customers.

10. What is beneficial ownership?

The individuals who own or control a business customer. Institutions generally identify and verify them as part of due diligence.

11. What is enhanced due diligence?

Additional review applied to higher-risk customers, such as more information about the source of funds or closer monitoring of activity.

12. What is a currency transaction report?

A report filed on large cash transactions, based on a defined trigger set by the rules.

13. What is a suspicious activity report?

A report filed when activity appears to lack a lawful or business purpose, suggests evasion, or is otherwise unusual, based on staff judgment.

14. Can an institution tell a customer a suspicious activity report was filed?

No. Suspicious activity reports are generally confidential, and institutions may not tip off the subject.

15. What is structuring?

Breaking up transactions to avoid a reporting trigger. It's a problem regardless of where the money came from.

16. What is transaction monitoring?

Using rules or models to flag unusual activity, followed by analyst review to decide whether further action or reporting is needed.

17. How long must records be kept?

Retention periods vary by record type. Maintain a records schedule and confirm it with counsel.

18. How does sanctions screening relate to the BSA?

It's a separate but closely related obligation that checks customers and transactions against government lists of restricted parties, often handled by the same teams and systems.

19. What happens if an institution fails to comply?

Consequences depend on the facts and can include examination criticism, required remediation, and enforcement action. Consult counsel about exposure.

20. How can institutions stay BSA compliant?

Keep a current risk assessment, empower the BSA officer, train staff by role, tune monitoring, document decisions, file accurate and timely reports, oversee third parties, and test independently.