4.1 U.S. Regulatory Architecture: BSA, PATRIOT Act, and AMLA 2020

The United States anti-money laundering (AML) and counter-terrorist financing (CFT) framework is a layered statutory architecture developed over more than five decades. For financial technology compliance professionals, understanding this regulatory framework is essential. Modern FinTech operating models—ranging from Banking-as-a-Service (BaaS) partnerships to peer-to-peer payment networks and crypto-asset platforms—must operate within these federal statutes and FinCEN regulations.

Evolution of the U.S. Anti-Money Laundering Framework

The foundation of modern U.S. financial crime regulation began with the Currency and Foreign Transactions Reporting Act of 1970, commonly known as the Bank Secrecy Act (BSA) (codified at 31 U.S.C. § 5311 et seq.). Congress initially designed the BSA to create an auditable paper trail of physical currency transactions to assist law enforcement in criminal investigations.

Subsequent statutory enactments expanded the reach and severity of federal AML obligations:

• Money Laundering Control Act of 1986: Formally established money laundering as a distinct federal crime under 18 U.S.C. §§ 1956 and 1957, prohibited the intentional structuring of transactions to evade reporting thresholds, and established civil and criminal forfeiture mechanisms.
• Annunzio-Wylie Anti-Money Laundering Act of 1992: Strengthened sanctions for BSA violations, authorized the revocation of bank charters for financial crime convictions (the "death penalty" clause), and authorized the creation of the Suspicious Activity Report (SAR) system.
• USA PATRIOT Act of 2001 (Title III): Enacted in the immediate wake of the September 11 terrorist attacks, the International Money Laundering Abatement and Financial Anti-Terrorism Act of 2001 broadened federal jurisdiction, targeted international correspondent banking, prohibited shell banks, and mandated customer verification programs.
• Anti-Money Laundering Act of 2020 (AMLA 2020): Enacted as Division F of the National Defense Authorization Act (NDAA) for Fiscal Year 2021, AMLA 2020 represented the most comprehensive legislative modernization of U.S. AML laws since 2001. It updated regulatory priorities, enhanced whistleblower protections, expanded extraterritorial subpoena powers, and enacted the Corporate Transparency Act (CTA).

---

BSA Core Reporting Thresholds & Timelines: CTRs, SARs, and Structuring

The operational core of the BSA rests on mandatory reporting and recordkeeping administered by the Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Department of the Treasury.

Currency Transaction Reports (CTR, FinCEN Form 112)

Under 31 CFR § 1010.311, financial institutions must file a Currency Transaction Report (CTR) for each deposit, withdrawal, exchange of currency, or other payment or transfer involving a transaction in physical currency of more than $10,000 conducted by, or on behalf of, one person in a single business day.

Key CTR operational rules include:

• Definition of Currency: Physical paper money and coin of the United States or any other country. It does not include electronic funds transfers, ACH payments, or personal checks.
• Multi-Transaction Aggregation: Multiple cash transactions conducted across branches or digital retail reload endpoints within the same business day must be aggregated if the institution knows that they are conducted by or on behalf of the same customer and total more than $10,000.
• Filing Timeline: CTRs must be electronically filed via FinCEN's BSA E-Filing System within 15 calendar days following the date of the transaction.

Suspicious Activity Reports (SAR, FinCEN Form 111)

Under 31 CFR § 1020.320 (for banks) and 31 CFR § 1022.320 (for Money Services Businesses), institutions must file a Suspicious Activity Report (SAR) whenever they detect a known or suspected violation of federal law, or suspicious activity involving money laundering, structuring, or terrorist financing.

Mandatory reporting thresholds depend on the institution's charter and whether a suspect has been identified:

• Depository Institutions (Banks, Credit Unions): Mandatory filing for transactions involving or aggregating $5,000 or more where a suspect can be identified; mandatory filing for transactions involving or aggregating $25,000 or more regardless of whether a potential suspect can be identified; mandatory filing for insider abuse involving any amount.
• Money Services Businesses (MSBs, including Money Transmitters and Crypto Exchanges): Mandatory filing for transactions involving or aggregating $2,000 or more that the MSB knows, suspects, or has reason to suspect involves funds derived from illegal activity, is intended to hide or disguise illicit funds, or is designed to evade BSA requirements (or $5,000 or more for issuers/sellers of money orders or traveler's checks).

SAR Filing Timelines and Non-Disclosure Rules

• 30-Day Filing Rule: A SAR must be filed within 30 calendar days after the date of initial detection of facts that may constitute a basis for filing. Initial detection does not mean the date the transaction occurred; it means the date when an alert is investigated and determined by the compliance function to involve suspicious activity.
• 60-Day Extension for Unknown Suspects: If no suspect was identified on the date of initial detection, the institution may delay filing for an additional 30 calendar days to identify a suspect, but in no case may filing occur later than 60 calendar days after the date of initial detection.
• Strict Non-Disclosure ("Tipping-Off" Prohibition): Under 31 U.S.C. § 5318(g)(2), financial institutions, their directors, officers, employees, and agents are strictly prohibited from notifying any person involved in the transaction that the transaction has been reported on a SAR. Willful violations carry civil monetary penalties and criminal imprisonment of up to 5 years.
• Statutory Safe Harbor: Under 31 U.S.C. § 5318(g)(3), financial institutions and their personnel enjoy absolute civil immunity from liability under federal, state, or local law for filing a SAR or reporting suspicious activity in good faith to law enforcement.

Structuring (31 U.S.C. § 5324)

Structuring is the criminal act of conducting one or more currency transactions in any amount, at one or more financial institutions, on one or more days, for the purpose of evading BSA reporting requirements (such as the $10,000 CTR threshold). Common structuring includes making multiple cash deposits of $9,500 over consecutive days or visiting distinct branches to deposit $3,000 each. Structuring is an independent federal crime regardless of whether the underlying funds originate from legitimate or illicit sources.

---

USA PATRIOT Act Title III: International Money Laundering Abatement

Title III of the USA PATRIOT Act introduced major extraterritorial mandates to cut off international illicit financial flows from the U.S. financial system.

Section 311: Special Measures

Codified at 31 U.S.C. § 5318A, Section 311 grants the Secretary of the Treasury the authority, upon finding that reasonable grounds exist for concluding that a jurisdiction outside of the United States, one or more foreign financial institutions, or one or more classes of transactions is of "primary money laundering concern," to require domestic financial institutions to take one or more of five Special Measures:

1. Enhanced recordkeeping and reporting on specific transactions.
2. Collection of beneficial ownership information for specific accounts.
3. Identification of customers permitted to use payable-through accounts.
4. Identification of customers permitted to use correspondent accounts.
5. Prohibition or conditioning of correspondent or payable-through accounts for the designated foreign entity. Special Measure 5 is an extreme regulatory sanction, effectively severing the targeted foreign bank or jurisdiction from clearing transactions in U.S. dollars.

Section 312: Special and Enhanced Due Diligence (EDD)

Section 312 mandates that U.S. financial institutions establish risk-based policies, procedures, and controls for foreign correspondent accounts and private banking accounts. For foreign private banking accounts—defined as accounts requiring a minimum aggregate deposit of $1,000,000 for non-U.S. individuals—institutions must identify the nominal and beneficial owners and conduct Enhanced Due Diligence (EDD) on any account owned or controlled by a Politically Exposed Person (PEP), including senior foreign political figures, their immediate family members, and close associates, to verify the legitimate source of wealth and funds.

Section 313 & 319: Shell Bank Prohibition and Subpoena Authority

• Shell Bank Ban (Section 313): Prohibits U.S. depository institutions and broker-dealers from establishing, maintaining, administering, or managing correspondent accounts in the United States for foreign shell banks—defined as foreign banks without a physical presence in any country that are not affiliated with an inspected depository institution. U.S. institutions must take reasonable steps to ensure foreign correspondent accounts are not used to provide indirect services to foreign shell banks.
• Foreign Bank Certifications (Section 319): Foreign banks maintaining U.S. correspondent accounts must execute periodic certifications (renewed at least every three years) confirming physical presence and designating a registered agent in the United States authorized to accept service of legal process.

Section 326: Customer Identification Program (CIP)

Implemented under 31 CFR § 1020.220, Section 326 requires financial institutions to implement a written Customer Identification Program (CIP) appropriate for their size and risk profile. At a minimum, institutions must collect four mandatory data points prior to opening an account:

1. Full Legal Name
2. Date of Birth (for individuals)
3. Physical Address (residential address for individuals, principal place of business for legal entities)
4. Identification Number (Taxpayer Identification Number [TIN/SSN] for U.S. persons; passport number, alien identification card, or government-issued photo identity for non-U.S. persons).

Institutions must verify the customer's identity within a reasonable timeframe through documentary methods (government-issued photo ID) or non-documentary methods (eIDV, consumer credit databases) and determine whether the applicant appears on any federal list of known or suspected terrorists (such as OFAC lists).

---

Anti-Money Laundering Act of 2020 (AMLA 2020) Landmark Reforms

AMLA 2020 introduced comprehensive legislative updates to modernize BSA/AML compliance, incentivize whistleblowers, and heighten enforcement tools.

Overhauled Whistleblower Bounties

Prior to AMLA 2020, BSA whistleblower rewards were capped at an administrative limit of $150,000, which provided insufficient incentive for high-level insiders to report systemic institutional fraud. Section 6314 of AMLA 2020 restructured the BSA whistleblower program to mirror the SEC's Dodd-Frank framework:

• Bounty Scale: For judicial or administrative enforcement actions where monetary sanctions exceed $1,000,000, qualifying whistleblowers can receive an award of up to 30% of the total monetary penalties collected. The Anti-Money Laundering Whistleblower Improvement Act of December 2022 made awards mandatory at 10% to 30%, created a dedicated fund, and extended the program to sanctions violations.
• Implementing Rules: FinCEN is responsible for the implementing regulations. Eligibility details, such as how the program treats compliance and audit staff, depend on those rules; do not assume the SEC's whistleblower rules apply.
• Anti-Retaliation Protections: Provides explicit statutory remedies (including reinstatement, double back pay with interest, and litigation costs) for employees who face retaliation from employers for reporting BSA violations.

Enhanced Penalties for Repeat and Egregious Violators

AMLA 2020 introduced severe financial disincentives for recidivist institutions:

• Treble Penalties: FinCEN can impose additional civil penalties up to the greater of three times the profit gained or loss avoided, or two times the maximum penalty otherwise allowed for the violation, against repeat BSA violators.
• Bonus Disgorgement: Mandates that directors, officers, or employees convicted of violating the BSA must forfeit all bonuses earned during the calendar year in which the violation occurred or the following year.
• Industry Bar: Mandates that individuals convicted of an egregious BSA violation are barred from serving on the board of directors of any U.S. financial institution for 10 years following conviction.

Expanded Cross-Border Subpoena Powers

Section 6308 of AMLA 2020 expanded the authority of the Department of Justice (DOJ) and the Treasury Department under 31 U.S.C. § 5318(k). Regulators can now issue administrative subpoenas to any foreign bank that maintains a correspondent account in the United States, requesting records related to any account at the foreign bank, including records located entirely outside the United States that are relevant to an investigation. If a foreign bank fails to comply, the U.S. court can impose civil contempt penalties of up to $50,000 per day, and the Attorney General can order the U.S. financial institution to terminate the foreign bank's U.S. correspondent account within 10 business days.

Technology Pilots and FinCEN Priorities

AMLA 2020 directed FinCEN to issue formal National AML/CFT Priorities (such as corruption, cybercrime, terrorist financing, and virtual currency risks) and required financial institutions to incorporate these priorities into their risk-based compliance programs. It also created regulatory testing mechanisms encouraging institutions to deploy artificial intelligence, machine learning, and automated transaction monitoring systems.

---

FinCEN Information Sharing: Section 314(a) vs. Section 314(b)

The USA PATRIOT Act established two distinct information sharing channels that compliance professionals must differentiate on the exam.

                                INFORMATION SHARING CHANNELS
                                              │
                     ┌────────────────────────┴────────────────────────┐
                     ▼                                                 ▼
           Section 314(a) Mandatory                          Section 314(b) Voluntary
     ┌────────────────────────────────┐                ┌────────────────────────────────┐
     │ • Biweekly law enforcement list│                │ • FI-to-FI multilateral share  │
     │ • 14 calendar day response     │                │ • Annual FinCEN notification   │
     │ • Historical search:           │                │ • Covers ML and TF only        │
     │   - 12 months for accounts     │                │ • Statutory safe harbor        │
     │   - 6 months for transactions  │                │ • Strict non-disclosure        │
     │ • Law enforcement sensitive    │                │ • Peer verification of status  │
     └────────────────────────────────┘                └────────────────────────────────┘

• Section 314(a) (Mandatory Law Enforcement Inquiries): Operates as a centralized communication system where federal, state, local, and approved international law enforcement agencies transmit suspect lists through FinCEN to financial institutions. Institutions must query their systems to identify accounts maintained by named subjects during the preceding 12 months and transactions conducted during the preceding 6 months. Institutions must respond to FinCEN within 14 calendar days if positive matches are identified. Section 314(a) requests are strictly confidential, cannot be used for general underwriting or credit decisions, and do not constitute an order to freeze assets.
• Section 314(b) (Voluntary Financial Institution Sharing): Establishes a voluntary mechanism allowing participating financial institutions to share customer and transaction information with peer institutions to identify money laundering and terrorist financing activities. To qualify for the statutory safe harbor protecting them from civil privacy liability, institutions must submit an annual notice of participation to FinCEN, establish robust security safeguards, and verify that counterparty institutions are also enrolled in the 314(b) registry.

---

The Corporate Transparency Act (CTA) & Beneficial Ownership

Enacted as Title LXIV of the NDAA for FY2021 (part of AMLA 2020), the Corporate Transparency Act (CTA) was designed to stop illicit actors from hiding behind shell companies. FinCEN's 2022 reporting rule required most U.S. companies and registered foreign companies to file Beneficial Ownership Information (BOI) reports with FinCEN's Beneficial Ownership Secure System (BOSS). After litigation and a policy review, FinCEN's March 2025 interim final rule exempted all entities formed in the United States and all U.S. persons. Only foreign companies registered to do business in a U.S. state must still report, and they do not report U.S. beneficial owners. The definitions below describe the reporting regime as it applies to those remaining filers.

The Beneficial Owner Definition

A Beneficial Owner is defined as any individual who, directly or indirectly, either:

1. Exercises Substantial Control over the reporting company (such as serving as a senior officer [CEO, CFO, General Counsel], having authority over appointment or removal of officers, or directing major corporate decisions); OR
2. Owns or Controls at least 25% of the ownership interests of the reporting company (including equity, stock, voting rights, convertible instruments, or options).

Statutory Exemptions and Legal Posture

The CTA provides 23 statutory exemptions for entities already subject to comprehensive federal or state oversight, including public companies, banks, credit unions, broker-dealers, investment advisers, and "large operating companies" (entities that employ more than 20 full-time employees in the U.S., maintain an operating physical office within the U.S., and demonstrate more than $5,000,000 in gross receipts or sales on federal income tax returns).

In National Small Business United v. Yellen (N.D. Ala., March 2024), a district court held the CTA unconstitutional as applied to the plaintiffs, and other courts issued conflicting rulings before the 2025 interim final rule narrowed the requirement. FinCEN's access rule allows authorized agencies, and financial institutions with customer consent, to use the database for CDD purposes. None of this changes the CDD Rule duties of covered financial institutions.

---

Geographic Targeting Orders (GTOs)

Under 31 U.S.C. § 5326, the Director of FinCEN possesses the statutory authority to issue temporary Geographic Targeting Orders (GTOs). A GTO imposes enhanced recordkeeping and reporting obligations on financial institutions and non-financial businesses operating within a specific geographic territory for a period of up to 180 days (frequently renewed by FinCEN).

The best-known example is the residential real estate GTO program, which since 2016 has required title insurance companies in designated metropolitan areas to report certain all-cash purchases of homes by legal entities, including the beneficial owners behind the buyer. Coverage areas and thresholds have changed with each renewal, and FinCEN has also used GTOs for other sectors, such as money services businesses in specific border areas. Always check the current order before relying on a threshold.

---

Comparison of Major U.S. AML Statutory Frameworks

---

Realistic Exam Scenario

A transaction monitoring compliance specialist at a federally chartered sponsor bank investigates a series of alerts generated by a partnered non-bank FinTech mobile payment platform. Over a consecutive 10-day period, a newly onboarded corporate LLC customer received multiple automated clearinghouse (ACH) credits totaling $380,000 from dozens of unrelated third-party individuals across the country.

Within 24 hours of each ACH deposit, the corporate account executed outbound point-of-sale card transactions to purchase $9,800 blocks of open-loop prepaid gift cards at regional retail stores, alongside several physical currency withdrawals of $9,500 each at various branch ATMs across three neighbouring cities. An internal corporate records search reveals that the LLC was formed 45 days prior, lists a registered agent commercial mailbox as its primary physical address, and its managers have not answered the bank's request to certify the company's beneficial owners under the CDD Rule.

Step-by-Step Compliance Analysis:

1. Structuring & CTR Analysis: While the ATM cash withdrawals were conducted at $9,500 increments—technically below the single-transaction $10,000 CTR threshold—multiple withdrawals occurring within the same business day across multiple ATMs must be aggregated under 31 CFR § 1010.313. If aggregated cash withdrawals exceed $10,000 in a single day, the bank must file a Currency Transaction Report (FinCEN Form 112) within 15 calendar days. Furthermore, the repeated $9,500 withdrawals strongly suggest structuring under 31 U.S.C. § 5324, which requires intent to evade the reporting requirement.
2. Information Sharing via Section 314(b): The sponsor bank compliance officer identifies that the rapid purchase of prepaid cards and subsequent liquidation suggests an organized money mule or payment fraud network. The bank contacts three peer financial institutions whose cardholders originated the incoming ACH transfers. Because all participating institutions maintain active annual Section 314(b) registrations with FinCEN, they share account-level fraud data under the 314(b) statutory safe harbor, confirming that the initial ACH credits were funded via unauthorized account takeovers.
3. SAR Filing Deadlines & Non-Disclosure: Under 31 CFR § 1020.320, the suspicious activity exceeds the $5,000 depository threshold. The compliance function completed its alert investigation on October 15. The bank must file a Suspicious Activity Report (FinCEN Form 111) within 30 calendar days of this detection date (by November 14). Under 31 U.S.C. § 5318(g)(2), the bank is strictly prohibited from tipping off the FinTech customer or its registered agent regarding the SAR.
4. CDD and National Priorities: The bank flags the customer's refusal to provide beneficial ownership information as a major red flag, freezes the account in accordance with bank terms, and cross-references FinCEN's National AML Priorities regarding cybercrime and organized fraud.

---

Common Exam Traps

• Trap 1: Calculating SAR Filing Deadlines from Transaction Date: Candidates frequently calculate the 30-day SAR deadline from the date the suspicious transaction occurred. The law states the 30-day clock begins on the date of initial detection (when the institution discovers facts showing the transaction is suspicious). If no suspect is identified, the deadline extends up to 60 calendar days from initial detection.
• Trap 2: Confusing Section 314(a) and 314(b) Rules: 314(a) is a mandatory law enforcement inquiry with a strict 14-day turnaround and a 12-month account / 6-month transaction lookback. 314(b) is a voluntary peer-to-peer sharing program protected by an annual FinCEN registration and statutory safe harbor.
• Trap 3: Misidentifying Whistleblower Bounties: Assuming whistleblower rewards remain capped at $150,000. AMLA 2020 replaced the $150,000 cap with a discretionary reward of up to 30% of monetary sanctions collected in judicial or administrative actions exceeding $1,000,000.
• Trap 4: Conflating CTR and SAR Filing Thresholds: Believing that any transaction exceeding $10,000 requires a SAR. A transaction exceeding $10,000 in physical currency automatically requires a CTR, but only requires a SAR if it is known or suspected to be illicit, structured, or unusual without economic substance.