7.2 BSA/AML, CDD, OFAC Sanctions, and Fiduciary Account Controls

BSA/AML, CDD, OFAC Sanctions, and Fiduciary Account Controls

Quick Answer: Corporate fiduciaries must maintain a comprehensive Bank Secrecy Act / Anti-Money Laundering (BSA/AML) compliance program built upon five core pillars: internal controls, a designated BSA compliance officer, ongoing employee training, independent audit testing, and risk-based Customer Due Diligence (CDD). Financial institutions must file Currency Transaction Reports (CTRs / FinCEN Form 112) for cash transactions exceeding $10,000 in a single business day and Suspicious Activity Reports (SARs / FinCEN Form 111) within 30 calendar days (or 60 days if the suspect is unknown) for suspicious activity meeting the $5,000 threshold ($25,000 if no suspect). SAR filings are subject to strict non-disclosure "tipping off" prohibitions and absolute safe harbor protections under 31 U.S.C. § 5318(g). Office of Foreign Assets Control (OFAC) regulations mandate immediate asset blocking and a 10-business-day reporting deadline for transactions involving Specially Designated Nationals (SDNs).

---

1. The BSA/AML Regulatory Architecture and the Five Pillars

Congress established the modern anti-money laundering legal framework through successive landmark statutes: the Bank Secrecy Act of 1970 (BSA) (31 U.S.C. § 5311 et seq.), the USA PATRIOT Act of 2001 (Title III), and the Anti-Money Laundering Act of 2020 (AMLA). Corporate fiduciaries and trust banks are classified as "financial institutions" under federal law and must maintain an effective, written BSA/AML compliance program approved by their Board of Directors.

┌─────────────────────────────────────────────────────────────────────────────┐
│                     THE FIVE PILLARS OF BSA/AML COMPLIANCE                  │
├─────────────────────────────────────────────────────────────────────────────┤
│  PILLAR 1: System of Comprehensive Internal Controls                        │
│            • Written policies, account onboarding filters, CIP/CDD matrices │
│  PILLAR 2: Designated BSA/AML Compliance Officer                            │
│            • Qualified, fully authorized officer overseeing daily operations│
│  PILLAR 3: Ongoing, Comprehensive Employee Training Program                 │
│            • Tailored annual training for trust officers, administrators, ops│
│  PILLAR 4: Independent Audit and Testing                                    │
│            • Annual independent testing by internal audit or outside CPAs   │
│  PILLAR 5: Risk-Based Customer Due Diligence (CDD)                          │
│            • Codified in FinCEN 2016/2018 Rule: ongoing monitoring & KYC    │
└─────────────────────────────────────────────────────────────────────────────┘

---

2. Customer Identification Program (CIP) and Due Diligence (CDD)

Under 31 CFR § 1020.220 (implementing Section 326 of the USA PATRIOT Act), banks must implement a written Customer Identification Program (CIP) appropriate for their size and business type.

The Core Four CIP Data Points

Before opening any fiduciary account, the institution must obtain, at a minimum, four identifying data points for every individual or entity customer:

1. Legal Name (verified via government-issued photo ID, passport, or certified corporate charter);
2. Date of Birth (for natural persons) or Date of Formation (for legal entities);
3. Physical Street Address (residential street address for individuals; principal place of business or physical office for entities; P.O. Boxes are strictly prohibited as primary addresses);
4. Taxpayer Identification Number (TIN): Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN) for U.S. citizens/residents, or Employer Identification Number (EIN) for domestic entities; passport number, alien identification card number, or foreign tax number for foreign persons.

┌─────────────────────────────────────────────────────────────────────────────┐
│                     TRUST BENEFICIAL OWNERSHIP & CDD MATRIX                 │
├──────────────────────────────────────┬──────────────────────────────────────┤
│           TRUST PARTY ROLE           │          REQUIRED DUE DILIGENCE      │
├──────────────────────────────────────┼──────────────────────────────────────┤
│  Grantor / Settlor / Trustor         │ • Full CIP verification (4 points)   │
│                                      │ • Document Source of Wealth (SOW)    │
│                                      │ • Verify legitimacy of funding assets│
├──────────────────────────────────────┼──────────────────────────────────────┤
│  Trustee / Co-Trustees               │ • Full CIP verification (4 points)   │
│                                      │ • Background and OFAC screening      │
├──────────────────────────────────────┼──────────────────────────────────────┤
│  Trust Protectors / Advisors         │ • Identify and screen against OFAC   │
│                                      │ • Verify powers to remove/appoint    │
├──────────────────────────────────────┼──────────────────────────────────────┤
│  Current Distributees & Remaindermen │ • Identify all named beneficiaries   │
│                                      │ • CIP verification prior to making   │
│                                      │   any financial distribution         │
└──────────────────────────────────────┴──────────────────────────────────────┘

FinCEN Beneficial Ownership Rule (31 CFR § 1010.230)

For legal entity customers (corporations, LLCs, general/limited partnerships, and business statutory trusts) opening fiduciary accounts, banks must identify and verify beneficial owners under a two-pronged test:

• The Ownership Prong: Each individual who, directly or indirectly, owns 25% or more of the equity interests of the legal entity customer (between zero and four individuals);
• The Control Prong: A single individual with significant responsibility to control, manage, or direct the legal entity customer (e.g., Chief Executive Officer, Chief Financial Officer, Managing Member, General Partner, or Senior Vice President).

Fiduciary Entity Application: When an irrevocable family trust owns 25% or more of an LLC opening an account, the trustee is identified under the ownership prong. If a corporate trustee is named, the bank identifies the trust officer or designated individual exercising fiduciary management.

Source of Wealth (SOW) vs. Source of Funds (SOF)

In high-net-worth wealth management, regulators expect robust distinction between:

• Source of Wealth (SOW): The origin of the client's entire accumulated net worth over time (e.g., sale of a multi-generational manufacturing enterprise, corporate executive equity compensation, commercial real estate development);
• Source of Funds (SOF): The specific origin and flow of the particular assets being transferred into the fiduciary account (e.g., a wire transfer originating from the client's verified commercial checking account at a regulated domestic bank).

---

3. Currency Transaction Reports (CTR / FinCEN Form 112)

Under 31 CFR § 1010.311, financial institutions must file a Currency Transaction Report (CTR / FinCEN Form 112) for each deposit, withdrawal, exchange of currency, or other payment or transfer involving physical currency in excess of $10,000 conducted in a single business day.

┌─────────────────────────────────────────────────────────────────────────────┐
│                     CTR AGGREGATION & STRUCTURING RULES                     │
├─────────────────────────────────────────────────────────────────────────────┤
│  Scenario A: Permissible CTR Aggregation                                    │
│  • 10:00 AM: Settlor deposits $6,000 cash into Family Trust Account A.      │
│  • 02:30 PM: Same Settlor deposits $5,500 cash into Family Trust Account B. │
│  • TOTAL CASH = $11,500 (> $10,000 threshold).                              │
│  • ACTION: System aggregates deposits; Bank MUST file Form 112 within 15    │
│    calendar days (25 days electronically).                                  │
├─────────────────────────────────────────────────────────────────────────────┤
│  Scenario B: Criminal Structuring (31 U.S.C. § 5324)                        │
│  • Client attempts to deposit $9,800 cash to avoid triggering a CTR.        │
│  • When informed of CTR rules, client cancels transaction or splits into    │
│    two $4,900 cash deposits over two days.                                  │
│  • ACTION: DO NOT discuss evasion techniques; Bank MUST file a SAR!         │
└─────────────────────────────────────────────────────────────────────────────┘

• Physical Currency Defined: Coin and paper money of the United States or any foreign country. Physical currency does not include electronic wire transfers, ACH entries, cashier's checks, or personal checks.
• Filing Deadlines: CTRs must be filed electronically through FinCEN's BSA E-Filing System within 15 calendar days following the date of the transaction (or 25 calendar days under certain electronic filing formats).
• Anti-Structuring Prohibition (31 U.S.C. § 5324): It is a federal felony to structure, assist in structuring, or attempt to structure transactions to evade BSA reporting thresholds. Bank personnel are strictly prohibited from advising clients on how to avoid CTR filings.

---

4. Suspicious Activity Reports (SAR / FinCEN Form 111)

Under 12 CFR § 21.11 (OCC) and 31 CFR § 1020.320 (FinCEN), national banks and corporate fiduciaries must file a Suspicious Activity Report (SAR / FinCEN Form 111) whenever they detect a known or suspected violation of federal law or suspicious transaction involving funds derived from illegal activity.

Mandatory SAR Filing Thresholds

SAR Filing Timelines and Procedures

• Standard 30-Day Rule: The SAR must be filed no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing.
• Extended 60-Day Rule: If no suspect was identified on the date of initial detection, the bank may delay filing for an additional 30 calendar days to attempt to identify a suspect, but in no case may the filing exceed 60 calendar days after the date of initial detection.
• Immediate Law Enforcement Notification: For ongoing violations or imminent threats (e.g., active terrorist financing or ongoing cyber heists), the bank must immediately notify appropriate law enforcement by telephone in addition to filing a SAR.

┌─────────────────────────────────────────────────────────────────────────────┐
│               SAR STATUTORY PROTECTIONS & NON-DISCLOSURE RULES              │
├──────────────────────────────────────┬──────────────────────────────────────┤
│  ABSOLUTE NON-DISCLOSURE MANDATE     │   STATUTORY SAFE HARBOR PROTECTION   │
│       (31 U.S.C. § 5318(g)(2))       │       (31 U.S.C. § 5318(g)(3))       │
├──────────────────────────────────────┼──────────────────────────────────────┤
│ • Strict criminal & civil liability  │ • Financial institutions, directors, │
│   for 'tipping off' any person       │   officers, and employees are immune │
│ • Bank CANNOT disclose SAR existence │   from ALL civil liability under any │
│   or SAR contents to customer,       │   federal, state, or local law for   │
│   beneficiary, or outside counsel    │   disclosing suspicious activity or  │
│ • In response to civil subpoena,     │   filing a SAR in good faith.        │
│   bank MUST refuse production &      │ • Protection applies even if no      │
│   immediately notify OCC and FinCEN  │   criminal wrongdoing is proven.     │
└──────────────────────────────────────┴──────────────────────────────────────┘

---

5. Office of Foreign Assets Control (OFAC) Sanctions Compliance

The Office of Foreign Assets Control (OFAC), an agency of the U.S. Department of the Treasury, administers and enforces economic and trade sanctions based on U.S. foreign policy and national security goals against targeted foreign countries, terrorists, international narcotics traffickers, and perpetrators of weapons of mass destruction proliferation.

The Specially Designated Nationals (SDN) List

OFAC publishes the Specially Designated Nationals and Blocked Persons List (SDN List). All U.S. persons—including corporate fiduciaries, trust officers, and national banks—are strictly prohibited from dealing with SDNs and must block their property.

┌─────────────────────────────────────────────────────────────────────────────┐
│                     OFAC MANDATES: BLOCKING VS. REJECTING                   │
├──────────────────────────────────────┬──────────────────────────────────────┤
│           BLOCKING (FREEZING)        │               REJECTING              │
├──────────────────────────────────────┼──────────────────────────────────────┤
│ • Required when an SDN or sanctioned │ • Required when a transaction lacks an│
│   target holds ANY legal, equitable, │   SDN or blocked party interest but  │
│   or beneficial interest in assets   │   violates sanctions prohibitions    │
│ • Bank immediately freezes property │ • Bank rejects/returns transaction   │
│ • Place funds in an interest-bearing │ • No asset freeze or interest-bearing│
│   blocked escrow account             │   escrow account established         │
│ • Title remains with target, but no  │ • Transaction is stopped and funds   │
│   transfers or withdrawals allowed   │   are returned to originating bank   │
├──────────────────────────────────────┴──────────────────────────────────────┤
│  MANDATORY OFAC REPORTING: Initial Blocking/Rejecting Report must be filed  │
│  with OFAC within 10 BUSINESS DAYS. Annual Report of Blocked Property must  │
│  be submitted to OFAC by SEPTEMBER 30 of each calendar year.                │
└─────────────────────────────────────────────────────────────────────────────┘

---

6. BSA/AML and OFAC Threshold & Reporting Matrix

---

7. Fiduciary-Specific Red Flags and High-Risk Typologies

Trusts and wealth management accounts are inherently vulnerable to illicit exploitation due to the legal separation of legal title (held by the trustee) and beneficial title (held by beneficiaries). Corporate trust officers must maintain heightened vigilance for the following fiduciary red flags:

1. Rapid Movement of Funds: Immediate requests to wire contributed trust principal out to foreign jurisdictions or unrelated third-party entities shortly after account funding with no estate planning rationale;
2. Reluctance to Disclose Information: Settlors, protectors, or co-trustees who refuse or display extreme reluctance to provide complete trust instruments, underlying business financial statements, or beneficial ownership identification;
3. Unexplained Complex Multi-Layered Structures: Creation of multi-tiered shell entities (e.g., an offshore trust holding an offshore LLC holding a domestic trust holding a holding company) where no tax, creditor protection, or administrative justification exists;
4. Sudden Changes in Fiduciary Parties: Frequent, unexplained replacement of trust protectors, individual co-trustees, or beneficiaries, particularly involving politically exposed persons (PEPs) or high-risk offshore secrecy jurisdictions;
5. Third-Party Disbursement Requests: Beneficiary requests to wire distributions directly to unverified third parties, luxury asset dealers (yachts, fine art, rare gems), or private cryptocurrency exchanges with vague explanations;
6. Uncharacteristic Cash Activity: Attempts to contribute physical cash, money orders, or structured cashier's checks into an irrevocable wealth management trust.

---

8. Foreign Relationships, Enhanced Due Diligence, and Pre-Acceptance Risk Tiering

The Risk and Compliance domain tests pre-acceptance risk judgment: before opening an account, the bank must identify account parties, assess jurisdiction and ownership risk, and decide whether the relationship can be administered safely.

• Identify every interested party: under risk-based KYC/CDD, document the identity of grantors, trustees, beneficiaries, protectors, and holders of financial powers of attorney — not merely the immediate customer standing at the desk. (Compare FinCEN's 25% beneficial-ownership rule for entity customers covered above.)
• Foreign clients, trustees, and beneficiaries: cross-border relationships raise documentary, tax-reporting (for example, Forms 3520/3520-A for U.S. persons engaging with foreign trusts), withholding, and OFAC-screening complexity. Foreign fiduciary parties do not disqualify an account, but they elevate the due-diligence tier and the ongoing monitoring cadence.
• Enhanced Due Diligence (EDD) triggers: politically exposed persons (PEPs — senior foreign political figures together with their immediate family and close associates), complex or opaque ownership structures, cash-intensive businesses, private-investment-company wrappers organized in bank-secrecy jurisdictions, elevated-risk geographies identified by FATF as having weak AML regimes, and inconsistent source-of-wealth narratives.
• EDD measures: senior-management approval, corroborated source-of-wealth/source-of-funds documentation, higher-frequency transaction and relationship reviews, and — where warranted — site visits or third-party verification.
• Accept, condition, or decline: pre-acceptance review (12 CFR § 9.6(a)) culminates in a documented acceptance-committee decision. Where controls cannot mitigate the risk — unresolved sanctions exposure, unidentified beneficial owners, or refusal to verify wealth origin — the fiduciary answer is to decline or resign rather than inherit unmanageable compliance liability.