BSA/AML,explained

What BSA/AML is

The Bank Secrecy Act is US law, administered by FinCEN and examined by the federal banking agencies and other functional regulators. It is not a certification and there is no certificate to hang on the wall. What you are judged on is whether you run a programme that works, and whether you can evidence it when an examiner asks.

People often say "BSA" and "AML" as if they were two things. In practice BSA is the statute and the rules under it, and the AML programme is what those rules require you to build and operate.

Who it applies to

The definition of a financial institution under the BSA is much wider than "a bank". It covers banks and credit unions, broker-dealers, money services businesses (including many payments and crypto firms), casinos, mutual funds, futures commission merchants, insurance companies for certain products, and more. If you move money or hold customer accounts in the US, assume you are in scope until someone qualified tells you otherwise.

If you are a technology vendor to those institutions rather than a regulated institution yourself, the obligations reach you through your customers. Their examiners expect them to oversee you, so their requirements land in your contracts and their diligence questionnaires.

The AML programme pillars

A compliant programme rests on five pillars. Four come from the original rule and the fifth was added by the customer due diligence rule.

• A designated BSA/AML compliance officer, qualified for the role, with real authority and access to the board.
• Written internal controls, policies and procedures, approved and overseen by senior management.
• Ongoing training for the staff whose work touches the risk, sized to their role.
• Independent testing on a risk-based schedule, by qualified internal or external people who did not build the thing they are testing.
• Risk-based customer due diligence, including understanding the nature and purpose of the customer relationship.

Customer due diligence and beneficial ownership

A Customer Identification Program (31 CFR 1020.220) requires you to identify and verify customers at onboarding and to retain the identifying information. On top of that, the CDD rule (31 CFR 1010.230) requires covered institutions to identify the beneficial owners of legal-entity customers and to maintain a risk-based, ongoing understanding of the relationship.

The word that carries the weight is "ongoing". A file that was accurate at onboarding and never revisited is a common examination finding, because the risk picture moves and the file does not.

Monitoring, reporting and recordkeeping

• Transaction monitoring: monitor on a risk basis for activity that is unusual or potentially indicative of money laundering, and investigate and disposition the alerts you raise.
• Suspicious Activity Reports: file with FinCEN within the required timeline once you have identified suspicious activity, keep the supporting documentation, and keep the filing confidential. Telling the subject is itself an offence.
• Currency Transaction Reports: aggregate and report cash transactions above the reporting threshold.
• Recordkeeping: retain BSA records for the required period and keep them retrievable for examination.

The recurring examination theme is not the tooling, it is the paper trail. If you cannot show why an alert was closed, the decision effectively did not happen.

How it relates to security frameworks

A lot of BSA/AML overlaps an information-security programme more than people expect. Governance and a named accountable owner, written policy, role-based training, independent assurance, logging and monitoring, and records retention all have direct analogues in ISO 27001 and SOC 2. If you already run one of those, that control work carries a meaningful part of the load, and BSA/AML adds the financial-crime specifics: customer identification, beneficial ownership, alert handling, and the reporting obligations.