By SanctionsAI team · Updated 2026-08-09
FinCEN AML requirements for financial institutions
FinCEN administers the Bank Secrecy Act (BSA), which requires financial institutions to maintain AML programs, file reports, and keep records.
Core BSA/AML requirements
| Requirement | Detail |
|---|
| AML program | Written program with CIP, CDD, monitoring, training, audit |
| Customer Identification Program (CIP) | Verify customer identity at onboarding |
| SAR filing | Report suspicious activity within 30 days |
| Currency Transaction Report (CTR) | Report cash transactions over $10,000 |
| Recordkeeping | Retain records for 5 years |
| OFAC screening | Screen customers and transactions against SDN list |
Which institutions are covered?
Banks, credit unions, money service businesses (MSBs), securities brokers, futures commission merchants, mutual funds, insurance companies, casinos, and precious metals dealers. Crypto businesses operating as MSBs are covered.
Integration: SanctionsAI satisfies the OFAC screening component of BSA/AML programs. API-based real-time screening for all transactions.
Screen your agent's next payment
Check any wallet, name, or entity against OFAC, EU, UN sanctions lists in real time.
Free wallet checkerFrequently Asked Questions
- What financial institutions need an AML program?
- Banks, credit unions, MSBs, securities brokers, insurance companies, casinos, precious metals dealers. Crypto exchanges operating as MSBs are covered.
- What is a CTR?
- Currency Transaction Report. Required for cash transactions over $10,000. Filed with FinCEN within 15 days.
- What is the SAR filing deadline?
- 30 calendar days from initial detection of suspicious activity. 60 days if no suspect identified.
- How long must AML records be kept?
- 5 years per FinCEN requirements. Includes CDD records, SARs, CTRs, and transaction records.
← Back to regulations · SanctionsAI