AML and the Bank Secrecy Act (BSA)

The Bank Secrecy Act (BSA) is the main US law for fighting money laundering and terrorist financing. Anti-money laundering (AML) is the set of controls institutions use to meet it. Passed in 1970, the BSA requires covered institutions to keep certain records, file certain reports and run a program to detect and report suspicious activity. The Financial Crimes Enforcement Network (FinCEN), a bureau of the US Treasury, administers it.

For banks and credit unions, a BSA/AML program has core parts:

• Internal controls: written policies and procedures based on the institution's risks.
• Independent testing of the program.
• A BSA officer who runs day-to-day compliance.
• Ongoing staff training.
• Customer due diligence: Know Your Customer (KYC) checks and, for business customers, identifying beneficial owners through Know Your Business (KYB).

Two reports matter most. A Suspicious Activity Report (SAR) is filed when activity may involve money laundering, fraud or another crime. A Currency Transaction Report (CTR) is filed for cash transactions over $10,000 in a day.

Coverage depends on the type of lender. Banks, credit unions and nonbank residential mortgage lenders have direct BSA program duties. Most nonbank business lenders, community development financial institution (CDFI) loan funds and merchant cash advance providers do not, though their banks and investors often require AML controls by contract. Sanctions rules from the Office of Foreign Assets Control (OFAC) are separate and apply to everyone.

The rules are changing. In April 2026, FinCEN proposed reshaping AML program requirements so institutions spend more effort on higher risks and less on low-risk customers. Comments closed in June 2026, and as of October 2026 it was still a proposal, with no final rule published.

Why it matters for lenders

Loans can be used to launder money. A borrower might repay with illegal cash, use loan proceeds to hide where money came from, or borrow through a shell company.

Weak programs bring fines, enforcement orders and lost banking relationships. For a nonbank lender, its bank's view of its AML controls can decide whether it keeps access to payment accounts.

How it works in practice

A credit union's business lending team sees a borrower pay off a $150,000 loan early with a series of cash deposits just under $10,000, spread across branches. That pattern, called structuring, is a red flag. The system flags the unusual payoff and routes it to the BSA officer. She reviews the account history and decides to file a SAR. The decision, reasoning and filing date are documented, and the borrower is not told, as the law requires.

In separate systems, patterns like this are easy to miss. Linking payments, customer data and alerts on one record, with a full audit trail, makes reviews faster and easier to defend.