Bank Secrecy Act and 31 CFR 1020.320, bank reports of suspicious transactions and their confidentiality

Section 1020.320 of title 31 requires every bank to file with the Treasury Department, to the extent and in the manner the section requires, a report of any suspicious transaction relevant to a possible violation of law or regulation.

Section 1010.100 of title 31 defines a bank to include each agent, agency, branch or office within the United States of a person doing business as a commercial bank or trust company, a private bank, a savings and loan association or building and loan association, an insured institution, a savings bank, industrial bank or other thrift institution, or a credit union, among the capacities the definition lists.

A transaction requires reporting if it is conducted or attempted by, at, or through the bank, involves or aggregates at least $5,000 in funds or other assets, and the bank knows, suspects, or has reason to suspect one of three listed conditions.

The three conditions are that the transaction involves funds derived from illegal activities or is intended or conducted to hide or disguise funds or assets derived from illegal activities as part of a plan to violate or evade any Federal law or regulation or to avoid any transaction reporting requirement under Federal law or regulation, that it is designed to evade any requirement of the Bank Secrecy Act regulations, or that it has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage and the bank knows of no reasonable explanation after examining the available facts.

A bank is required to file a SAR, short for Suspicious Activity Report, no later than 30 calendar days after the date of initial detection by the bank of facts that may constitute a basis for filing a SAR. If no suspect was identified on the date of the detection, a bank may delay filing a SAR for an additional 30 calendar days to identify a suspect, and in no case may reporting be delayed more than 60 calendar days after the date of initial detection of a reportable transaction.

Where a violation requires immediate attention, such as an ongoing money laundering scheme, the bank shall immediately notify an appropriate law enforcement authority by telephone in addition to filing a SAR on time. A bank is not required to file a SAR for a robbery or burglary committed or attempted that is reported to appropriate law enforcement authorities, or for lost, missing, counterfeit, or stolen securities with respect to which the bank files a report under 17 CFR 240.17f-1.

A bank shall maintain a copy of any SAR filed and the original or business record equivalent of any supporting documentation for a period of five years from the date of filing the SAR. Supporting documentation is deemed to have been filed with the SAR, and the bank shall make all of it available upon request to FinCEN, to any Federal, State, or local law enforcement agency, and to the regulatory authorities the section names.

A SAR, and any information that would reveal the existence of a SAR, are confidential and may not be disclosed except as paragraph (e) of the section authorizes. No bank, and no director, officer, employee, or agent of any bank, may disclose a SAR or any information that would reveal the existence of a SAR.

A bank, or a director, officer, employee, or agent of a bank, that is subpoenaed or otherwise requested to disclose a SAR or such information shall decline to produce it, citing the section and the statute, and shall notify FinCEN of the request and the response.

Provided that no person involved in any reported suspicious transaction is notified that the transaction has been reported, the prohibition does not bar a bank from disclosing a SAR, or information that would reveal its existence, to FinCEN, to any Federal, State, or local law enforcement agency, to a Federal regulatory authority that examines the bank for compliance with the Bank Secrecy Act, or to a State regulatory authority administering a State law that requires the bank to comply with the Bank Secrecy Act.

On the same condition, the prohibition does not bar disclosing the underlying facts, transactions, and documents upon which a SAR is based, including to another financial institution for the preparation of a joint SAR and in certain employment references or termination notices.

On the same condition, the prohibition does not bar a bank from sharing a SAR, or information that would reveal its existence, within the bank's corporate organizational structure for purposes consistent with Title II of the Bank Secrecy Act as determined by regulation or in guidance.

Section 5318(g)(1) of title 31 authorizes the Secretary of the Treasury to require any financial institution, and any director, officer, employee, or agent of a financial institution, to report any suspicious transaction relevant to a possible violation of law or regulation.

Under section 5318(g)(2)(A) of title 31, once a financial institution reports a suspicious transaction to a government agency, neither the institution, nor any of its directors, officers, employees or agents, nor any other current or former director, officer, or employee of, or contractor for, the institution, may notify any person involved in the transaction that the transaction has been reported or otherwise reveal any information that would reveal that the transaction has been reported.

A domestic financial institution, and a partner, director, officer, or employee of one, that willfully violates the Bank Secrecy Act subchapter or a regulation under it is liable to the United States Government for a civil penalty of not more than the greater of the amount, not to exceed $100,000, involved in the transaction or $25,000.

The Secretary of the Treasury may impose a civil money penalty of not more than $500 on a financial institution that negligently violates the subchapter or a regulation under it, and, for a pattern of negligent violations, a further penalty of not more than $50,000.

The inflation adjustment table in the July 1, 2025 edition of title 31 of the Code of Federal Regulations replaces the statutory range of $25,000 to $100,000 for willful violations with a range of $71,545 to $286,184 for penalties assessed on or after January 17, 2025. A person who willfully violates the subchapter or a regulation under it shall be fined not more than $250,000, imprisoned for not more than five years, or both.

Where the willful violation occurs while violating another law of the United States or as part of a pattern of illegal activity involving more than $100,000 in a 12-month period, the penalty is a fine of not more than $500,000, imprisonment for not more than 10 years, or both. Banks shall be examined by FinCEN or its delegatees for compliance with the section.

FinCEN's filing instructions list the parallel duty to file a SAR for casinos and card clubs, money services businesses, brokers or dealers in securities, mutual funds, insurance companies, futures commission merchants and introducing brokers in commodities, and residential mortgage lenders and originators, in sections 1021.320, 1022.320, 1023.320, 1024.320, 1025.320, 1026.320 and 1029.320 of title 31.

FinCEN moved the Bank Secrecy Act regulations to a new chapter of the Code of Federal Regulations by a final rule effective March 1, 2011. FinCEN's rule requiring banks to report suspicious transactions, first codified as 31 CFR 103.21, became effective on April 1, 1996.