The “Crime” part of Financial Crime

1. How FinCEN Fits In

The Financial Crimes Enforcement Network (FinCEN) is a bureau of the U.S. Department of the Treasury and the delegated administrator of the Bank Secrecy Act (BSA) and every statute that has amended it since 1970. In practice that gives FinCEN four jobs: it writes the implementing regulations at 31 CFR Chapter X, it collects and analyzes BSA reports (CTRs, SARs, FBARs, and others), it shares that intelligence with law enforcement, and it brings civil enforcement actions for BSA violations.

FinCEN does not do most of the examining. It delegates exam authority to the federal banking agencies, the IRS, the SEC, and others, and it refers criminal conduct to the Department of Justice. That split matters: a bank sees its BSA program tested by the OCC, Fed, FDIC, or NCUA, while an MSB or a crypto exchange usually sees the IRS and state regulators. Section 11 maps who does what by type of institution.

The legal basis for FinCEN's role is the delegation at 31 CFR 1010.810, which gives FinCEN overall authority for enforcement and compliance and lists the agencies that examine on its behalf.

Quick reference

2. Bank Secrecy Act (1970)

The Bank Secrecy Act, formally the Currency and Foreign Transactions Reporting Act (Pub. L. 91-508), is the statute everything else hangs on. Congress passed it because criminals and tax evaders were moving cash through U.S. banks and offshore accounts with no paper trail. The law's answer was simple: require financial institutions to keep records and file reports that have a "high degree of usefulness" in criminal, tax, regulatory, and counterterrorism matters.

Title I (now 12 U.S.C. 1829b and 1951 to 1960) covers recordkeeping by banks and other institutions. Title II (now 31 U.S.C. 5311 and following) covers reporting. Over five decades, Congress has extended the BSA from banks to casinos, MSBs, broker-dealers, insurance companies, card clubs, dealers in precious metals, and others, and FinCEN can add new categories by regulation.

What it requires

• Currency Transaction Reports (CTRs): cash transactions over $10,000 in a business day, aggregated across transactions by or for the same person.
• Suspicious Activity Reports (SARs): the statutory authority came later (1992), but SARs are now the BSA's most valuable output for law enforcement.
• Reports of Foreign Bank and Financial Accounts (FBARs): U.S. persons with financial interest in or signature authority over foreign accounts above $10,000 in aggregate.
• Currency and Monetary Instrument Reports (CMIRs): physical transport of more than $10,000 into or out of the United States.
• Recordkeeping: five-year retention for most BSA records; funds-transfer records and the Travel Rule at $3,000 and above.
• AML programs: risk-based programs for covered financial institutions (authority added in 1992 and expanded in 2001).

Live links

• 31 U.S.C. Chapter 53, Subchapter II (BSA reporting provisions)
• 31 U.S.C. 5311: Declaration of purpose and 31 U.S.C. 5312: Definitions
• 12 U.S.C. 1829b: Bank recordkeeping and 12 U.S.C. Chapter 21
• 31 CFR Chapter X: FinCEN's implementing regulations (eCFR)
• FFIEC BSA/AML InfoBase and Examination Manual

3. BSA Amendments, 1986 to 2004

Between 1986 and 2004, Congress amended the BSA repeatedly. None of these laws is as large as the PATRIOT Act, but several created obligations that compliance teams work with every day.

Money Laundering Control Act of 1986

This law made money laundering a standalone federal crime for the first time (18 U.S.C. 1956 and 1957) and made it illegal to structure transactions to evade CTR filing (31 U.S.C. 5324). The laundering offenses are prosecuted by DOJ, not FinCEN, but the structuring prohibition sits inside the BSA and drives a large share of SAR filings.

Anti-Drug Abuse Act of 1988

The 1988 Act required records for cash purchases of monetary instruments (cashier's checks, money orders, traveler's checks) between $3,000 and $10,000, now 31 U.S.C. 5325. It also created Geographic Targeting Order (GTO) authority at 31 U.S.C. 5326, which lets FinCEN lower reporting thresholds in a defined area for up to 180 days. FinCEN has used GTOs for title insurers in real estate and, since March 2025, for MSBs along the southwest border.

Annunzio-Wylie Anti-Money Laundering Act of 1992

Annunzio-Wylie gave Treasury the authority to require suspicious activity reporting (31 U.S.C. 5318(g)), created the safe harbor from civil liability for SAR filers, and barred tipping off the subject of a SAR. It also authorized Treasury to require AML programs (31 U.S.C. 5318(h)) and to set recordkeeping rules for wire transfers, which became the Recordkeeping and Travel Rules.

Money Laundering Suppression Act of 1994

This Act required money services businesses to register with Treasury (31 U.S.C. 5330), encouraged states to adopt uniform MSB licensing laws, and created the CTR exemption framework banks use for certain customers (31 U.S.C. 5313(d)).

Money Laundering and Financial Crimes Strategy Act of 1998; IRTPA of 2004

The 1998 Act created the national money laundering strategy and High Intensity Financial Crime Areas (HIFCAs). Section 6302 of the Intelligence Reform and Terrorism Prevention Act of 2004 directed Treasury to study reporting of cross-border electronic funds transfers.

Live links

• 18 U.S.C. 1956: Laundering of monetary instruments and 18 U.S.C. 1957
• 31 U.S.C. 5324: Structuring prohibited
• 31 U.S.C. 5325: Monetary instrument identification and 31 U.S.C. 5326: Geographic targeting orders
• 31 U.S.C. 5318: SARs, AML programs, CIP, and due diligence (subsections g to l)
• 31 U.S.C. 5330: Registration of money transmitting businesses and 31 U.S.C. 5313: CTRs and exemptions

4. USA PATRIOT Act, Title III (2001)

Title III of the USA PATRIOT Act, the International Money Laundering Abatement and Financial Anti-Terrorism Act of 2001, was the biggest expansion of the BSA until 2020. Passed six weeks after September 11, it pushed AML obligations beyond banks, made customer identification mandatory, gave Treasury sharp tools against foreign threats, and made FinCEN a permanent Treasury bureau.

Key sections

Live links

• USA PATRIOT Act (H.R. 3162, Pub. L. 107-56) on Congress.gov
• 31 U.S.C. 5318A: Section 311 special measures
• 31 U.S.C. 310: FinCEN's organic statute
• 31 U.S.C. 5331: Reports of cash received in nonfinancial trades or businesses

5. Anti-Money Laundering Act of 2020

The AML Act of 2020 (Division F of the FY2021 National Defense Authorization Act, enacted January 1, 2021 over a presidential veto) is the most comprehensive BSA overhaul since 2001. Its central theme is effectiveness: Congress told FinCEN to shift the system toward reports and programs that actually help law enforcement, while expanding coverage and enforcement tools. It also contained the Corporate Transparency Act as Title LXIV (Section 6 of this guide).

Major provisions

• Section 6101, AML/CFT priorities: FinCEN must publish national priorities (first issued June 30, 2021) and program rules must incorporate them. The statute also codified the risk-based approach to AML programs.
• Crypto coverage: amended the BSA's definitions to reach "value that substitutes for currency," codifying FinCEN's long-standing position that virtual currency businesses can be money transmitters.
• Section 6110, antiquities: added dealers in antiquities to the BSA definition of financial institution, and directed study of the art market.
• Section 6308, foreign bank subpoenas: expanded Treasury and DOJ subpoena power over foreign banks with U.S. correspondent accounts.
• Section 6314, whistleblowers: a whistleblower award program (31 U.S.C. 5323). As amended in December 2022, awards run from 10 to 30 percent of sanctions over $1 million and cover sanctions violations as well as BSA violations.
• Enhanced penalties: added penalties for repeat violators, bars on board service for egregious violators, and clawback of bonuses from people responsible for violations.
• Burden reduction studies: required reviews of CTR and SAR thresholds, a no-action letter process assessment, and streamlined SAR processes. These studies feed the current threshold debate (Section 10).

Live links

• NDAA FY2021 (H.R. 6395, Pub. L. 116-283), Division F
• FinCEN AML Act of 2020 implementation page
• 31 U.S.C. 5323: Whistleblower incentives and protections

6. Corporate Transparency Act

The Corporate Transparency Act (Title LXIV of the AML Act, codified at 31 U.S.C. 5336) was written to stop the use of anonymous shell companies by requiring entities to report their beneficial owners to a nonpublic FinCEN database. FinCEN's 2022 reporting rule originally reached most U.S. corporations and LLCs, with reporting starting January 1, 2024.

That scope no longer exists. After litigation and a March 2025 interim final rule, FinCEN issued a final rule on August 11, 2026 that permanently exempts domestic companies and U.S. persons. The statute itself was not repealed, so a future rulemaking could reverse course.

Where it stands now

• Domestic companies: exempt. FinCEN says it will delete previously reported information on U.S. persons and domestic companies.
• Foreign reporting companies: entities formed abroad and registered to do business in a U.S. state still file, but report beneficial owners who are not U.S. persons only.
• FinCEN IDs: U.S. persons who obtained one no longer have to update or correct it.
• Bank CDD unaffected: the Customer Due Diligence Rule (31 CFR 1010.230) still requires covered institutions to collect beneficial ownership from legal entity customers. With domestic BOI reporting gone, that bank-collected data is now the main domestic beneficial ownership source.

Live links

• 31 U.S.C. 5336: Beneficial ownership information reporting
• FinCEN final rule, August 2026 (PDF)
• FinCEN press release on the final rule
• FinCEN beneficial ownership page

7. Special Measures Authorities

FinCEN now has three statutory routes for cutting off or restricting foreign threats. They share a menu of measures but differ in speed and scope, and recent actions have leaned heavily on the newer, faster authorities.

A 2023 Section 311 proposal would also treat international CVC mixing as a class of transactions of primary money laundering concern and impose new recordkeeping and reporting duties. It was the first time FinCEN targeted an activity rather than an institution or jurisdiction. We found no final rule in the public record as of this date.

Live links

• FinCEN special measures list (311, 9714, and 2313a actions)
• 21 U.S.C. 2313a: FEND Off Fentanyl special measures
• FinCEN final rule severing Huione Group
• Section 2313a order: CIBanco (PDF)

8. GENIUS Act (2025)

The Guiding and Establishing National Innovation for U.S. Stablecoins Act (Pub. L. 119-27, signed July 18, 2025) created the first federal licensing regime for payment stablecoins. For FinCEN purposes, its key move is declaring permitted payment stablecoin issuers (PPSIs) to be financial institutions under the BSA, which brings them under the full AML/CFT framework.

What it means for AML and sanctions

• Three issuer pathways: subsidiaries of insured depository institutions approved by their primary federal regulator; federal qualified issuers approved by the OCC; and state qualified issuers approved by state regulators.
• Full BSA program: AML/CFT program, CIP, SAR filing, recordkeeping, and the Travel Rule for transmittals involving payment stablecoins.
• Sanctions program: a first-of-its-kind OFAC requirement for issuers to maintain an effective sanctions compliance program, plus the technical ability to comply with lawful orders to block, freeze, or reject transactions.
• Primary versus secondary market: the proposed rules separate issuance and redemption (direct customer relationships) from secondary-market transfers where the issuer only touches the smart contract, with lighter, different duties for the latter.

Live links

• GENIUS Act (S. 1582) on Congress.gov
• FinCEN/OFAC proposed rule for PPSIs (Federal Register)
• Rulemaking docket FINCEN-2026-0100 (Regulations.gov)

9. Core Implementing Regulations (31 CFR Chapter X)

The statutes above are mostly authorizations. The obligations institutions actually comply with live in 31 CFR Chapter X. Part 1010 holds the general rules; Parts 1020 through 1033 hold industry-specific rules (1020 banks, 1021 casinos, 1022 MSBs, 1023 broker-dealers, and so on).

FinCEN has also issued interpretive guidance that functions like rules in practice. The most important for crypto are the 2013 virtual currency guidance (FIN-2013-G001) and the 2019 CVC business models guidance (FIN-2019-G001). More recent items include SAR FAQs (October 9, 2025) and exceptive relief streamlining CDD requirements (February 13, 2026), both linked from FinCEN's AML Act page.

10. Recent and Pending Rulemakings

This is the part of the landscape most likely to change between now and your next exam cycle.

11. Regulatory Bodies and Enforcement

FinCEN owns the rules, but which agency examines and enforces depends on what the institution is. The first table maps the agencies; the subsections walk through each sector.

Who does what

Banks

Banks carry the full BSA load: CTRs, SARs, CIP, CDD, Section 312 and 313 duties, 314(a) searches, and the Travel Rule. Each federal banking agency has its own BSA program regulation that mirrors FinCEN's, so a bank answers to both FinCEN and its prudential regulator. Exams follow the FFIEC BSA/AML Examination Manual.

Enforcement often stacks. In October 2026, FinCEN assessed a $1.2 billion penalty against Bank of America for willful failures involving Chinese money laundering networks and southwest border activity, while the OCC assessed a $750 million penalty (credited toward the total) and OFAC separately settled for $11.6 million. The prudential agencies also issue cease and desist orders under their own statutes, guided by a 2020 interagency enforcement statement.

• OCC BSA program rule: 12 CFR 21.21
• Federal Reserve BSA program rule: 12 CFR 208.63
• FDIC BSA program rule: 12 CFR 326.8
• NCUA BSA program rule: 12 CFR 748.2

Fintechs

"Fintech" is not a BSA category. A fintech's obligations follow its activities and its charter, and most fall into one of four models:

• Bank partnership (banking-as-a-service): the sponsor bank is the BSA-regulated institution and its prudential regulator holds it responsible for the fintech's customers. Contracts typically push CIP, monitoring, and SAR referral work to the fintech, but the bank owns the outcome. Several sponsor banks have received consent orders over partner oversight.
• Money transmitter: a fintech that moves money on its own license is an MSB: FinCEN registration, its own AML program, plus state money transmitter licenses in nearly every state where it operates.
• Chartered: a fintech with a national bank, trust, or state charter is regulated like any bank of that type.
• Securities or commodities: brokerage and trading apps fall under SEC and FINRA (or CFTC and NFA) AML rules.

OFAC applies regardless of model. Consumer protection rules (Regulation E for transfers and remittances, UDAAP) run on a separate track from AML but often surface in the same exam findings.

Money services businesses

MSBs are defined at 31 CFR 1010.100(ff). The categories are money transmitters (any amount), dealers in foreign exchange, check cashers, issuers and sellers of money orders and traveler's checks, and providers and sellers of prepaid access (most with a $1,000 per person per day threshold), plus the U.S. Postal Service. Foreign-located MSBs doing business in the United States are covered too.

• Register with FinCEN within 180 days of starting business, renew every two years, and keep a current agent list. Agents acting solely as agents do not register separately.
• Maintain a written AML program, file SARs at $2,000 and CTRs over $10,000, and follow the recordkeeping and Travel Rules.
• The IRS Small Business/Self-Employed Division is the delegated federal examiner. States license and examine as well, often coordinated through CSBS and NMLS.
• Operating without registration exposes the business to FinCEN civil penalties and criminal prosecution under 18 U.S.C. 1960 (unlicensed money transmitting).
• FinCEN enforcement for failure to register as an MSB

Crypto exchanges and stablecoin issuers

FinCEN treats exchangers and administrators of convertible virtual currency as money transmitters, a position it took in 2013, expanded in 2019, and Congress codified in 2020. A centralized exchange is therefore an MSB with the full set of MSB duties, including the Travel Rule at $3,000. Users who buy crypto for their own purposes are not MSBs, and the 2019 guidance addresses hosted versus unhosted wallets, peer-to-peer exchangers, kiosks, and DeFi applications.

• Federal AML: FinCEN registration and AML program; IRS examination. Paxful's December 2025 settlement ($3.5 million, with parallel DOJ action) covered failure to register, program failures, and missing SARs.
• State: money transmitter licenses, plus New York's BitLicense (23 NYCRR Part 200) for firms serving New Yorkers.
• Sanctions: OFAC sanctions apply on a strict liability basis, including to listed wallet addresses.
• Market structure: still unsettled. The CLARITY Act, which would have divided spot crypto oversight between the SEC and CFTC and classified platforms as BSA financial institutions, failed a 49 to 50 Senate cloture vote on September 15, 2026. The SEC proposed Regulation Crypto Assets in August 2026 and the CFTC has sent its own proposed crypto market rules to the White House for review.
• Stablecoin issuers: under the GENIUS Act (see Section 8 of this guide), issuers will be regulated by the OCC, their bank's primary regulator, or a state regulator for licensing, by FinCEN for AML, and by OFAC for sanctions.
• NYDFS virtual currency businesses (BitLicense)
• CLARITY Act (H.R. 3633) status on Congress.gov
• OFAC regulations: 31 CFR Chapter V

Enforcement tools and penalties

Recent FinCEN actions worth knowing