The AML Statutory Framework: BSA, MLCA, FinCEN, and FATF

AML Statutory Framework
Foundational statute	Bank Secrecy Act (1970)
Criminalizing statute	Money Laundering Control Act (1986), 18 U.S.C. §§1956–1957
U.S. regulator	FinCEN (Treasury bureau)
International standard-setter	FATF (founded 1989)
SAR filing deadline	30 days (60 if no suspect identified)
SAR threshold	$5,000 general / $2,000 MSBs
Related	AML Law, Money Laundering, Asset Tracing

See also: AML Law (the broader legal survey, including AMLA 2020 and the Corporate Transparency Act), Money Laundering (the underlying placement–layering–integration mechanics), and Asset Tracing (following funds once a report or investigation exists).

The AML statutory framework is the specific set of laws and institutions that (1) define money laundering as a distinct federal crime, (2) require regulated businesses to report cash and suspicious transactions to the government, and (3) set the international benchmark against which national anti-money-laundering (AML) regimes are judged. This article stays close to the founding statutory text and the regulatory mechanics beneath it: what the Bank Secrecy Act requires of a financial institution, what the Money Laundering Control Act criminalizes, when and how a Suspicious Activity Report (SAR) must be filed, and how the Financial Action Task Force (FATF) built and enforces its global standard. It closes with adjacent statutes — RICO, the False Claims Act, and the Computer Fraud and Abuse Act — that frequently appear alongside AML charges.^[1]

1 Division of coverage with AML Law

Because this wiki already carries a general AML Law article, the two pages are deliberately scoped to avoid repeating each other. AML Law covers the CTR/SAR distinction at survey level, FATF's 40 Recommendations as a topic heading, the 2020 Anti-Money Laundering Act (AMLA) and its whistleblower bounty, and the 2026 Corporate Transparency Act beneficial-ownership rollback — the parts of the framework that have changed most recently. This article goes underneath those headlines to the founding statutes: the specific reporting and retention duties the Bank Secrecy Act imposes, the exact criminal elements of 18 U.S.C. §§1956 and 1957, the procedural detail of SAR filing (deadlines, thresholds, and the statutory confidentiality shield), and FATF's institutional history and enforcement mechanics rather than just its Recommendations. It also treats RICO, the False Claims Act, and the CFAA in more depth, including the Supreme Court's 2021 narrowing of CFAA liability in Van Buren v. United States. Readers wanting AMLA 2020, the whistleblower program, or the current status of beneficial-ownership reporting should consult AML Law directly; this article does not restate those provisions.

2 The Bank Secrecy Act of 1970

The Currency and Foreign Transactions Reporting Act of 1970, universally known as the Bank Secrecy Act (BSA), is the foundational U.S. anti-money-laundering statute, codified at 31 U.S.C. §§5311 et seq. Congress designed it to generate a paper trail with a "high degree of usefulness" in criminal, tax, and regulatory investigations by imposing recordkeeping and reporting duties directly on financial institutions rather than waiting to prosecute laundering after the fact.^[2]

The BSA's core obligations are:

• Currency Transaction Reports (CTRs), filed on FinCEN Form 112, for cash transactions exceeding $10,000 in a single business day;
• Suspicious Activity Reports (SARs), covering transactions that suggest money laundering or other criminal conduct regardless of dollar amount (detailed in Section 4 below);
• recordkeeping for cash purchases of negotiable instruments and other transactions the statute identifies as evidentially significant; and
• a minimum five-year retention period for the records the BSA requires institutions to keep — the baseline duration an investigator can expect a bank, money services business, or other covered institution to still hold historical transaction records.^[2]

The BSA has been amended substantially since 1970, most significantly by Title III of the USA PATRIOT Act (2001), which layered on customer due diligence and beneficial-ownership requirements, and by the 2020 AMLA, discussed in AML Law. But the 1970 Act remains the statutory root: every reporting duty a modern bank, broker-dealer, or money services business (MSB) discharges through FinCEN ultimately traces back to the BSA's original recordkeeping-and-reporting mandate.^[2]

3 The Money Laundering Control Act of 1986

The BSA required reporting, but for its first sixteen years U.S. law did not treat laundering money as a freestanding federal crime in itself — prosecutors had to reach it indirectly, through the underlying predicate offense or through structuring and reporting violations. The Money Laundering Control Act of 1986 (MLCA), enacted as part of that year's Anti-Drug Abuse Act, closed that gap. It was the first U.S. federal statute to criminalize money laundering as its own offense, codified at 18 U.S.C. §§1956–1957.^[3]

Provision	Popular name	Core elements	Minimum threshold
18 U.S.C. §1956	Laundering of Monetary Instruments	Knowingly conducting a financial transaction involving proceeds of "specified unlawful activity," with intent to (a) promote the crime, (b) conceal the proceeds' nature, source, or ownership, (c) avoid a reporting requirement, or (d) evade taxes	None — no minimum dollar amount and no requirement that a financial institution be involved
18 U.S.C. §1957	Engaging in Monetary Transactions in Property Derived from Unlawful Activity	Knowingly engaging in a monetary transaction in criminally derived property, without the concealment-intent element §1956 requires	Transaction must exceed $10,000

The contrast between the two sections is one of the more consequential technical distinctions in AML law. Section 1956 is the broader and more serious provision: it requires proof of one of the four specific intents listed above, but in exchange it applies to any transaction amount and does not require the transaction to pass through a bank or other financial institution at all — a cash handoff in a parking lot can violate §1956 if the intent element is met. Section 1957 is narrower and easier to prove in one respect (no concealment intent is required, only knowledge that the property is criminally derived) but is bounded by its $10,000 threshold. Maximum penalties under the MLCA reach twenty years' imprisonment. Because §1956 carries no floor, it is the provision most often paired with lower-dollar structuring and layering conduct that would otherwise fall outside the BSA's $10,000 CTR trigger — the deliberate splitting of transactions described as a classic red flag in the placement stage of laundering, as covered in Money Laundering.^[3]

4 FinCEN and the SAR filing regime

The Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Department of the Treasury, administers the Bank Secrecy Act and defines the operative rules that turn the BSA's general SAR mandate into a concrete filing regime. Three sets of details matter to an investigator relying on SAR data: who must file, on what deadline, and what confidentiality protects the report once filed.^[4]

Trigger and thresholds. A covered institution must file a SAR when it knows, suspects, or has reason to suspect that a transaction conducted by, at, or through the institution is suspicious, and the transaction involves at least $5,000 — or, for money services businesses (MSBs), at least $2,000. Unlike the CTR, which triggers on a flat currency threshold, the SAR trigger turns on the institution's subjective and objective suspicion, so a transaction well under $10,000 can still generate a mandatory filing.^[4]

Filing deadlines. FinCEN's SAR deadlines are staged around detection and ongoing activity:

Deadline	Applies when
30 calendar days	From initial detection of facts constituting the basis for filing (the default deadline)
60 calendar days	Extension permitted when no suspect has been identified as of the 30-day mark
120 days	General guideline for filing a continuing-activity SAR relative to the prior related filing, where suspicious activity persists

Confidentiality. SAR confidentiality is not a matter of institutional policy; it is a statutory mandate under 31 U.S.C. §5318(g)(2), which prohibits a financial institution (and its directors, officers, employees, and agents) from disclosing that a SAR has been filed, or disclosing any information that would reveal the existence of a SAR, to the subject of the report or to any other unauthorized party. This confidentiality shield is what allows SARs to function as an intelligence product for law enforcement and FinCEN rather than a notice to the person under suspicion, and it is why SAR filings themselves are not directly obtainable through ordinary discovery or public-records requests — a practical limit worth understanding before attempting to build an asset-tracing workflow that assumes SAR access.^[4]

FinCEN also administers CTR filing (Form 112, discussed in Section 2) and beneficial-ownership reporting under the Corporate Transparency Act, whose 2026 status is covered separately in AML Law.

5 FATF: founding, Recommendations, and lists

The Financial Action Task Force (FATF) is the intergovernmental policy-making body that sets the global AML and counter-terrorist-financing (CFT) standard against which national regimes — including the U.S. framework described above — are measured. FATF was established in 1989 at the G7 Paris Summit, initially to address the emerging problem of money laundering tied to drug trafficking. Its mandate expanded in 2001, after the September 11 attacks, to cover terrorist financing, and later still to cover financing of weapons proliferation.^[5]

FATF's principal instrument is "The FATF Recommendations," commonly called the 40 Recommendations. First issued in 1990, they were revised in 1996, revised again in 2003, and comprehensively rewritten in 2012, with ongoing amendments since (the companion AML Law article notes a February 2025 amendment to Recommendation 1). The Recommendations are not self-executing treaty law; they are a standard that member and cooperating jurisdictions are expected to transpose into their own domestic statutes — which is exactly the relationship between FATF's standard and the U.S. BSA/MLCA regime described in Sections 2–3 above.^[5]

A central methodological pillar of the modern Recommendations is the risk-based approach (RBA): rather than mandating identical, one-size-fits-all controls for every institution and transaction type, the RBA requires countries and individual institutions to first identify, assess, and understand their own money-laundering and terrorist-financing risks, and then apply AML/CFT measures proportionate to those risks — concentrating scrutiny and resources where the danger is highest rather than spreading them evenly. This is the same logic that underlies why a bank's due-diligence intensity varies by customer type, geography, and product, rather than being uniform across every account.^[5]

FATF enforces its standard not through direct sanctions but through peer-review mutual evaluations, in which member and FATF-Style Regional Body (FSRB) jurisdictions assess one another's compliance and effectiveness. Countries found to have strategic AML/CFT deficiencies are publicly named on one of two lists:

• the "black list" (formally, "High-Risk Jurisdictions subject to a Call for Action") — countries with the most serious, unaddressed deficiencies, prompting FATF to call on all members to apply enhanced due diligence or, in the most serious cases, countermeasures; and
• the "grey list" (formally, "Jurisdictions under Increased Monitoring") — countries that have committed to an action plan to resolve identified deficiencies and are being actively monitored while they do so.

Listing carries real practical consequences: banks and other regulated institutions worldwide typically apply enhanced due diligence, and sometimes de-risk entirely, when dealing with counterparties in listed jurisdictions, which can materially restrict a country's access to the global financial system. FATF's standard now reaches more than 180 countries through its own membership plus its network of FATF-Style Regional Bodies, making it the closest thing the AML field has to a single global baseline — and the reason an investigator tracing funds across borders, as described in Asset Tracing, should always check a jurisdiction's current FATF status before assuming its domestic AML controls resemble those of the FATF founding members.^[5]

6 Adjacent statutes: RICO, False Claims Act, CFAA

Money-laundering charges are rarely brought in isolation. Three additional statutes recur often enough alongside BSA/MLCA charges, and in broader financial-crime and digital-evidence investigations generally, that an investigator should recognize them even though each is a subject in its own right rather than a core AML statute.^[6]

Statute	Year	Relevance to AML investigations
RICO (Racketeer Influenced and Corrupt Organizations Act, 18 U.S.C. §§1961–1968)	1970	Criminalizes conducting or investing in an enterprise through a "pattern of racketeering activity" (at least two predicate acts within ten years). Money laundering is itself a recognized RICO predicate, so a pattern of laundering transactions can support a RICO count layered on top of, or instead of, standalone §1956/§1957 charges. Civil RICO additionally allows private plaintiffs to recover treble damages.
False Claims Act (31 U.S.C. §§3729–3733)	1863 (substantially amended 1986)	The government's primary civil tool against fraud on federal programs and contracts. Its qui tam provisions let private relators sue on the government's behalf and share in the recovery — a whistleblower-incentive structure conceptually similar to the AMLA bounty program described in AML Law. False Claims Act proceeds are themselves a common predicate for downstream laundering charges when a fraud recovery is concealed or moved.
Computer Fraud and Abuse Act (CFAA) (18 U.S.C. §1030)	1986	Criminalizes unauthorized access to a "protected computer," a term defined broadly enough to reach essentially any internet-connected device. Financial-crime investigations increasingly rely on the CFAA where laundering or fraud schemes involve compromised accounts or systems.

The CFAA's reach was narrowed significantly by the Supreme Court in Van Buren v. United States (2021), which addressed the statute's "exceeds authorized access" language — the provision covering someone who has legitimate access to a computer system but uses that access for an improper purpose. The Court rejected the broader reading under which any misuse of otherwise-authorized access (for example, an employee who looks up a database record for a personal, non-work reason) could trigger CFAA liability, holding instead that liability attaches only when a person accesses information or areas of a computer system that are off-limits to them, not merely when they misuse access they are otherwise entitled to have. For an OSINT or forensic investigator, Van Buren is the operative boundary line: it clarifies how far a researcher or examiner with legitimate credentials to a system may go, in terms of what is actually accessible to them, before crossing from a permissible-use question into unlawful "exceeding authorized access" territory — a distinction that matters whenever a fraud investigation touches an employer's own systems or a cooperating institution's records.^[6]

References

1. Digital Forensics, Forensic Science Validity, and Standards: A Research Synthesis, Part V §25 (AML statutory framework overview), 2026.
2. Bank Secrecy Act (Currency and Foreign Transactions Reporting Act of 1970), Pub. L. No. 91-508, codified at 31 U.S.C. §§5311 et seq. https://www.fincen.gov/
3. Money Laundering Control Act of 1986, Pub. L. No. 99-570, codified at 18 U.S.C. §§1956–1957. https://www.law.cornell.edu/uscode/text/18/1956
4. Financial Crimes Enforcement Network (FinCEN), U.S. Department of the Treasury. "Bank Secrecy Act Filing Information" and SAR filing guidance, including 31 U.S.C. §5318(g)(2) confidentiality. https://www.fincen.gov/resources/filing-information
5. Financial Action Task Force (FATF). "The FATF Recommendations." FATF, Paris (founded 1989; Recommendations 1990, rev. 1996, 2003, 2012, amended through 2025). https://www.fatf-gafi.org/en/publications/fatfrecommendations/documents/fatf-recommendations.html
6. Racketeer Influenced and Corrupt Organizations Act, 18 U.S.C. §§1961–1968 (1970); False Claims Act, 31 U.S.C. §§3729–3733 (1863, as amended); Computer Fraud and Abuse Act, 18 U.S.C. §1030 (1986); Van Buren v. United States, 593 U.S. 374 (2021). https://www.law.cornell.edu/uscode/text/18/1030