# Bank Secrecy Act The Bank Secrecy Act of 1970 is the foundation of American anti-money-laundering law. Its name is misleading in the usual way — it does not protect bank secrecy, it **abolishes** it for defined categories of transaction by conscripting financial institutions into a reporting system. The statute's design decision is the one worth understanding: **the government did not build a surveillance apparatus of its own. It required banks to build one and report the results.** ## What it requires - **Currency Transaction Reports (CTRs)** — filed for cash transactions above a threshold, long set at $10,000. - **[[Suspicious Activity Report]]s (SARs)** — filed when an institution detects a transaction it has reason to believe is illicit, regardless of amount. Added by the Annunzio-Wylie Act in 1992. - **Customer identification, recordkeeping, and AML program requirements**, expanded substantially by the USA PATRIOT Act in 2001. Reports go to [[FinCEN]], the Treasury bureau established in 1990 that serves as the repository and analytical hub. SARs carry a **confidentiality obligation** — an institution may not tell the customer a report was filed — and a **safe harbor**, shielding the filer from liability for reporting. ## The structural weakness The BSA's enforcement problem is a direct consequence of its delegation. A SAR is filed at the institution's discretion, on the institution's timeline, by employees whose compensation depends on the client relationship the report jeopardizes. The statute supplies a legal duty and a liability shield; it does not supply an incentive strong enough to overcome the revenue on the other side. Penalties for late or absent filing have historically been civil, corporate, and small relative to the fee income involved — and individual bankers are rarely charged. The result is a system that produces enormous volume — millions of SARs a year — while systematically under-reporting the highest-value clients, who are precisely the ones the reporting is meant to catch. The vault's [[FinCEN Files]] material documents the same pattern from the leak side. ## The Epstein case as the demonstration The clearest available illustration is the **Wyden report of 4 August 2026**, *Looking the Other Way* — the culmination of a four-year Senate Finance Committee minority-staff investigation that reviewed SARs, litigation material, and information requests to Wall Street banks and Treasury. Its central finding is a timing finding. More than a dozen bankers at **[[JPMorgan Chase]]**, **[[Bank of America]]**, and **[[Deutsche Bank]]** were aware of suspicious [[Jeffrey Epstein]] transactions **as far back as 2002**, and in most cases the institutions did not alert Treasury **until years later, after Epstein's 2019 arrest**. The report concludes the three banks likely violated federal anti-money-laundering law. The BSA machinery worked exactly as written and produced nothing useful, because "file when you detect suspicious activity" contains no deadline enforceable against a bank that would rather not. Reports filed five to seven years after the fact satisfy the form of the statute and defeat its purpose entirely. > [!note] Attribution > *Looking the Other Way* is a report by the ranking member's staff, not an adjudication. "Likely violated" is the report's characterization. No criminal AML charges against these institutions arising from it are recorded on this page. ## Why it matters for the KB **1. Delegated enforcement is capturable enforcement.** The BSA is this vault's cleanest case of a regulatory design that depends on the regulated party to generate the evidence against its own customers. Compare the [[Preclearance]] entry: the mechanism that worked in voting rights shifted the burden *onto* the covered party and required approval *before* the fact. The BSA does neither — it asks after the fact, and asks the interested party. **2. Compliance volume is not compliance.** Millions of filings a year make the system look functional in aggregate while the specific cases that matter go unreported for years. Aggregate activity metrics are a poor proxy for enforcement, and this is the reference example. **3. It is the statute under most "debanking" arguments.** BSA/AML obligations are what banks cite when they exit customer relationships, which makes the Act a live node in contemporary political fights about financial deplatforming — from crypto to gun retailers to politically disfavored accounts. ## See Also - [[FinCEN]] — the reporting repository - [[Money Laundering]] · [[FinCEN Files]] - [[Bank of America]] · [[JPMorgan Chase]] · [[Deutsche Bank]] — the Wyden report's three subjects - [[Jeffrey Epstein]] · [[Ron Wyden]] · [[Senate Finance Committee]]