Bank Secrecy Act
The foundational U.S. anti-money-laundering statute; requires financial institutions, including money transmitters and, under the GENIUS Act once effective, payment-stablecoin issuers, to maintain AML programs and report suspicious activity to FinCEN.
The Bank Secrecy Act (BSA), enacted in 1970, is the core federal anti-money-laundering (AML) framework. It requires “financial institutions” to keep records and file reports that help detect and prevent money laundering, including customer identification, transaction monitoring, currency transaction reports, and suspicious activity reports. It is administered by the Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Treasury.
For fintech, the BSA reaches further than many founders expect. Money services businesses, including money transmitters and many cryptocurrency businesses, are financial institutions subject to BSA registration and to a written, risk-based AML program. The GENIUS Act of 2025 treats permitted payment-stablecoin issuers as financial institutions for BSA purposes once the Act takes effect, which will be no later than January 18, 2027.
A BSA/AML program is not a policy document filed and forgotten. It requires a designated compliance officer, ongoing training, independent testing, and monitoring proportionate to the institution's risk. A money services business must have its program in place within 90 days after it is established and must register with FinCEN within 180 days.