Flow of the explanation in this lesson.
The US Bank Secrecy Act: the BSA framework behind every dollar payment
What you will learn
Your objective. By the end of this lesson, you will be able to explain US bank secrecy act: the BSA framework behind every dollar payment and apply it to a real banking scenario.
Why it matters. For a business analyst, the BSA is a set of concrete system requirements.
Chapter objective: Data protection, US anti-money-laundering law, and keeping payments running under stress
Key learning points
- Bank Secrecy Act of 1970
- Designated BSA compliance officer
- Suspicious activity
- Beneficial ownership rule
- US dollar correspondent requirements
Key terms
Correspondent banking: A service where one bank holds accounts for another bank so the second bank can make payments in currencies or countries where it has no branch.
Payment hub: A central system in a bank that receives payment instructions from all channels, validates them, applies screening and routing rules, and sends them to the correct clearing system or correspondent.
Payment flow diagram showing The US Bank Secrecy Act: the BSA framework behind every dollar payment.
Practise this lesson
Exercise
Route the payment described in this lesson and justify the route.
Use the routing rules, the correspondent chain and the charges in this lesson.
- What to do. Name each bank in the chain, the message used on each leg, and the charges deducted at each step.
Correct result. The route follows the correspondent chain from the debtor agent to the creditor agent, with each intermediary deducting its charge and passing the remainder on. The message on each leg carries the information the next bank needs.
Why. Routing is a business decision with a cost. The wrong route is slower, more expensive, or fails.
Check your understanding
Practice question
Which of the following best describes US bank secrecy act: the BSA framework behind every dollar payment?
Takeaway and next step
What to remember
For a business analyst, the BSA is a set of concrete system requirements.
Follow 9,000 dollars through every stage, from instruction to beneficiary credit, and note where it can stop.
Open the Payment Lifecycle Simulator →
Builds on "Cross-border data transfers: when a payment message leaves the region".
Transcript and full text
Show transcript
The Bank Secrecy Act of 1970 is the foundation of American anti-money-laundering law, and it reaches every dollar payment in the world. Any bank that clears US dollars through a US correspondent must comply with the BSA, and the US Treasury's Financial Crimes Enforcement Network, FinCEN, enforces it. The BSA requires banks to keep records, to file reports, and to have a written anti-money-laundering programme. A foreign bank that moves dollars and has no BSA programme will lose its US correspondent, and without a US correspondent it cannot clear dollars at all. The BSA programme has four pillars, and a payments BA will meet all of them. The first is internal policies, procedures and controls that cover how payments are screened, how alerts are triaged, and how records are kept. The second is a designated BSA compliance officer with the authority to stop a payment. The third is ongoing training for everyone who touches payments, including operations staff who process exceptions. The fourth is independent testing, an audit that checks whether the controls actually work, not whether they exist on paper. Currency transaction reports are the most mechanical BSA obligation. A bank must file a CTR with FinCEN for any cash transaction over 10,000 US dollars, and must aggregate multiple cash transactions by the same person on the same day. The CTR is not a suspicion report, it is a record, and the customer is not told it was filed. For a payments system the CTR requirement means the cash and the electronic payment worlds must be joined, because a customer who deposits 9,000 dollars in cash and then wires 9,000 dollars abroad has moved 18,000 dollars, and the system must see the whole picture. Suspicious activity reports are the judgement call. A bank must file a SAR with FinCEN within 30 calendar days of detecting a suspicious transaction, with a 30 day extension if no suspect is identified, and must not tell the customer that a SAR was filed. The SAR narrative must describe the who, what, when, where, why and how of the suspicious activity, and must be detailed enough for law enforcement to act on. A payments BA writes the requirements for the SAR workflow: the alert, the investigation, the narrative template, the filing, and the audit trail that proves the 30 day deadline was met. Customer due diligence and beneficial ownership are the identity side of the BSA. The CDD rule requires the bank to understand the nature and purpose of the customer relationship and to build a customer risk profile. The beneficial ownership rule requires the bank to identify every person who owns 25 percent or more of a legal entity customer, and every person who controls it. For a payments product that onboards corporate customers, the requirements must state exactly which ownership documents are collected, how they are verified, and what happens when the ownership changes. The USA PATRIOT Act added the correspondent banking provisions that matter most to cross-border payments. Section 313 prohibits US banks from maintaining correspondent accounts for foreign shell banks, which are banks with no physical presence in any country. Section 312 requires enhanced due diligence for correspondent accounts held for foreign banks operating under an offshore licence, or in a jurisdiction designated as a primary money laundering concern. A European bank that wants a US dollar correspondent must be able to prove it is not a shell bank and must provide its ownership and control information. For a business analyst, the BSA is a set of concrete system requirements. The payment hub must be able to aggregate transactions by customer and by day, to generate a CTR file, to support the SAR narrative workflow, and to block a payment to a shell bank. The acceptance criteria must include a test where a customer makes two cash deposits of 6,000 dollars on the same day and the system files one CTR for 12,000 dollars. Last reviewed 7 November 2026. Further reading: Bank Secrecy Act, 31 USC 5311 to 5330; FinCEN CDD Rule, 31 CFR 1020.220; FinCEN SAR filing guidance; USA PATRIOT Act, Sections 312 and 313.
The Bank Secrecy Act of 1970 is the foundation of American anti-money-laundering law, and it reaches every dollar payment in the world. Any bank that clears US dollars through a US correspondent must comply with the BSA, and the US Treasury's Financial Crimes Enforcement Network, FinCEN, enforces it. The BSA requires banks to keep records, to file reports, and to have a written anti-money-laundering programme. A foreign bank that moves dollars and has no BSA programme will lose its US correspondent, and without a US correspondent it cannot clear dollars at all.
The BSA programme has four pillars, and a payments BA will meet all of them. The first is internal policies, procedures and controls that cover how payments are screened, how alerts are triaged, and how records are kept. The second is a designated BSA compliance officer with the authority to stop a payment. The third is ongoing training for everyone who touches payments, including operations staff who process exceptions. The fourth is independent testing, an audit that checks whether the controls actually work, not whether they exist on paper.
Currency transaction reports are the most mechanical BSA obligation. A bank must file a CTR with FinCEN for any cash transaction over 10,000 US dollars, and must aggregate multiple cash transactions by the same person on the same day. The CTR is not a suspicion report, it is a record, and the customer is not told it was filed. For a payments system the CTR requirement means the cash and the electronic payment worlds must be joined, because a customer who deposits 9,000 dollars in cash and then wires 9,000 dollars abroad has moved 18,000 dollars, and the system must see the whole picture.
Suspicious activity reports are the judgement call. A bank must file a SAR with FinCEN within 30 calendar days of detecting a suspicious transaction, with a 30 day extension if no suspect is identified, and must not tell the customer that a SAR was filed. The SAR narrative must describe the who, what, when, where, why and how of the suspicious activity, and must be detailed enough for law enforcement to act on. A payments BA writes the requirements for the SAR workflow: the alert, the investigation, the narrative template, the filing, and the audit trail that proves the 30 day deadline was met.
Customer due diligence and beneficial ownership are the identity side of the BSA. The CDD rule requires the bank to understand the nature and purpose of the customer relationship and to build a customer risk profile. The beneficial ownership rule requires the bank to identify every person who owns 25 percent or more of a legal entity customer, and every person who controls it. For a payments product that onboards corporate customers, the requirements must state exactly which ownership documents are collected, how they are verified, and what happens when the ownership changes.
The USA PATRIOT Act added the correspondent banking provisions that matter most to cross-border payments. Section 313 prohibits US banks from maintaining correspondent accounts for foreign shell banks, which are banks with no physical presence in any country. Section 312 requires enhanced due diligence for correspondent accounts held for foreign banks operating under an offshore licence, or in a jurisdiction designated as a primary money laundering concern. A European bank that wants a US dollar correspondent must be able to prove it is not a shell bank and must provide its ownership and control information.
For a business analyst, the BSA is a set of concrete system requirements. The payment hub must be able to aggregate transactions by customer and by day, to generate a CTR file, to support the SAR narrative workflow, and to block a payment to a shell bank. The acceptance criteria must include a test where a customer makes two cash deposits of 6,000 dollars on the same day and the system files one CTR for 12,000 dollars. Last reviewed 7 November 2026. Further reading: Bank Secrecy Act, 31 USC 5311 to 5330; FinCEN CDD Rule, 31 CFR 1020.220; FinCEN SAR filing guidance; USA PATRIOT Act, Sections 312 and 313.
Full lesson text (all scenes)
Completing a lesson updates your progress dashboard on the homepage.
Scene timestamps are estimated by allocating the narration text proportionally across the real audio length. The audio playback position is the source of truth: pause freezes the visual, seeking restores the correct scene, replay restarts the scene animation.