Regulatory Compliance and BSA/AML
The AML framework
The Bank Secrecy Act requires customer identification programs, customer due diligence, suspicious activity reporting, currency transaction reporting, and recordkeeping. Candidates must know thresholds: currency transaction reports for cash transactions over $10,000, suspicious activity reports generally within 30 days of detection, and enhanced due diligence for high-risk customers such as foreign politically exposed persons.
The five pillars (and their successor)
Historically: internal controls, designated compliance officer, training, independent testing, and customer due diligence. The 2020 amendments added a risk-assessment pillar. Traps ask which pillar is missing from a described program-often independent testing or the risk assessment.
Sanctions and OFAC
OFAC screening is separate from BSA/AML. Sanctions are strict liability; a blocked transaction must be reported. Questions often conflate SAR filing with OFAC reporting-they are distinct obligations.
Compliance program elements
Beyond AML, banks maintain compliance management systems: board oversight, policies, training, monitoring, testing, and issue management. The three lines model applies-compliance is the second line, audit the third.
Worked example
A customer deposits $9,500 in cash three days in a row. Rule of thumb: structuring is itself suspicious even though no single transaction exceeds $10,000. File a SAR; do not file a CTR unless the aggregate in one business day exceeds $10,000.
Traps to expect
Confusing SAR confidentiality (never tell the customer) with customer notification duties, or treating a SAR as proof of criminality.