Legal and Regulatory Framework: BSA/AML, USA PATRIOT Act, AML Directives, and Cross-Border Regulatory Obligations
What the exam tests
This domain tests the statutory and regulatory layer: the US Bank Secrecy Act, the USA PATRIOT Act, the EU AML Directives, and how cross-border obligations interact. Questions often ask which report, threshold or section applies.
Core rules and concepts
- The BSA (1970) requires recordkeeping and reporting by banks, MSBs, broker-dealers, casinos and other covered institutions. Currency transactions over USD 10,000 in one business day are aggregated and reported on a CTR, generally within 15 calendar days.
- Suspicious activity reporting thresholds vary: depository institutions generally file at USD 5,000 for suspected insider abuse and USD 25,000 for other suspicious activity; MSBs at USD 2,000; broker-dealers and casinos at USD 5,000. A SAR is generally due within 30 calendar days of initial detection, extendable to 60 if no suspect is identified. SAR confidentiality prohibits tipping off.
- USA PATRIOT Act Title III added Section 314 information sharing, Section 319(b) records requests, Section 326 customer identification programs, Section 312 due diligence for correspondent and private banking, Section 313 shell-bank prohibitions, Section 352 AML programs and Section 356 SAR requirements. Section 311 special measures target jurisdictions or institutions of primary money-laundering concern.
- EU AML Directives are directives, not regulations: member states must transpose them. 4AMLD established risk-based CDD and beneficial ownership registers; 5AMLD extended coverage to virtual assets and enhanced beneficial ownership transparency; 6AMLD harmonized criminal liability and expanded predicate offences.
- Cross-border obligations may arise through correspondent relationships, foreign branches, MLAT requests and FIU-to-FIU sharing. Local law may prohibit disclosure; escalate before responding.
Worked example
A customer makes six cash deposits of USD 9,500 at different branches on the same day. No single deposit exceeds USD 10,000, but aggregation exceeds the CTR threshold. Because the pattern suggests intentional evasion, the bank should file a CTR for the aggregated currency and a SAR for structuring. If the customer is an MSB, the SAR threshold is USD 2,000, not USD 25,000.
Traps that cost marks
Do not assume the BSA covers only banks. Do not apply the USD 25,000 bank SAR threshold to MSBs. Do not treat an EU directive as directly applicable without transposition. Do not tip off a customer about a SAR. Do not forget that CTRs aggregate by business day, not by transaction.