Bank Secrecy Act and Anti-Money Laundering: CIP, CDD, SARs, CTRs, and OFAC
This domain tests the Bank Secrecy Act and anti-money-laundering program. Expect questions on risk assessment, customer identification, customer due diligence, beneficial ownership, currency transaction reports, suspicious activity reports, recordkeeping, information sharing, and OFAC sanctions.
Core rules
- A BSA/AML program requires a risk assessment, written policies, a designated BSA officer, training, and independent testing.
- CIP requires a taxpayer identification number, name, date of birth, address, and identity verification, generally within 30 days, with records retained for five years.
- CDD requires understanding the customer, expected activity, and beneficial ownership. For legal entity customers, identify each beneficial owner with at least 25% ownership and one individual with control.
- A CTR is required for currency transactions over $10,000 in a business day, including known aggregates; it is generally filed within 15 calendar days.
- A SAR is required for suspicious activity of at least $5,000 where the bank knows, suspects, or has reason to suspect a violation or suspicious transaction; it is generally filed within 30 calendar days, extendable to 120 days if no subject is identified.
- SAR confidentiality is strict: no tipping off the customer. OFAC screening is separate and strict-liability based.
Worked example
A customer deposits $6,000 cash in the morning and $5,000 cash in the afternoon. The bank knows both transactions and they total $11,000 in one business day. It must aggregate the cash and file a CTR; it should not file two separate reports or ignore the second deposit as below $10,000. If the pattern suggests intentional structuring to avoid reporting, a SAR may also be required. Reasoning: CTR aggregation is based on the bank’s knowledge of same-day currency activity, not on a single teller transaction.
Traps that cost marks
- Filing a SAR and then telling the customer or a third party.
- Treating a CTR as a suspicious activity report; the CTR is a currency report, not a suspicion finding.
- Missing beneficial ownership for legal entities, including the 25% and control prongs.
- Relying only on a vendor’s OFAC screen without resolving potential matches.
- Letting the BSA risk assessment become stale after new products or higher-risk customers.
Exam focus
Know the filing trigger, timing, retention period, and confidentiality rule for each report type.