What anti-money laundering rules are and why banks have them

Anti-money laundering (AML) is a set of rules and processes that banks use to detect and report suspicious financial activity. The goal is to prevent criminals from hiding the origin of illegally obtained money by moving it through the banking system. Banks are required by law to implement these controls, report suspicious transactions to federal authorities, and keep records that prove they did so.

The rules exist because money laundering makes it possible for drug traffickers, human smugglers, terrorists, and other criminals to spend proceeds from their crimes without being caught. Without AML controls, a criminal could deposit cash from illegal activity into a bank account and then transfer it elsewhere, making the money appear legitimate. AML rules force banks to interrupt that process by identifying when something looks wrong and reporting it.

In the United States, the Financial Crimes Enforcement Network (FinCEN), which is part of the Treasury Department, sets and enforces AML rules. Banks that fail to follow these rules face civil penalties, criminal charges, and loss of their banking license.

Key Takeaways

  • Banks must verify who their customers are, monitor their accounts for unusual activity, and report suspicious transactions to FinCEN within a set timeframe.
  • A Suspicious Activity Report (SAR) is filed when a bank detects transactions that may indicate money laundering, fraud, or other financial crimes.
  • Currency Transaction Reports (CTRs) are filed automatically when a customer deposits or withdraws more than $10,000 in cash in a single day.
  • Banks use software and human review to flag transactions that don't match a customer's normal spending patterns or that involve high-risk countries or industries.
  • Customers are not told when a SAR is filed about them, and filing a SAR does not mean the customer has committed a crime.

The three main parts of an AML program

Every bank must have a written AML program that covers three core areas. The first is customer due diligence (CDD), which means the bank must verify who you are when you open an account. This involves checking your name, address, date of birth, and identification documents. For business accounts, the bank must also identify the beneficial owners — the real people who control the company — not just the company itself.

The second part is ongoing transaction monitoring. Banks use software to watch for patterns that don't fit a customer's normal behavior. If you usually spend $2,000 a month and suddenly wire $50,000 overseas, the system flags it. If you deposit cash regularly but then deposit $15,000 in a single day, that gets flagged too. The bank doesn't automatically assume you've done something wrong — it just means a human will review the transaction to decide whether it warrants a report.

The third part is reporting suspicious activity. When a bank finds a transaction or pattern that suggests money laundering, fraud, or other financial crime, it files a Suspicious Activity Report (SAR) with FinCEN. The bank must file the SAR within 30 calendar days of detecting the suspicious activity, though some situations allow for a 60-day extension. The bank keeps the SAR confidential and does not tell the customer that one was filed.

Suspicious Activity Reports and what triggers them

A Suspicious Activity Report (SAR) is the main tool banks use to report potential financial crime. Banks file SARs when they detect activity that could indicate money laundering, terrorist financing, fraud, embezzlement, or other illegal conduct. The threshold is not certainty — the bank does not have to prove a crime happened. It only has to believe the activity is suspicious and that the amount involved is at least $5,000.

Common reasons a bank files a SAR include: a customer deposits large amounts of cash with no clear source of income; a customer's account suddenly receives many small deposits that total a large sum (called "structuring"); a customer sends money to a country known for financial crime or terrorism; a customer's transactions don't match their stated occupation or business; or a customer tries to move money out of the country quickly after receiving it.

It is important to understand that a SAR is not an accusation. Filing a SAR does not mean the bank thinks you committed a crime, and it does not automatically trigger an investigation. It means the bank found something unusual enough to report to authorities, who then decide whether to investigate further. Many SARs are filed and closed without any action taken.

Currency Transaction Reports and the $10,000 rule

Banks must file a Currency Transaction Report (CTR) whenever a customer deposits or withdraws more than $10,000 in cash in a single business day. This is not optional and does not depend on whether the transaction looks suspicious. If you deposit $12,000 in cash on a Monday, the bank files a CTR. If you deposit $6,000 on Monday and $5,000 on Tuesday, no CTR is filed because each day is under the threshold.

The CTR includes your name, address, the amount, the date, and the form of currency (bills, coins, or both). The bank files it with FinCEN within 15 days of the transaction. Like a SAR, a CTR is not evidence of wrongdoing — it is straightforward a record that a large cash transaction occurred. Authorities use CTRs to track cash flows and identify patterns, but filing a CTR does not mean you are under investigation.

One thing CTRs do not do is prevent you from depositing or withdrawing cash. You have the legal right to move your own money in and out of your account. The bank cannot refuse a cash deposit or withdrawal just because it exceeds $10,000, and it cannot ask you questions designed to get you to split the deposit into smaller amounts to avoid the CTR threshold. That practice is called "structuring" and is itself illegal.

How banks decide what looks suspicious

Banks use a combination of automated software and human judgment to spot suspicious activity. The software is programmed with rules based on risk factors. High-risk factors include: the customer's location or the destination of their money (certain countries have higher financial crime rates); the customer's industry (cash-heavy businesses like restaurants or retail are monitored more closely); the customer's stated purpose (some types of transactions are inherently riskier); and the customer's transaction history (sudden changes in behavior stand out).

When the software flags a transaction, a human analyst reviews it. The analyst looks at the customer's account history, the nature of the transaction, and whether there is a reasonable explanation. If a customer who runs a restaurant deposits $8,000 in cash on a Friday, that may be normal. If a customer who works as a software engineer deposits $8,000 in cash with no stated reason, that warrants closer review.

Banks also maintain a list of customers and entities they are prohibited from doing business with. This list comes from FinCEN and includes known terrorists, drug traffickers, and sanctioned countries. If a customer's name matches someone on that list, the bank must freeze the account and file a report when ready.

What happens after a suspicious activity report is filed

Once a bank files a SAR with FinCEN, the report goes into a find database that law enforcement agencies can access. The FBI, DEA, IRS, Secret Service, and other federal agencies use SARs to investigate financial crimes. State and local law enforcement can also request access to SARs relevant to their investigations.

The customer is not notified that a SAR was filed. In fact, the bank is legally prohibited from telling the customer about the SAR in most cases. This is called the "tipping off" rule, and it exists to prevent suspects from destroying evidence or fleeing before an investigation begins. The only exception is if the customer is the subject of a criminal investigation and the investigator specifically requests that the bank not disclose the SAR.

A SAR does not automatically freeze your account or prevent you from accessing your money. It is a report, not an action. However, if law enforcement obtains a warrant or court order, the bank may freeze the account as part of a criminal investigation. That is a separate legal process from the SAR filing.

Your rights when a transaction is blocked or delayed

If a bank blocks a transaction or delays it for AML review, you have the right to ask why. The bank does not have to give you detailed information about its AML procedures or explain exactly what triggered the review — that information is confidential. But the bank should tell you that the delay is due to AML compliance and provide a general timeframe for resolution.

If you believe a transaction was blocked in error, you can contact your bank's compliance department and ask them to review the decision. You can also file a complaint with the Consumer Financial Protection Bureau (CFPB) if you think the bank's AML process was unfair or discriminatory. The CFPB cannot override the bank's decision, but it can investigate whether the bank followed its own procedures and treated you fairly.

If you are the subject of a SAR and law enforcement contacts you, you have the right to speak with an attorney before answering questions. Being the subject of a SAR does not mean you are guilty of anything, and you should not assume that cooperating with investigators without legal counsel is in your interest.

Frequently Asked Questions

Can a bank refuse to let me withdraw my own money because of AML rules?

A bank cannot refuse a withdrawal just because the amount is large or because it triggers a CTR. However, a bank can freeze an account if law enforcement obtains a court order or if the bank has reason to believe the account is connected to terrorism or sanctions violations. If your account is frozen, the bank must tell you and explain the reason.

What does it mean if my bank asks me where money came from?

Your bank is required to ask questions about the source and purpose of large or unusual deposits. This is part of customer due diligence. You should answer honestly. If you refuse to answer or give inconsistent answers, the bank may file a SAR or close your account.

Will a SAR show up on my credit report or background check?

No. A SAR is filed with FinCEN and is not part of your credit report, criminal record, or standard background check. It is a confidential report used by law enforcement. Unless you are charged with a crime, a SAR will not appear on any document a third party can see.

Is structuring my deposits illegal even if the money is legitimate?

Yes. Structuring — deliberately splitting deposits or withdrawals to stay under the $10,000 CTR threshold — is illegal regardless of whether the money itself is legal. It is a federal crime called "structuring to evade reporting requirements." If a bank suspects you are structuring, it will file a SAR.

How long does a bank keep AML records?

Banks must keep records of customer identification, CTRs, and SARs for at least five years. Some records must be kept longer depending on the type of account or transaction. These records are available to law enforcement upon request.