Definition
The Bank Secrecy Act (BSA, 31 U.S.C. §§ 5311-5336), enacted in 1970 and substantially amended by the USA PATRIOT Act (2001), the Anti-Money Laundering Act of 2020, and other legislation, is the primary US federal law requiring financial institutions to maintain records and file reports that enable law enforcement agencies to detect, investigate, and prosecute money laundering, tax evasion, and other financial crimes. The BSA is administered by the Financial Crimes Enforcement Network (FinCEN), a bureau of the US Department of the Treasury, which issues regulations and guidance interpreting the BSA’s requirements and receives the reports mandated by the statute. At its core, the BSA creates a financial intelligence infrastructure by requiring financial institutions to be the first line of defense against illegal financial flows, effectively deputizing private financial firms as reporters to the government.
The BSA’s requirements apply to “financial institutions,” a term defined to encompass banks, broker-dealers, mutual funds, casinos, insurance companies, money services businesses (MSBs), and — through FinCEN’s 2013 guidance — cryptocurrency exchangers and administrators. Any entity that qualifies as an MSB under FinCEN’s regulations must register with FinCEN, implement a written AML program, file Suspicious Activity Reports (SARs) for transactions involving $5,000 or more that the institution suspects involve proceeds of illegal activity, and file Currency Transaction Reports (CTRs) for cash transactions over $10,000. The AML program must include: internal policies and procedures, designation of an AML compliance officer, employee training, and an independent audit function.
Key Facts
- FinCEN’s March 2013 guidance was the first formal US regulatory statement that money transmission in virtual currencies, when it involves exchanging virtual currency for fiat (or vice versa), constitutes money services business activity subject to BSA requirements.
- The Financial Action Task Force (FATF) Recommendation 16 (the “Travel Rule”) requires financial institutions to transmit sender and beneficiary information with funds transfers over $3,000; FinCEN applied this rule to crypto in 2019 (31 CFR § 1010.410(f)) and proposed lowering the threshold to $250 for cryptocurrency in 2020.
- Suspicious Activity Reports filed by crypto companies increased from approximately 800 in 2013 to over 150,000 in 2023, reflecting the dramatic growth of the crypto industry’s BSA compliance infrastructure.
- FinCEN assessed a $100 million penalty against BitMEX in 2022 for operating a derivatives exchange serving US customers without an AML program, and a $3.4 billion penalty against Binance in 2023 — the largest BSA penalty in history — for systematic AML failures.
- The Anti-Money Laundering Act of 2020 expanded BSA authorities to cover antiquities dealers, art market participants, and virtual asset service providers (VASPs), and required FinCEN to issue a beneficial ownership rule to combat shell company use (effective 2024).
- Crypto Travel Rule compliance remains technically challenging due to the pseudonymous nature of blockchain addresses; industry solutions including Notabene, Sygna, TRP, and TRISA attempt to build interoperable travel rule data exchange networks among VASPs.
- Self-hosted wallet transfers (transfers to/from wallets not controlled by a regulated VASP) have been the subject of ongoing FinCEN rulemaking regarding enhanced recordkeeping requirements, with the “unhosted wallet” rule proposed in December 2020 but not yet finalized.
Relevance to Tokenization
The Bank Secrecy Act’s AML requirements are a mandatory compliance layer for virtually every tokenized asset platform that operates in the United States or serves US investors. Any platform that qualifies as an MSB (money transmitter, exchanger, or administrator of virtual currency) must maintain a full AML program, file SARs, and implement the Travel Rule for crypto transfers. Platforms that qualify as broker-dealers (SEC/FINRA registered) must comply with FINRA’s Rule 3310 AML compliance program requirements, which parallel BSA requirements but are administered through FINRA examination rather than FinCEN.
The Travel Rule presents the most significant technical compliance challenge for tokenized securities platforms. When a tokenized security is transferred between wallets on a blockchain, the transaction is irreversible and pseudonymous by default — the blockchain records only the sending and receiving addresses, not the identity of the beneficial owners. FATF and FinCEN’s Travel Rule requires that identity information accompany transfers above the relevant threshold, creating a requirement that tokenized security platforms must either implement through off-chain messaging systems (the approach of Notabene and similar Travel Rule solutions) or through on-chain identity claims (the approach of ERC-3643’s ONCHAINID). Neither approach is fully standardized across the industry, and compliance gaps remain.
For the long-term development of tokenized securities markets, BSA compliance is both a burden and a competitive advantage. The burden is the cost and complexity of implementing KYC, AML screening, SAR filing, and Travel Rule systems across every investor interaction. The competitive advantage is that well-implemented on-chain compliance systems — particularly programmable compliance under ERC-3643 or similar standards — can make BSA compliance automatic, auditable, and demonstrably superior to the paper-based compliance processes of traditional securities markets. Regulators who can review a complete on-chain record of all transfers, all investor identity checks, and all suspicious activity flags in real time may ultimately find blockchain-based tokenized securities more transparent and compliant than their traditional counterparts.
Related entries: On-Chain KYC/AML, Money Transmitter License, Transfer Agent