Revising the Bank Secrecy Act to Protect Privacy and Deter Criminals

Given that Congress enacted the BSA without careful study, it is hardly surprising that the resulting regulatory framework has proved so ineffective at stopping criminal activity. The BSA’s broad sweep today, however, seems surprising because even in 1974, when evaluating a far narrower regime, five Supreme Court justices, including Justice Thurgood Marshall, raised major concerns with the BSA’s requirements under the Fourth Amendment. While two of those justices ultimately found that the BSA, as it stood in 1974, did not violate the Constitution, today’s BSA asks more of financial institutions and citizens and operates on a financial system that has changed dramatically from the early 1970s. In fact, two current Supreme Court justices (Justices Neil Gorsuch and Sonia Sotomayor), recognizing these (and other) changes, have signaled a willingness to revisit some of the constitutional questions that the Court raised in the early 1970s.

It should be easy for Congress to fix the BSA because the basic framework to balance the competing interests of individuals’ financial privacy and the government’s ability to gather evidence to enforce laws is already present in the Fourth Amendment. This constitutional right generally requires the government to obtain a warrant upon a showing of probable cause to obtain access to an individual’s person, house, papers, and effects. It is this framework that should guide reform of the BSA to limit government intrusion into individuals’ private financial affairs.

The Bank Secrecy Act of 1970 (BSA) and its later amendments, including the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (Patriot Act) in 2001, require financial institutions in the United States to assist U.S. government agencies in detecting and preventing money laundering and other crimes. The BSA now forms the basis of an extensive—and costly—regulatory framework. Yet, if judged by the standard of reducing predicate crimes, there is virtually no empirical evidence to suggest that the approach has worked. Instead, the evidence suggests that the BSA framework has proven a minor inconvenience for criminals but a major burden on law-abiding citizens.

The BSA was enacted without careful study or forethought. Congressional hearings clearly show that the bill’s supporters had not fully considered whether the legislation included appropriate solutions to the supposed abuse of secret foreign bank accounts. Congress and the Department of the Treasury then spent five-plus decades building on this shaky BSA framework to supposedly better deter criminals, but the evidence shows no net benefit to this approach. Rather, the expansion of the BSA has dramatically increased explicit compliance costs for financial institutions and diminished Americans’ constitutionally protected rights.

At minimum, Congress should amend the BSA to remove the reporting requirements that force financial institutions to act as law enforcement agents and allow the U.S. government to intrude into private citizens’ financial business without the protections guaranteed by the Constitution. Limiting the BSA to recordkeeping requirements would preserve relevant information for criminal investigations and allow federal resources to be more efficiently focused on catching criminals while respecting constitutional safeguards. As the digital age takes hold, it is more important than ever that the United States lead the way in protecting individuals’ rights against government overreach and setting the standard for personal financial privacy.

Congress passed a bill in 1970, several titles of which have become known as the BSA.¹ No member did more to promote that legislation than Rep. Wright Patman (D‑TX), the chairman of the House Committee on Banking and Currency in 1968. Known as the “last populist,” Patman ultimately served 24 consecutive terms in the House (from 1929 to 1976), and he believed that “the root of all evil was the concentration of economic power in the hands of a small number of bankers, business executives and government officials.”² Patman held a “preliminary inquiry” hearing in December 1968 and then introduced his legislation at another hearing in December 1969.

The stated purpose of the 1968 hearing was to “inquire into some of the practices of foreign banking institutions, and their depositors.”³ At the end of the hearing, Patman announced his intent to introduce a bill. According to Patman, his legislation would

Ultimately, the legislation that became the BSA went much further than merely extending existing “financial safeguards” and did not make it a crime to deal with foreign financial institutions. It remains the statutory foundation for the existing federal anti–money laundering (AML) regulatory framework (see Figure 1).

Patman’s bill made two major changes to existing federal laws: one that required financial institutions to maintain records “where such records have a high degree of usefulness in criminal, tax, or regulatory investigations or proceedings” and one that required the reporting of certain financial transactions to the Treasury Department.⁵ The bill specified that transactions of more than $5,000 in monetary instruments transferred either into the United States or out of the United States had to be reported.⁶ This provision became the statutory basis for requiring the filing of a Report of International Transportation of Currency or Monetary Instruments, or CMIR. The bill also required reporting on domestic transactions, which became the statutory basis for filing currency transaction reports, or CTRs. The bill left the details on what would be required up to the Treasury.⁷

Given this statutory language, Patman clearly did not direct his bill solely toward making it more difficult for Americans to hide funds using foreign financial institutions. It is even more disturbing, though, how little justification the hearings revealed for the changes that the bill implemented. Both the 1968 and 1969 hearings relied on little more than government officials’ anecdotes and assurances that access to more information was essential to effective law enforcement. None of the witnesses provided data to support the prevalence of the ostensible money laundering problems through either domestic or foreign financial institutions. Moreover, the witnesses barely discussed how the specific legislative proposals for domestic transactions might improve the ability to prosecute crimes. Given that the witnesses acknowledged the successful prosecutions that were already taking place, this shortcoming is notable.

Patman began the 1968 hearing by summarizing the problems his committee was considering. Against a backdrop of using secret foreign bank accounts, he mentioned “the illicit financial manipulation of huge sums of money,” income tax evasion, fraudulent defense contracts, the theft of Treasury bills, corporate kickbacks by Vietnamese importers, various types of securities fraud, and the use of “fictitious” and “dummy” corporations. One witness, U.S. attorney for the Southern District of New York Robert Morgenthau, decried how secret Swiss bank accounts had become an “increasingly widespread and versatile tool” to evade U.S. laws and regulations. He explicitly accused many of the “millions of Americans” who vacation in Europe of finding that “secret foreign banks are available readily to them for lucrative criminal purposes.” Yet he was unable to provide any data to support his claims. Morgenthau similarly claimed that “enormous numbers” of investors used foreign banks to “evade income taxes on their trading profits” and that the number of tax evaders had become “very large,” representing “a loss of tax revenues in the many millions of dollars.”⁸

Morgenthau also complained of other illegal activities, including fraudulent stock market transactions, insider trading, and the avoidance of margin requirements. Most of his anecdotes discussed cases that were successfully prosecuted even though the alleged activity took place long before the 1968 hearing. He testified that he often could not prosecute criminals because foreign banks would not “furnish witnesses competent to introduce their banking documents into evidence,” and as a result, “it should be obvious” that the increasing number of “successfully prosecuted criminal cases” by his office represented only “a small fraction of the crimes committed by Americans through secret foreign accounts.” He also opined that “even if 99 or 98 percent of citizens pay their income taxes and abide by the securities laws, a substantial percentage of our citizens are evading the payment of taxes and violating other laws through the use of Swiss and other foreign banks.” In Morgenthau’s view, this situation was “a serious problem in itself, and if it goes unchecked, more and more people are going to try to use this device.”⁹

Other witnesses, such as Irving Pollack and Mahlon Frankhauser of the Securities and Exchange Commission (SEC), similarly described stories of tax evasion and violations of securities laws and regulations. However, just as Morgenthau had done, Pollack mentioned examples of fraud that had already been successfully prosecuted, such as the case where “American corporate officials, and others, used such foreign intermediaries to mask a massive distribution to the American public of worthless securities of an insolvent corporation at a manipulated price.” Separately, then assistant attorney general Fred Vinson outlined some of “the principal Federal laws and regulations” that criminals might violate using foreign bank accounts, singling out Section 7 of the 1934 Securities Exchange Act, whereby the Federal Reserve sets limits on how much credit can be used to purchase securities.¹⁰

What was even stranger, though, was that Vinson later testified that many countries, even Switzerland, did share financial transaction and account holder information with U.S. authorities. Vinson pointed out that the problem with the Swiss banks—the most frequently used foreign institutions for these purposes—was not that the Swiss refused to help U.S. prosecutors. The problem instead was that Swiss laws required court orders for Swiss bankers to disclose information. Vinson objected that the court order process took too long and stated that the difficulty was “more a matter of attitude than of law; the attitude being, regardless of the merit of the request, that they should be very slow, and they are very slow to furnish judicial assistance.” It is difficult to see how any of the changes in Patman’s bill addressed this problem, and even Pollack affirmed his belief that the only solution would be for the United States to enter into treaties or other international agreements for sharing information.¹¹

Regardless of whether it was possible for prosecutors to gather sufficient information in a timely manner, the witnesses again presented no empirical evidence describing the size and scope of the alleged problems. Pollack stated that it would “take some time” to find out what percentage of exchange trading was done on behalf of foreigners or foreign accounts. Frankhauser added that the SEC “unfortunately lack[s] very precise figures in this area” and that the SEC “do[es] not know the full extent or number of special omnibus accounts that are carried by U.S. brokers for Swiss banks.” After Patman referred to an FBI estimate that “there might be as much as $12 million a year in skim, gambling skim winding up in the hands of members of organized crime,” a “significant amount” of which may go abroad, Pollack stated that “just how great [these fraudulent transactions] are is a difficult thing for any of us, I guess, to estimate, since we can’t get the information because of restrictive laws operating in foreign countries.”¹²

Patman held another hearing in December 1969 and introduced his draft legislation. At the beginning of the hearing, Patman announced that his legislation had been “carefully drafted so that it is aimed at the prevention of the use of secret foreign financial facilities for illegal purposes by those subject to U.S. laws.”¹³ But as discussed at the 1968 hearing, the problem was primarily caused by foreign banking laws, meaning that cooperation from foreign governments is necessary to facilitate information sharing with federal authorities. The bill does nothing to directly address that issue, though, and Patman expressly stated that he wanted to avoid creating burdensome regulations that would infringe on the laws of any other nation.

Patman also claimed that his legislation and the 1969 hearings were “a direct result of a 1‑day investigative hearing held by this committee on December 9, 1968,” and that those hearings revealed that “the use of these secret foreign bank accounts and foreign financial institutions as part of illegal schemes by American citizens and others created a tremendous and grave problem of law enforcement in the United States.” He then mentioned that Morgenthau (who participated in both hearings) had estimated that the loss in tax revenues to the U.S. government due to the use of these secret foreign accounts was in the “hundreds of millions.”¹⁴ The record from the 1968 hearing demonstrates, however, that Patman’s statements (at best) mischaracterize what occurred during those proceedings.

One of the most revealing exchanges at the 1969 hearing occurred when Rep. William Widnall (R‑NJ) briefly stopped Patman from getting to the first witness.

Patman then moved on, and the remainder of the testimony was remarkably like that given during 1968, when multiple government officials discussed the problem of secret foreign bank accounts with respect to tax evasion and fraud.

Morgenthau’s 1969 testimony referenced some of the same prosecutions that he had discussed in 1968, as well as additional cases that resulted in convictions. He also reiterated his belief that there were many more instances of criminal activity that he was unable to prosecute (due to either lack of resources or because the existing evidence was inadmissible in court) and gave his estimate that “deposits in secret foreign bank accounts held for illegal purposes have a value in the hundreds of millions of dollars.”¹⁶ As during the first hearing, he provided no evidence to substantiate this opinion, nor did he discuss the legitimate reasons in the U.S. tax code for Americans to invest in foreign jurisdictions.¹⁷

Later, when answering Widnall and Rep. Ben Blackburn (R‑GA), then assistant U.S. attorney general Will Wilson acknowledged that there was nothing illegal about transporting large amounts of cash unless the money was stolen property or somehow derived by illegal means and that prosecutors face the same search and seizure problems with any kind of property that Americans attempt to transport internationally. Similarly, Widnall told two witnesses (Randolph Thrower, the IRS commissioner, and Eugene Rossides, an assistant Treasury secretary) that while he understood they were both endorsing the objectives of the bill, he recognized that “you are trying your best to point up the difficulties in connection with not just the administration of it but in arriving at the right solution, and until you have had a chance to study it even more.”¹⁸

Given how this process unfolded, it is hardly surprising that multiple members of Congress complained that the bill’s domestic transaction reporting requirements did not address the legislation’s stated purpose. As a 1983 report by the Department of Justice noted, “many Congressmen argued that the reports regarding domestic transactions [in the BSA] were not relevant to the purpose of the legislation, which was to address the problems caused by the foreign bank secrecy laws” and that those portions of the bill should be severed and considered later. Patman, however, was able to overcome such objections by “stressing the urgent need for the legislation and the need for uniform recordkeeping.” Several members also objected that the domestic transaction reporting requirements would violate the privacy of bank customers, that they would “unduly burden legitimate commercial transactions,” and that they delegated “too much power” to the Treasury secretary.¹⁹

Despite these misgivings, Patman’s legislation passed in 1970 and still forms the core of the AML regulatory framework in the United States and, thanks mainly to the efforts of the U.S. government, many other countries.

The biggest statutory changes implemented by the BSA in 1970 were the new recordkeeping and reporting requirements. As noted earlier, the legislation required financial institutions to maintain records “where such records have a high degree of usefulness in criminal, tax, or regulatory investigations or proceedings” and gave the Treasury secretary the regulatory authority to determine which records displayed such usefulness.²⁰

Separately, the legislation required reporting of two types of transactions in currency. First, anyone, “whether as principal, agent, or bailee,” who transfers funds in to or out of the United States “in an amount exceeding $5,000 on any one occasion” must report the transaction according to regulations promulgated by the Treasury secretary.²¹

Second, the legislation required the reporting of certain domestic financial transactions, but it left virtually all those details (including a threshold amount) up to the Treasury. The legislation stated:

The Treasury promulgated the first BSA rules in 1972, requiring financial institutions to “file a report of each deposit, withdrawal, exchange of currency or other payment or transfer, by, through, or to such financial institution, which involves a transaction in currency of more than $10,000.”²³ This $10,000 reporting threshold remains unchanged.

The next time that Congress made major changes to the BSA was in 1986, when it passed the Money Laundering Control Act, which established money laundering as a criminal offense.²⁴ In addition, Section 1354 of the act made it a criminal offense to structure transactions to evade the BSA reporting requirements.²⁵ This law also expanded compliance obligations for banks by amending Section 8 of the Federal Deposit Insurance Act and Section 206 of the Federal Credit Union Act to require essentially all banks subject to federal regulation to “establish and maintain procedures reasonably designed to assure and monitor the compliance” with the BSA provisions and to include a review of banks’ BSA compliance procedures in all federal bank examinations.²⁶

In 1992, the Annunzio-Wylie Anti–Money Laundering Act strengthened sanctions for BSA violations.²⁷ For instance, Sections 1501 and 1502 provided that federal banking regulators could appoint a conservator or revoke a federal banking charter for banks guilty of a money laundering offense.²⁸ Section 1504 provided that federal banking regulators could remove officers or directors of a depository institution for various BSA violations (including those committed by other employees of the institution),²⁹ and Section 1512 prohibited the operations of an illegal money transmitting business.³⁰

But the most consequential change made in 1992 was the addition of the statutory basis for requiring financial institutions to file what are now known as suspicious activity reports (SARs). Specifically, Section 1517 authorized the Treasury secretary to “require any financial institution, and any director, officer, employee, or agent of any financial institution, to report any suspicious transaction relevant to a possible violation of law or regulation.”³¹ As a result of this statutory requirement, financial institutions were required to file “criminal referral forms,” with supporting documentation, with multiple federal agencies.³²

The Money Laundering Suppression Act of 1994 established the modern SAR reporting regime by authorizing the Treasury to designate a single officer or agency to “refer any report of a suspicious transaction to any appropriate law enforcement or supervisory agency.”³³

In April 1996, the Financial Crimes Enforcement Network (FinCEN), part of the Treasury Department, finalized the first regulation to create “a new method for the reporting by depository institutions, on a uniform ‘Suspicious Activity Report,’ of suspicious transactions and known or suspected criminal violations.”³⁴ The final rule required banks to file for transactions—not limited merely to transactions in currency—of at least $5,000 that they know (or have reason to suspect) are derived from illegal activity, or those that they believe are designed to “hide or disguise funds or assets derived from illegal activities … as part of a plan to violate or evade any federal law or regulation or to avoid any transaction reporting requirement under federal law or regulation.”³⁵

The next major change to the BSA came after the September 11, 2001, terrorist attacks, when Congress passed the Patriot Act. Title III of the Patriot Act added multiple provisions intended to improve the federal government’s ability to stop terrorist financing internationally.³⁶ For example, Section 311 authorized the Treasury secretary to designate a foreign jurisdiction or foreign financial institution as a primary money laundering concern,³⁷ and Section 312 required U.S. financial institutions that maintain a banking relationship with “a non–United States person” to “establish appropriate, specific, and, where necessary, enhanced, due diligence policies, procedures, and controls” to detect and report money laundering.³⁸ Section 313 prohibited U.S. financial institutions from establishing correspondent accounts with foreign shell banks (those that have no physical presence in any country),³⁹ and Section 319 enhanced the federal government’s ability to seize funds in an interbank account in the United States.⁴⁰ Section 356 also expanded the group of financial institutions required to file SARs to include broker-dealers (firms engaged in purchases and sales of securities).⁴¹

Multiple sections of the Patriot Act (such as Sections 328 and 330) imposed responsibilities on the executive branch to negotiate with and encourage foreign governments to assist the U.S. government in detecting money laundering and terrorist financing. Section 361 formally made FinCEN a bureau of the Treasury Department, and Section 363 increased civil and criminal penalties for money laundering. Interestingly, Section 371 made “the act of smuggling bulk cash itself a criminal offense,” after noting that Congress found that “effective enforcement of the currency reporting requirements” of the BSA have “forced drug dealers and other criminals engaged in cash-based businesses to avoid using traditional financial institutions.”⁴²

Another major Patriot Act provision is directly related to financial firms’ operations. Section 326 required the Treasury secretary to prescribe regulations that establish “the minimum standards for financial institutions and their customers regarding the identity of the customer that shall apply in connection with the opening of an account at a financial institution.”⁴³ These regulations must, at minimum, “require financial institutions to implement, and customers (after being given adequate notice) to comply with reasonable procedures” to verify each potential account holder’s identity, including maintaining records of the information used to verify identity and consulting government-provided lists of known terrorists.⁴⁴ To implement these requirements, FinCEN has promulgated regulations that generally compel financial institutions to have written customer identification programs that are appropriate for their “size and type of business,” as well as appropriate “risk-based procedures for conducting ongoing” customer due diligence.⁴⁵

The Anti–Money Laundering Act of 2020 implemented the most recent set of legislative changes to the BSA.⁴⁶ The act expands the federal government’s role in combating financial crimes in multiple ways, such as by creating FinCEN domestic liaisons, BSA information security officers, BSA innovation officers, and a government-based financial crimes tech symposium.⁴⁷ Through these and other changes, the act is supposed to “improve coordination and information sharing” among federal agencies and law enforcement to help counter terrorism and money laundering. It also codifies that the AML regulatory framework is supposed to be based on risk and tries to modernize the regulatory framework by (among other changes) accounting for the use of cryptocurrency and digital assets. Specifically, the act expands BSA definitions in several places to include the term “value that substitutes for currency.”⁴⁸

One of the biggest changes that the 2020 act implements to the BSA is the establishment of “uniform beneficial ownership information reporting requirements.” Prior to the act, financial institutions were generally charged with obtaining information about the beneficial owners of a corporate customer as part of their customer identification programs and customer due diligence processes. Section 6403 of the act places the burden on the company and requires the company to report identifying information to a central database that FinCEN manages, in accordance with regulations to be promulgated by the Treasury.⁴⁹ These provisions are intended to prevent people from circumventing AML laws using shell corporations, one problem that the BSA was supposed to mitigate when originally enacted in 1970.⁵⁰

As this brief history makes clear, Congress gave federal regulators a great deal of discretion to establish the AML regulatory framework, which has expanded well beyond the basic recordkeeping and reporting requirements established by the BSA in 1970. The AML framework has also led to the creation of multiple, expensive, and overlapping national and international bureaucracies. Mostly due to the efforts of the U.S. government, there is now a long list of national and international agencies, as well as national laws and international agreements, governing the exchange and reporting of financial information. For instance, there are more than 100 foreign financial intelligence units around the world, a role that FinCEN fills in the United States.⁵¹ Virtually all countries now have laws and regulations that require private entities to collect and report financial information much like what the United States requires under the BSA.⁵² Both American and foreign financial institutions must report on the financial activities of their U.S. customers under the Foreign Account Tax Compliance Act and the qualified intermediary rules.⁵³ The terrorism-related Information Sharing Environment, a center within the Office of the Director of National Intelligence, involves thousands of federal, state, local, and tribal government agencies,⁵⁴ and the FBI also operates (among other programs) a National Data Exchange. Finally, the International Criminal Police Organization, or INTERPOL, maintains various information-sharing databases that it makes available to its 190 members.⁵⁵

Moreover, the wide discretion given to FinCEN, as well as the potential for being held criminally liable, predisposes financial institutions to err on the side of filing too many reports rather than too few. As a result, financial institutions—a list of companies that now includes banks, broker-dealers, pawnbrokers, travel agencies, and at least 10 other types of companies⁵⁶—file millions of reports each year even though FBI and IRS records show that there are only approximately 2,000 money laundering investigations per year.⁵⁷ The current approach is heavily biased toward collecting as much information as possible with little regard for whether the information is useful for investigations and even less regard for the burdens imposed on financial institutions and those who seek their services.

Multiple federal regulators enforce the BSA/AML rules, which impose heavy compliance costs on financial institutions and individual citizens alike.⁵⁸ Essentially, the AML rules ensure that financial institutions cannot legally transfer money without knowing who the customer is and having some idea of where the money came from.⁵⁹ The rules make it very difficult for anyone to transfer funds anonymously unless they use small amounts of paper currency.

Current federal regulations require financial institutions to report transactions of more than $10,000⁶⁰—the same threshold used for currency transaction reports in the original 1972 rule—and the failure to report such transactions is a criminal offense.⁶¹ Most financial institutions have a $5,000 threshold for filing SARs, but some, such as most money-service businesses, have their own $2,000 threshold.⁶² Separately, all financial institutions categorized as money-service businesses must obtain and record specific information for all transfers of at least $3,000,⁶³ and all currency exchangers must track any exchange that exceeds $1,000 in either domestic or foreign currency.⁶⁴

The AML rules also go well beyond the submission of reports. Federal regulators require, for instance, financial institutions to institute formal BSA/AML compliance programs.⁶⁵ Regulators heavily micromanage this process, requiring (at minimum) internal controls, independent testing for compliance, hiring a compliance officer, and providing employees with formal training programs.⁶⁶ The overall BSA compliance program is distinct from a customer identification program,⁶⁷ and it is not uncommon for regulators to require financial institutions to devote additional personnel and physical resources to their compliance programs.⁶⁸

In December 2021, for instance, FinCEN fined the CommunityBank of Texas $8 million for BSA violations that occurred between 2015 and 2019, on top of the $1 million fine assessed by a separate investigation for related violations by the Office of the Comptroller of the Currency (OCC).⁶⁹ According to FinCEN, the bank’s compliance program during the relevant period was insufficient because it was “understaffed,” even though the bank retained “six to eight BSA staff, including a BSA Officer and several BSA analysts, of which three reviewed case alerts on a regular basis and provided quality control review for one another.”⁷⁰

These types of regulations impose on financial institutions high explicit and implicit costs, some of which are passed on to consumers. The regulations leave financial institutions in constant legal jeopardy with a set of largely unreasonable expectations. For instance, the consent order between FinCEN and the CommunityBank of Texas faults the bank for failing to file SARs on persons that were known to be gamblers. The order then singles out one such customer (Customer A) and says that “in June 2019, Customer A, Customer A’s spouse, and another family member pleaded guilty to criminal charges including structuring, tax evasion, and money laundering associated with operating an illegal sports gambling operation from at least 1985 until April 2017.”⁷¹ It makes little sense to fine a bank (or any private business) for failing to detect criminals who, allegedly, were able to evade law enforcement for more than 30 years.

More broadly, it makes little sense to force private businesses to serve as law enforcement officials. It is hardly surprising, therefore, that the BSA/AML regime has proved so ineffective at stopping criminal activity. If judged by the standard of reducing predicate crimes, there is virtually no empirical evidence to suggest that the BSA/AML framework has worked.

One comprehensive study, for instance, points out that the U.S. General Accounting Office (GAO) has made several unsuccessful attempts to study the effectiveness of SAR filings in terms of prosecutions and convictions. One problem is that prosecutions often involve simultaneously charging perpetrators with money laundering violations, thus obscuring whether law enforcement discovered, for example, a drug crime because of money laundering or vice versa. According to the GAO, as of 2002, FinCEN was unable to report whether any of its SAR-based referrals resulted in criminal prosecutions.⁷² As late as 2014, academic research affirmed that possible benefits from the existing AML framework (internationally) had not yet been demonstrated.⁷³ More recently, Rep. Patrick McHenry (R‑NC), ranking member of the House Financial Services Committee, repeatedly asked the Treasury and FinCEN for evidence—not merely anecdotes about enforcement actions—that the AML regime provides a net benefit. According to McHenry, the information provided thus far “does not justify the burden placed on small businesses.”⁷⁴

Not only have the BSA/AML regulations been sharply criticized as a costly, ineffective approach to reducing crime, but they have also been criticized for being overly intrusive and elaborate, as well as for distorting the classical constructions of criminal law and criminal procedure. For example, one criminal law journal article reports that the framework for fighting money laundering, including the BSA, displays (among other problems) a “disproportionate imposition of severe penalties on predicate offenders who are easily detected.”⁷⁵ That is, money laundering charges tend to be simply added to the main offense rather than providing any independent benefit.⁷⁶

Overall, the evidence suggests that the AML regulatory framework has done little more than produce an information overload through excessive reporting. In 2015, for instance, the FinCEN director announced that the agency receives “approximately 55,000 electronically filed BSA reports from more than 80,000 financial institutions and 500,000 individual foreign bank account holders each day.”⁷⁷ In 2020, FinCEN Director Kenneth Blanco caused a stir when he announced that since 2013, FinCEN had received nearly 70,000 SARs related to “cryptocurrency exploitation,” but he neglected to mention that this is a small proportion of SARs for an agency that received almost 2.3 million SARs in 2019 alone.⁷⁸

FinCEN has also struggled with the fact that financial institutions may be reluctant to make tough decisions about what is and is not reportable on a SAR, further adding to the voluminous data by including more reports that have lower value to law enforcement officials. FinCEN has long recognized the problem of filing a SAR “defensively,” so to speak, and the filing can form the basis for liability for the financial institution itself,⁷⁹ but it is easy to understand the temptation to file more, rather than less, often (see Figures 2 and 3).⁸⁰

This problem is compounded by the multitude of federal regulators who lay claim to ensuring compliance with the AML regulatory framework. In addition to FinCEN, the federal banking regulators, the IRS, the SEC, and the Financial Regulatory Authority, among others, examine and investigate the effectiveness of financial institutions’ AML compliance programs and whether those firms have met their obligations to file SARs, have a customer identification program, and perform customer due diligence.⁸¹ It is not unusual for more than one regulator to bring an action on the same set of facts. Regulators levied more than $592 million in fines for AML violations in 2021 alone, and they have long cited AML enforcement as a top priority, often bringing with it some of the highest fines collected by the agencies.⁸²

Unsurprisingly, research suggests that compliance costs are high for financial companies, with a disproportionate burden falling on smaller firms.⁸³ Though few total compliance cost estimates exist, one based on Office of Management and Budget burden-hour estimates suggests that total BSA/AML costs are between $5 billion and $8 billion per year.⁸⁴ This total cost can be used to estimate per-conviction figures, but because federal agencies’ money laundering statistics vary, these averages display a wide range. For instance, using IRS-initiated money laundering sentences, and assuming (generously) that all such sentences would not have occurred but for the AML statutes, the per-conviction cost is at least $7 million.⁸⁵ Using, instead, the FBI’s money laundering conviction totals, the per-conviction cost is between $107 million and $178 million.⁸⁶

Given the stakes, financial firms may be reluctant to take on customers or activities that make their regulatory compliance more difficult. In fact, in 2018, the GAO “determined that Bank Secrecy Act/anti–money laundering (BSA/AML) regulatory concerns have played a role in banks’ decisions to terminate and limit customer accounts and close bank branches.”⁸⁷ Though not explicit, the AML regulatory framework imposes costs on would-be financial services customers, with firms simply refusing to provide some financial services to certain customers. These rules have also likely contributed to financial firms’ hesitancy to work with emerging industries, such as cryptocurrency-related companies and blockchain-based technologies. This hesitancy can hinder innovation and competition in financial markets, one of several difficult-to-quantify costs associated with this regulatory regime.

Many law-abiding customers have had their accounts frozen, at least temporarily, and have been kept out of the banking system. For instance, long before 2022, many Russian Americans had their accounts closed by banks who feared being liable for AML violations simply due to these customers’ connections to Russia. Similarly, a recent World Bank survey demonstrated that firms providing foreign remittance services have been increasingly scrutinized under the AML regime since the early 2000s; of more than 80 money transfer operators across 13 countries, almost half had their bank accounts closed.⁸⁸ In the United States, Federal Deposit Insurance Corporation surveys also suggest that approximately one-third of the unbanked have chosen to stay out of the banking system because they do not want to provide the personal information that AML regulations require.⁸⁹

The BSA framework is an ineffective way to fight crime. Indeed, multiple members of Congress noted during the 1968 and 1969 hearings that it was difficult to see how any of the legislative changes they were contemplating would solve the foreign-bank money laundering and tax evasion problems that they were hoping to stop. The expansion of the BSA over the years has not changed this basic dynamic.

It is also not clear why a heavy AML burden should be placed on (either narrowly or broadly defined) financial institutions because all business transactions can potentially be used to launder money. Regardless, most types of businesses—financial or otherwise—are generally ill-equipped to catch criminals, especially when those criminals go to great lengths to conceal their crimes.⁹⁰ It makes little sense to penalize legitimate businesses for failing to know that their customers might have engaged in criminal activity, and prosecutors should prosecute criminals for their crimes irrespective of what payment methods they use.

While BSA supporters typically point to enforcement actions or prosecutions as evidence that the regime is working, such examples, by themselves, provide no such proof. First, many actions arise from other criminal activity, thus alerting federal regulators who otherwise would not have discovered BSA/AML violations. These cases demonstrate that the BSA/AML regulations did not stop criminal activity.

Other incidents show how difficult it can be to detect criminal activity and that federal regulators are themselves vulnerable to criminals. For example, in 2016, North Korean hackers broke into the SWIFT messaging network, stealing almost $100 million from the Bank of Bangladesh by routing it into private accounts through the Federal Reserve Bank of New York.⁹¹ Had it not been for a fluke occurrence, the thieves would have tricked the New York Fed into routing them nearly $1 billion from the Bank of Bangladesh.⁹² Similarly, the U.S. federal government has proven itself to be far from immune to cybercrime in recent years, and the SARs database itself contains a wealth of information that could be attractive to hackers or other criminals. On these grounds alone, it makes sense to avoid creating these data-rich targets inside federal agencies.

Even without BSA/AML reporting requirements, financial institutions already have incentives to implement programs that avoid criminal activity, including cybercrimes. It is doubtful—based on experience—that holding these firms legally responsible for AML programs that fail to stop criminals can improve those incentives. Even if Congress fully repealed the BSA, it would remain illegal for financial institutions to knowingly facilitate criminal activity such as tax evasion or the sale of illegal drugs,⁹³ and reputational risks for financial institutions found to be assisting criminals are high.

Regardless, there is little to support the idea that federal agencies have the knowledge and ability to design AML programs that more effectively deter criminal activity. It is not unusual for federal regulators to cite financial institutions for AML violations after federal regulators, during their annual bank examinations, certified that the offending bank had a sound AML program in place. The frequency of these occurrences suggest that enforcement often operates with the benefit of hindsight and that certifications in the examination process say little about whether a financial institution has an AML program that can identify criminal activity.

In January 2021, for instance, FinCEN announced that it would assess $290 million in penalties against Capital One, a fine that came two years after the OCC had assessed $100 million in penalties for the same violations. FinCEN said that Capital One failed to “adequately monitor the cashing of millions of dollars” of checks by more than 100 customers dating between 2008 and 2014.⁹⁴ The OCC has examined Capital One every year, for decades, and the OCC has been statutorily required to review banks’ BSA/AML programs during those exams beginning in 1986. At the very least, it is difficult to argue that the OCC knew how to design an effective BSA/AML program for Capital One. Overall, the evidence demonstrates that the BSA/AML regulatory framework does little more than impose heavy explicit and implicit costs on millions of Americans.

Personal and financial privacy are key components of life in free societies, where individuals enjoy a private sphere free of government involvement, surveillance, and control.⁹⁵ Unless there is a reasonable suspicion that they have committed a crime or conspired to commit a crime, people should generally be free to live their lives unmolested and unsurveilled by the government.⁹⁶ Financial privacy is of deep and abiding importance to freedom, but many governments have shown themselves willing to routinely abuse private financial information. Financial privacy can let people protect their life savings when a government tries to confiscate its citizens’ wealth, whether for political, ethnic, religious, or “merely” economic reasons. As events in Canada in early 2022 demonstrate, even relatively free governments are sometimes willing to use private financial information to quell nonviolent protests.⁹⁷

In 2021, the Biden administration proposed to “create a comprehensive financial account information reporting regime” for all financial accounts with a “gross flow threshold” of $600 or more.⁹⁸ In response, many Americans expressed their disbelief that such a proposal did not run afoul of the protections guaranteed by the Fourth Amendment to the U.S. Constitution.⁹⁹ As it turns out, many Americans wondered the same thing about the BSA when it was enacted in 1970, sparking lawsuits that ended up before the Supreme Court.¹⁰⁰

The two major Supreme Court cases regarding the BSA were California Bankers Association v. Shultz (decided 6–3) in 1974 and United States v. Miller (decided 7–2) in 1976.¹⁰¹ These cases resulted in Americans losing what one commentor has called any “protectible interest in records held by a third party.”¹⁰² Both cases are ripe for revisiting, though, in light of the concerns that some justices raised at the time, the changes in information sharing brought by the digital age, and the increasingly broad reach of the BSA.

In California Bankers Association v. Shultz, the Court addressed the constitutionality of both the recordkeeping and reporting provisions of the BSA, upholding those provisions.¹⁰³ The Court held that the BSA recordkeeping provisions did not violate the Fourth Amendment, finding that nothing in the recordkeeping provisions require that any information be disclosed to the government.¹⁰⁴ The Court rejected plaintiffs’ argument that the banks were themselves effecting a seizure of customer records acting as “agent[s] of the Government,” noting that banks, who are themselves a party to the transaction, “voluntarily kept records of this sort before they were required to do so by regulation.”¹⁰⁵

The Court also upheld the reporting provisions of the BSA, finding no violation of the Fourth Amendment. For the foreign reporting requirements, the Court relied on the fact that the requirements dealt with matters “in foreign commerce,” over which the government has stronger authorities.¹⁰⁶ For the domestic reporting requirements, the Court’s analysis was different: it held that the reporting requirements did not violate any Fourth Amendment rights of the banks because they are parties to the transactions themselves but found that the depositors lacked standing to assert a Fourth Amendment claim because they had not shown that their transactions were required to be reported.¹⁰⁷

Thus, while the Supreme Court upheld the BSA’s reporting provisions, it did not address the fundamental question of whether the reporting requirements violated the Fourth Amendment rights of bank customers to be free from the government’s search and seizure of their records. The lower court had found that the provision violated the Fourth Amendment, “insofar as it authorizes the Secretary to require virtually unlimited reporting from banks and their customers of domestic financial transactions as a surveillance device for the alleged purpose of discovering possible, but unspecified, wrongdoing among the citizenry.”¹⁰⁸

Although the Court upheld the BSA, the justices were divided over the BSA’s implications for constitutional protections. Even Justices Lewis Powell and Harry Blackmun, who joined the majority in upholding the law, wrote a concurring opinion explicitly cautioning against “a significant extension of the regulation’s [domestic] reporting requirements”:

Justices William O. Douglas, William J. Brennan Jr., and Thurgood Marshall filed separate dissents voicing similar concerns with the BSA but found that the law, as then conceived, violated the Constitution.

Justice Douglas recognized that “customers have a constitutionally justifiable expectation of privacy in the documentary details of the financial transactions reflected in their bank accounts.” He acknowledged that the “wall is not impregnable” but found that both the recordkeeping and reporting provisions ran afoul of the Fourth Amendment.¹¹⁰ On the recordkeeping provision, Douglas wrote:

Douglas contrasted the BSA with other compulsory recordkeeping that did not raise the same constitutional concerns, noting that prior to the BSA, the United States had “confined compulsory recordkeeping to that required to monitor either (1) the recordkeeper, or (2) his business” and that even then “they must be records that would ‘customarily’ be kept, have a ‘public’ rather than a private purpose, and arise out of an ‘essentially noncriminal and regulatory area of inquiry.’ ”¹¹²

Douglas returned to the characterization that a “checking account … may well record a citizen’s activities, opinion, and beliefs” to find that the reporting provisions violate the Constitution.¹¹³

Justice Brennan joined Douglas’s concurrence as to the recordkeeping provisions but wrote separately on the reporting provisions, finding that those provisions violated the Constitution by delegating to the Treasury secretary “in broad and indefinite terms under a statute that lays down criminal sanctions and potentially affects fundamental rights.”¹¹⁵

Justice Marshall also agreed with Douglas and Brennan but wrote a separate dissent to emphasize that he saw the BSA’s recordkeeping provisions themselves as an unlawful search and seizure:

Marshall also worried that the existence of these records “will chill the exercise of First Amendment rights of association on the part of [contributors to political organizations] who wish to have their contributions remain anonymous.”¹¹⁷

Just two years later, in 1976, the Supreme Court again considered a case related to the BSA. In United States v. Miller, the Court addressed whether a person under criminal investigation had standing to challenge IRS subpoenas seeking information from the person’s bank collected pursuant to the BSA’s recordkeeping provisions.¹¹⁸ While the California Bankers Association case did not decide whether the reporting requirements were an unconstitutional seizure of a customer’s information because the majority found that the plaintiffs lacked standing to bring the claim, the Court’s decision in Miller essentially answered the question by holding that the Fourth Amendment does not protect information revealed to the bank. Justice Powell, writing for seven members of the Court, stated:

The Court rejected all arguments that the fact that the documents were compelled to be created by the BSA altered the analysis.

Justices Brennan and Marshall again dissented.¹²⁰ Brennan largely quoted from the lower court opinion, with which he agreed: “A bank customer’s reasonable expectation is that, absent compulsion by legal process, the matters he reveals to the bank will be utilized by the bank only for internal banking purposes.“¹²¹ That opinion recognized the important fact that

Justice Marshall expressed his exasperation with the majority’s ruling:

The holding in Miller (along with another Supreme Court case in the 1970s regarding the privacy of telephone records¹²⁴) established what is known as the “third-party doctrine,” which has served as a serious limitation on the Fourth Amendment’s protections by stripping a person of an expectation of privacy over information that a person voluntarily provides to a third party.

After the Supreme Court decided these cases in the 1970s, Congress passed a law to try to strengthen citizens’ diminished privacy rights and constitutional protections.¹²⁵ That attempt, however, failed to allay privacy concerns amid the ever-widening regulatory framework that Congress authorized the Treasury to implement. As a result, many of the same privacy rights concerns exist today—to an even larger degree in some ways. The type of information contained in a SAR, for example, is essentially an accusation—by a financial institution, reported to the federal government—that someone has acted illegally. Even the collection of this information under strict confidentiality requirements is problematic for citizens’ constitutionally protected rights, likely more so in the digital age than in the 1970s.

Yet the BSA/AML framework has consistently expanded in scope, size, and cost. In total, five justices in the California Bankers Association case—Powell, Blackmun, Douglas, Brennan, and Marshall—raised issues with the BSA’s sweep under the Fourth Amendment. Although two of them (Powell and Blackmun) found that the BSA, as it stood in the 1970s, did not violate the Constitution, today’s BSA—particularly the reporting requirements—is of much broader scope than the law that the California Bankers Association court faced. And the technology that gave Justice Marshall reason to find that the recordkeeping provisions constituted an unconstitutional seizure has only proliferated in later years, including by expanding the number of situations in which a customer interacts with an intermediary to conduct financial transactions. While the constitutionality of the BSA may have been upheld in 1974, these are questions that can—and should—be revisited as both the law and society have changed.

In fact, two current Supreme Court justices have signaled a willingness to revisit and revise the third-party doctrine. In the 2012 case United States v. Jones, Justice Sonia Sotomayor suggested that the idea that an individual waives privacy by sharing information with a third party might be “ill-suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks.”¹²⁶ More explicitly, she wrote that “it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties.”¹²⁷

Justice Neil Gorsuch also wrote an extensive critique of the third-party doctrine in his dissent in Carpenter v. United States in 2018, in which the majority found that the third-party doctrine is not applicable to cellphone location data. Gorsuch, however, took on the third-party doctrine directly, arguing that under the traditional understanding of the Fourth Amendment’s “protections for your papers and effects do not automatically disappear just because you share them with third parties.”¹²⁸ Noting that “at least some of [the Supreme Court’s] decisions have already suggested that the use of technology is functionally compelled by the demands of modern life,” Gorsuch asserts that “just because you have to entrust a third party with your data doesn’t necessarily mean that you should lose all Fourth Amendment protections in it.”¹²⁹

While it is virtually impossible to argue that the BSA/AML framework has markedly deterred criminal activity and provided a net benefit, federal officials have remained intent on further expanding the same approach. Especially given the technological advances in payments during the past few decades—changes that produce more voluminous transaction data with personal information that can more easily be shared—it is now more important than ever to reform the BSA to protect privacy rights.¹³⁰

The basic framework to balance the competing interests of individuals’ financial privacy and the government’s ability to gather evidence to enforce laws is already present in the Fourth Amendment. This constitutional right generally requires the government to obtain a warrant upon a showing of probable cause to obtain access to an individual’s person, house, papers, and effects. It is this framework that should guide reform of the BSA to limit government intrusion into individuals’ private financial affairs.

One reasonable way for Congress to reform the BSA would be to require financial institutions to maintain records but to ensure that the government can only access customers’ personal information with a valid search warrant. In this way, Congress could affirm that the Bill of Rights is not, to paraphrase Justice Douglas, intended to aid the prosecution of criminal cases. Given the high costs and the poor performance of the BSA in deterring criminal activity, it should be easy for Congress to implement this type of reform.

Moreover, aside from specific constitutional protections, financial privacy is vital because it can be the difference between survival and systematic suppression of an opposition group. Many businesses, dissidents, and human rights groups maintain accounts outside the countries where they are active for precisely this reason, and there are many legitimate reasons to operate anonymously owned “shell” companies.¹³¹ The current financial regulatory framework is inconsistent with these principles.

To reform the BSA so that it is consistent with these principles, Congress could keep intact the sections of the BSA that require financial institutions to maintain records but repeal those that require financial institutions to report customers’ financial information to government agencies.

The main changes to the U.S. Code would be as follows:¹³²

• Amend 12 U.S.C. § 3402 to strike as follows:
  
  Except as provided by section 3403(c) or (d), 3413, or 3414 of this title, no Government authority may have access to or obtain copies of, or the information contained in the financial records of any customer from a financial institution unless the financial records are reasonably described and—
  
  (1) such customer has authorized such disclosure in accordance with section 3404 of this title;
  
  (2) such financial records are disclosed in response to an administrative subpoena or summons which meets the requirements of section 3405 of this title;
  
  (3) such financial records are disclosed in response to a search warrant which meets the requirements of section 3406 of this title;
  
  (4) such financial records are disclosed in response to a judicial subpoena which meets the requirements of section 3407 of this title; or
  
  (5) such financial records are disclosed in response to a formal written request which meets the requirements of section 3408 of this title.
• Amend 12 U.S.C. § 3413 to delete all but the first two subsections, with the resulting statutory language as follows:
  
  (a) Disclosure of financial records not identified with particular customers
  
  Nothing in this chapter prohibits the disclosure of any financial records or information which is not identified with or identifiable as being derived from the financial records of a particular customer.
  
  (b) Disclosure to, or examination by, supervisory agency pursuant to exercise of supervisory, regulatory, or monetary functions with respect to financial institutions, holding companies, subsidiaries, institution-affiliated parties, or other persons
  
  This chapter shall not apply to the examination by or disclosure to any supervisory agency of financial records or information in the exercise of its supervisory, regulatory, or monetary functions, including conservatorship or receivership functions, with respect to any financial institution, holding company, subsidiary of a financial institution or holding company, institution-affiliated party (within the meaning of section 1813(u) of this title) with respect to a financial institution, holding company, or subsidiary, or other person participating in the conduct of the affairs thereof.
• Repeal 12 U.S.C. § 3414
• Amend 31 U.S.C. § 5311 by deleting all but the first section, with the resulting statutory language as follows:
  
  (1) require financial institutions to retain transaction records that include information identified with or identifiable as being derived from the financial records of particular customers
• Repeal 31 U.S.C. §§ 5313–16
• Repeal 31 U.S.C. § 5318(a)(2)
• Repeal 31 U.S.C. § 5318A
• Repeal 31 U.S.C. § 5324
• Amend section (a) of 31 U.S.C. § 5325 so that it reads:
  
  (a) In General.—No financial institution may issue or sell a bank check, cashier’s check, traveler’s check, or money order to any individual in connection with a transaction or group of such contemporaneous transactions which involves United States coins or currency (or such other monetary instruments as the Secretary may prescribe) in amounts or denominations of $3,000 (adjusted for inflation with the consumer price index each fiscal year hereafter X, 20XX.”) or more unless—
• Repeal 31 U.S.C. § 5326
• Repeal 31 U.S.C. §§ 5331–32¹³³
• Repeal 31 U.S.C. § 5336
• Repeal 31 U.S.C. §§ 5341–42
• Repeal 31 U.S.C. §§ 5351–55

The United States should never have led the way in designating private companies as an extension of law enforcement agencies to criminalize the use of money. It should have done all that was necessary to strengthen the protections guaranteed by the Fourth Amendment to the Constitution to guard against government intrusion that diminishes financial privacy. It is, of course, not too late for the federal government to reverse course, thus reaffirming its commitment to protecting individuals’ rights against government overreach.

Congress enacted the BSA without careful study and did not enact the appropriate solutions to the alleged problems associated with abusing secret foreign bank accounts. It is hardly surprising, therefore, that the BSA framework, though enormously costly, has provided no net benefit to deterring criminal activity. Congress should amend the BSA so that financial institutions are no longer forced to act as law enforcement agents. Requiring financial institutions only to maintain records would have the twin benefit of protecting individuals’ financial privacy and improving federal agencies’ abilities to prosecute criminal activity instead of devoting effort to examining program compliance and ensuring that financial institutions file millions of low-value reports.

Michel, Norbert J., and Jennifer J. Schulp. “Revising the Bank Secrecy Act to Protect Privacy and Deter Criminals,” Policy Analysis no. 932, Cato Institute, Washington, DC, July 26, 2022.