FinCEN: Financial Crimes Enforcement Network

What Is FinCEN?

The Financial Crimes Enforcement Network (FinCEN) is a bureau of the US Department of the Treasury established in 1990. Unlike the SEC or CFTC, FinCEN is not primarily a market regulator: it functions as a financial intelligence unit and the administrator of the Bank Secrecy Act, the primary federal anti-money laundering (AML) law.

FinCEN sits at the intersection of financial regulation and law enforcement. It collects financial data from regulated institutions, analyzes it for patterns that may indicate money laundering, terrorist financing, or other financial crimes, and disseminates intelligence to federal, state, local, and international law enforcement partners.

FinCEN also has civil enforcement authority. It can impose civil money penalties on financial institutions that fail to comply with BSA requirements. Criminal enforcement, however, typically involves coordination with the Department of Justice and other federal law enforcement agencies rather than FinCEN acting on its own.

The Bank Secrecy Act Framework

The Bank Secrecy Act (BSA), enacted in 1970 and substantially amended by the USA PATRIOT Act in 2001 and the Anti-Money Laundering Act of 2020, is the foundational US statute for combating financial crime. FinCEN administers the BSA and delegates examination authority to other federal regulators.

The core BSA requirements for covered financial institutions are:

• Customer Identification Programs (CIP): Financial institutions must verify the identity of customers opening accounts. This is the legal basis for the identity verification process investors experience when opening brokerage or bank accounts (collecting name, address, date of birth, and a government ID number).
• Know Your Customer (KYC): Beyond initial identification, institutions must understand the nature of customer relationships and monitor for activity inconsistent with a customer's stated profile and business.
• AML programs: All covered institutions must implement a written AML compliance program including internal controls, designated compliance officers, employee training, and independent testing.
• Recordkeeping: BSA requires retaining records of certain transactions, including wire transfers of $3,000 or more, for five years.

Broker-dealers, mutual fund companies, futures commission merchants, and insurance companies are all covered institutions under the BSA and must maintain FinCEN-compliant AML programs, directly affecting the compliance environment investors operate in.

SARs, CTRs, and Financial Intelligence

Two reporting requirements form the backbone of FinCEN's financial intelligence collection:

Suspicious Activity Reports (SARs): Financial institutions must file a SAR with FinCEN within 30 days (or 60 days if the subject is unidentified) when they know, suspect, or have reason to suspect that a transaction involves funds derived from illegal activity, is designed to evade BSA requirements, lacks a lawful purpose, or involves suspicious patterns. SARs are confidential records; a financial institution is prohibited from disclosing to the subject of a SAR that one has been filed. The "tipping off" prohibition is strictly enforced.

Currency Transaction Reports (CTRs): Financial institutions must file a CTR with FinCEN for any cash transaction (deposit, withdrawal, exchange, or other payment) involving more than $10,000 in a single day by or on behalf of the same person. The $10,000 threshold has not been adjusted since 1970. Deliberately structuring transactions to stay below the $10,000 threshold to avoid CTR filing is itself a federal crime called "structuring."

FinCEN makes aggregate BSA data available in de-identified form to the research community and publishes analysis of financial crime trends, but individual SAR and CTR records remain confidential law enforcement tools.

Corporate Transparency Act and Beneficial Ownership

The Corporate Transparency Act (CTA), enacted in 2021 and administered by FinCEN, created a new mandatory beneficial ownership information (BOI) reporting requirement for most US companies and foreign entities registered to do business in the US.

Under the CTA, reporting companies must disclose to FinCEN's BOI database information about their beneficial owners: individuals who either own 25 percent or more of the company's ownership interests or who exercise substantial control over it. The required information includes each beneficial owner's name, date of birth, address, and a unique identifying document (such as a passport or driver's license) and image.

What the CTA means for investors:

• If you own 25 percent or more of a company that qualifies as a "reporting company" under the CTA, that company must report your information to FinCEN.
• Publicly traded companies, large operating companies (more than 20 full-time employees and more than $5 million in US gross receipts), and certain regulated entities (banks, credit unions, registered investment advisers, broker-dealers) are exempt from CTA reporting.
• LLCs, limited partnerships, corporations, and similar entities formed by filing with a state are generally reporting companies unless they qualify for an exemption.
• The BOI database is not publicly accessible. It is available to law enforcement, national security agencies, financial institutions conducting customer due diligence with customer consent, and certain government agencies.

AML Rules for Cryptocurrency

FinCEN extended BSA requirements to virtual currency businesses in 2013, treating cryptocurrency exchanges and administrators that convert virtual currency to and from fiat money as money services businesses (MSBs) subject to FinCEN registration and AML program requirements.

A cryptocurrency exchange operating in the US must register with FinCEN as an MSB, implement a BSA-compliant AML program, file SARs for suspicious transactions, collect customer identification information (KYC), and apply the Travel Rule (transmitting identifying information about the originator and beneficiary of transfers exceeding $3,000).

FinCEN has taken enforcement actions against cryptocurrency businesses that failed to register or implement adequate AML programs. In notable cases, FinCEN imposed civil money penalties running into hundreds of millions of dollars against exchanges that allowed users to transact anonymously without proper identity verification.

FinCEN's jurisdiction over crypto is limited to the AML dimension. Whether a particular digital asset is a security (SEC) or a commodity (CFTC) is a separate question from whether the entity dealing in it must comply with BSA requirements. A crypto exchange can simultaneously be subject to FinCEN's AML rules, SEC oversight as a securities exchange, and CFTC oversight for derivatives products.