US Regulators: FinCEN, OFAC and the Banking Agencies

1. Why This Topic Matters

The United States operates the world's largest financial system and the US dollar is the dominant currency for international trade and correspondent banking. Because almost every significant cross-border payment touches a US clearing bank at some point, US anti-money laundering (AML) and sanctions rules effectively reach financial institutions everywhere, not just those headquartered in the United States. This extraterritorial reach is the main reason the CAMS examination devotes substantial attention to US regulators even though it is a global certification.

For the exam, this topic matters because:
• The Bank Secrecy Act (BSA) framework administered by FinCEN is the model many other jurisdictions have copied, so understanding it helps you understand global expectations.
• The Office of Foreign Assets Control (OFAC) enforces sanctions on a strict liability basis, and the largest fines in AML/sanctions history (for example, BNP Paribas, HSBC and Standard Chartered) involved US sanctions breaches.
• Questions frequently test whether you can tell which agency is responsible for which function. Confusing FinCEN with OFAC, or FinCEN with the prudential banking regulators, is one of the most common ways candidates lose marks.

2. What It Is: The Three Pillars of the US Regime

The US AML/CFT and sanctions architecture can be summarised as three groups of actors working together:

A. FinCEN – the Financial Crimes Enforcement Network
FinCEN is a bureau of the US Department of the Treasury, created in 1990 and given formal status by the USA PATRIOT Act in 2001. It is the administrator of the Bank Secrecy Act and the Financial Intelligence Unit (FIU) of the United States. Key roles:
• Issues BSA regulations (found in 31 CFR Chapter X) and interpretive guidance, advisories and FAQs.
• Receives, stores and analyses BSA reports: Suspicious Activity Reports (SARs), Currency Transaction Reports (CTRs), Reports of International Transportation of Currency or Monetary Instruments (CMIRs), Reports of Foreign Bank and Financial Accounts (FBARs) and Form 8300 (cash over USD 10,000 received in a trade or business, filed jointly with the IRS).
• Shares intelligence with law enforcement and foreign FIUs as a member of the Egmont Group.
• Administers Section 314(a) (law enforcement requests routed to institutions) and Section 314(b) (voluntary information sharing between institutions with a safe harbour).
• Designates jurisdictions, institutions or accounts as primary money laundering concerns under Section 311 of the USA PATRIOT Act and imposes special measures.
• Issues Geographic Targeting Orders (GTOs) requiring enhanced reporting in specific areas or sectors (for example, cash purchases of residential real estate).
• Brings civil enforcement actions and civil money penalties for BSA violations against any type of financial institution, including non-bank entities such as money services businesses (MSBs), casinos and virtual asset service providers.
• Under the Anti-Money Laundering Act of 2020 (AMLA) and the Corporate Transparency Act, FinCEN publishes national AML/CFT priorities, runs the whistleblower programme and maintains the beneficial ownership information (BOI) registry.
• Delegates examination authority for BSA compliance to the federal functional regulators (banking agencies, SEC, CFTC) and to the IRS for institutions without a federal functional regulator (MSBs, casinos, dealers in precious metals and others).

B. OFAC – the Office of Foreign Assets Control
OFAC is also part of the Treasury Department but is entirely separate from FinCEN. It administers and enforces US economic and trade sanctions against targeted countries, regimes, terrorists, narcotics traffickers, proliferators of weapons of mass destruction and other threats to US national security and foreign policy. Its authority derives mainly from the International Emergency Economic Powers Act (IEEPA), the Trading with the Enemy Act (TWEA) and specific statutes and executive orders. Key features:
• Maintains the Specially Designated Nationals and Blocked Persons (SDN) List plus other lists (for example, the Sectoral Sanctions Identifications List and the Non-SDN lists).
• Sanctions are comprehensive/country-based (for example, Cuba, Iran, North Korea, Syria, the Crimea region) or list-based/targeted (individuals, entities, vessels, aircraft).
• The 50 Percent Rule: any entity owned 50 percent or more, directly or indirectly, individually or in aggregate, by one or more blocked persons is itself blocked even if not named on the list.
• Applies to all US persons (citizens and permanent residents wherever located, entities organised under US law and their foreign branches, and anyone physically in the US), and to transactions involving US-origin goods or the US financial system. Some programmes extend to foreign subsidiaries of US companies and some include secondary sanctions on non-US persons.
• Strict liability: a violation occurs regardless of intent or knowledge, although culpability affects the penalty.
• Two main obligations when a match is confirmed: block (freeze) the property and report it to OFAC within 10 business days, or reject the transaction where blocking is not required but processing is prohibited. Blocked funds must be placed in an interest-bearing account and an annual report of blocked property is filed by 30 September.
• Issues general licences (published, available to all who meet the conditions) and specific licences (granted on application to a particular person).
• The May 2019 Framework for OFAC Compliance Commitments sets out five essential components of a sanctions compliance programme: management commitment, risk assessment, internal controls, testing and auditing, and training.
• Enforcement follows the Economic Sanctions Enforcement Guidelines; voluntary self-disclosure can halve the base penalty.

C. The Federal Banking Agencies and Other Functional Regulators
These are the prudential supervisors that charter, examine and discipline financial institutions. They do not write the BSA rules, but they examine institutions for compliance and can take enforcement action under their own safety-and-soundness powers as well as for BSA violations.
• Office of the Comptroller of the Currency (OCC) – national banks and federal savings associations.
• Board of Governors of the Federal Reserve System (FRB) – bank holding companies, state member banks, and US branches and agencies of foreign banks.
• Federal Deposit Insurance Corporation (FDIC) – state-chartered banks that are not members of the Federal Reserve System; also the deposit insurer.
• National Credit Union Administration (NCUA) – federally insured credit unions.
• State banking departments – state-chartered institutions (for example, the New York Department of Financial Services, whose Part 504 rule requires an annual board or senior officer certification of transaction monitoring and filtering programmes).
• Beyond banking: the SEC and FINRA for broker-dealers and mutual funds, the CFTC and NFA for futures commission merchants, and the IRS Small Business/Self-Employed division for MSBs, casinos and other non-bank entities.
• The agencies coordinate through the Federal Financial Institutions Examination Council (FFIEC), which publishes the FFIEC BSA/AML Examination Manual, the standard reference for how examiners assess an AML programme.

3. How It Works in Practice

The legal foundation. The BSA of 1970 created record-keeping and reporting duties. The Money Laundering Control Act 1986 made money laundering a federal crime and prohibited structuring. The Annunzio-Wylie Act 1992 introduced SARs and the safe harbour for filers. The Money Laundering Suppression Act 1994 registered MSBs. The USA PATRIOT Act 2001 added Sections 311 (special measures), 312 (due diligence on correspondent and private banking accounts), 313 (ban on shell bank accounts), 314 (information sharing), 319 (forfeiture of funds in interbank accounts and the 120-hour rule for records requests), 326 (Customer Identification Programme) and 352 (minimum AML programme standards). The 2016 CDD Rule added beneficial ownership identification as a fifth pillar, and AMLA 2020 modernised the regime.

Division of labour. FinCEN writes the rules and collects the reports. The prudential regulators examine institutions against those rules using the FFIEC manual and share findings with FinCEN. When serious deficiencies are found, the banking agency may issue a Memorandum of Understanding, a written agreement, a consent order, a cease-and-desist order or civil money penalties, often in parallel with a FinCEN civil penalty and sometimes a Department of Justice criminal resolution. OFAC acts separately on sanctions breaches, but examiners also review OFAC compliance during BSA examinations and the agencies frequently coordinate settlements.

The five pillars of a BSA/AML programme. Examiners test for: (1) a system of internal controls, (2) a designated BSA/AML compliance officer, (3) ongoing employee training, (4) independent testing (audit) and (5) risk-based customer due diligence including beneficial ownership. An OFAC programme is expected alongside this, scaled to the institution's risk profile.

Key reporting thresholds and timelines you must know.
• CTR: cash transactions over USD 10,000 in a day by or on behalf of one person; filed within 15 calendar days.
• SAR (banks): generally USD 5,000 or more where a suspect is identified; USD 25,000 regardless of suspect; any amount for insider abuse; filed within 30 calendar days of initial detection, extendable to 60 days if no suspect is identified. MSBs use a USD 2,000 threshold. SAR confidentiality is strict – the subject may never be told.
• Record retention: 5 years for most BSA records, including SAR supporting documentation.
• Section 314(a): search records and respond to FinCEN within 2 weeks.
• Section 319(b): produce correspondent account records within 120 hours of a request.
• OFAC blocked or rejected transaction report: within 10 business days.
• CMIR: carrying more than USD 10,000 in currency or monetary instruments across the US border.
• FBAR: foreign accounts exceeding USD 10,000 in aggregate at any point in the year.

Extraterritorial effect. A non-US bank that clears dollars through a US correspondent exposes itself to OFAC jurisdiction for those transactions and to Section 311 designation if FinCEN finds it to be a primary money laundering concern. This is why global institutions screen against the SDN list even where local law does not require it, and why correspondent banking relationships are a recurring exam theme.

4. How to Answer Exam Questions on This Topic

CAMS questions are scenario-based and ask for the best answer. The examiners are testing whether you can identify the correct agency, the correct obligation and the correct timing, usually with distractors that are partially true.

Exam Tips: Answering Questions on US Regulators: FinCEN, OFAC and the Banking Agencies

Tip 1 – Match the keyword to the agency. If the question mentions sanctions, SDN list, blocking, freezing, embargo, licences or the 50 Percent Rule, the answer involves OFAC. If it mentions SARs, CTRs, FIU, BSA regulations, 314(a)/(b), Section 311, GTOs, beneficial ownership registry or advisories, the answer involves FinCEN. If it mentions examination, safety and soundness, consent order, cease-and-desist, charter or FFIEC manual, think prudential banking regulator (OCC, FRB, FDIC, NCUA or state regulator).

Tip 2 – Remember FinCEN does not examine banks. FinCEN sets rules, receives reports and imposes penalties, but routine BSA examinations of banks are performed by the banking agencies under delegated authority. For MSBs and casinos the examiner is the IRS. An answer saying FinCEN examiners visited a bank for a routine BSA exam is a classic distractor.

Tip 3 – OFAC is strict liability. If a scenario asks whether a bank that unknowingly processed a payment for an SDN has violated sanctions, the answer is yes. Intent affects the penalty, not the existence of the violation. Also remember OFAC is not technically an AML law, but AML questions will still include it.

Tip 4 – Know block versus reject. Block (freeze and hold in an interest-bearing account) when the property of a blocked person is involved, for example an SDN payee. Reject (refuse to process and return) when the transaction is prohibited but no blockable interest exists, for example certain Iran-related transfers where the parties are not themselves SDNs. Both require a report to OFAC within 10 business days.

Tip 5 – Memorise the numbers. USD 10,000 for CTRs, CMIRs, Form 8300 and FBAR; USD 5,000 (banks) and USD 2,000 (MSBs) for SARs; 15 days for CTRs; 30/60 days for SARs; 5 years retention; 2 weeks for 314(a); 120 hours for 319(b); 10 business days for OFAC reports; 50 percent ownership threshold. Many questions can be answered purely by knowing these figures.

Tip 6 – Distinguish 314(a) from 314(b). 314(a) is mandatory, flows from law enforcement through FinCEN to institutions, and requires only a yes/no match response. 314(b) is voluntary, institution-to-institution sharing, requires annual registration with FinCEN, and is protected by a safe harbour. Confusing the two is a common exam trap.

Tip 7 – Section 311 belongs to FinCEN, not OFAC. Designating a foreign jurisdiction, institution or account type as a primary money laundering concern and imposing special measures (up to prohibiting correspondent accounts) is a FinCEN power under the USA PATRIOT Act. Placing a person on the SDN list is an OFAC action. The exam likes to swap these.

Tip 8 – Know the pillars and which one was added last. Internal controls, compliance officer, training and independent testing are the original four; customer due diligence with beneficial ownership is the fifth (2016 CDD Rule, effective 2018). A question asking which element was not historically required points to CDD/beneficial ownership.

Tip 9 – Think about jurisdiction in cross-border scenarios. When a non-US bank is involved, ask whether US dollars were cleared through the US, whether a US person participated, or whether US-origin goods were involved. Any yes means US jurisdiction can apply. If a question asks what a foreign bank should do about a US correspondent request under 319(b), the answer is to respond within 120 hours or risk the correspondent account being closed.

Tip 10 – Choose the compliance-sound, best-practice answer. When two options seem plausible, prefer the one that follows the risk-based approach, escalates to the compliance officer, preserves SAR confidentiality, files within the regulatory deadline and documents the decision. Avoid answers that involve tipping off the customer, waiting for law enforcement permission before filing a required report, or treating a sanctions match as optional.

Tip 11 – Read for the question actually asked. Some items ask who administers a rule, others who enforces against a particular institution, and others what the institution must do. Three different agencies may be correct depending on the verb. Underline the verb mentally before selecting an answer.

Tip 12 – Use elimination. Discard any option that assigns sanctions duties to FinCEN, assigns SAR receipt to OFAC, gives examination authority to FinCEN over banks, states a wrong threshold or timeline, or suggests disclosing a SAR to the subject. What remains is usually the correct answer.

5. Quick Reference Summary

• FinCEN: Treasury bureau; BSA administrator; US FIU; receives SARs/CTRs; 314(a)/(b); Section 311; GTOs; BOI registry; civil penalties; delegates exams.
• OFAC: Treasury office; sanctions administration and enforcement; SDN list; 50 Percent Rule; strict liability; block or reject; 10 business day reporting; general and specific licences; five-component compliance framework.
• Banking agencies: OCC, FRB, FDIC, NCUA and state regulators; charter and examine; FFIEC BSA/AML manual; enforcement via orders and civil money penalties; five pillars.
• Other functional regulators: SEC/FINRA, CFTC/NFA, IRS for non-bank entities.

Master the division of responsibilities, the thresholds and timelines, and the extraterritorial logic, and you will be well prepared for any CAMS question on the US regulatory landscape.