FinCEN's 2025 inflation adjustment pushed the maximum willful civil penalty range to $71,545–$286,184 per violation — up again from the year before, as it is every January. That trajectory alone should move BSA compliance from a back-office task to a board-level agenda item.
Many fintechs, payments companies, and financial institutions still underestimate how fast civil penalties multiply. A single deficiency can be charged per violation, per day, and per office. What starts as a $1,430 negligence fine can snowball into millions within weeks. Add criminal liability, and even unintentional lapses can turn into personal exposure for officers and directors.
This guide breaks down civil versus criminal penalties, the factors examiners use to set severity, the latest regulatory changes, and how to build a program that keeps your institution off the enforcement docket.
Key Takeaways
- Civil and criminal BSA penalties aren't mutually exclusive: regulators can pursue both for the same conduct
- Inflation adjustments raise civil fine ceilings every January, so maximum exposure grows annually
- Willfulness, patterns, and the number of offices or days involved can multiply fines into the millions
- FinCEN eliminated a redundant civil penalty rule in 2025
- A proactive, audit-ready compliance program remains the strongest defense against BSA enforcement action
Understanding the Bank Secrecy Act: A Quick Primer
Congress passed the Bank Secrecy Act in 1970 to give law enforcement a paper trail for financial crime. The law requires banks, credit unions, money services businesses, and other financial institutions to maintain anti-money laundering (AML) programs, file specific reports, and keep records that help investigators trace illicit funds.
BSA penalties generally stem from two categories of failure:
- Recordkeeping and reporting violations: missed Suspicious Activity Reports (SARs), Currency Transaction Reports (CTRs), or inaccurate records
- Programmatic failures: no AML program, no designated compliance officer, or inadequate customer due diligence
Three agencies share enforcement authority, and knowing which one applies matters:
- FinCEN holds primary civil penalty authority under 31 U.S.C. § 5321
- IRS enforces FBAR-specific penalties (foreign bank account reporting) under authority delegated in 2003
- IRS Criminal Investigation investigates criminal BSA violations
That split matters. A single deficiency, say, a missed SAR tied to an unreported foreign account, can draw scrutiny from more than one regulator at once.
Civil Penalties for BSA Violations
Civil penalty authority comes from 31 USC 5321 and 31 CFR 1010.821, both adjusted annually for inflation. Here are the inflation-adjusted civil penalty amounts effective 2025:
| Violation type | Statutory amount | 2025 adjusted amount |
|---|---|---|
| General willful violation (5321(a)(1)) | $25,000–$100,000 | $71,545–$286,184 |
| Negligence (5321(a)(6)(A)) | $500 | $1,430 |
| Pattern of negligent activity (5321(a)(6)(B)) | $50,000 | $111,308 |
| Due diligence/shell-bank/special measures (5321(a)(7)) | $1,000,000 | $1,776,364 |
These numbers get dangerous fast because penalties apply per violation, per day, and per office. A small deficiency doesn't need to be severe. It just needs to persist.
Quick example: A payments company with five branches misses a category of high-risk transactions for 100 days. If examiners deem the failure willful and chargeable per office, a mid-range penalty of $150,000 per location already totals $750,000, before any daily multiplier applies. That's how single findings turn into eight-figure exposure.
Negligence Penalties
Negligent violations under 31 USC 5321(a)(6) require no intent, only a failure to exercise reasonable care in recordkeeping or reporting. The statutory $500 cap now sits at $1,430 per violation after inflation adjustment. This applies to financial institutions and to nonfinancial trades or businesses covered by BSA rules, such as certain vehicle dealers.
Negligence penalties start small. They don't stay that way once a pattern emerges. The pattern add-on penalty jumps to $111,308.
Willful Violations (Recordkeeping & Reporting)
Willful recordkeeping and reporting violations carry far higher stakes than negligence, with 2025 penalties ranging from $71,545 to $286,184 per violation. Liability can also reach beyond the institution itself.
Partners, directors, officers, or employees who participate willfully, or through gross negligence, can face personal civil liability. A compliance officer who buried a known red flag doesn't get to hide behind the corporate entity.
Structuring Penalties
Structuring means splitting a transaction into smaller pieces to dodge the $10,000 CTR threshold, such as depositing $9,500 across three days instead of one $28,500 deposit. Under 31 USC 5324, the civil penalty can equal the full amount of currency involved, minus any related forfeiture. There's no fixed dollar ceiling: exposure scales directly with the money moved.
AML Program & MSB Registration Failures
Willful failure to build an AML program (missing policies, a compliance officer, training, or independent testing) triggers its own daily penalty track under the general willful amounts above. Money services businesses that skip FinCEN registration face a $5,000 statutory penalty per violation ($10,556 adjusted), with each day counted separately.
A few entities still hold temporary AML program exemptions under 31 CFR 1010.205(b)(1), including certain pawnbrokers, travel agencies, and vehicle sellers. Banks without a federal functional regulator lost that exemption in 2020.
Criminal Penalties for BSA Violations
Criminal liability attaches once a violation crosses from careless into willful. The statute lays out three tiers:
- Standard willful violation (31 USC 5322(a)): Up to $250,000 in fines, five years in prison, or both, for any person or bank employee who willfully violates the BSA
- Aggravated violations (31 USC 5322(b)): Up to $500,000 and 10 years when the violation is part of a pattern involving more than $100,000 in a 12-month period, or occurs alongside another federal crime
- Due diligence and shell-bank violations (31 USC 5322(d)): A fine of not less than twice the transaction amount, capped at $1,000,000, tied to due diligence failures under 31 USC 5318
IRS Criminal Investigation handles most criminal BSA cases, with one carve-out for currency and monetary instrument reports at the border, which fall to other agencies.
Civil and criminal penalties are not mutually exclusive. Under 31 USC 5321(d), FinCEN can pursue civil penalties regardless of whether the Department of Justice pursues a criminal case for the exact same conduct.
That overlap is exactly what happened with TD Bank. In October 2024, FinCEN assessed a record $1.3 billion civil penalty against TD Bank for willfully failing to maintain an adequate AML program.
The bank had thousands of unfiled SARs covering roughly $1.5 billion in suspicious transactions. The Department of Justice pursued criminal charges in parallel.
Dollar figures alone understate the fallout. Reputational damage, executive turnover, and years of heightened scrutiny followed. Those costs don't show up in the penalty line item, but they shape a company's trajectory for years.
What Factors Determine BSA Penalty Severity
Examiners weigh one question above all else: was this negligence, or was it willful?
- Negligence means failing to exercise reasonable care — an honest, if costly, oversight
- Willfulness includes actual knowledge, willful blindness, and reckless disregard of known BSA obligations, even without provable intent to break the law
Evidentiary Signs of Willfulness
Examiners look for concrete evidence, not assumptions:
- Failing to report transactions already flagged internally
- Altered or backdated records
- Misleading statements to examiners during an exam
- Ignoring internal alerts tied to specific customers over time
How Prior History Raises the Stakes
An institution's compliance history establishes "knowledge of the law", and that knowledge cuts against it in a later exam. Formal notification letters, prior examination findings, and a inconsistent SAR/CTR filing track record all signal that the institution knew what was required and didn't fix it.
Aggravating and Mitigating Factors
FinCEN's 2020 BSA Enforcement Statement lays out both sides of the ledger.
Aggravating factors that multiply exposure:
- Number of days a deficiency persists
- Number of branches or offices involved
- Whether the pattern exceeds statutory dollar thresholds
- Management's knowledge of, or complicity in, the failure
Mitigating factors that can reduce penalties:
- Demonstrated reasonable cause for the lapse
- Voluntary self-disclosure before an exam uncovers it
- Evidence of good-faith remediation already underway
- Cooperation during the examination process
None of these work in isolation. An institution with a strong self-disclosure record but a five-year pattern of ignored alerts across a dozen branches still lands closer to the willful end of the spectrum.
How Financial Institutions Can Minimize BSA Penalty Risk
The good news: nearly every factor examiners weigh is within an institution's control before an exam ever begins.
Focus on the areas examiners scrutinize most:
- Risk-based AML program: Document policies, run ongoing training, and commission independent testing regularly. Examiners use this evidence to separate negligence from willfulness.
- Transaction monitoring: Missed SARs and late CTRs are the most common civil penalty triggers. Tune alert logic and file on time before gaps compound into per-day, per-office calculations.
- Exam findings: Prior notification letters and repeat findings are what examiners cite to prove an institution "knew" its obligations. Address them early.
This is where Pillars FinCrime Advisory works with fintechs, payments companies, and financial institutions building scalable, audit-ready programs. Founder Joshua Douglas, a CAMS-certified compliance professional with 12+ years in financial crime, helps clients close alert-quality gaps and reduce operational friction before issues become regulatory findings.
That support includes fractional BSA Officer work, transaction monitoring optimization, and exam readiness.
Penalty exposure rarely comes from one dramatic failure. It comes from small gaps left unaddressed long enough to become a pattern. A strong program is built to interrupt that pattern.
Frequently Asked Questions
What are the penalties for violating the Bank Secrecy Act?
Civil fines are inflation-adjusted and range from as low as $1,430 for negligence to $286,184+ for willful violations. Criminal penalties can reach $250,000 to $1 million in fines and 5 to 10 years imprisonment, depending on intent and severity.
What factors determine penalties for violating the Bank Secrecy Act?
Willfulness versus negligence is the central factor, followed by the number of violations, days, and offices involved, prior compliance history, and whether the conduct fits a broader pattern of illegal activity.
Who is exempt from the Bank Secrecy Act?
Certain financial institutions without a federal functional regulator, plus a short list under 31 CFR 1010.205(b)(1) like pawnbrokers and travel agencies, receive temporary exemptions from AML program requirements. Most banks, credit unions, MSBs, and casinos remain fully covered.
What is the $3,000 rule for banks?
Under 31 USC 5325, banks must verify and record customer identification before issuing money orders, cashier's checks, or traveler's checks worth $3,000 or more, to prevent anonymous structuring through official bank instruments.
How often are BSA civil penalty amounts adjusted?
FinCEN adjusts civil penalty amounts annually for inflation under the Federal Civil Penalties Inflation Adjustment Act, typically publishing updated figures in the Federal Register in mid-to-late January.
Can a financial institution face both civil and criminal penalties for the same BSA violation?
Yes. Under 31 USC 5321(d), FinCEN can impose civil penalties regardless of whether a criminal penalty is also pursued for the same underlying conduct.
