Part 1 – The USA PATRIOT Act Amends the Bank Secrecy Act and Expands Anti-Money Laundering Requirements
The USA PATRIOT Act: Legislative Response in a Time of Crisis
In the immediate aftermath of the attacks of September 11, 2001, Congress moved swiftly to pass the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (USA PATRIOT Act). Introduced amid heightened national security concerns, the legislation advanced rapidly through both chambers and was signed into law on October 26, 2001, marking a significant federal response. Its passage reflected an urgent effort to equip authorities with expanded tools to address emerging threats.
The USA PATRIOT Act was structured as a far-reaching statute spanning national security, criminal procedure, and financial regulation. Rather than creating an entirely new legal framework, it amended numerous existing federal laws, including the Bank Secrecy Act (BSA) allowing rapid implementation while preserving legal continuity. Three years after the USA PATRIOT Act was enacted, the Office of the Comptroller of the Currency (OCC) described it as the most significant expansion of US AML authority since the BSA. Financial institutions were required to implement comprehensive, board-approved AML programs, including customer identification procedures, independent testing, designated compliance officer, and ongoing employee training. This marked a shift from reactive compliance toward a proactive, risk-based approach centered on stronger governance, institutional accountability, and continuous regulatory oversight. 25 years and five (5) presidential administrations have supplemented the USA PATRIOT Act, albeit numerous critical anti-money laundering (AML) gaps remain.
Core Pillars Take Shape Across Five Presidential Administrations
The USA PATRIOT Act introduced statutory changes across intelligence, law enforcement, and financial regulation with provisions that amended multiple existing federal statutes and expanded government authorities in areas related to national security. The framework consisted of four core pillars that have been implemented, enhanced, and deployed across five (5) US presidential administrations to date:
Rapid Expansion and Institutionalization: The Bush Administration (2001–2009)
Following September 11, 2001, the Bush Administration rapidly implemented the USA PATRIOT Act, expanding national security and financial regulatory authorities to support the Global War on Terrorism (GWOT). The US operationalized new AML requirements, establishing risk-based frameworks to know your customer (KYC), enhanced due diligence, regulatory reporting, and formalized information sharing.
The early 2000s saw the swift transition of legislative authority into operational policy, with financial institutions positioned as critical partners in national security as the entry point to the financial system, required to implement enhanced controls and cooperate more closely with regulators and law enforcement. The GWOT eventually runs parallel to balance sheet crunches created by the 2008 Global Financial Crisis.
Internationally, the post-9/11 environment drove rapid alignment of AML/CFT standards, with the US playing a central role in shaping global regulatory priorities due the USA PATRIOT Act’s outward presence. Countries accelerated the adoption of stricter financial controls and enhanced cross-border cooperation to continue to do business with US financial institutions.
Key AML Developments under the Bush Administration
– BSA added mutual funds, broker-dealers, money services businesses (MSBs), certain futures brokers, and insurance companies as financial institutions (10/2001)
– 314(a) and 314(b) information sharing initiated (11/2002)
– FATF issued Eight Special Recommendations on terrorist financing (10/2001); comprehensively revised the 40 Recommendations (6/2003); issued Ninth Special Recommendation on terrorist financing (10/2004)
– Wolfsberg Group released Correspondent Banking Due Diligence Questionnaire (2004)
– OCC/FinCEN issued the largest civil monetary penalty ($25M each) ever brought against a US financial institution, Riggs Bank NA, for willful AML program violations under the BSA (5/2004)
– Federal Financial Institutions Examination Council (FFIEC) issued Bank Secrecy Act/Anti-Money Laundering (BSA/AML) Examination Manual (6/2005)
– US released first Money Laundering Threat Assessment (12/2005)
– FATF de-listed Myanmar from the Non-Cooperative Countries and Territories (NCCT) ending the NCCT classification (10/2006)
– International Emergency Economic Powers Enhancement Act increased civil and criminal sanctions penalties (10/2007)
Oversight and Rebalancing: The Obama Administration (2009–2017)
With the continued GWOT and the fall out from the Global Financial Crisis, regulators enhanced expectations on financial institutions compliance with AML requirements through enforcement, guidance, and new federal and state laws to accommodate existing regulatory gaps, but also for new technologies.
AML and OFAC compliance frameworks were reinforced through heavy enforcement by regulators for noncompliance with extensive organizational remediations. Rising out of the GFC, significant technology advancements and investments push into the financial sector with financial technology and digital assets shaping regulatory guidance, interpretations, and new laws.
From 2009 to 2017, policy shifts emphasized balancing national security authorities with enhanced legal oversight, influencing domestic supervision and global regulatory discourse. Foreign banks operating in the US and correspondent banks providing access to the US financial systems face heavy scrutiny. After years of intelligence gathering during the GWOT, Osama bin Laden was killed on May 2, 2011, in Pakistan signaling a major blow to Al-Qaeda’s operations..
Key AML Developments under the Obama Administration
– FinCEN amended definition of a MSB and separates prepaid access, effective 2012 (7/2011)
– OCC issued Bulletin 2011-12 on Model Risk Management (12/2011)
– FATF consolidated and released the 40 Recommendations (2/2012)
– FinCEN interpretative guidance that exchanging virtual currency qualified as money transmission required MSB registration (3/2013)
– OFAC and NY DFS fined BNP Paribas S.A. ~$9B for sanctions violations; first global bank to plead guilty for systemic sanctions violations (6/2014)
– FinCEN Statement on Providing Banking Services to MSBs (11/2014)
– FinCEN issued Customer Due Diligence Requirements for Financial Institutions (CDD Rule); effective 2018 (5/2016)
– NY DFS Bitlicense; Circle Financial awarded first license (6/2015)
– US released inaugural National Terrorist Financing Risk Assessment and second National Money Laundering Risk Assessment (2015)
– First Geographic Targeting Orders (GTO) involving certain real estate transactions (2016)
– FATF issued US Mutual Evaluation Report citing serious gaps on beneficial ownership information (BOI) (12/2016)
– NY DFS Transaction Monitoring and Watchlist Filtering Programs, Part 504, effective 2017 (6/2016)
National Security Reframed: The Trump 45 Administration (2017–2021)
Under the Trump 45 Administration, economic and state-based threats became central to regulatory policy. Financial regulation increasingly intersected with sanctions enforcement, export controls, cybersecurity, and foreign investment review, placing greater compliance emphasis on screening, transaction monitoring, and geopolitical risk exposure amid the 2020 Covid shutdowns.
US national security priorities were increasingly integrated into domestic regulatory and enforcement frameworks. Policy measures emphasized border control, economic leverage, and cyber resilience, with financial institutions balancing beneficial ownership requirements, the rise of digital assets, Covid shutdowns, and remote work.
US national security measures had measurable effects on trade policy, sanctions coordination, and cross-border regulatory alignment. Financial systems and multinational institutions faced heightened exposure to geopolitical risk and compliance complexity. Financial technology companies thrive due to remote work, app-driven onboarding and transacting.
Key AML Developments under the Trump 45 Administration
– NY DFS Cybersecurity Regulation, Part 500 (3/2017)
– SEC released DAO Report of Investigation under the Securities Exchange Act of 1934 classifying virtual tokens as securities under the Howey test (7/2017)
– FinCEN issued Advisory to Financial Institutions and Real Estate Firms and Professional based on Real Estate GTOs (11/2017)
– South Carolina became 49th state to license money transmission; Montana lone state that does not license money transmission (5/2018)
– The CDD Rule went live for covered financial institutions (5/2018)
– Cybersecurity and Infrastructure Security Agency Act of 2018 (11/2018)
– OFAC added first virtual currency address to the SDN List (11/2018)
– OFAC issued The Framework for OFAC Compliance Commitments aligning with the BSA’s 5 Pillars of AML framework (5/2019)
– FinCEN issued Statement on Enforcement of the BSA releasing factors used to determine enforcement of BSA violations (8/2020)
– Anti-Money Laundering Act of 2020 (AMLA) enacted by Congress over President Trump veto (1/2021)
– FinCEN Advisory on Ransomware and the Use of the Financial System to Facilitate Ransom Payments (11/2021)
Systemic Risk and Resilience: The Biden Administration (2021–2024)
Regulatory focus shifted toward systemic risk, infrastructure protection, and operational resilience due to the crypto winter (2022), multiple bank failures (2023), and BaaS failure (2024). Covid shutdowns ease, while the Russo-Ukrainian War of 2022 and Israel-Hamas War of 2023 accelerate OFAC sanctions programs. AMLA implementation stalls due to challenges to the Corporate Transparency Act (CTA).
US seeks to close a critical hole in beneficial ownership transparency by implementing the CTA. BaaS providers and banks supporting Fintech fail, rattling the banking and Fintech sectors. US sanctions increase more than 100% under the Biden Administration due to Russo-Ukrainian and Israel-Hamas Wars.
Regulatory frameworks increasingly reflected cross-border interdependence and the need for operational continuity standards. Venture capital funding to financial technology companies slows. UK, US, and EU accelerate sanctions on Russia, however, UN Security Council is unable to sanction Russia due to veto power as a permanent member.
Key AML Developments under the Biden Administration
– CTA enacted; required BOI reporting of legal entities to FinCEN, effective 2024 (1/2021)
– US released third National Money Laundering Risk Assessment (3/2022)
– Robinhood Crypto received first civil penalty ($30M) under NY DFS Bitlicense for AML compliance failures (8/2022)
– CTA court challenges; nationwide injunction issued (12/2024)
– US 2024 FATF Follow-Up Report and Technical Compliance Updates shifting R24 (BOI) from Non-Compliant to Largely Compliant rating based on CTA (03/2024)
– Technology middleware provider Synapse filed for bankruptcy (4/2024)
– Russia leads OFAC SDN List for largest number of new unique designations for three consecutive years (2023-2025)
– FRB, FDIC, and OCC issued Joint Statement on Banks’ Arrangements with Third Parties to Deliver Bank Deposit Products and Services (7/2024)
– FinCEN issued Residential Real Estate Rule (RRE Rule) requiring BSA reporting on non-financed residential real property transactions (8/2024); effective (3/2026))
Security, Sovereignty & Enforcement: The Trump 47 Administration (2025–Present)
The Trump 47 Administration focuses on international impact with the prosecution of Venezuelan leader Maduro and the Iran War increasing sanctions, uncovering domestic fraud, waste, and abuse, and removing red tape and eliminating perceived burdensome regulations such as the CTA and RRE Rule.
National security considerations increasingly intersect with economic regulation, technology oversight, and financial supervision across fits, starts, delays, and termination of prior regulation seeking to close the gaps of the USA PATRIOT Act. Executive Orders and OFAC sanctions play prominent roles.
US enforcement measures have continued to shape cross-border compliance expectations. Multinational institutions face heightened exposure to jurisdictional complexity and regulatory fragmentation. This period reflects an enforcement-centered approach in which national security authorities directly influence financial regulation, trade governance, and cross-border operational strategy.
Key AML Developments under the Trump 47 Administration
– FinCEN issued Interim Final Rule removing the requirement for US companies and persons to report BOI to FinCEN under CTA (3/2025)
– Trump issued Executive Order on ‘debanking’ Guaranteeing Fair Banking for All Americans (8/2025)
– NY DFS Cybersecurity Regulation, Part 500 Second Amendment, effective (11/2025)
– Registered Investment Advisor (IA AML) Rule requiring RIAs to comply with BSA; enacted (8/2024); effective 1/2026; postponed to 1/2028 (12/2025)
– Iran passed Russia on OFAC SDN List for largest number of new unique designations (2025)
– FATF started US Mutual Evaluation and onsite (2/2026)
– US released its fourth National Money Laundering Risk Assessment (3/2026)
– FinCEN RRE Rule vacated by US court decision (3/2026)
– OCC rescinded Bulletin 2011-12; issued Bulletin 2026-13 Model Risk Management: Revised Guidance (4/2026)
– FinCEN issued Final Rule on removing the requirement for US companies and persons to report beneficial ownership information to FinCEN under CTA (8/2026)
The Rise of SAR Reporting
The USA PATRIOT Act fundamentally expanded AML requirements across the financial industry, transforming institutions into active participants in national security efforts. Over time, this led to sustained growth in SAR filings, driven by enhanced customer identification, risk-based monitoring, and stricter reporting obligations. There was an industry shift from fragmented compliance to a standardized, data-driven surveillance and reporting frameworks with defined timeframes.
Key Insights:
– Upward momentum across all sectors, and sharply increasing after 2020.
– Growth driven by digital transactions, fraud expansion, and stricter AML enforcement.
– Filings concentrated in major economic hubs (California, New York, Texas, Florida)
Industry Takeaways:
– Depository Institutions are the core driver of SAR volume, showing a stable and mature reporting framework.
– MSBs have the fastest growth, reflecting fintech and remittance expansion.
– Loan and Finance Companies have rising exposure to digital lending and identity fraud.
US Falls Short of International Standards on Beneficial Ownership
FATF 2016 Mutual Evaluation Report Identified Non-Compliance with BOI Recommendation 24. FATF determined the US regulatory framework maintained significant gaps for certain institutions and businesses such as investment advisers, lawyers, real estate agents, trust and company service providers. More importantly, the US lacked timely access to accurate, adequate and updated BOI on legal entities resulting in a Non-Compliant rating on R24.
FATF 2024 Follow-Up Report Re-Rating R24 Falls Apart in 2026. After the US passed the CTA in January 2021, effective 2024, which mandated existing and newly established businesses to submit BOI to FinCEN, the US was re-rated on R24 from Non-Compliant to Largely Compliant. However, after several legal challenges, in August 2026, FinCEN issued a Final Rule removing the requirement for US companies and persons to report beneficial ownership information to FinCEN under CTA . Thus, 10 years after the BOI was identified as Non-Compliant by FATF, the US remains in the same place.
Global Legal Echoes of the USA PATRIOT Act with Regulatory Gaps
Over the past 25 years, financial regulation evolved from emergency response to embedded regulatory infrastructure. Requirements first introduced in 2001 are now integrated into financial supervision, cross-border governance, and institutional risk management frameworks.
Enhancements and refinement of the USA PATRIOT Act principals continues, however, 25 years later, a different market signals a hesitation to do so with the recent failed efforts to bring the wider real estate industry participants under the BSA and centralized beneficial ownership reporting under the CTA, lack of implementation of the AML Act of 2020, and the 2-year pushback of the IA AML Rule all while the US was scheduled for and undergoing its FATF Mutual Evaluation in 2026:
RISK | STRATEGY | CYBER COMPLIANCE MANAGEMENT
