Skip to content
ComplianceOfficer
§ 01

BSA · AML · Sanctions

AML transaction monitoring, and the BSA rules your monitoring has to meet

Run the free scan

Work email and a 6 digit code. No card, nothing charged. Starter plan $149 a month when you want the daily watch.

AML transaction monitoring is the process a financial business runs to spot suspicious activity in payment flows and report it, SARs filed within 30 days of detection, sanctions screened continuously. ComplianceOfficer does not monitor transactions, screen names or file SARs. It covers the thing exam findings cite most: knowing when FinCEN, OFAC and the banking agencies move, so you can keep the program current. Your monitoring system stays where it is.

Check your BSA and AML obligations now

Pick financial services below. The scan returns the BSA, AML and KYC obligation register that sits behind your monitoring rules, with recent regulatory movement and sources linked. No signup, nothing stored.

§ Live · Compliance scan

One free run. Nothing you pick is stored.

Frameworks you answer to

Fintech, US · first rows of a real scan

  • § 01 Control environment and governance
  • § 02 Risk assessment and monitoring of controls
  • § 03 Logical access controls
  • § 04 System monitoring and incident response

The AML register a fintech or bank runs on

  • § 01 Written AML program board-approved, named officer
  • § 02 KYC / customer identification 31 CFR 1020.220
  • § 03 Due diligence, beneficial owners FinCEN CDD rule
  • § 04 Transaction monitoring SARs within 30 days
  • § 05 OFAC sanctions screening lists change constantly
  • § 06 Independent testing findings acted on

AI transaction monitoring is only half the exam. The other half is whether your program reflects the current rulebook: FinCEN rulemaking, OFAC designations, agency guidance and the state MTL regimes move all year, and examiners test against the current text, not your last revision date. That watching layer is this product's core, checked once a day; the AML program guide walks the five minimum program contents in detail.

§ 02 Built for the money side

Why AML compliance software needs the regulatory layer

Security-framework tools stop at SOC 2 and ISO; financial-crime regimes sit outside their scope. That leaves AML teams tracking FinCEN, OFAC and the exam manuals by hand while running the monitoring itself. ComplianceOfficer puts the AML obligations, including the monitoring and SAR duties, on one register with a status and note you set, and emails you the rule changes that move them, next to your SOC 2 and GDPR lines.

Run the scan with Fintech + AML/KYC selected: the last 12 months of BSA/AML movement, sources linked, in about fifteen seconds.

Run the compliance scan
  • § 01 BSA penalties civil and criminal exposure
  • § 02 FinCEN and OFAC output checked daily at the source
  • § 03 Where it lives one register with security regimes
§ 03 The reporting clocks

What FinCEN transaction monitoring has to produce, and when

Detection is only the first half of the obligation. A monitoring system earns its place by getting a filing out of the door inside a statutory window, and the windows are stated more precisely in the regulation than in most vendor material. These were checked against the eCFR on 13 August 2026.

Obligation Trigger Clock Cite
Suspicious activity report Involves or aggregates at least $5,000, attempts included 30 calendar days from initial detection, 60 day hard cap 31 CFR 1020.320(b)(3)
Currency transaction report Currency transaction of more than $10,000 15 days following the day of the transaction 31 CFR 1010.311, 1010.306(a)(1)
SAR record retention Every filed report and its supporting documentation Five years from the date of filing 31 CFR 1020.320(d)
Independent testing The monitoring program itself, including model tuning Risk-based interval, second in the regulation's own list 31 CFR 1020.210(a)(2)(ii)

The clock starts at detection, not at the transaction

This is the single most common misreading of the SAR rule, and it cuts both ways. A pattern surfaced by a quarterly look back may involve transactions from months earlier without putting you late, because 1020.320(b)(3) runs from "the date of initial detection by the bank of facts that may constitute a basis for filing a SAR." Equally, an alert that sits unreviewed in a queue does not get a fresh clock when someone finally opens it. The 30 day extension is narrower than it is usually described: it is available only where no suspect was identified on the detection date, and never past 60 days.

A CTR needs more than $10,000, not $10,000 or more

31 CFR 1010.311 says "a transaction in currency of more than $10,000." A transaction of exactly $10,000.00 does not trigger a report. A surprising amount of published training material states this as $10,000 or more, and a monitoring rule written to that reading generates false positives on every round-number deposit.

If someone subpoenas a SAR, you must decline

Under 31 CFR 1020.320(e)(1)(i) a bank asked to disclose a SAR "shall decline to produce the SAR or such information, citing this section and 31 U.S.C. 5318(g)(2)(A)(i), and shall notify FinCEN of any such request and the response thereto." The underlying facts are not covered by that prohibition and may be shared, including with another institution to prepare a joint filing. Our SAR filing guide covers the confidentiality rules in full, and AML compliance software is the pillar page above this one.

§ 90

Related registers

§ 99 · Final entry

Create your account

Leave your work email, confirm the 6-digit code, and your account is ready. Nothing is charged to create it.

Buy the plan