AML for the SIE: CIP, SARs, CTRs, and Structuring

Two numbers dominate this topic, and prep material mixes them up constantly: $5,000 and $10,000.

They belong to different filings with different triggers. A SAR is filed when a broker-dealer suspects wrongdoing involving at least $5,000. A CTR is filed automatically whenever more than $10,000 in physical currency moves in a single business day, suspicious or not.

This isn’t a hypothetical confusion. Merrill Lynch applied the wrong threshold — the $25,000 figure that applies to banks rather than the $5,000 that applies to broker-dealers — and failed to file roughly 1,500 SARs over a decade before catching it.

Here’s the topic properly sorted, including guidance FinCEN issued in October 2025 that most study material predates.

The short answer

CIP (Customer Identification Program) — before you can open an account, you collect four things: name, date of birth, address, and identification number. Then you verify them well enough to form a reasonable belief you know who the customer really is.

CTR (Currency Transaction Report) — filed for cash transactions totalling more than $10,000 by or on behalf of the same person in one business day. Purely mechanical. No suspicion needed, no judgment involved.

SAR (Suspicious Activity Report) — filed when a broker-dealer knows, suspects, or has reason to suspect that a transaction involving or aggregating at least $5,000 is connected to illegal activity. Judgment-based. Due within 30 calendar days of initial detection.

Structuring — deliberately splitting transactions to stay under the $10,000 CTR threshold. It is a crime in itself, whether or not the underlying money is dirty.

The cleanest way to hold it: CTR is arithmetic. SAR is judgment. Structuring is the crime of trying to avoid the arithmetic.

The full answer

Where the rules come from

The Bank Secrecy Act of 1970 is the foundation. It requires financial institutions to keep records and file reports that help detect money laundering.

The USA PATRIOT Act of 2001 expanded it substantially, adding the requirement that firms maintain AML programs and establish customer identification procedures.

FinCEN — the Financial Crimes Enforcement Network, a bureau of the Treasury — receives the filings and writes the implementing regulations.

FINRA Rule 3310 requires every member firm to develop and implement a written AML program reasonably designed to achieve compliance with the BSA.

The AML program: five pillars

Pillar	Requirement
1. Policies and procedures	Written internal controls reasonably designed to detect and report suspicious activity
2. Designated AML compliance officer	A named individual responsible for the program
3. Ongoing training	For appropriate personnel
4. Independent testing	Periodic audit of the program’s effectiveness
5. Customer due diligence	Risk-based CDD, including beneficial ownership of legal entity customers

The fifth pillar was added in 2018. Older material describes “four pillars” — if yours does, it predates the CDD rule.

CIP: what you collect and what you verify

The CIP rule for broker-dealers sits at 31 CFR 1023.220. A firm must establish a written CIP appropriate to its size and business, and it must be part of the firm’s overall AML program.

The four minimum data points:

Item	Detail
Name	—
Date of birth	Individuals only
Address	Residential or business street address
Identification number	TIN for US persons; passport or similar for non-US persons

Then you verify. The rule requires risk-based procedures sufficient to form a reasonable belief that the firm knows the true identity of each customer. Two methods:

• Documentary — a driver’s licence, passport, or for entities, certified articles of incorporation
• Non-documentary — contacting the customer, checking references, comparing against a consumer reporting agency or public database

Note what the standard is not. The rule doesn’t require certainty, and it doesn’t require verification before the account opens. It requires a reasonable belief, formed within a reasonable time.

Three more CIP elements worth knowing:

Government list comparison. The CIP must include procedures for determining whether a customer appears on any list of known or suspected terrorists issued by a federal agency and designated by Treasury — within a reasonable time after the account is opened.

Customer notice. Firms must give customers adequate notice that information is being collected to verify identity. The account-opening language you’ve seen — we’ll ask for your name, address, date of birth, and may ask to see your licence — exists because of this requirement.

Reliance on another institution. A firm may rely on another financial institution’s performance of CIP elements under specified conditions.

The retention detail people get wrong

CIP records run on two different clocks, and questions exploit this.

Record	Retention
The identifying information you collected	5 years after the account is closed
The verification records — what documents you looked at, what methods you used, how you resolved discrepancies	5 years after the record is made

Most summaries collapse this into a single “five years.” The identifying information clock doesn’t even start until the relationship ends; the verification clock starts immediately.

SAR records follow a third rule: the firm retains a copy of any filed SAR and its supporting documentation for five years from the filing date.

CTRs: the mechanical one

A CTR is required for transactions in currency — physical cash — by, through, or to the institution, by or on behalf of any person, resulting in cash in or cash out totalling more than $10,000 during any one business day.

Four things to hold onto:

• It’s cash only. A $500,000 wire transfer generates no CTR. A $10,500 cash deposit does.
• It aggregates. Three separate $4,000 cash transactions by the same person on the same day total $12,000 and require a CTR.
• It’s “more than,” not “at least.” Exactly $10,000 doesn’t trigger it. $10,000.01 does.
• No suspicion required. A CTR is not an accusation. Entirely legitimate cash businesses generate them routinely.

SARs: the judgment one

A broker-dealer must file a SAR for a transaction conducted or attempted by, at, or through the firm that involves or aggregates at least $5,000 in funds or other assets, where the firm knows, suspects, or has reason to suspect that the transaction:

• Involves funds derived from illegal activity
• Is designed to evade any BSA requirement
• Has no business or apparent lawful purpose
• Involves use of the firm to facilitate criminal activity

Different institution types carry different thresholds, which is exactly where Merrill Lynch went wrong:

Institution	Threshold
Broker-dealer	$5,000
Money services business	$2,000
Bank, where no suspect is identified	$25,000

Deadlines: file within 30 calendar days of initial detection. If no suspect has been identified in that time, the firm may take up to an additional 30 days — 60 total, and no longer.

Attempted transactions count. If a customer tries to do something suspicious and the firm blocks it, the SAR obligation can still arise. “Attempted by, at, or through” is in the rule text.

Two SAR rules that get tested

Confidentiality. A firm may not notify anyone involved that a SAR has been filed. Telling the customer — “tipping off” — is itself a violation. If an exam scenario has a rep reassuring a client that a report has been made, that’s the wrong answer regardless of how helpful the rep was being.

The safe harbour is partial. Filing a SAR protects the firm and its officers, directors, and employees from civil liability. It does not protect against criminal liability. Firms that file don’t get immunity from prosecution for their own conduct.

Structuring

Structuring is conducting or attempting to conduct transactions in a way designed to evade the CTR requirement. Depositing $9,500 today and $9,500 tomorrow instead of $19,000 at once, for the purpose of staying under the threshold, is structuring.

Two features candidates miss.

It’s illegal regardless of where the money came from. This is the important one. A restaurant owner with entirely legitimate cash receipts who splits deposits specifically to avoid triggering a CTR has committed a federal offence. The crime is evading the reporting requirement — the cleanliness of the funds is not a defence.

No single transaction has to cross $10,000. FinCEN’s regulations are explicit: a transaction or series of transactions need not exceed the threshold at any single institution on any single day to constitute structuring. Splitting across multiple days, multiple branches, or multiple institutions is still structuring.

What FinCEN clarified in October 2025

On October 9, 2025, FinCEN and the federal banking agencies issued FAQs addressing suspicious activity reporting. The guidance created no new obligations, but it clarified something worth knowing.

Transactions at or near the $10,000 CTR threshold do not, by themselves, require a SAR. The mere presence of activity near the threshold isn’t sufficient information to trigger a filing. A SAR is required only where the institution knows, suspects, or has reason to suspect that the activity is designed to evade reporting.

The practical difference: a restaurant depositing $8,000 in cash three times a week, consistent with its business, is not structuring and doesn’t require a SAR. A customer who asks a teller how to stay under the limit, or whose deposit pattern changes abruptly after learning about CTRs, is a different case entirely.

Intent is the dividing line, not the dollar amount.

Red flags

Patterns the exam associates with money laundering:

• Reluctance to provide CIP information, or providing information that can’t be verified
• Cash deposits just under $10,000, especially repeated
• Wire transfers to or from high-risk or bank-secrecy jurisdictions
• Funding an account and immediately liquidating with no apparent investment purpose
• Activity inconsistent with the customer’s stated occupation or net worth
• Third parties funding accounts with no clear relationship to the customer
• Unusual concern about reporting requirements or firm procedures

OFAC

Separate from the BSA and often confused with it.

The Office of Foreign Assets Control, also part of Treasury, administers economic sanctions. It publishes the SDN list — Specially Designated Nationals — and firms must screen against it and block prohibited transactions.

The distinction: BSA reporting is about detecting and reporting. OFAC is about blocking. A BSA red flag gets reported; an OFAC match gets stopped.

Common misconceptions

“SARs are filed for anything over $10,000.” No. $10,000 is the CTR cash threshold. The SAR threshold for broker-dealers is $5,000, and it requires suspicion.

“A CTR means the firm thinks something is wrong.” It doesn’t. CTRs are mechanical filings for cash over $10,000. Legitimate businesses generate them constantly.

“Structuring only matters if the money is dirty.” Structuring is a crime on its own. Clean money plus intent to evade the reporting requirement is still a federal offence.

“Every transaction near $10,000 triggers a SAR.” FinCEN clarified in October 2025 that proximity to the threshold alone isn’t enough. There must be knowledge, suspicion, or reason to suspect evasion.

“I should tell the customer we filed a SAR.” Never. SAR confidentiality is mandatory and disclosure is its own violation.

“Filing a SAR protects the firm from everything.” The safe harbour covers civil liability, not criminal.

“CIP records are kept five years.” Two clocks: identifying information for five years after the account closes; verification records for five years after the record is made.

“CTRs apply to large wire transfers.” Currency means physical cash. A wire of any size generates no CTR.

“There are four pillars.” Five since 2018, when customer due diligence was added.

What to do with this info

1. Anchor the two numbers by their nature, not their size. $10,000 CTR is mechanical and cash-only. $5,000 SAR is judgment-based and covers funds or assets.
2. Memorise the deadlines: 30 days from detection, extendable to 60 only if no suspect has been identified.
3. Treat structuring as its own offence. If a question describes deliberate splitting, the source of the funds is a distractor.
4. Never pick the answer where someone tells the customer. Tipping off is always wrong.
5. Keep OFAC separate. BSA reports; OFAC blocks.
6. Check your material for “four pillars” and for a $10,000 SAR threshold. Both are dated, and material carrying them probably has other stale figures too.

Related resources

• Suitability, KYC and Reg BI — Rule 2090’s essential facts, and how KYC differs from CIP
• The SIE exam glossary — 170 terms in plain English, including the regulatory vocabulary above
• Every number and formula on the SIE — the thresholds and retention periods in one reference
• SIE exam explained: format, scoring, subjects — where the regulatory domain sits in the weighting
• How to read SIE exam questions — spotting the intent cue in a structuring scenario
• Free SIE practice exam — a domain-scored diagnostic