Last reviewed: 8 October 2026
Home › Mortgage help › AML programs and Suspicious Activity Reports
Anti-money-laundering programs and Suspicious Activity Reports for mortgage lenders and originators, explained
Most of what we cover is a protection owed to a borrower. This is a different kind of rule: a federal compliance duty that non-bank residential mortgage lenders and originators owe to the government, and that you will usually never see.
Who the rule covers
FinCEN’s definition of “loan or finance company” in 31 CFR § 1010.100(lll) includes a residential mortgage lender (the person to whom the debt is initially payable, or to whom it is initially assigned at or immediately after settlement) and a residential mortgage originator (a person who accepts a residential mortgage loan application or offers or negotiates terms of one).[2] A residential mortgage loan, for this purpose, is a loan secured by a mortgage, deed of trust or equivalent security interest on a residential structure of one to four units, or on residential real estate on which such a structure is built or intended to be built.[2] The definition does not include a bank, a person registered with and functionally regulated or examined by the SEC or CFTC, a government-sponsored enterprise regulated by the Federal Housing Finance Agency, a federal or state agency administering mortgage or housing assistance, fraud prevention or foreclosure prevention programs, or an individual employed by a loan or finance company.[2] Because an employed individual is excluded, the duty sits with the company rather than with each employee; separately, the lender definition does not cover an individual who finances the sale of their own dwelling or real property.[2]
The written AML program: what § 1029.210 requires
The program must be written, reasonably designed to prevent the company from being used to facilitate money laundering or terrorist financing, approved by senior management, and available to FinCEN or its designee on request.[1] The rule sets four minimum elements:
| Element | What § 1029.210(b) says |
|---|---|
| Policies, procedures and internal controls | Based on the company’s own assessment of the money-laundering and terrorist-financing risks of its products and services; must cover compliance with the Bank Secrecy Act requirements that apply, integrating the company’s agents and brokers into the program, and obtaining customer-related information needed for an effective program.[1] |
| Compliance officer | A designated person responsible for effective implementation (including monitoring agents’ and brokers’ compliance), for keeping the program updated, and for making sure appropriate people are trained.[1] |
| Ongoing training | Training of appropriate persons on their responsibilities; for employees, agents and brokers the company may train directly or verify that a competent third party did.[1] |
| Independent testing | Testing to monitor and maintain an adequate program, including agents’ and brokers’ compliance, with scope and frequency matched to the risks; it may be done by a third party or by an officer or employee other than the designated compliance officer.[1] |
FinCEN or its delegates examine compliance, and failing to meet the section may be a violation of the Bank Secrecy Act.[1] The compliance date in the rule is August 13, 2012; FinCEN’s final rule was published on February 14, 2012 (77 FR 8148) and took effect April 16, 2012.[1, 4]
When a SAR is required
Under § 1029.320(a)(2), a transaction requires reporting if it is conducted or attempted by, at or through the company, involves or aggregates funds or other assets of at least $5,000, and the company knows, suspects or has reason to suspect that the transaction (or a pattern of transactions it is part of) does one of four things:[3]
- involves funds from illegal activity, or is intended or conducted to hide or disguise such funds as part of a plan to violate or evade federal law or to avoid a federal reporting requirement;
- is designed, through structuring or other means, to evade the Bank Secrecy Act rules;
- has no business or apparent lawful purpose or is not the sort in which the customer would normally be expected to engage, and the company knows of no reasonable explanation after examining the available facts; or
- involves use of the company to facilitate criminal activity.
A company may also file a SAR on a transaction it believes is relevant to a possible violation of law even when filing is not required, and more than one company may have to report the same transaction; in that case a single joint report containing all relevant facts is enough.[3]
Deadlines, records and confidentiality
| Item | Rule in § 1029.320 |
|---|---|
| Filing deadline | No later than 30 calendar days after the date of initial detection of facts that may be a basis for filing; if no suspect is identified on that date, up to 30 more calendar days to identify one, but never more than 60 calendar days after initial detection (b)(3).[3] |
| Urgent situations | For violations needing immediate attention, such as suspected terrorist financing or ongoing money-laundering schemes, the company must immediately notify an appropriate law enforcement authority by telephone in addition to filing a SAR (b)(4).[3] |
| Record retention | A copy of each SAR and the original (or business-record equivalent) of supporting documentation for five years from the filing date (c); supporting documentation is treated as filed with the SAR.[3] |
| Confidentiality | A SAR, and any information that would reveal its existence, is confidential; no company, director, officer, employee or agent may disclose it, and a subpoena or other request must be declined, citing the section and 31 U.S.C. 5318(g)(2)(A)(i), with FinCEN notified (d)(1)(i).[3] |
| Liability protection | A company and its directors, officers, employees and agents are protected from liability for a SAR disclosure to the full extent provided by 31 U.S.C. 5318(g)(3) (e).[3] |
Section (d)(1)(ii) lists disclosures the confidentiality rule does not prohibit, provided no person involved in the transaction is told it was reported: giving a SAR to FinCEN, law enforcement or an examining federal or state regulator; sharing the underlying facts and documents with another financial institution to prepare a joint SAR; and sharing within the company’s corporate structure for permitted purposes.[3]
A related cash-reporting rule
Section 1029.330 simply refers to § 1010.330, which requires a person in a trade or business who receives currency in excess of $10,000 in one transaction (or two or more related transactions) to file a report, with exceptions stated in that section.[5] It is a separate duty from the SAR rule. Section 1010.330 sets conditions and exceptions not summarized here; open the section for the full text.
What this means for a borrower
You will generally never be told whether a SAR was or was not filed about your transaction. The confidentiality rule means that silence is not a signal either way. A company’s AML program is also not a substitute for the licensing, disciplinary and complaint checks in our standard: what NMLS Consumer Access or your state regulator shows about a specific originator is a separate question, and our license verification guide shows how to look. Expect an originator to ask for identity documents and to explain where funds come from; those requests are part of the company’s program, and nothing on this page says a request means you are suspected of anything.
Canada has its own version
Canadian mortgage brokers, lenders and administrators are separately covered by a federal AML framework with different triggers and timing. See FINTRAC’s anti-money-laundering obligations for Canadian mortgage brokers.
Update (8 October 2026): this page was rewritten against the current text of 31 CFR Part 1029 and § 1010.100(lll). The earlier version paraphrased the SAR trigger as fraud, no lawful purpose, or evasion of the Bank Secrecy Act; the rule lists four patterns, including funds from illegal activity and use of the company to facilitate criminal activity, and the page now states all four. The AML program elements, the 60-day outer limit and the exact rule text were added. See the updates log.