NewsAML Internal Controls for Cash: 2026 BSA Compliance Guide
AML internal controls for cash go beyond CTR filings. The 2026 BSA framework shows where monitoring, training, testing, and AI...
Cash-heavy businesses attract attention because large or unusual cash activity can be difficult to distinguish from legitimate operating revenue without reliable records. In FY2025 alone, FinCEN received approximately 4.8 million Suspicious Activity Reports, 21.5 million Currency Transaction Reports, and 420,400 reports of cash payments over $10,000 received in a trade or business. Those figures cover many types of activity, not just cash-intensive businesses, but they show how extensively large and suspicious financial transactions are reported across the U.S. financial system.
Cash business red flags become especially important when transaction patterns, customer behavior, deposit activity, or business records do not match the operation’s normal activity. Banks may scrutinize unusual account behavior, while the IRS can examine whether reported income is supported by business records. Businesses that receive more than $10,000 in cash in a single transaction or related transactions may also have a federal Form 8300 filing obligation. This guide explains the warning signs that can draw scrutiny and the controls cash-intensive businesses can use to document legitimate activity.
What Makes Cash Businesses High-Risk for Money Laundering?
Cash can be attractive to money launderers because it is easier to commingle illicit proceeds with legitimate business receipts than many other payment methods. Cash-intensive businesses such as restaurants, retailers, gas stations, and other businesses with frequent in-person payments can therefore be vulnerable when illicit cash is introduced into otherwise legitimate revenue streams.
Money laundering is commonly described in three stages: placement, layering, and integration. Placement introduces illicit proceeds into the financial system, layering obscures their origin through transactions or transfers, and integration returns the funds to the economy with an appearance of legitimacy. Cash-intensive businesses can be misused at one or more of these stages.
The volume and velocity of cash transactions create natural blind spots. When a restaurant deposits $8,500 on Monday, $9,200 on Wednesday, and $8,900 on Friday, banks can't easily verify whether those amounts reflect actual customer payments or structured deposits designed to avoid reporting thresholds.
One important 2026 compliance development involves beneficial ownership reporting. FinCEN finalized its revised Corporate Transparency Act rule in August 2026, permanently exempting U.S.-created companies and U.S. persons from BOI reporting requirements. Current federal BOI reporting generally applies only to certain foreign entities registered to do business in the United States, so businesses should avoid relying on older guidance stating that most domestic companies must file BOI reports.
Cash business red flags are only one part of a wider financial crime risk picture. The Anti-Money Laundering (AML) and Fraud Prevention course covers money laundering methods, suspicious transaction patterns, fraud indicators, and practical compliance controls for identifying risks before they escalate.
Transaction Pattern Red Flags That Trigger AML Alerts
Financial institutions use risk-based monitoring to identify activity that may warrant further review. A transaction near the $10,000 CTR threshold is not automatically suspicious. FinCEN clarified in October 2025 that transactions at or near the threshold alone are insufficient to require a SAR; the institution must know, suspect, or have reason to suspect that the activity is designed to evade BSA requirements or otherwise meets applicable SAR criteria.
-
Possible Structuring: Repeated cash transactions below $10,000 may attract scrutiny when the pattern suggests they were deliberately divided to evade reporting requirements.
-
Rapid Movement of Funds: Large cash deposits followed quickly by transfers, withdrawals, or payments that do not fit the business's normal activity may prompt additional review.
-
Repeated Round-Number Activity: Frequent large deposits in unusually consistent round amounts may warrant attention when they do not correspond with documented sales or other legitimate sources.
-
Sales and Deposit Discrepancies: Material differences between point-of-sale records, recorded cash receipts, bank deposits, and reported income can become problematic when the business cannot reconcile them with supporting records.
Customer and Transaction Behavior Red Flags in Cash-Intensive Businesses
Unusual customer actions during cash transactions often indicate attempts to conceal identities or launder funds. Key behavior triggers include:
-
Large Cash Payments and Identification Problems: Large or related cash payments can require additional customer information when a Form 8300 filing obligation applies. Generally, a trade or business must file Form 8300 after receiving more than $10,000 in cash from the same buyer in a single transaction or related transactions. Refusal to provide information needed for a required filing can therefore create a compliance problem.
-
Third-Party & Distributed Cash Payments: Unrelated individuals paying on behalf of a named customer, or multiple people pooling small cash amounts to fund a single purchase to obscure the buyer's identity.
-
Overpayment Refund Schemes: Paying significantly more than the required amount in cash and requesting the balance refunded by check, effectively swapping illicit cash for legitimate business funds.
-
Unfamiliarity with Purchases: Customers buying expensive luxury goods or specialized services while displaying complete unfamiliarity with the product or indifference to product details.
Operational Red Flags That Raise Compliance Concerns
Poor records are one of the biggest risks for a cash-intensive business because the business must be able to explain where its receipts came from and support the income and expenses reported on its tax returns.
A business should be able to reconcile its recorded sales with cash receipts, card receipts, deposits, refunds, owner contributions, loans, and other legitimate sources of funds. A difference between point-of-sale records and bank deposits is not automatically evidence of wrongdoing, but significant unexplained differences can attract scrutiny.
Cash-intensive businesses should maintain consistent daily or periodic cash summaries, preserve receipts and invoices, keep deposit and bank records, separate business and personal transactions, and document unusual deposits while the information is still available.
Inadequate documentation becomes especially problematic during an examination because reconstructed records may be harder to substantiate than records maintained in the ordinary course of business.
How Banks and Financial Institutions Monitor Cash Business Accounts
Banks use risk-based transaction monitoring and customer due diligence to identify activity that does not fit a customer's expected business profile. Cash-intensive businesses may receive additional scrutiny when deposits, withdrawals, transfers, or other activity materially differ from their normal operating patterns.
A sudden increase in cash deposits, unexplained movement of funds, activity inconsistent with the customer's known business, or patterns suggesting reporting avoidance can lead to additional review. However, FinCEN clarified in 2025 that transactions merely occurring at or near the $10,000 threshold are not enough by themselves to require a Suspicious Activity Report.
Banks must file Currency Transaction Reports when applicable currency transactions by or on behalf of the same person exceed $10,000 during one business day. Multiple qualifying transactions are aggregated when the financial institution knows they involve the same person or are conducted on that person's behalf.
That rule is different from a business's Form 8300 obligation. A trade or business generally files Form 8300 when it receives more than $10,000 in cash from the same buyer in a single transaction or related transactions. Transactions occurring more than 24 hours apart may still be related if the business knows or has reason to know they form part of a connected series.
Structuring can occur across multiple days, but that does not mean banks combine several days of activity into one CTR. The CTR aggregation period remains one business day. Multi-day transactions may instead become relevant if the pattern suggests an attempt to evade reporting requirements.
Banks generally cannot notify customers that a SAR has been filed. As a result, a business may receive requests for additional documentation or account information without being told whether suspicious activity has been reported.
FinCEN received approximately 4.8 million SARs in FY2025, compared with about 4.7 million in FY2024.
Specific Money Laundering Typologies in High-Risk Cash Businesses
Trade-based money laundering schemes manipulate invoices and shipments to justify large cash movements. A clothing retailer might claim to purchase $500,000 in inventory from an overseas supplier but actually receive goods worth $200,000. The extra $300,000 represents laundered funds disguised as legitimate business expenses. Over-invoicing, under-invoicing, and phantom shipments all serve to create paper trails for illegal money.
Integration schemes blend illegal cash with genuine business revenue. A restaurant earning $400,000 annually in legitimate sales might report $700,000 by adding $300,000 in drug proceeds to the daily cash deposits. The business appears more profitable than reality, pays taxes on the laundered amount, and the criminal now possesses "clean" money with apparent legal origins.
Funnel account activity typically involves an individual or business account receiving multiple cash deposits in geographic areas different from where the account holder normally operates, followed by rapid withdrawals, wires, or movement of the funds elsewhere. Deposits may be made by multiple individuals and can occur in amounts below reporting thresholds. The geographic separation and rapid movement of funds can help obscure where the money originated.
Cash businesses sometimes function purely as fronts with minimal actual operations. A car wash reporting $800,000 in annual revenue but showing water bills consistent with washing 20 cars weekly creates an obvious discrepancy. The business exists primarily on paper to justify cash deposits that originated from criminal activity.
Treasury's 2026 National Money Laundering Risk Assessment continues to identify cash-intensive businesses as a laundering vulnerability because illicit cash can be commingled with legitimate business receipts. The report gives a 2025 example involving a grocery store and a restaurant owner who discussed splitting cash into smaller deposits as part of a laundering scheme. Treasury also notes increasing use of digital assets in illicit finance, while stating that money laundering through digital assets remains below the volume conducted through fiat currency and other methods.
Building Strong Cash-Transaction Compliance Controls
Being cash-intensive does not automatically require an ordinary business to maintain the same formal BSA/AML program as a bank, money services business, casino, or another specifically regulated financial institution. For most ordinary merchants, one important federal cash-reporting obligation is Form 8300 when more than $10,000 in cash is received in a single transaction or related transactions.
Strong controls should begin with accurate records. Daily cash receipts should reconcile with sales records, refunds, deposits, and other legitimate sources of funds. Businesses should preserve receipts, invoices, deposit slips, register reports, bank records, and other documentation supporting reported income and expenses.
Businesses that may receive large cash payments should also establish a clear Form 8300 process. Employees responsible for accepting those payments should understand when transactions must be combined, what customer information is needed, and when the reporting threshold has been crossed.
Generally, Form 8300 must be filed after a trade or business receives more than $10,000 in cash in a single transaction or related transactions. Multiple payments for related transactions can become reportable when the combined amount exceeds the threshold.
Internal escalation procedures can also help employees handle unusual transactions consistently. Rather than treating every large cash payment as suspicious, staff should know when to refer an unusual pattern to management, accounting personnel, or qualified compliance counsel for review.
Businesses that are themselves subject to formal BSA/AML program requirements because of their regulated activities may have additional obligations and should determine those requirements based on the regulatory category they actually fall into.
What to Do If Your Cash Business Faces Additional Scrutiny
A request for additional information from a bank does not necessarily mean the business has been accused of money laundering. Financial institutions conduct risk-based due diligence and may ask customers to explain unusual activity, provide records, or update information about their operations.
If a bank asks about cash activity, provide accurate records showing the source and business purpose of the transactions requested. If the IRS opens an examination, follow the instructions in the official notice and organize the records used to support reported income and deductions.
If the business receives a subpoena, investigative request, penalty notice, or other significant regulatory communication, consider consulting a qualified tax attorney, CPA, or financial-crime compliance professional before responding. Preserve relevant business records and avoid altering or recreating documentation after the fact.
Industry-Specific Red Flags by Business Type
Different cash-intensive industries produce different operating records, so red flags often involve activity that cannot be reconciled with how the business actually operates.
Restaurants and bars may draw questions when sales, inventory purchases, payroll, card receipts, and cash deposits do not reasonably align. Car washes and laundromats can face similar questions when reported revenue appears inconsistent with operating records or business capacity. Salons and barbershops should be able to reconcile appointments, receipts, employee or contractor records, and deposits.
Retail and convenience businesses should maintain records connecting inventory purchases with recorded sales and cash receipts. Auto dealers face additional Form 8300 exposure because individual transactions can more readily exceed the federal cash-reporting threshold. Third-party payments, split payments, or related cash transactions should therefore be reviewed carefully to determine whether reporting is required.
