In the weeks following the September 11, 2001, terrorist attacks, Congress moved swiftly to close financial loopholes by overhauling how U.S. banks detect money laundering and terrorist financing. The result was the USA Patriot Act, signed into law just 45 days after the attacks. It became one of the most significant changes to bank regulation in modern history, fundamentally altering the daily responsibilities of compliance officers and expanding the government’s access to financial records.
Twenty-five years later, the Patriot Act’s banking provisions are so deeply embedded in the regulatory system that their origins are often overlooked. Yet debates over their effectiveness and cost continue, especially as recent policy shifts have scaled back certain reporting requirements.
The Immediate Response to 9/11
Before the attacks, anti-money laundering efforts were a relatively minor part of bank regulation. The Bank Secrecy Act of 1970 had established reporting requirements, but enforcement was limited. That changed dramatically when it emerged that 18 of the 19 hijackers had obtained U.S. identification documents, opened bank accounts, and moved hundreds of thousands of dollars through wire transfers between Saudi Arabia, Germany, and the United States without triggering suspicious activity reports.
Lawmakers believed stricter compliance with the Bank Secrecy Act might have helped prevent the attacks. The Patriot Act passed with overwhelming bipartisan support—a 98-1 vote in the Senate—and required banks to verify customer identities, monitor transactions, and file reports with the Treasury Department’s Financial Crimes Enforcement Network (FinCEN) for any activity that might indicate money laundering or terrorist financing.
“After 9/11, anti-money laundering was something banks had to take seriously,” said David Zaring, the Elizabeth F. Putzel professor of legal studies and business ethics at the University of Pennsylvania’s Wharton School. “It definitely drove the adoption of better know-your-customer practices and all the terrorism financing work they implemented afterwards.”
How Bank Compliance Changed
The Patriot Act’s Title III imposed new obligations on financial institutions. Banks had to obtain, verify, and record information identifying every person opening an account, including tax identification numbers, dates of birth, and physical addresses. They also had to maintain formal anti-money laundering (AML) programs and share information with the government through new channels.
“Before 2001, the Bank Secrecy Act was mostly about filing reports,” said Chris Friedman, a partner at Husch Blackwell. “Title III of the Patriot Act required every bank to identify and verify each customer at account opening, and required every financial institution to maintain a formal AML program, and gave the government and banks new channels to share information.”
Anne Balcer, general counsel for the Independent Bankers Association of Texas and principal at Community Bank Advisory Services, noted that banks became key partners in helping law enforcement reconstruct terrorist activities and understand how money moved through the banking system. “That experience demonstrated that banks serve as a powerful source of information for law enforcement,” she said. “But somewhere along the way following the aftermath of 9/11, BSA/AML evolved well beyond its original purpose, and banks are increasingly asked to do the work of law enforcement.”
Balcer added that banks now “are required to monitor, investigate and make judgments about customers and activities based on information that the government itself often has far greater ability to obtain and analyze.”
Criticism and the ‘Box-Checking’ Problem
While the Patriot Act’s banking provisions remain in force, some experts argue that the AML framework has become an expensive exercise in technical compliance rather than a tool for catching criminals. Banks have long complained about the cost and rigidity of these rules.
“If you go back to the original purpose of the Bank Secrecy Act, which is to provide information and reports that are highly useful to law enforcement, criminal investigations, and tax investigations, that original purpose has been lost or de-emphasized at least, and the focus has tended to be more on technical compliance with rules,” said Dan Stipano, a partner at Davis Polk & Wardwell and a former regulator at the Office of the Comptroller of the Currency.
Carlin A. McCrory, a financial services attorney at Troutman Pepper Locke, said that financial institutions often felt they were doing “check-the-box work.” She noted that FinCEN wants to empower institutions to direct attention to higher-risk customers and activities, focusing resources where they are most needed.
Recent Deregulatory Changes
The Trump administration has not reversed the Patriot Act’s core banking provisions, but it has made a significant change to beneficial ownership reporting. In August, the administration permanently ended reporting requirements for U.S. companies and citizens under the Corporate Transparency Act, which had taken effect in 2024. The final rule, effective August 14, means FinCEN’s reporting requirements now apply only to foreign entities registered to do business in the U.S.
“The original design of the Corporate Transparency Act was to create this centralized, national registry of beneficial owners for the benefit of law enforcement,” Stipano said. “By making this change, the registry that’s left will be of very little value to law enforcement.”
Because criminal organizations and money launderers use shell companies to move money, Stipano said, bad actors can avoid the reporting requirement by simply forming a U.S. limited liability company. The change superseded a rule finalized in 2024 under the Biden administration.
“This is unfortunate because the U.S. government spent many years trying to get Congress to pass a law to create this registry, and they finally got it over the finish line six years ago,” Stipano said. “It’s like Lucy pulling the football away from Charlie Brown. It has a real-world impact on law enforcement’s ability to investigate financial crimes.”
Treasury Secretary Scott Bessent said the rule followed President Trump’s promise to “cut red tape” by reducing compliance burdens on businesses. McCrory noted that one benefit of the change is that financial institutions can target their resources toward actual threats.
What Remains of the Patriot Act Framework
Despite the recent changes, many aspects of the AML/BSA regime remain intact. Banks are still examined for compliance on the same schedule, customer identification requirements are still in the regulations, and suspicious activity report obligations continue. Enforcement has also continued.
“The government has trimmed the paperwork, particularly on beneficial ownership,” Friedman said. “But the examination and enforcement infrastructure the Patriot Act built is still standing, and banks are still enforcing it against their partners.”
Aaron Klein, the Miriam K. Carliner Chair in Economic Studies at the Brookings Institution and a former Senate Banking Committee staffer who was in the Capitol on 9/11, noted that each administration has used the same tools to catch different types of criminals. “You build one system to try to catch an international cocaine syndicate growing cocaine in Colombia, and that’s a very different AML regime than to try to catch Al Qaeda training suicide bombers in the United States,” Klein said.
Klein added that the Trump administration’s approach is a stark departure from congressional intent. “It used to be that Congress dictated the bad guys, and then the Treasury Department used the authorities, with some discretion on the hierarchy of bad guys,” he said. “Now the Treasury Department is just saying, ‘We’re not going to collect the information that Congress required under law.'”
The Road Ahead
Twenty-five years after 9/11, the Patriot Act’s banking legacy is a complex mix of strengthened security and ongoing debate over effectiveness and cost. While the core requirements for customer verification and suspicious activity monitoring remain, the recent rollback of beneficial ownership reporting signals a shift in priorities. How this balance evolves will shape the financial system’s role in combating illicit finance for years to come.