Wire Transfer Regulations: AML, OFAC, UCC 4A, and Consumer Rules

Wire transfer regulations in the United States come from several overlapping sources: Article 4A of the Uniform Commercial Code sets the payment mechanics and liability rules, the Bank Secrecy Act and OFAC drive anti-money-laundering and sanctions compliance, and the Consumer Financial Protection Bureau’s Remittance Rule adds protections for international consumer transfers. The through-line across all of them is finality. Once a wire is accepted by the receiving bank, undoing it is difficult and often impossible, and the consumer protections people assume they have with debit cards do not carry over to wires.

UCC Article 4A Sets the Ground Rules

Article 4A of the Uniform Commercial Code, adopted in some form by every state, is the foundation. It standardizes how payment orders work, who bears the loss when something goes wrong, and when a transfer becomes final. It governs credit transfers between commercial parties and does not itself provide consumer protection or AML compliance.¹

A wire begins with a payment order — the sender’s instruction to a bank to pay a named beneficiary. The sender’s bank accepts by executing the order or by failing to reject it within a reasonable time. Once the beneficiary’s bank accepts, the transfer is generally final and irrevocable.¹

When an unauthorized payment order goes through, the bank may bear the loss, but only if the sender can show the order was truly unauthorized. The bank escapes liability by proving it followed a commercially reasonable security procedure agreed with the customer. In practice, the security setup a business negotiates with its bank matters enormously. A weak arrangement can leave the business bearing the full loss on a fraudulent wire.¹

A sender can cancel or amend a payment order only if the receiving bank gets the request before it accepts the order. After acceptance, cancellation requires the bank’s agreement, and the bank has no obligation to help. Narrow relief exists for a transfer sent to the wrong person, for the wrong amount, or as an accidental duplicate, but only where a pre-agreed error-detection security procedure was in place and the sender followed it. Even then, the bank’s remedy is to try to claw the funds back from the unintended recipient under the law of mistake and restitution, which is not guaranteed to work.²

A sender who finds an error after the bank confirms acceptance must report it within a reasonable time, and no later than 90 days after the bank’s notification. Missing that window can leave the sender on the hook for whatever loss the bank proves the delay caused.²

Anti-Money-Laundering Rules Every Wire Runs Through

The Bank Secrecy Act and its implementing regulations impose compliance obligations on every financial institution that handles wire transfers. Institutions must verify the identity of senders and recipients, keep transaction records, and report suspicious activity to the federal government.³

The Travel Rule

For any wire of $3,000 or more, the sending institution must collect and pass along identifying information about both sides of the transaction — names, addresses, and account numbers of the sender and the recipient. This is the Travel Rule, and it ensures that identifying information follows the money through every bank in the chain. Records must be kept for five years.⁴

CTRs and SARs

Any transaction involving more than $10,000 in physical cash during a single business day triggers a Currency Transaction Report. A wire transfer by itself does not trigger a CTR, but a wire funded by a cash deposit above $10,000 (or paid out in cash at the other end) does.⁵

Separately, banks must monitor wires for patterns that suggest money laundering or other financial crimes regardless of amount, and file a Suspicious Activity Report with FinCEN when they see them. A SAR is required at $5,000 or more when the bank can identify a possible suspect, at $25,000 or more even without a suspect, and at $5,000 or more for activity the bank believes involves money laundering or evasion of BSA rules. Banks are prohibited from telling a customer that a SAR has been filed; disclosing one is a federal offense.⁶

Structuring Is Its Own Crime

Deliberately breaking a transaction into smaller amounts to duck the $10,000 CTR threshold or the $3,000 recordkeeping requirement is a federal crime called structuring. You do not need to be laundering money or committing any other offense. Splitting the transactions to avoid reporting is itself the crime, punishable by up to five years in prison, or up to 10 years if the structuring is part of a broader pattern involving more than $100,000 over 12 months.⁷

This catches people who have done nothing else wrong. Sending four $8,000 wires over a week instead of one $32,000 wire because you heard about reporting thresholds and wanted to avoid hassle is structuring. Intent to evade reporting is what matters, not whether the underlying money is clean. Civil penalties for BSA violations range from $500 for negligent failures up to the greater of $100,000 or the transaction amount for willful ones.⁸

OFAC Sanctions Screening

Every institution handling a wire, domestic or cross-border, must screen all parties against the sanctions lists maintained by the Office of Foreign Assets Control. The Specially Designated Nationals list is the central one. Processing a transfer that involves an SDN party is prohibited, and the bank must block or reject the transaction.⁹

OFAC penalties are steep. Civil penalties can reach the greater of roughly $378,000 or twice the value of the transaction per violation, and willful violations can bring criminal fines up to $1 million and imprisonment up to 20 years.¹⁰ Banks are expected to screen not only their own customers but every party named in the wire before executing it; if a bank has information indicating any party is subject to blocking, it will be held responsible for processing the transfer.¹¹

The Consumer Protection Gap on Domestic Wires

Here is where most people are mistaken. Regulation E, the federal rule that protects consumers who use electronic fund transfers such as debit cards and ATM withdrawals, explicitly excludes transfers through Fedwire and similar systems used primarily between financial institutions or businesses. That exclusion covers virtually every domestic wire a consumer sends through a bank.¹²

The familiar consumer protections that apply to debit card fraud do not apply to domestic wires:

No $50 or $500 liability cap. The Regulation E limits that cap consumer losses on unauthorized debit card transactions at $50 (reported within two business days) or $500 (reported within 60 days) do not apply to wire transfers.¹³
No mandatory error investigation. Banks have no federal obligation to investigate a domestic wire error within 10 business days or provisionally credit a consumer’s account while they look into it.
No protection for authorized-but-fraudulent transfers. If a scammer tricks you into authorizing a wire yourself, no federal law currently requires the bank to reimburse you. The wire was authorized in the eyes of the law even though you were deceived.

Domestic consumer wires fall under UCC Article 4A by default — the same framework that governs billion-dollar interbank settlements. Article 4A was built for speed and finality between sophisticated commercial parties, not for protecting individuals who got scammed. The gap for authorized-push-payment fraud is one of the most widely criticized holes in U.S. payment law.

International Consumer Transfers Have Real Protections

The Remittance Rule, which the Consumer Financial Protection Bureau implemented under the Dodd-Frank Act, gives international consumer transfers a separate layer of protection. It applies to transfers of more than $15 sent from a provider in the United States to a recipient in a foreign country.¹⁴

Before you pay, the provider must give a written disclosure showing the exchange rate, all fees and taxes it will charge, and the exact amount of foreign currency the recipient should receive. The provider must give a receipt with the same information after payment.

You have the right to cancel an international remittance at no charge within 30 minutes of paying, as long as the funds have not already been picked up or deposited by the recipient. The cancellation request must identify you and the specific transfer. Providers can offer a longer cancellation window voluntarily, but the 30-minute minimum is mandatory.¹⁵

The rule also requires providers to investigate and resolve reported errors, such as the recipient receiving the wrong amount or the transfer never arriving. There is no comparable error-resolution framework for domestic consumer wires.

One quirk of cross-border transfers worth knowing: intermediary bank fees. Wires often pass through one or more correspondent banks, and each can deduct its own processing fee from the transfer amount. The Remittance Rule’s disclosure requirements were designed to address that by forcing the sending provider to disclose the expected final amount up front.

Tax Reporting a Wire Can Trigger

Wires can also pull you into tax-related filings that have nothing to do with money laundering, and the penalties for missing them are serious.

Any U.S. person with a financial interest in or signature authority over foreign financial accounts must file a Report of Foreign Bank and Financial Accounts (FBAR) if the combined value of those accounts exceeds $10,000 at any time during the year. This applies even if you simply use a foreign account to receive wires. The filing goes through FinCEN’s BSA E-Filing system, not your tax return.¹⁶

If you receive wires from a foreign individual totaling more than $100,000 during the tax year, you must report them on IRS Form 3520. The threshold for gifts from foreign corporations or partnerships is lower and adjusted annually for inflation ($19,570 for 2024). These filings are informational, and the gifts themselves are generally not taxable, but the penalties for failing to file are steep and often calculated as a percentage of the unreported amount.¹⁷

Wire Fraud and What You Can Actually Do

Business email compromise is the most damaging form of wire fraud. The FBI reported $2.77 billion in BEC losses in 2024. A scammer impersonates a vendor, executive, or title company through a spoofed or hacked email and sends fake wire instructions. The email looks authentic, the request looks routine, and by the time anyone notices, the money is gone.¹⁸

Recovery is possible but far from guaranteed. The FBI’s Recovery Asset Team, which works with banks to freeze fraudulent wires, reported a 66% success rate in 2024 on cases it handled, though this only covers transactions reported quickly enough for the funds to still be in the banking system.¹⁹

The most effective defenses are low-tech:

Verify wire instructions by phone using a number you already have on file, not one from the email requesting the transfer. This single step prevents the majority of BEC fraud.
Scrutinize the full email address, not just the display name. Scammers use addresses that differ from legitimate ones by a single character.
Treat urgency as a red flag. Legitimate wire requests rarely require you to skip verification.
Use dual controls for business wires so a single compromised employee cannot send funds alone.

If you believe a fraudulent wire has been sent, call your bank immediately. Speed matters more than anything else — the sooner the sending bank can reach the receiving bank, the better the chance the funds can be frozen before they are withdrawn or moved again. File a complaint with the FBI’s Internet Crime Complaint Center (IC3), which coordinates with the Recovery Asset Team to freeze funds still in the banking system.¹⁹

1
Legal Information Institute. UCC Article 4A – Funds Transfer
2
Legal Information Institute. UCC 4A-205 – Erroneous Payment Orders
3
Financial Crimes Enforcement Network. The Bank Secrecy Act
4
FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Funds Transfers Recordkeeping
5
Financial Crimes Enforcement Network. A CTR Reference Guide
6
eCFR. 12 CFR 208.62 – Suspicious Activity Reports
7
Office of the Law Revision Counsel. 31 US Code 5324 – Structuring Transactions to Evade Reporting Requirement Prohibited
8
Office of the Law Revision Counsel. 31 US Code 5321 – Civil Penalties
9
FFIEC. BSA/AML Manual – Office of Foreign Assets Control
10
eCFR. 31 CFR Part 589 Subpart G – Penalties and Findings of Violation
11
U.S. Department of the Treasury. Frequently Asked Questions 116
12
eCFR. 12 CFR Part 1005 – Electronic Fund Transfers, Regulation E
13
eCFR. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
14
Consumer Financial Protection Bureau. Assessment of the Remittance Rule
15
Consumer Financial Protection Bureau. 12 CFR 1005.34 – Procedures for Cancellation and Refund of Remittance Transfers
16
FinCEN. Report Foreign Bank and Financial Accounts
17
Internal Revenue Service. Gifts from Foreign Person
18
Federal Bureau of Investigation. Business Email Compromise
19
Federal Bureau of Investigation. 2024 IC3 Annual Report