Patrick G. Eddington and Nicholas Anthony
Cato Surveillance Week 2026 featured a panel that included my colleague and Cato Research Fellow Nicholas Anthony. As is always the case with such expert panels, there are inevitably more questions than we have time to address in an hour. Moreover, because the reach of the Bank Secrecy Act (BSA) is so vast, I wanted to follow up with Nick on some of the issues we covered and some we didn’t have a chance to get into depth on. What follows is the transcript of my chat with Nick, edited for clarity.
Q. Folks may not be as familiar with the Bank Secrecy Act as other laws. Can you give them a brief crash course?
The Bank Secrecy Act was enacted in 1970 to require banks and other financial institutions to monitor customers and report certain transactions to the government. It started as an attempt to go after tax evaders, but it has since been expanded to go after drug dealers, terrorists, and immigrants (and everything in between).
With that said, the stated targets may be criminals, but there is little data to show that it is effective in catching them. The best data available paint a grim picture. Banks spend around $59 billion a year complying with this system, file more than 28.7 million customer reports with the government, and yet only 275 investigations were initiated because of those reports. That is not a success story. And that’s to say nothing of the massive intrusion into our financial lives.
Q. Some supporters accept the underlying premise—that tracing money helps catch criminals—and only fault the execution. Are Bank Secrecy Act supporters wrong to accept that premise?
I don’t deny that tracing money can help catch criminals. When investigators have a suspect, getting that person’s financial information can help. After all, our financial information reveals our work, travel, relationships, politics, and much more. What I do reject is the conclusion that the government should therefore have open access to everyone’s financial information without so much as a warrant.
Yet, that conclusion is the foundation for financial surveillance under the Bank Secrecy Act regime. The US government has created an ever-growing system with the argument that warrants are too hard to get, and a little more surveillance will fix the problem. It happened with the war on drugs and then the war on terror. Today, debates revolve around expanding surveillance to go after illegal immigrants, cryptocurrency crime, and fraud. If the premise is that more visibility means more safety, every gap looks like a vulnerability, and every expansion looks like progress. I want to put the burden back where it belongs: the government should have to justify its surveillance in each individual case.
Q. Is your objection to the BSA constitutional or consequentialist? If the Fourth Amendment argument failed in court tomorrow — and under the third-party doctrine it mostly has — would you still oppose the regime, or does your case ultimately rest on the cost-benefit numbers?
My objection to the Bank Secrecy Act falls into both categories.
First, the Supreme Court was wrong in United States v. Miller. People don’t give up their expectation of privacy by using a bank any more than they do by using a phone company. The Supreme Court recognized in Carpenter that the third-party doctrine doesn’t fit the digital age, and more progress has been made since then. However, you are right. We have a long way to go.
Second, the cost-benefit numbers show that the Bank Secrecy Act doesn’t deliver. You don’t have to be a privacy maximalist to recognize that spending billions of dollars to initiate a few hundred investigations is concerning. And that strikes at the very heart of the law. The whole idea boils down to the argument that if banks are not forced to report suspicious activity, then criminals will be allowed to operate freely. Yet, as we can see, this law is not the silver bullet its supporters suggest it is.
Q. Your marquee figures — roughly $59B in annual compliance cost, ~28.7 million reports, a few hundred investigations — are concerning. Yet, some people would likely argue that “a few hundred investigations directly initiated” undercounts by design, because the Bank Secrecy Act data’s value is retrospective: 94% of IRS-CI cases were run against it. Does that framing blunt your statistic? How do you answer the “searched against” defense?
It sounds impressive, but look at what that figure is saying. If every investigation includes a routine query of the FinCEN database, then of course a large share of cases will show a “hit” in this context. In other words, that figure measures how often the database is used, not whether it contributed anything. The real question is the counterfactual: would the case have been made without it? Agencies have struggled to answer that.
The retrospective defense also cuts against the current design. If the data’s main value comes after investigators have already identified a suspect, that is the textbook case for targeted legal process. Banks keep records in the ordinary course of business, and law enforcement can get them with a warrant once it has a reason to. You don’t need a standing government database of everyone’s transactions to look up a specific suspect’s history.
Q. If the BSA were repealed tomorrow, what’s the real cost, and how do you meet the “We need this to stop terrorist attacks and human trafficking” argument?
I won’t pretend that a repeal costs nothing. Some investigations would take longer, and investigators would have to go to banks through the legal process instead of searching a ready-made database. On the other hand, tens of billions of dollars spent on compliance burdens would be freed. It would become easier for competitors to enter the realm of banking. It would be easier to service customers with lower incomes. And with any luck, we may see better interest rates.
None of that stops law enforcement from going after terrorists. It just means that law enforcement must do an investigation and get a warrant. Supporters also have little to stand on with this argument. Keep in mind: The Bank Secrecy Act had been in effect for 30 years when 9/11 happened. Invoking the worst crimes to justify surveilling everyone is the oldest move in the surveillance playbook. It deserves the same answer here that it gets for wiretaps: go get a warrant.
Q. If I understand their positions correctly, Carole House has endorsed data minimization and “calibrated discoverability”; Aaron Klein wants to rethink what’s collected at all. All three of you agree the current data haul is excessive. Is the disagreement really about principle, or just about how far to cut? Where does your position stop being a difference of degree from theirs and become a difference in kind?
There’s real overlap, and I welcome it. If House’s data minimization or Klein’s rethinking of what’s collected means higher thresholds and fewer reports, those are steps I’d support. But the difference is one of kind. Their proposals keep the baseline that the government is entitled to see financial activity unless a case is made for limiting it. “Calibrated discoverability” still means calibrated by the state: the data is designed to be discoverable, and the debate is over how much. My starting point is the reverse. Your financial records are yours, and the government has to show individualized suspicion before it gets to look.
You can see the difference in where each position stops. Under theirs, a well-designed Bank Secrecy Act might collect less, but it would still collect proactively, without suspicion, and that’s the part I object to. Under mine, cutting the data haul is progress but not the destination. The destination is ending sweeping reporting and restoring the warrant requirement. So we can travel together for part of the road. The point where I keep going is the point where they would declare the system fixed.
Did you miss Cato Surveillance Week? You can find all of the panels here: foreign surveillance, financial surveillance, transportation surveillance, and commercial surveillance.
