Skip to main content

Extract data from Currency Transaction Reports (CTRs)

A Currency Transaction Report is the filing a bank or other financial institution submits when a customer moves more than $10,000 in cash in a single business day. It exists because the Bank Secrecy Act requires it, and it is filed with the Financial Crimes Enforcement Network on FinCEN Form 112 within 15 days of the transaction. Unlike a Suspicious Activity Report, a CTR is not an allegation: crossing the $10,000 cash threshold triggers the report whether or not anything looks wrong. Each report pairs the reporting institution with the transaction and the person who conducted it, so a BSA officer, an examiner, and an AML analyst all read the same fields to confirm the report was filed correctly and on time. What carries weight is the aggregate cash amount, the identity of the person conducting the transaction, and the flags. Deposits, withdrawals, and exchanges are aggregated across a single business day, so two cash deposits of $9,000 and $9,500 by the same customer add to $18,500 and cross the threshold together even though neither alone would. Splitting cash into sub-threshold amounts to dodge the report is structuring, a federal offense under 31 U.S.C. 5324, which is why the multiple-transactions flag is a field on its own. Whoever conducts the transaction is recorded with a name, a date of birth, an identification type and number, and an address, and the currency is typed in ISO 4217 with any exchange rate to a US-dollar equivalent. Talonic reads the CTR and returns the reporting institution, the transaction, and the person conducting it as typed fields, keeping the individual transactions and the customers as tables. A CTR from Lakeshore Community Bank (routing 041200555) for a cash deposit on 2026-05-12 by Daniel Okonkwo (born 1979-11-03, driver license on file), totalling $18,500 in USD across two same-day deposits and filed 2026-05-20 by BSA officer Rachel Kim with the multiple-transactions flag set and no suspicious-activity flag, loads into an AML system instead of a retyped form. This extraction structures what the report states and makes no determination about whether the activity is suspicious or the filing complete.

What gets extracted from Currency Transaction Reports (CTRs)

CTR NumberCTR-2026-0512-0033
Reporting InstitutionLakeshore Community Bank
Institution IDRouting 041200555
Transaction Date2026-05-12
Total Amount (USD)$18,500
Person ConductingDaniel Okonkwo
Customer ID TypeDriver's license
Transaction TypeCash deposit
Multiple Transactions FlagYesSame-day deposits aggregated over $10,000
Filing PersonRachel Kim, BSA Officer

How extraction works for Currency Transaction Reports (CTRs)

CTRs are produced by a BSA reporting system, filed through the FinCEN portal, and kept as PDFs in the institution's records, so the layout of the transaction and person boxes shifts between vendors. Talonic reads the report and maps each value to the currency-report field set that the Field Registry tracks, which keeps the reporting institution, the transaction detail, and the person conducting the transaction as separate blocks rather than one form. Cash amounts and their US-dollar equivalents are typed as numbers with the ISO 4217 currency and any exchange rate, the transaction and filing dates parse to ISO 8601 so the 15-day filing window can be checked, and the multiple-transactions and suspicious-activity flags are read as their own boolean fields. Individual transactions and customers each load as a table, so two same-day deposits that aggregate over the $10,000 threshold are kept as distinct rows that foot to the reported total. Provenance follows DIN SPEC 91491, attaching a confidence score and a source-region pointer to every value, so a BSA officer can trace the $18,500 aggregate or an identification number back to the filed report. On balance, Talonic captures what the CTR states and does not decide whether the activity is suspicious or the report complete.

Sample extraction

A FinCEN CTR for aggregated same-day cash deposits

{
  "document_number": "CTR-2026-0512-0033",
  "document_date": "2026-05-20",
  "reporting_institution_name": "Lakeshore Community Bank",
  "reporting_institution_id": "041200555",
  "transaction_date": "2026-05-12",
  "currency": "USD",
  "total_amount": 18500,
  "total_amount_usd": 18500,
  "customer_name": "Daniel Okonkwo",
  "customer_date_of_birth": "1979-11-03",
  "customer_id_type": "drivers_license",
  "customer_id_number": "D-4471-8890-2261",
  "customer_address": "58 Harbor View Drive, Cleveland, OH 44113",
  "transaction_type": "deposit",
  "suspicious_activity_flag": false,
  "multiple_transactions_flag": true,
  "filing_person_name": "Rachel Kim",
  "governing_law": "Bank Secrecy Act, 31 CFR 1010.311",
  "transactions": [
    {
      "transaction_date": "2026-05-12",
      "currency": "USD",
      "transaction_amount": 9000,
      "transaction_amount_usd": 9000,
      "transaction_type": "deposit",
      "customer_name": "Daniel Okonkwo",
      "suspicious_activity_flag": false
    },
    {
      "transaction_date": "2026-05-12",
      "currency": "USD",
      "transaction_amount": 9500,
      "transaction_amount_usd": 9500,
      "transaction_type": "deposit",
      "customer_name": "Daniel Okonkwo",
      "suspicious_activity_flag": false
    }
  ],
  "customers": [
    {
      "customer_name": "Daniel Okonkwo",
      "customer_date_of_birth": "1979-11-03",
      "customer_id_type": "drivers_license",
      "customer_id_number": "D-4471-8890-2261",
      "customer_address": "58 Harbor View Drive, Cleveland, OH 44113"
    }
  ]
}

Frequently asked

How is a CTR different from KYC or AML due diligence?

A CTR is a specific report a financial institution files when cash over $10,000 moves in a day under the Bank Secrecy Act. KYC and AML due diligence is the ongoing customer identification and monitoring program. Talonic reads the CTR filing on its own schema and cross-links to the kyc-aml extractor for onboarding records.

Does it show why the transaction crossed the threshold?

Yes. The individual transactions load as a table, so two same-day deposits of $9,000 and $9,500 are kept as distinct rows that foot to the $18,500 aggregate, and the multiple-transactions flag records that the report covers combined transactions.

Is the person conducting the transaction captured?

The person is recorded with name, date of birth, identification type and number, and address, held both on the report and in the customers table, so a filer or examiner reads the identity fields from structured data rather than the form.

Does a CTR mean the activity was suspicious?

No, and Talonic does not judge that. A CTR is triggered by the cash threshold, not by suspicion. The suspicious-activity flag is captured as the report states it, and whether a Suspicious Activity Report is warranted is a decision for the institution, not the extraction.

Ready to extract from your own Currency Transaction Reports (CTRs)?

Author note

Reviewed by Talonic engineering, AML schema review · last reviewed 2026-07-09