QUESTION
Recently,
we had training in our anti-money laundering program. I have to say, it wasn't
very good. We went to our compliance officer to request another training
because the trainer kept skirting our questions. He listened to the recording
and agreed with us. So, now he's looking for a new trainer for the anti-money
laundering training.
In the
meantime, we still don't have clear answers to several questions. We want to
know more about SAR filings, like when they're required and the timing to file.
My teammate wants to see if we can discuss the filing of a SAR with the person
we're reporting on. You would think these are obvious questions, but our
trainer did not know the answers! So, we hope you can provide answers for us.
By the way, we love your weekly newsletter!
When is a
SAR required?
Can we
question the individual we're reporting the SAR on?
What goes
into SAR decision-making?
What is
the timing to file the SAR?
ANSWER
Thank you
for your kind words. We are grateful!
We provide Anti-Money Laundering (AML) testing and training. In fact, we
were the first compliance firm in the country to offer testing, training, and a highly esteemed,
written AML Program. If you want information about our AML compliance support,
contact us here.
Because money is the basis for
criminal activity or, in the case of terrorism, is an integral part of the
activity, the United States government has prioritized pursuing the funds
generated or used in these activities. Since financial institutions occupy a
critical position in the U. S. financial system, the government not only
requires financial institutions to report information, it requires them to be
proactive in looking for transactions that may be part of a criminal activity.
In particular, this responsibility
takes the form of the Suspicious Activity Report (SAR). This report is required
as part of the Bank Secrecy Act (BSA).[i]
The banking regulatory agencies and the NCUA have adopted identical regulations
to implement this requirement.[ii]
The law and regulations make it
clear that an effective BSA compliance program includes controls and measures
to identify and report suspicious transactions in a timely manner. A financial
institution must apply due diligence to make an informed decision about the
suspicious nature of a particular transaction and whether to file a suspicious
SAR.
I will provide some guidelines to
consider in response to your questions. The applicable statutes are quite
complicated, and there's plenty of case law. However, I think a general answer
is certainly important for you to consider.
I will take your questions in order.
When is a SAR required?
The SAR is the primary method by
which financial institutions are to report suspected criminal activity.
However, it is not the only means. There are instances requiring more immediate
attention, such as when a reportable violation occurs, the financial
institution must immediately notify, by telephone, appropriate law enforcement
and financial institution supervisory authorities.
One area that is not specifically
addressed in the regulation but – which has become extremely important since
September 11, 2001 – is terrorism. To facilitate the reporting of suspected
terrorist activities, the Financial Crimes Enforcement Network (FinCEN)
established a Financial Institutions Hotline, (866) 556-3974, for financial
institutions to voluntarily report to law enforcement suspicious transactions
that may relate to terrorist activity against the United States. This hotline
is operational seven days a week, 24 hours a day.
However, financial institutions must
be aware that contacting law enforcement directly, whether about terrorism or
anything else, does not eliminate the need to file a SAR. A SAR must be filed
when required, even if law enforcement was contacted by telephone.
The agencies' SAR regulations
mandate that a SAR must be filed for:
·
Insider abuse
involving any amount.
·
Violations of federal
law aggregating $5,000 or more when a suspect can be identified.
·
Violations of federal
law aggregate $25,000 or more regardless of a potential suspect.
·
Transactions
aggregating $5,000 or more that involve potential money laundering or
violations of the BSA if the institution knows, suspects, or has reason to
suspect that the transaction:
o
Involves funds from
illegal activities or is intended or conducted to hide or disguise illicit
funds or assets as part of a plan to violate or evade any law or regulation or
to avoid any transaction reporting requirement under federal law;
o
Is designed to evade
any of the BSA regulations; or
o
Has no business or
apparent lawful purpose or is not the sort in which the particular customer
would normally be expected to engage, and the institution knows of no
reasonable explanation for the transaction after examining the available facts,
including the background and possible purpose of the transaction.
Can we question the individual we're reporting the SAR on?
Questioning individuals about potentially suspicious activity requires considerable
discretion. When determining suspicious
activity, institutions are responsible for "examining all the facts,
including the background and possible purpose of the transaction."
Thus, as part of an institution's
due diligence to determine whether suspicious activity has occurred, a reasonable
investigation into the nature and purpose of the activity may be necessary.
Institutions have expressed concern over the perceived tension between
questioning a customer about potentially suspicious activity and the
institution's responsibility to maintain the confidentiality of SARs.
FinCEN recognizes that under certain
circumstances, institutions may discreetly question a customer about the nature
and purpose of a transaction without revealing their intention to file a SAR.
For example, to determine whether a customer's transactions are "designed
to evade any [reporting] requirements," an institution may wish to ask a
customer why they are making frequent cash deposits slightly below a certain
reporting or recordkeeping threshold. If the customer provides an answer that
reasonably satisfies the institution that the transaction is not designed to
evade reporting requirements (i.e., their business has a verifiable insurance
policy that covers up to $10,000 in currency in the event of a burglary), no
SAR would be required.
However, it is important to keep in
mind that any questioning should not risk "tipping off" the customer
or otherwise disclose that a SAR is being filed. In short, institutions will
need to exercise discretion and judgment when determining how and when to
inquire of customers about unusual activity.
What goes into SAR decision-making?
Our auditors and reviewers get this
question often. Sometimes, many variables and nuances go into deciding to file
a SAR. The financial institution should have policies, procedures, and
processes for referring unusual activity from all business lines to the
personnel or department responsible for evaluating unusual activity. The
process should effectively evaluate all applicable information (i.e., criminal
subpoenas, NSLs, or section 314(a) requests).
You should document SAR decisions,
including final decisions not to file a SAR. Thorough documentation provides an
essential record of the SAR decision-making process (viz., what determines
whether or not a SAR would be filed). The decision to file a SAR is an
inherently subjective judgment.
Examiners usually focus on whether
the institution has an effective SAR decision-making process, not individual
SAR decisions. Examiners also may review individual SAR decisions to test the
effectiveness of the SAR monitoring, reporting, and decision-making process. If
the financial institution has an established SAR decision-making process, followed
existing policies, procedures, and processes, and determined not to file a SAR,
it should not be criticized for failing to file the SAR unless the failure is
significant or accompanied by evidence of bad faith.
What is the timing to file the SAR?
A financial institution must file a
SAR within 30 calendar days after the date of the initial detection of
facts that may constitute a basis for filing a SAR. If no suspect was
identified on the date of detection of the incident requiring the filing, the
financial institution could delay filing a SAR for an additional 30 calendar
days to identify a suspect. However, that is the maximum length of time the
institution can delay the reporting. In no case can the reporting be delayed
more than 60 calendar days after the date of initial detection of a
reportable transaction. If no suspect can be identified by the end of the 60
days, a SAR must be filed without the identity information.
The phrase "initial detection"
should not be interpreted as meaning the moment a transaction is highlighted
for review. Various legitimate transactions could raise a red flag simply
because they are inconsistent with an account holder's normal account activity.
For instance, a real estate investment (purchase or sale), the receipt of an
inheritance, or a gift may cause an account to have a significant credit or
debit inconsistent with typical account activity. The institution's automated
account monitoring system or initial discovery of information, such as
system-generated reports, may flag the transaction; however, this should not be
considered initial detection of potential suspicious activity.
The 30-day (or 60-day) period does
not begin until an appropriate review is conducted and a determination is made
that the transaction under review is "suspicious" within the meaning
of the SAR regulations.
You should
promptly initiate a review upon identifying
unusual activity that warrants investigation. The timeframe required for
completing the review of the identified activity, however, may vary given the
situation but should be completed in a reasonable period of time.
Naturally, you’ll want to know what
constitutes a reasonable period of time. The timeframe will vary
according to the facts and circumstances of the particular matter being
reviewed and the effectiveness of each institution's SAR monitoring, reporting,
and decision-making process. The key factor is that an institution has
established adequate procedures for reviewing and assessing facts and
circumstances identified as potentially suspicious and that those procedures
are documented and followed.
Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director Lenders Compliance Group
[ii] The regulations can be found at: OCC
(national banks; federal savings associations): 12 CFR 21, 12 CFR 163.180;
Federal Reserve (state member banks): 12 CFR 208.62; FDIC (state nonmember
banks and savings banks; state savings associations) 12 CFR 353, 12 CFR 390.355;
NCUA (credit unions) 12 CFR 748.1(c).
