The Suspicious Activity Report (SAR) is another report that credit unions file to assist law enforcement with uncovering illegal activities. As you learned in the last email, a CTR is triggered by a very specific transaction and dollar amount. SAR filing triggers are much more subjective and can be initiated by activity that is difficult to define or even recognize. The credit union does not need to confirm that the activity they are reporting is illegal, just that it is suspicious in nature or unexplained for that particular individual or entity.

Money launderers are well aware of the filing requirements of a CTR and often try to structure their activities to avoid detection and reporting. This makes the SAR even more important. Your credit union should have processes or software to monitor accounts and identify patterns of suspicious or illegal activity, as well as a method to report them to the appropriate person(s) within your credit union for a possible SAR filing.

Timing

SARs are electronically filed by the 30th calendar day after "discovery" of the suspicious activity -- which may not necessarily be 30 days after the actual activity occurred. If no suspect can be identified, the credit union has 60 days from discovery to file it. Documenting the initial detection date can be valuable in proving a SAR was filed timely and the deadline was not missed.

It is also important to document your decision to not file a SAR if your investigation determines one is not necessary or warranted. When you look at local or national crime stories, think about where the detection in the financial institution may have occurred and what the SAR filing may have noted that led to further investigation.

Confidentiality

SAR filing is extremely confidential. It should never be discussed with a member, any other employee who is not involved in the investigation, with the media, or any other third parties. Disclosure of the information by an employee or even a board or supervisory committee member can subject them to federal charges and fines, so that is an important training subject. You might remember a few years ago when an official with FinCEN was sentenced to prison for disclosing SAR information to the media to try to harm President Trump's reputation.

Filing Triggers

The following categories trigger a SAR and show an example of something that might be included in that type of filing. The dollar amounts are aggregates and do not have to occur in a single transaction or within a specific time period.

1. Insider abuse of any amount (embezzlement)
2. Violations of $5,000 or more with an identified suspect (check kiting)
3. Violations of $25,000 or more, regardless of an identified suspect (romance scam or fraud)
4. Activity of $5,000 or more with potential money laundering or violations of BSA (structuring)
5. Any information that might be helpful to law enforcement or activity that is in violation of any law or regulation, regardless of whether it meets one of the above categories

One of the most common categories for SAR filing in Montana is elder financial exploitation (EFE). The CFPB put out an informative report in 2019 that details trends and analyzes elder fraud that you might find useful in understanding SARs. FinCEN also noted how helpful the elder fraud SAR reports are for their work in a December 2019 release.

Writing a Narrative

One of the most challenging aspects of the SAR is the determination of whether or not to file. The next challenge lies in the filing process itself. The SAR is not a fill-in-the-blank form like the CTR; instead, it requires writing a narrative that tells law enforcement a story (think of a book report) that compels them to investigate the situation further. FinCEN provides excellent narrative writing guidance that your credit union should consider as a reference.

A SAR review team of federal agents from the IRS, Secret Service, U.S. Attorney's office, FBI, and other agencies, including Adult Protective Services (APS), reviews every SAR filed in Montana, so starting with a summary statement is useful. It helps the review team evaluate how your SAR fits an agency's current priorities and determines the resources and time to put toward investigating the activity it describes. They also recommend having contact information within the report for the person they should reach out to for more detail or supporting documentation, if needed.

Resources

You can find more detail on the FinCEN SAR FAQ page or in the Suspicious Activity Reporting section of the FFIEC BSA examination manual. They also provide some examples that give "the rest of the story" to show how SAR filing can be used in law enforcement investigations. FinCEN FAQ issued in Jan. 2021 (questions 4 and 5) also offer some insight on how a credit union should deal with negative information about a member in the media. They discuss whether a SAR is required (hint: the answer is no!) and how to deal with details you uncover in a subsequent media search that could be useful to law enforcement.

Continuing Activity

Your credit union should do a review 90 days after filing a SAR to see if the fraudulent or suspicious activity continues on the account(s). If it does, you must file another SAR by the 120th day. 

Sometimes the account is no longer open, so no additional filing is required or further activity has not occurred since the previous filing. FinCEN addressed this issue in their Jan. 2021 FAQ in #3.

Make sure that your BSA policy contains these timelines and a process to assist with reminders of the 90-day review can also be helpful. FinCEN has noted that the continuing SAR is a process they intend to update at some point in the future.

Board Reporting

A monthly report to your board of directors on the SARs filed in the prior month is required for both federal and state-chartered credit unions. It should provide the number of SARs filed, may include their category type(s), and the dollar amounts involved, but any discussion of names or specifics is discouraged.

This preserves the highly confidential nature of the reports while keeping board members apprised of the program trends they are responsible for overseeing. The BSA compliance officer or a member of management can be available to provide additional details on the filings if questions arise; but even if asked, names should not be revealed.

Requests for Information

Sometimes after a SAR is filed, an appropriate agency will contact your credit union requesting information or documentation. You can supply the information if it's within the scope of the SAR filed.

If it's not, the credit union should require one of the following: 

• Member authorization,
• Administrative subpoena or summons,
• Search warrant,
• Judicial subpoena, or 
• Formal written request.

FinCEN released this guidance to summarize their expectations. If you are ever in doubt, reach out to your regulator for guidance and assistance.

Donya Parrish, VP Risk Management | donya@mcun.coop | 406-459-3497