Q&A – Wishing on a SAR: Writing Effective Suspicious Activity Report (Webinar)

  • At what point should an institution sever its relationship with a client (i.e., number of SAR filings)? The activity has been deemed suspicious numerous times; however, the institution continues to do business with the customer.

    According to Section 5 of FinCEN’s The SAR Activity Review – Trends, Tips & Issues (October 2000), “The closure of a customer account as the result of the identification of suspicious activity is a determination for an organization to make in light of the information available to the organization. A filing of a SAR, on its own, should not be the basis for terminating a customer relationship. Rather, a determination should be made with the knowledge of the facts and circumstances giving rise to the SAR filing, as well as other available information that could tend to impact on such a decision. It may be advisable to include the organization’s counsel, as well as other senior staff, in such determinations.”

  • Can you bold words on a SAR that would highlight some of the whys?

    Bolding these words is not necessary. When law enforcement pulls the SAR from FinCEN they would not see the bold words. Just focus on documenting a clear “why” in the first paragraph and it should be easily identifiable to all readers.

  • I believe that these two pieces of advice seem contradictory. Can you please explain both statements?
    – Do: Identify credits and debits separately
    – Don’t: List transactions

    In reference to identifying debits and credits separately, the recommendation is to address the debits in total (depending on the amounts and frequency). From there, address the credits in total (depending on the amounts and frequency), as applicable.

    It is important to avoid describing the activity as the subject’s account was debited a dollar amount and credited a dollar amount and then repeat for another transaction if the subject’s account was debited a dollar amount followed by a dollar credit. This process can make it difficult to follow the flow of funds. If there are a large number of transactions, It is recommended you use the attachment feature. The “Don’t: List Transactions” aligns with the above—if you have a large number of transactions, just address totals at a high level and utilize the attachment feature as needed.

  • Since Law Enforcement does a string search, it is better to have the SARs written in sentence form for all transactional activity?

    The string search results from limited system capabilities within FinCEN and how law enforcement can pull the information. If there are a lot of transactions, it is recommended using the attachment feature. FinCEN recommends when describing activity– clear, concise and chronological. Format the verbiage in your narrative you feel would best describe the flow of funds.

  • What sort of subject demographic information do you think is important to include in the SAR narrative?

    Reference the SAR narrative keyword document provided as it identifies some keywords related to demographic areas. As applicable, it would be beneficial to identify the activity as international if it occurred in a HIDTA/HIFCA, border state region or high risk country (reference knowyourcountry.com).

  • Please explain what is meant by structured wires? Structured against what?

    While the structuring codified law pertains only to cash, some individuals do not know that. In turn, they attempt to structure wires, checks, etc. While structuring wires may not alone be a SAR reportable activity, it typically can be the starting thread that can unravel other suspicious activity. Also, structuring wires can indicate an individual who is facilitating structuring on the receiver side of the wires.

  • Regarding SAR filing: If there are multiple signers on a business account and it could not be determined which signer conducted the suspicious activity, do you recommend adding all of the signers or just listing the business and none of the signers?

    If you could not determine a suspect (the person conducting the transaction), then you should not list the signers as suspects. However, you should list them and all of their related CIP and CDD information in the narrative of the SAR. Also, if you are able to determine the individual involved by video that may in turn help narrow down the suspect information.

  • Regarding MSBs or MTBs: Apart from the usual documentation such customer identification, beneficiary information and transactional data—what other information may be required as ‘customer files’ that is not retained as it is with banking institutions?

    Please review the FATF February 2016 MVTS guidance, pgs. 20-22, which provides some factors related to MSB/MTB customer risk.

  • Should SARs always be filed at least 30 days after the internal investigation and after it is deemed as suspicious activity?

    SARs should be filed within 30 days after your institution has determined a SAR should be filed if a suspect is known (very critical part)

  • Please clarify: During an investigation a third-party payment is identified or the bank client receives funds from a third-party instead of a direct buyer. As far as the client is concerned, they have to receive payment and would not mind if payment comes from the direct buyer or third-party. The client can be instructed not to accept third-party payment during EDD. However, if this happens can I file a SAR on the third-party who initiated the payment on behalf of the actual buyer instead of the bank client?

    Yes, you can focus the SAR on the third-party. However, it is important to explain the entire situation in the narrative and include the name and number of all involved accounts.

  • If a SAR report involves transactions conducted through ATMs, particularly non-proprietary ATMs, should we include the addresses of those ATMs/other institutions?

    Yes, you should include the information you have pertaining to where the ATMs are located and any possible automatic clearing house (ACH) descriptions that would indicate the differences in the ATM – ACH deposits.