Risk Management Manual of Examination Policies - FDIC

BANK SECRECY ACT, ANTI-MONEY LAUNDERING,
AND OFFICE OF FOREIGN ASSETS CONTROL
designated committee thereof, review each and every SAR
document. It is acceptable for the BSA officer to prepare
an internal tracking report that briefly discusses all of the
SARs filed for a particular month. As long as this tracking
report is meaningful in content, then the institution will still
be meeting the requirements of Part 353 of the FDIC’s
Rules and Regulations. Such a report would identify the
following information for each SAR filed:
• Customer’s name and any additional suspects;
• Social Security Number or TIN;
• Account number (if a customer);
• The date range of suspicious activity;
• The dollar amount of suspicious activity;
• Very brief synopsis of reported activity (for example,
“cash deposit structuring” or “wire transfer activity
inconsistent with business/occupation”); and
• Indication of whether it is a first-time filing or repeat
filing on the customer/suspects.
Such a tracking report promotes efficiency in review of
multiple SAR filings. Nevertheless, there are still some
SARs that the board of directors, or designated committee
thereof, should review individually. Such “significant
SARs” would include those that involve insiders
(notwithstanding the guidance above regarding the
handling of SARs involving board members and senior
management), suspicious activity above an internally
determined dollar threshold, those involving significant
check kiting activity, etc. Financial institutions are
encouraged to develop their own parameters for defining
“significant SARs” necessitating full reviews; such
guidance needs to be written and formalized within board
approved BSA policies and procedures.
Safe Harbor for Institutions on SAR Filings
A financial institution that files a SAR is accorded safe
harbor from civil liability for filing reports of suspected or
known criminal violations and suspicious activities with
appropriate authorities. Any financial institution that is
subpoenaed or otherwise requested to disclose information
contained in a SAR or the fact that a SAR was filed to
others shall decline to produce the SAR or provide any
information or statements that would disclose that a SAR
has been prepared or filed. This prohibition does not
preclude disclosure of facts that are the basis of the SAR,
as long as the disclosure does not state or imply that a SAR
has been filed on the underlying information.
Recently, the safe harbor protections were reiterated and
expanded. Section 351 of the USA PATRIOT Act,
amended Section 5318(g)(3) of 31 USC and included
directors, officers, employees, and agents of the financial
Section 8.1
institutions who participate in preparing and reporting of
SARs under safe harbor protections. Section 355 of the
USA PATRIOT Act, implemented at Section 18(w) of the
FDI Act, established a means by which financial
institutions can share factual information of suspected
involvement in criminal activity with each other in
connection with references for employment. To comply,
employment references must be written and the disclosure
made without malicious intent. The financial institution
still may not disclose that a SAR was filed. The sharing of
employment information is voluntary and should be done
under adequate procedures, which may include review by
the institution’s legal counsel to assess potential for claims
of malicious intent.
Examination Guidance
Examiners should ensure that the financial institution has
procedures in place to identify and report suspicious
activity for all of the financial institution’s departments and
activities. The guidance may be contained in several
policies and procedures; however, it may be advisable for
the financial institution to centrally manage the reporting of
suspicious activities to ensure that transactions are being
reported, when appropriate. A single point of contact can
also expedite law enforcement contacts and requests to
review specific SARs and their supporting documentation.
As part of its BSA and anti-money laundering programs,
the financial institution’s policies should detail procedures
for complying with suspicious activity reporting
requirements. These procedures should define reportable
suspicious activity. Financial institutions are encouraged
to elaborate and clarify definitions using examples and
discussion of the criminal violations. Parameters to filter
transactions and review for customer suspicious activity
should also be established. Typically, the criteria will be
used to identify exceptions to expected customer and
transaction activity patterns and identify high-risk
customers, whose accounts and transactions should be
subject to enhanced scrutiny. Procedures to facilitate
accurate and timely filing of SARs, as well as to ensure
proper maintenance of supporting documentation, should
also be prescribed. Procedures to document decisions not
to file a SAR should also be established. Reporting
requirements, including reporting SAR filings to senior
management and institution directors should be defined.
Any additional actions, such as closer monitoring or
closing of an involved account(s) that the financial
institution may wish to take should be defined in the
policy. Many institutions are concerned about facilitating
money laundering by continuing to process these
suspicious transactions. As there is no requirement to
close an account, the institution should assess each
DSC Risk Management Manual of Examination Policies 8.1-47 Bank Secrecy Act (12-04)
Federal Deposit Insurance Corporation