Fulfilling Your SAR Filing Requirements

By Chris W. Bell, Associate General Counsel, Compliance Alliance​

​One of the most common types of questions that we get at Compliance Alliance concerns the deadline of particular regulatory requirements. While some requirements have a definite due date and a knowable trigger, the trigger for other requirements is a bit is more of a judgment call. The suspicious activity report (“SAR”) must be filed “no later than 30 calendar days after the date of initial detection by the bank of facts that may constitute a basis for filing a SAR.” You have to love any rule with a self-referential deadline. What can be clearer than the notion that you have to file a SAR within 30 days of knowing you need to file a SAR? A closer look at the SAR rules can help break this requirement down into a more manageable expectation and tune up your suspicious activity reporting system.
 
The first thing to keep in mind is what constitutes “suspicious activity.” The Bank Secrecy Act (“BSA”) tells banks, bank holding companies, and their subsidiaries to monitor transactions and file a SAR on any transaction that they deem suspicious. A transaction includes “a deposit; a withdrawal; a transfer between accounts; an exchange of currency; an extension of credit; a purchase or sale of any stock, bond, certificate of deposit, or other monetary instrument or investment security; or any other payment, transfer, or delivery by, through, or to a bank.” You must file a SAR when you have reason to suspect:

• Insider abuse (regardless of amount);
• Criminal violations aggregating $5,000 or more when you can identify a suspect;
• Criminal violations aggregating $25,000 or more, even when you are unable to identify a suspect; or
• Transaction(s) involving your bank that aggregate to $5,000 or more, if you know, suspect, or have reason to suspect that the transaction(s):
  • Potentially involve money laundering or other illegal activity (e.g., terrorism financing);
  • Is designed to evade the BSA or its implementing regulations; or
  • Has no business or apparent lawful purpose or is not the type of transaction that the particular customer would normally be expected to engage in, and the filer has no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction.

 
You must establish and follow suspicious activity monitoring and reporting systems to fulfill your duties under the BSA. Examiners look for suspicious activity monitoring and reporting systems that include five key components: identification or alert of unusual activity; managing alerts; SAR decision making; SAR completion and filing; and monitoring and SAR filing on continuing activity. This boils down to being able to identify unusual customer behavior, deciding whether that behavior is “suspicious activity” that triggers the reporting requirement, and fulfilling the reporting requirement. During an exam you may be asked to show, through policies, procedures, and processes, how your bank takes the necessary steps to address each component and the person(s) or departments responsible for executing those steps.
 
Through your transaction monitoring programs, you will identify many cases of unusual behavior on behalf of your customers. That does not mean that you will file a SAR on each case of unusual behavior. You must file a SAR within 30 days of identifying potentially suspicious activity, with the deadline extending to 60 days when you are unable to identify a suspect. “Initial detection” is not when you identify unusual behavior. That is only the first step to identifying suspicious activity. There are many cases where activity can be deemed unusual for a particular customer and generate a red flag, but where the activity, upon further review and investigation, is legitimate and perfectly reasonable. After identifying unusual behavior, you must promptly review the transaction or account to determine whether the unusual behavior suggests that the activity is consistent with one of the types of suspicious activity outlined above. If you determine that the unusual behavior is suspicious activity, the clock starts ticking.
 
There is no specific timetable for your investigation. While the FFIEC has said the investigation must be completed “within a reasonable period of time,” what is considered reasonable will vary according to the facts and circumstances of the particular activity being reviewed and the effectiveness of your SAR monitoring, reporting, and decision-making process. The examiner will be looking to make sure that you have “adequate procedures for reviewing and assessing facts and circumstances identified as potentially suspicious, and that those procedures are documented and followed.”
 
One question that comes up often during the review process is the extent to which a bank has to confirm the underlying criminal activity to support a SAR. While the BSA requires you to report suspicious activity that may involve money laundering, BSA violations, terrorist financing, and certain other crimes above prescribed dollar thresholds, you do not have to investigate or confirm the underlying crime itself. Law enforcement will handle the investigation. When evaluating suspicious activity and completing the SAR, you should, to the best of your ability, identify the characteristics of the suspicious activity.
 
Your bank plays a crucial role in helping the government catch people who are engaged in terrorist financing, money laundering, and other illegal activity. You must have systems in place to monitor for consumer activity that is designed to further such illegal activity and report the suspicious activity to the proper authorities. While your systems should flag all unusual activity, you will not be filing SARs on all of it. Your reporting requirement arises when you have reason to suspect that the identified activity is the kind of suspicious activity under the BSA. You should promptly review all unusual behavior to determine whether you are dealing with suspicious activity and must file a SAR and then file that SAR within 30 days (or 60 days if you cannot identify a suspect). Compliance Alliance members have access to our BSA toolkit, which contains many tools to help you fulfill your SAR filing requirements. 

---

Learn More