SAR WARS Writing for Law Enforcement vs Writing for Examiners June 2016 PRESENTED BY BRIENNE BRYSON, CAMS BANKERS TOOLBOX INC AND ANDREW LEE, SPECIAL AGENT, U.S. TREASURY
SAR WARS - ACAMSfiles.acams.org › pdfs › 2016 › CESOCA06072016_3_SAR_WARS.pdf · 2016-07-06 · SAR WARS Writing for Law Enforcement vs Writing for Examiners June 2016. PRESENTED
Do Use Your Resources! Electronic Filing Requirements for the FinCEN Suspicious
Activity Report (FinCEN SAR)
FinCEN SAR FAQs
FinCEN’s 2003 SAR Guidance
FinCEN 314(b) Information Sharing
FinCEN’s SAR Review by the Numbers
For MRB Related SARs – The Cole Memo
FFIEC Exam Manual
Presenter
Presentation Notes
We all know that you have a huge responsibility placed on you in the role of a BSA Officer. Not only are you doing this job to try and stop criminals, money laundering and terrorist financing – as if that wasn’t scary enough! – You are also trying to impress regulators! Well how do you do that and walk that fine balancing act of satisfying law enforcement with your SARS and your regulators? The first tip I can offer you is USE YOUR Resources!!! There are numerous resources out there – you just have to know where to look. FinCEN 314(b) Information Sharing is being strongly encouraged by FinCEN – and while quite old – the 2003 SAR Guidance is still being used by some examiners. This should be superseded by recently revised FFIEC Exam Manual guidance, but we all know how slow some things are to change. The FinCEN SAR Review by the Numbers is a great place to stay apprised of the recent trends in reporting and new key terms FinCEN is recommending be used.
Do Use Your Resources! FFIEC Exam Manual Appendix L
Who – Who was involved?
What – What is the activity you think is suspicious?
When – When did the activity occur and when did you discover it?
Presenter
Presentation Notes
And since we’re talking about what the examiners will be looking for – use Appendix L from the FFIEC Manual. Appendix L covers the 5 Ws + how – but it’s a starting point to get you thinking. Who – Who was involved in the activity? Some examiners and auditors believe if you have a name – you have a subject even if you have no other identifying information. What – What is the activity you think is suspicious? What happened? What was the customer doing? Were they acting nervous? What instruments were used in that activity? When? Not only when did the activity occur, but when did you discover it? If this is activity that happened some time in the past, be sure you explain how or why you are just now discovering and reporting it.
Do Use Your Resources!
FFIEC Exam Manual Appendix L Continued
Where – Where did the activity occur?
Why – Why do you think the activity –or the customer – is suspicious?
How – How did the activity occur?
Presenter
Presentation Notes
Where did the activity take place? Online? Physical Location? Or was the activity only attempted? Just because you outsmarted the bad guys and stopped the act, doesn’t mean that a SAR shouldn’t still be filed Why – Why do you think it is suspicious? How – How did the activity occur? How was the money moved? How was the activity discovered? Or here’s one - How did the money smell? Did the customer confess? Confessions are big! If you don’t include anything else in your narrative, but answer all of these completely – you will have a pretty good SAR. But we don’t just want pretty good – we want strong and informative! So how do we do that?
Do Be Specific!
FinCEN BSA E-Filing FAQ #1 – “may leave non-critical fields without an
asterisk blank when information is not readily available.”
Use keywords.
Indicate where the money is now.
List the supporting documents for the SAR and how law enforcement may request the supporting documents.
Presenter
Presentation Notes
Be Specific! FinCEN BSA E-Filing FAQ #1 refers to the critical vs non-critical fields on the SAR form. For non-critical Items, FinCEN expects financial institutions will provide the most complete filing information available and may leave non-critical fields without an asterisk blank when information is not readily available. What is readily available? What is not readily available? Is having the information on a signature card readily available? Is performing a search of the Secretary of State’s website for corporate documents or registration numbers considered readily available? These are decisions you will need to make for your financial institution. Also, Indicate where the money is now at the time of filing – especially if you have closed the account. If a Cashier’s Check was issued, where was it deposited? Providing that extra pebble on the path, may just be the link law enforcement needs. And somewhere in your narrative, even as a final sentence or two at the very end, include a detailed list of the supporting documents you used for your SAR and how law enforcement may request them. You may know exactly what you had used to write your SAR, but in the age of musical BSA Officers, help your successor to know and be able to respond quickly to law enforcement’s request. This also helps examiners understand what documents you used as part of your monitoring program and helps them work through their examination procedures.
Don’t Speak in Acronyms! Don’t use banking jargon or acronyms.
If you must use an acronym, define it the first time you use it.
Presenter
Presentation Notes
DON’T SPEAK IN ACRONYMS! Ok – the world of BSA is full of acronyms. BSA, AML, CFT, SAR, CTR, OFAC, FinCEN, MIL, NSL – the list goes on and on – but to anyone outside of this world – it’s all Greek! And, really most of the law enforcement professionals reviewing the SARs do not have the in depth hands on experience to immediately recognize an acronym you use. For that matter, account names and types often vary from institution to institution. Some may consider a money market account a savings account and some may consider it a demand deposit account. Don’t assume that your examiner or auditor will automatically know what you mean by an MMDA. Keep it simple - For debit card transactions, avoid the POP and POS terminology in your narrative – simply indicate that it was a debit card transaction. And if you must use an acronym – define it the first time you use it.
Do Use a Strong Opening Statement
Start your narrative with the hook!
Incorporate the activity you checked off in Part II into your first few sentences.
If you can, tie the activity to a Specified Unlawful Activity (SUA) – this helps law enforcement!
Presenter
Presentation Notes
Start your narrative with the hook! – tell them what activity you identified and why you think it may be suspicious in the first few sentences. Incorporate the activity you checked off in Part II into your first few sentences - Using these phrases along with the other keywords FinCEN has provided in guidance and their SAR Review by the Numbers assists law enforcement in their queries and to hold their attention. It also helps examiners review your SAR. I had an auditor once tell me that the new SAR form was an auditor’s dream. So many boxes to check, so many opportunities for gotchas! If the language in the narrative matches the Activity listed in Part II, it is that much easier to verify that you checked the right boxes! Fewer gotchas! If you can tie the activity to a specified unlawful activity –or SUA- I know another acronym – please do so.
Don’t Start the Narrative with a History of the Bank
If you do want to include a history or profile of the bank – include it at the end.
Include the history of the customer - after you have detailed the suspicious activity.
Presenter
Presentation Notes
Don’t start he Narrative with a History of the bank! Somewhere along the line, someone thought it would be a good idea to include a history of the bank in the SAR narrative. Unless you are saying that you are a very small community bank in a very small town in the middle of the US, and you have just received a suspicious wire for the Sheikh of Abu Dhabi, the history of your institution may not be that pertinent to the case. If you do want to include the history of the bank – include it at the end. The whole point of reporting suspicious activity is to notify law enforcement. If you bore them in the first two minutes – they will move on. You may be reporting the scariest thing – but they will never see it. If the customer’s history is pertinent to the reportable activity, and often it is as that’s the basis for which you are making your decision, include it, but after your initial statement of the suspicious activity you are reporting.
Do Use the Attachment! Designed to include “additional suspicious
activity information not suitable for inclusion in the narrative.”
The file must be an MS Excel-compatible comma separated value (CSV) file with a maximum size of 1 megabyte.
Enter the activity as it occurred.
Presenter
Presentation Notes
USE THE ATTACHMENT! According to the FinCEN E-Filing Requirements, the attachment was designed to include “additional suspicious activity information not suitable for inclusion in the narrative.” SO USE IT! Enter the activity as it occurred into the spreadsheet – not just one large credit and debit. If you are entering one large credit and one large debit to account for all of the activity you are reporting and to get the total amount into the SAR form, obviously your attachment may not be the best resource for law enforcement.
Don’t List all of the Transactions in the Narrative
Provide a description of the activity you observed, or a sample of the activity – but do not list all of the transactions!
Example: During the review period, the customer made 42 cash deposits ranging in amounts from $8,500 -$9,900, for a total of $404,400 in cash, and never exceeded the reporting threshold.
The Narrative is not the place for a listing of transactions!
Clarify totals in the narrative.
Presenter
Presentation Notes
Don’t list all of the Transactions in the Narrative The attachment is the place for the listing of the transactions – not the narrative. The narrative is for detailing the activity and clarifying the amount reported. Instead, provide a summary of the type of activity you observed. Now in my travels, I have heard of a few examiners that still like to see the full listings of transactions in the narrative. I would refer them to the SAR Instructions which state: “Filers must provide a clear, complete, and concise description of the activity, including what was unusual or irregular that caused suspicion. “ and “Information provided in other sections of the FinCEN SAR need not be repeated in the narrative unless necessary to provide a clear and complete description of the suspicious activity. “ If the total amount reported involves both credits and debits, clarify that in your narrative. Provide a credit total, and a debit total. Provide a current reporting period amount as well as the cumulative amount.
Compare and Contrast
Do Cover Both Sides of The Equation
Include the Source of funds and the use of funds –
Even if the suspicious activity is only on one side!
Presenter
Presentation Notes
For example, if the customer has an unknown source of cash but is using those funds for normal business expenses that may be useful information to law enforcement
Do Double Check Your Work!
If it’s in your narrative, is the box checked, is the subject included?
If you have mentioned a subject or checked a box, did you explain it in the narrative?
Check your math!
Check your spelling!
Presenter
Presentation Notes
I know BSA Officer’s are perfect – I mean you would have to be to take on this job everyday. But do double check your work. Have someone else read through the SAR. Spell check does not catch everything! Does it make sense? If you have mentioned someone in the narrative and are not including them as a subject (meaning there’s no subject page) be sure to indicate why you don’t believe them to be a subject. Check your math – do the amounts mentioned in the narrative match the amount you are reporting? And as my auditor friend was so kind in pointing out, and from what I’ve heard from my colleagues - he’s not the only one – if it’s in your narrative, did you check the box? And vice versa.
Other Helpful Reminders
Don’t forget about loan SARs.
Be Timely – Investigations & Filings
Look Backs - Are you going back far enough?
Include pictures if possible
Document, document, document No SAR decisions!
Reach out to Law Enforcement!
Presenter
Presentation Notes
Some other helpful reminders – Don’t forget about loan SARs – it’s easy to get caught up with all of the activity on the deposit side of the bank, but examiners are looking for reports from all areas of the bank. Keep in mind that it is a crime “lie” in the obtaining of a loan from a federally insured financial institution. Be timely in your investigations and filings. You have 30 days from the date of the initial detection of facts that may constitute a basis for the filing of a SAR – so you do have time to complete your investigation, but be reasonable. If you take 6 months to complete the investigation, you may have to answer a lot of questions. Look Backs are becoming more popular with examiners and some are now looking to your SARs for them. When you discovered suspicious activity, how far are you going back to see when it started - 3 months? 6 months? A year? Examiners and regulators are getting tougher on this look back process. Include pictures if you have them as part of your supporting documentation Document, document, document No SAR decisions – in some ways these need to be documented even more thoroughly than your SARs And finally – reach out to law enforcement. At the end of the day – we are all in this together.
Important Reminders Use a standard format to identify the bank
or banking organization. This makes it easier for an investigator to follow up.
Filing a SAR is not the equivalent of calling a Federal Law Enforcement Agency and asking them to investigate a customer. Filing a SAR simply puts information about the individual and the transaction(s) into a database. Contact law enforcement agencies
directly if appropriate before or after the filing of the SAR.
Important Reminders
Law enforcement doesn't pursue every suspicious report. They look for patterns. If a customer is actually innocent, then the report will probably never be noticed. But if your customer is part of a bigger undertaking, your SAR may be a critical piece of evidence.
What is suspicious? Anything that is not normal or clearly related to the consumer's reasonable banking transactions
Keywords The list is always changing based on trends, investigative
findings and contact with financial institutions. Some keywords include:
Tax Evasion
Structuring
Money Laundering
Bankruptcy Fraud
Bulk Cash
Law Enforcement
Unregistered MSB
Political
Medical Marijuana
TRENDS Bi-coastal transactions
Important to work with your East Coast counterpart to make a complete assessment of the transactions.
Overseas transactionsTrade based money laundering
Are you seeing transactions that don’t match the account’s purpose – Clothing Store is wiring funds or receiving funds from an electronic company in China
Trends
Mexican Money Regulations Structuring money into US accounts then wiring
to Mexico.
Using MSB to move US Currency
Medical MarijuanaDEA is looking at all SARs related to medical
marijuana facilities.
TRENDS
???What are you seeing? Law enforcement
relies on financial institutions, as the front line, to see emerging trends in suspicious transactions.
Trends
Paying employees in cash
Writing checks to cash
Deposit cash into personal accounts when they have business accounts
Closing Accounts After a SAR is filed or a criminal
subpoena is received, an institution may want to close the subjects account(s).
As a courtesy, please contact the law enforcement officer who served the subpoena or requested supporting doc’s prior to closing the account.
A LEO may submit a written request issued by a supervisory agent or by an AUSA requesting the account remain open for at least 6 months. Financial institutions are not
required to keep the account open.
Do not keep the account open if there is the possibility a loss may be experienced except in special circumstances.
Contacting Financial Institutions
What information can banks provide to law enforcement without a subpoena or SAR?
12 USC 3413g
Disclosure pursuant to legitimate law enforcement inquiry banks can provide the name, address, account number, and type of account of any customer or ascertainable group of customers associated with a financial transaction or class of financial transactions
Key Takeaways
Be Specific
Use the Attachment
Double Check Your Work
Reach Out to Law Enforcement
Presenter
Presentation Notes
We’ve all heard the KISS saying – Keep it simple and today’s take aways are just that – simple things that will lead to strong and informative SARS: Be Specific Use the Attachment Double Check Your Work Reach Out to Law Enforcement
THANK YOU QUESTIONS?
In addition to the ACAMS Chapter Webpage you can also find us on LinkedIn at
http://www.linkedin.com/groups?gid=2202988&trk=myg_ugrp_ovrFollow us on Twitter @ACAMSOCAL
Feel free to send any suggestions or comments to: [email protected].
