To Follow that SAR: Suspicious Activity Reports from Red Flags to Verdict

Wednesday, April 5 | 8:50 AM

Moderator:

Dennis M. Lormel, CAMS, President and Chief Executive Officer, DML Associates

Speakers:

James A. Candelmo, CAMS, Chief AML Officer, Capital One

Jim Dinkins, Senior Vice President, Director of Operations for Enterprise Financial Crimes Compliance, US Bank

Luis Sierra, Attaché, Andean Region, U.S. Immigration and Customs Enforcement, Homeland Security Investigations – Office of

International Operations

2

SARs from Alert to Prosecution

3

4

5

Purpose of SARs

• The purpose of filing a SAR is to

support law enforcement

• Financial institutions are responsible

for identifying and reporting

suspicious activity in a

comprehensive and timely manner

• Law enforcement is responsible for

conducting criminal investigations

• Effective SARs are used to predicate

and / or enhance investigations

6

Suspicious Activity Reports (SARs)

• Most serious compliance breakdown

• Failure to file SARs

• SARs must be filed within 30 days of detecting suspicious activity

• Should be comprehensive and thorough

• Answer who, what, when, where, why, how

• Include all identifying data

• SARs make an important difference

7

Internal SAR Investigative Flow• Alerts / referrals

• Transaction monitoring• Negative media• 314 a and b requests• Law enforcement• Call centers / customer complaints • Front line employees• Business or other internal units / teams• Other

• Pre-investigative analysis• File SAR, escalate or close

• Investigations• SAR / no-SAR decision

• Reporting

8

Regulators

RegulatoryReview

Law Enforcement

FinCENPortal

SARs Not

Investigated

SARs Used to Predicate/Support

Investigation

Analysis of SARs

• Prosecution• Deferred

Prosecution• Cooperation

Agreement• Plea• Acquittal• Declination

FinCEN Analysis

Foreign FIUs

SAR Lifecycle

Civil Enforcement

Action

9

The Why and How

• Key element for law enforcement

is the why

• Why is the activity suspicious?

• Key element for financial

institution is the how

• How was the financial institution

used to facilitate the suspicious

activity?

10

Keep ADApTing Your Program

• Analyze your suspicious activity detection and reporting program against changes to your business operations, regulatory expectations, and evolving criminal activity trends to identify gaps between current capabilities and risk tolerance

• Develop those aspects of your program that require improvement to close the compliance gaps and design a program that will diminish risk

• Apply your updated SAR program by training staff on new sensitivities and implementing program enhancements

• Test your revisions to ensure the updated program functions as intended

11

12

SAR Process and Consequences

13

Components of Effective SAR Process

• Capturing suspicious incidents

• Investigative process

• Written standards

• The right people

• Case management and management reporting

• Using investigative information to improve a program

14

SAR Completion and Filing per FFIEC Manual

• Timing of SAR filing• 30 or 60 days from initial detection

• SAR quality• Complete, thorough and timely

• Notify Board of Directors• SAR record retention (and supporting

documentation)• Five years

• Prohibition of SAR disclosure• Sharing SARs with head offices and controlling

companies• May share SARs

15

SAR Reporting Thresholds for Depository Institutions

• Insider abuse involving any amount

• Violations aggregating to $5,000 or more where a suspect can be identified

• Violations aggregating to $25,000 or more regardless of a potential suspect

• Transactions aggregating to $5,000 or more that involve potential money laundering or violations of the Bank Secrecy Act

• Unauthorized electronic intrusions

16

Timing of a SAR Filing

• SAR must be electronically filed through BSA E-Filing System no later than 30 calendar days from the date of initial detection of facts that may constitute a basis for filing a SAR• If no subject identified, time period for filing SAR 60 days

• The phrase “initial detection” should not be interpreted as meaning the moment a transaction is highlighted for review• 30 or 60 day period does not begin until appropriate review

conducted and determination made that transaction under review is “suspicious” within meaning of SAR regulation

• Law enforcement notification• For situations requiring immediate attention, in addition to filing SAR,

bank must immediately notify, by telephone, “appropriate law enforcement authority” and as necessary, bank’s primary regulator

Source: FFIEC Manual

17

Perspective

• Challenge

• Subjectivity of SAR process

• Response

• Implement consistent process

• Documentation

• Timeliness

18

SAR Process and Consequence Workflow• Internal process

• Alerts / referrals

• Escalation• Pre-investigative analysis

• Investigation

• Decisioning

• Reporting

• External consequence• Law enforcement investigation

• End game

• Civil law suit• End game

• Enforcement actions• End game

19

Perspectives of Process and Resultant Consequence

• Law enforcement• The “why”

• Why does a financial institution believe activity suspicious?

• Prosecution• Forfeiture

• Financial institution• The “how”

• How is my institution being used as a facilitation tool to support suspicious activity?

• Prevent or minimize losses• Recover losses• Protect reputation

20

SAR Decision Process

21

SAR Decisioning Responsibility

• Moving from red flags to reportable suspicion

• Red flags are indicators that suspicious activity may have

taken place but not necessarily

• Requires escalation process

• SAR decision responsibility

• Committee

• BSA officer

• Supervisor / manager

• Investigator

22

SAR / No SAR Decisioning

• SAR

• Ensure narrative is

• Concise

• Clear

• Chronological

• Complete

• No SAR

• Documentation

23

SAR Narrative Skills

24

SAR Narrative

• Writing an effective

SAR narrative requires

• Compiling the

appropriate

information

• Formatting the relevant

information in a

cohesive manner

25

Compiling Information for the Narrative

• Requires answering six essential questions

• Who is conducting the suspicious activity?

• What instruments or mechanisms were used to facilitate the

suspicious activity?

• When did the suspicious activity take place?

• Where did the suspicious activity occur?

• Why is the activity considered suspicious?

• How was the suspicious activity conducted?

26

Formatting the Narrative

• Introduction• Set forth purpose of the SAR and briefly explain why the activity

is suspicious• Impact statement

• Body• Answer who, what, where, when and how

• Elaborate on why

• Other information or observations that could help law enforcement

• Conclusion• Any follow-up actions taken by institution

• Points of contact

• Documentation that may be available

27

Keys to Writing a Complete & Sufficient SAR Narrative• Do not assume the reader is familiar with your institution’s internal

terminology

• Concise, clear, detailed narrative identifying the pertinent information in

chronological order

• Describe the known or suspected violation and dates and reasons of any

previously filed SARs

• Identify all involved accounts and describe the transactions raising

suspicion

• Summarize the report and include any planned follow-up action and the

location of all SAR related records

28

Law Enforcement Use of SARs

29

• In July 2003, HSI launched the

Cornerstone Outreach Program

• The key is building strong

partnerships and alliances

30

Law Enforcement Perspective of SARs• Importance of reporting suspicious activity

• Law enforcement direct beneficiary of SARs• Front line employees and management share responsibility for

submitting meaningful SARs • Importance of comprehensive narrative

• Who, what, where, when, why, and how• The why is most important

• Explain up front why the activity is suspicious• Key words

• Identify crime problems• Importance of collateral information

• The more common the names, the more identifiers you need• Availability of SAR file for law enforcement• Investigative and financial intelligence value of SARs

31

Maintaining Account (FinCEN Guidance June 13, 2007)• Request by law enforcement for financial institutions to maintain

accounts:

• Purpose: to further law enforcement efforts

• Ultimate decision to maintain or close account up to financial institution

• Notify law enforcement of decision to close if aware of pending investigation based on 314(a), subpoena, or NSL

• Request a written request from law enforcement

• Issued by supervisory agent, US Attorney’s Office or Department of Justice (equivalent at state level)

• Express request to maintain the account and the purpose

• Duration of the request – not to exceed 6 months

• Subsequent request post-expiration is permissible

• Document retention is recommended for 5 years post expiration

32

Evolution of Law Enforcement SAR Review

• Review process historically manual

• Emergence of SAR review teams

• Review process becoming more automated• Data mining

• FBI Investigative data warehouse

• IRS Reveal

• Improved law enforcement and FinCEN analytics

• FinCEN modernization project• Data extraction capability

• Lifecycle of a SAR

33

SARs and Prosecution

• Role of prosecutor

• Developing / preparing documentary evidence

• Developing / preparing witnesses

• Role of financial institutions

• Role of law enforcement

• Prosecutive results

34

Takeaways

35

Takeaways

• SARs intended to support law enforcement

• Importance of why and how

• ADApT (analyze, develop, apply, test)

• Balance process and consequence

• Start narrative with impact statement

• SARs make an important difference to law enforcement