An Assessment of Suspicious Activity Reports Filed by the Securities and Futures Industry

By FinCEN Office of Regulatory Analysis

This section of The SAR Activity Review focuses on suspicious activity reporting by the securities and futures industry. An article by FinCEN?s Office of Regulatory Analysis highlights findings of an assessment of SAR-SF filings. An article by SEC staff provides guidance on how to file SARs and discusses how SARs are used and the consequences to a financial institution when they fail to file SARs. Finally, staff from the SEC and FINRA provide feedback on some of the questions raised during the examination process. Brokers and dealers in securities have been required to file suspicious activity reports since January 1, 2003.2 In May 2004, the regulatory definition of ?financial institution? was expanded to include futures commission merchants and introducing brokers in commodities, requiring that they also comply with the recordkeeping and reporting requirements of the Bank Secrecy Act (BSA). In this article, we highlight key findings from an assessment of Suspicious Activity Reports filed by the Securities and Futures Industries (SAR-SF) between January 1, 2003 and December 31, 2008, for money laundering, terrorist financing and other financial crimes.3 FinCEN analysts examined SAR-SFs to identify trends and patterns relating to filing volume, type of reporting institution, characterization of suspected activities, and filings by instrument type. We also include summaries from a sample of SAR-SF narratives reviewed to identify typologies and potential emerging threats to this industry. FinCEN continues to examine SAR-SFs and plans to release a more detailed assessment later in 2009.

Filing Trends
In 2003, the first year suspicious activity reporting was required for securities brokers and dealers, the securities industries filed 4,267 SARs. The annual volume of SAR-SF filings has increased every year since then, with 15,104 reports received by FinCEN in 2008. In the six year period since suspicious activity reporting requirements were extended to the securities and futures industries, covered institutions have filed a total of 53,022 SAR-SFs.4 Graph 1 depicts the annual filing volume and the percentage change in reporting from year to year.

Types of Reported Suspicious Activity Between January 1, 2003 and December 31, 2008, filers marked the ?Other? field (Field 30t) on the SAR-SF form as the most prevalent characterization of suspicious activity, followed by Money Laundering/Structuring (Field 30l). Exhibit 1 identifies the top five characterizations of suspicious activity reported for the review period. These five characterizations together comprise 61 percent of all suspicious activity reported in SAR-SFs filed since 2003.

Exhibit 2 depicts the percentage change observed in 2008 SAR filings compared to the previous year for all categories of suspicious activity listed in Part II, Field 30. Reported activities that showed an increase from 2007 to 2008 are highlighted. or introducing securities brokers. Furthermore, collectively, the clearing securities brokers, introducing securities brokers, and securities dealers filed the majority of the SAR-SFs during the entire period of the study. Six types of reporting institutions filed more than 1,000 SAR-SFs in 2008. Exhibit 3 lists those types of institutions.

Filing Institutions
SAR filings from the securities and futures industries were received from a variety of filing institutions. While many of the institutional categories identified in Field 51 (Type of Institution or Individual) on the SAR-SF form are not mutually exclusive, the majority of the institutions self-identified as either clearing securities brokers or introducing securities brokers. Furthermore, collectively, the clearing securities brokers, introducing securities brokers, and securities dealers filed the majority of the SAR-SFs during the entire period of the study. Six types of reporting institutions filed more than 1,000 SAR-SFs in 2008. Exhibit 3 lists those types of institutions.

Instrument Type Reported
?Cash or equivalent? (Field 23b) remains the most commonly reported instrument type used in transactions or activities that have been identified by filers as suspicious. The top five corresponding characterizations of suspicious activity reported where ?cash or equivalent? was the instrument type were check fraud, identity theft, money laundering/structuring, significant wire or other transactions without economic purpose, and wire fraud. Furthermore, SAR-SF filers listed ?stocks? as the second most reported instrument type. Computer intrusion, identity theft, market manipulation, securities fraud, and wire fraud ranked as the top five characterizations of suspicious activity associated with stocks.

Suspicious Activity Identified in SAR-SF Narratives
The following list of the most frequently cited alleged suspicious activities includes examples of specific activities included in the SAR narratives.

Structured Deposits and Withdrawals:

Structured check withdrawals from funds that originated ? from a margin loan against the assets held in the customer?s account. No trade had occurred in the account since it had been opened.
Deposits of multiple postal money orders and cashiers checks in amounts under the BSA reporting requirements. When asked about the deposits, the customer stated the purchasers who bought his home gave him postal money orders and cashier checks as part of the payment.
Structured cashiers check purchases, check or money order deposits, cash withdrawals and wire transfer activity done to avoid the Currency Transaction Report (CTR) filing requirements. On occasion, individuals purchased money orders or cashiers checks at the same location but with different tellers and, at other times, at different locations. Destinations for some wire transfers included Africa, Australia, Brazil, China, New Zealand, Singapore, Switzerland and Taiwan.
Structured deposits from an electronic payment and money transfer business, which did not correspond to the purchase of any merchandise.

Identity Theft:

Individuals with trade accounts who became victims of identity theft.

Possible Terrorist Financing:

Customers purportedly having business relationships with individuals and charitable organizations suspected of financing terrorist organizations.
Login history of customer trade accounts from Internet protocol addresses routed through Canada, France, Iran, Jordan, Nigeria, United Arab Emirates, and United Kingdom. Filing institutions expressed concern that the account holders supposedly violated sanctions by accessing U.S. financial institutions online while in Iran. Furthermore, SAR narratives stated that deposit and withdrawal activity and unusual address connections might have indicated money laundering and/or terrorist financing.
Client?s withdrawals structured to possibly avoid ? the CTR reporting requirements. Further review by the filer of the source of funds revealed a dissident of an African country who is currently residing in Europe. According to the SAR-SF narrative, officers of the securities firm suspected the account holder?s business, supposedly a shell company, was designed to facilitate the laundering of illicit funds. The filer further stated that potential ties to this particular African country presented concern that the funds involved possibly were used for terrorist financing.

Suspected Money Laundering or Tax Evasion:

Trading account indicating an attempt to launder funds through stock transfers.
Brokerage account receiving an excessive number of money order deposits which, according to the filer, resembled money laundering/structuring.
Multiple postal money order deposits in amounts that appeared structured, possibly to avoid currency reporting requirements. The deposits did not support trading activity, and may have indicated an attempt to launder funds or evade taxes.
Multiple customers with trade accounts internally transferring assets and funds. The utilization of the same address was the common thread between the parties. The filer stated that the activity might have indicated money laundering or terrorist financing.

Suspicious Wire Transfers:

An unusual and unexplainable pattern of activity involving deposits from an electronic payment and money transfer business and incoming wire transfers followed by ATM withdrawals or wire transfers to foreign locations.
An account with debit card purchases and cash advance transactions in South and Central America and the United States. Also, wire transfers from New York and from Miami, Florida disbursed at locations throughout one South American country known for its drug cartels and for having connections to a terrorist organization.
A trading firm detected a pattern of funds flowing through a customer?s account where wire transfers were deposited into the customer?s account from a bank. The customer then used the funds to write checks or make wire transfer withdrawals paid to the order of a casa de cambio located in Mexico.

Other Notable Suspicious Activity:

Amounts deposited into trading accounts that exceeded the ? customer?s annual income and net worth.
An individual submitting three account applications online to a registered broker-dealer firm. A check for approximately $150,000 was deposited into one of the accounts. When attempting to verify the check, the filer learned that it was counterfeit and immediately closed the account. Further investigation by the firm revealed that the individual used a false social security number, date of birth, name and address.
A customer identifying himself as a tax attorney was concerned with commission amounts and looking for ?no-load? mutual funds. It appeared that the activity in the account did not correspond with the selected time horizon of 10+ years. Also, the filer?s search of an attorneys? database did not reveal any name matches for the customer despite his claims to being a tax attorney.

Conclusion
SAR-SF narratives analysis revealed much of the reported suspicious activity to be structuring of deposits or withdrawals using cash or equivalent to evade CTR filing requirements, which filers believed may have represented possible tax evasion, money laundering, terrorist financing or other financial crimes. Several SAR-SF narratives noted clients attempting to utilize their trading accounts for purposes other than investments or conducting unusual and unexplainable patterns of deposits followed by withdrawals or wire transfers to international locations. Multiple SARSF narratives reported alleged terrorist financing through charitable organizations. The filers noted some clients engaged in business relationships with individuals and organizations allegedly financing terrorist organizations. Later this year, FinCEN plans to publish a full report describing the findings from its assessment of SAR-SFs filed since 2003.

2 See 31 CFR ? 103.19 and 67 F.R. 44048 (July 1, 2002).

3 Please note: Futures commission merchants and introducing brokers in commodities were not required to report suspicious activity until May 2004, although the analysis for this study dates back to January 1, 2003. Insurance companies do not have a dedicated SAR form, and so they have been instructed to use the SAR-SF. Insurance companies filing SAR-SFs are included in the totals; however, analysts eliminated these from the study group. For information regarding suspicious activity reporting by certain insurance companies, see FinCEN?s Insurance Industry Suspicious Activity Reporting: An Assessment of Suspicious Activity Report Filings April 2008 at http://www.fincen.gov/news_room/rp/reports/pdf/Insurance_Industry_SAR.pdf.

4 See By the Numbers, FinCEN?s bi-annual companion publication to The SAR Activity Review-Trends, Tips & Issues, for more numerical information at http://www.fincen.gov/news_room/rp/sar_by_number.html.
5 This statistic reflects Investment Advisors who identified themselves as such on the SAR-SF (box 51j). Investment advisors are not currently subject to AML requirements and SAR filing requirements but may voluntarily file a SAR.

Excerpted from SAR Activity Review Issue 15, page 13