SAR Stuff

Every so often, FinCEN publishes its SAR Activity Review (it's own SAR, so to speak.) This publication is increasingly full of interesting stuff, including SAR filing trends, how SARs have been used by law enforcement and the latest techniques that criminals are using.

SAR Trends
In the months following September 11, 2001, almost three fourths of the SARs filed were connected to or triggered by names on the OFAC list and other government lists. Since then, the trend is virtually reversed with well over two thirds of the SARs filed resulting from institution work rather than reliance on government lists.

This change is a huge complement to the financial industry. It means that the industry has made significant improvements to its BSA programs and to its ability to identify and report suspicious transactions.

Activities that institutions identified included even dollar deposits followed by like-amount wire transfer, frequent ATM activity including international use, customers with no known source of income, occupation given as student, wire transfers and Internet transfers to or from high-risk locations, frequent address changes, purchases of military or high-tech items, and stories in the news. These reports mean that CIP is working - before it was even in place. It also shows that institutions have the ability to put disparate pieces of information together, such as a customer activity and a story in the news.

Money Movement
Investigators have given intense attention to the informal money transmitter businesses. SARs filed by financial institutions have provided valuable information to law enforcement because, at some point, the money usually moves through a bank. When that happens, and the institution observes and reports it, the SAR becomes the basis for law enforcement's ability to find the informal money transmitters.

Funds may be moved through personal accounts, using checks in and wire services out. The account and its use may be inconsistent with what the institution knows about the customer. The institution may observe structured cash transactions. These are sometimes followed by wire or Internet transfers.

The triggers are funds movement that is not consistent with the customer's occupation, business or expected account activity, in-flow of funds by check or cash followed by wire transfers out, large deposits or transfers in whole numbers, and wires sent to suspect entities or countries.

Increasingly, the SARs are identifying activity of hawalas, the informal money transmitters. Institutions' due diligence efforts have helped to identify situations where individuals or small businesses are acting as hawalas. In each case, the pattern of funds movement was the trigger.

Writing SARs
There is more to SARs than simply filing them. How the SAR is prepared - particularly how the narrative is written - has a significant impact on the usefulness of the SAR.

FinCEN and the banking agencies recommend that institutions have a centralized review of SARs before they are filed to ensure that SARs are prepared completely and that descriptions are accurate and adequate. Even complete boxes for which you don't have information, using "none" "not applicable" or "unknown." Then law enforcement knows that you considered the item and that you did not simply overlook it.The narrative is the most important part of the SAR. How clearly and concisely you describe the situation has everything to do with the ability of law enforcement to use your report. Your SAR should specify why you are suspicious - what action or event led to the concern. This will never be self-evident from the boxes you check. You must describe it.

Writing the description serves an important function in your SAR preparation process. Preparing a description of why the institution has identified a customer or a transaction as suspicious serves to clarify the issue. You can't write without thinking.

In reviewing the SAR, try to think like law enforcement. Look for terms that are insider boilerplate that law enforcement might not understand. How many FBI agents know what MMDA or CD stand for in the world of banking?

Even grammar and spelling matter. For example, if you use abbreviations in your narrative, the information may not come up in response to a search for that very type of information. Moreover, people don't all abbreviate in the same way. So avoid tempting shortcuts.

New Issues
Law Enforcement has found new areas for investigation. One such new area is real estate transactions. In particular, sale of real estate and management of real estate are now identified as opportunities for illegal transfer of funds. Padded sales, extra rent checks, complicated transfers can all conceal an illegal transfer of funds.

Internet Transactions
E-banks have proven particularly vulnerable to criminal activities as criminals seem to learn about how to beat the system almost as fast as it is built. The experiences of e-banks are useful guides to any bank offering Internet banking.

One pattern is to open an account with a small deposit, followed by deposits of worthless instruments. Wires, withdrawals, or point-of-sale transactions were made before the bad checks were returned.

Another angle is to initiate on-line transfers between accounts, creating a float with little actual value behind it. Then rapid withdrawals are made leaving the financial institution holding nothing but cyberspace.

These exposures can be controlled by placing new-account transaction limits or requiring anyone opening a new account to appear - at some point - in person for the full-scope CIP. These exposures also call for monitoring of Internet and ATM transactions to identify risky patterns.

Section 314(a) Works
The financial industry has worked hard (and complained a lot) to respond to the Section 314(a) list process. The good news here is that the compliance efforts have paid off big time for law enforcement. And when law enforcement catches bad guys, we all benefit.

Law enforcement submitted 167 cases involving 962 "subjects of interest." In response to the Section 314(a) requests, there were 6,397 positive responses from financial institutions. Of these 2,136 related to terrorism cases and 4,261 related to money laundering cases. Since money laundering supports terrorism, all reports helped to make this country a safer place.

Law enforcement reports strong results from these Section 314(a) reports. They identified 586 new accounts that were unknown to law enforcement. The reports let to serving 216 Grand Jury Subpoenas and the issuance of 11 search warrants, and 16 administrative subpoenas.

If you are looking for some kind words, consider what some of the law enforcement individuals have written or said about Section 314(a) information: "pivotal to the investigation," "helped the case tremendously," "great and valuable," "fantastic," and "identified domestic account activity previously unknown." And our personal favorite: "In all my government years, I really haven't seen a system work this efficiently. I was able to identify over 40 accounts for my subject. I don't think I would have been able to identify some of these accounts without this mechanism."

ACTION STEPS

Take a hard look at how you identify the types of funds movements described in this article. If you can't identify them, consider looking for a better system.
If you offer Internet banking, review the controls you have in place for new accounts and for account transactions.
Keep up the good work on Section 314(a).
Review account activity for small business customers and evaluate whether the activity is legitimate and consistent.
Review a sample of wires and compare them to deposits made to related accounts within a 2-week period preceding the wire.