Compliance Blog

Written by Stephanie Lyon, Senior Regulatory Compliance Counsel, NAFCU

As one of my colleagues stated in a prior blog, credit union suspicious activity reports (SARs) are invaluable to law enforcement. It seems many credit unions spend a significant amount of time and resources filing SARs so it is important to understand when it is appropriate to file an initial report, a continuing/updated activity report and when to stop filing continuing reports once the suspicious activity is no longer ongoing.  

As background, federally-insured credit unions are required to file a SAR “for any known or suspected crime or any suspicious transaction related to money laundering or other illegal activity, for example, terrorism financing, loan fraud, or embezzlement, or a violation of the Bank Secrecy Act by sending a completed …SAR to …FinCEN”. See, 12 C.F.R. § 748.1(c)(1). FinCEN also expects credit unions to monitor the account to determine whether a continuing activity report should be filed in the subsequent months. Interestingly enough, this requirement is not explicitly stated in the BSA or in the NCUA’s security regulation that implements SAR filing requirements. Rather credit unions will find guidance pertaining to continuing SARs in several places including the FFIEC BSA/AML Examination Manual, FinCEN’s SAR Activity Review Trends Tips & Issues publications and in Frequently Asked Questions Regarding the FinCEN Suspicious Activity Report.

Technically, the BSA and other regulations require a credit union to file a SAR within 30 days of determining suspicious activity occurred that meets specific filing thresholds. See, 31 C.F.R. § 1020.320(b)(3). However, in order to provide some regulatory relief, FinCEN implemented continuing SAR guidance that modified the 30-day SAR filing requirements for ongoing activity. According to the guidance, the time period for filing continuing SARs is between 90 to 120 days but a credit union may file a continuing SAR before this timeline if the credit union believes the activity should be reviewed by law enforcement earlier. See, SAR Activity Review Trends, Tips, & Issues #21, pp. 53.

FinCEN SAR FAQ number 16 has an example of how the initial and continuing SAR filing timeline should work:

• Identification of suspicious activity and subject: Day 0.
• Deadline for initial SAR filing: Day 30.
• End of 90 day review: Day 120.
• Deadline for continuing activity SAR with subject information: Day 150 (120 days from the date of the initial filing on Day 30).
• If the activity continues, this timeframe will result in three SARs filed over a 12-month period.

FinCEN guidance also notes important expectations for continuing SAR filings such as asking credit unions to list the cumulative date range and dollar amount for the entire period of suspicious activity rather than just listing the date and dollar amount for the last 90 days. In addition, the continuing SAR narrative need not detail the previous SAR. However, the continuing SAR should reference the prior SAR(s) filed along with a summary of the activity reported and detail any new activity that has occurred since the last report.

In addition, continuing reports should be used only if the activity is ongoing, meaning the subject of the SAR is engaging in the same type of previously reported activity.  If for example, the SAR subject starts engaging in different suspicious activity, the credit union should consider filing an initial report within the normal SAR filing deadline of 30 days. However, even for initial reports, it may be appropriate to cross reference prior SARs filed for the same subject in the narrative to point out the same person was engaging in other types of suspicious activity.

Here are a couple of examples of when to file an initial SAR, a continuing SAR and when to stop filing continuing reports and instead file an initial report:

Initial and Continuing SARs. The week of January 1, 2018, Member ABC begins making several cash deposits right below the CTR filing threshold. The credit union reviews a transaction monitoring alert on January 8 for this activity and determines this is likely structuring. The credit union files an initial SAR on January 9, 2018. The week of February 1, 2018, Member ABC begins to deposit cash below the CTR filing threshold again. The credit union does not have to file a SAR for this activity within 30 days. Rather, as this is ongoing activity, the credit union may wait until the end of its 90-day review period to report ongoing activity. The review period of this type of activity is within 90 days after filing the initial SAR, or April 9, and the deadline to file the continuing SAR is within 120 days of filing the initial SAR, or May 9.

Only Initial SAR. The week of January 1, 2018, Member ABC begins making several cash deposits right below the CTR filing threshold. The credit union reviews a transaction monitoring alert on January 8 for this activity and determines this is likely structuring. The credit union files an initial SAR on January 9, 2018. The week of February 1, 2018, Member ABC starts engaging in what the credit union suspects is wire transfer fraud with some of the structured deposited funds. The credit union must file an initial SAR for the wire activity within 30 days of determining the activity is suspicious as this is not considered ongoing activity. The credit union may also want to reference the prior January SAR to highlight this person is engaging in other types of suspicious activity that may be related. However, the credit union would not aggregate the date or amount of the January SAR as this is not a continuing SAR.

***

New CDD Examination Guidance. The NCUA released a new letter to credit unions regarding examination guidance for the BSA Customer Due Diligence (CDD) rule. The letter includes a BSA questionnaire, CDD and exam procedures overview and beneficial ownership requirement for legal entity customer overview. Of note, the NCUA explained its examiners will not be penalizing credit unions for non-compliance with the new rules throughout 2018 as long as a credit union is making a good-faith effort at compliance.