16.1 Suspicious Activity Reporting, Confidentiality and Records
Key Takeaways
SAR thresholds differ for insider abuse, identified suspects and other suspicious activity.
SAR confidentiality does not make every underlying business record secret.
Filing deadlines, continuing-activity reviews and record retention must be tracked separately.
Mandatory Filing Triggers and Thresholds
- Insider Abuse ($0 Threshold): Any known or suspected criminal violation, embezzlement, self-dealing, or illegal activity committed by or against the bank by an institution-affiliated party (director, officer, employee, or agent), regardless of the dollar amount.
- Known Suspect ($5,000 Threshold): Any transaction conducted or attempted through the bank involving or aggregating $5,000 or more where the bank has a substantial basis for identifying a suspect or group of suspects.
- Unknown Suspect ($25,000 Threshold): Any transaction conducted or attempted involving or aggregating $25,000 or more where the bank cannot identify any suspect.
- Potential Money Laundering or BSA Violations ($5,000 Threshold): Any transaction aggregating $5,000 or more where the bank knows, suspects, or has reason to suspect that:
- The transaction involves funds derived from illegal activities or is intended to hide or disguise illicit assets;
- The transaction is designed to evade any BSA regulation or reporting requirement (including currency structuring);
- The transaction has no business or apparent lawful purpose, or is not the sort in which the particular customer would normally be expected to engage, and the bank knows of no reasonable explanation after examining the available facts.
-
Continuing activity: FinCEN guidance describes reviewing continuing activity over ninety days and filing the continuing report within thirty days after that review period. This yields a possible 120-day filing interval from the previous filing. Follow the applicable rule, guidance and circumstances, and promptly notify law enforcement where immediate attention is needed.
-
SAR confidentiality: Do not disclose a SAR or information revealing its existence to the subject or unauthorized third parties. Authorized disclosures to FinCEN, appropriate regulators and law enforcement, and permitted sharing under the rule, are exceptions. The underlying records do not become confidential SAR information merely because they support a report.
4. Information Sharing & Specialized BSA Rules
FinCEN Section 314(a) (Government-to-Bank Sharing)
Under Section 314(a) of the USA PATRIOT Act, FinCEN transmits bi-weekly requests to designated bank points-of-contact on behalf of federal law enforcement agencies investigating significant money laundering or terrorist acts.
- Search Requirements: Upon receiving a 314(a) request, the bank must conduct a retrospective search of its records:
- Search all deposit, credit, and trust accounts maintained by the subject during the preceding 12 months;
- Search all transmittals of funds or currency transactions conducted by or on behalf of the subject during the preceding 6 months.
- Response Deadline: The bank must complete its search and report any positive matches to FinCEN within 14 calendar days via the secure FinCEN portal.
- Important Limitation: Receiving a Section 314(a) inquiry does not mandate freezing customer funds or automatically filing a SAR; it requires solely identifying and reporting account matches.
FinCEN Section 314(b) (Voluntary Bank-to-Bank Sharing)
Section 314(b) provides financial institutions with a statutory safe harbor from privacy and liability laws to share information with other financial institutions regarding individuals or entities suspected of terrorist financing or money laundering.
- Conditions for Safe Harbor: (1) The institution must submit an annual notice of participation to FinCEN; (2) The institution must verify that the counterparty institution has also filed an active 314(b) notice; (3) Shared information must be used strictly to identify money laundering or terrorist acts; and (4) Strict information security safeguards must be maintained.
Monetary Instrument Recordkeeping Rule (31 CFR § 1010.415)
Financial institutions must maintain an operational log of all sales of bank checks, cashier's checks, traveler's checks, and money orders for currency in amounts between $3,000 and $10,000 inclusive.
- Required Data: Purchaser's identity, verification method (deposit account holder vs. non-accountholder), date of purchase, dollar amount, and specific serial numbers of each instrument issued.
- Retention: Records must be maintained for 5 years.
Funds Transfer Rules: Travel Rule and Recordkeeping Rule
- Recordkeeping Rule (31 CFR § 1010.410(e)): For transmittals of funds of $3,000 or more, banks must collect and retain originator and recipient details, account numbers, and transaction dates for 5 years.
- Travel Rule (31 CFR § 1010.410(f)): For transmittals of funds of $3,000 or more, the transmittor's financial institution must ensure that specific transmittal details (originator name, address, account number, sending institution, amount, date, and beneficiary data) travel with the payment order to intermediary and receiving institutions.
5. Comparison Matrix: CTR vs. SAR Operational Standards
| Compliance Standard | Currency Transaction Report (CTR) | Suspicious Activity Report (SAR) |
|---|---|---|
| FinCEN Form | FinCEN Form 112 | FinCEN Form 111 |
| Governing Rule | 31 CFR § 1020.310 | 12 CFR § 21.11 / 31 CFR § 1020.320 |
| Reporting Trigger | Cash transactions exceeding $10,000 in one business day | Suspicious, structured, anomalous, or criminal transactions |
| Filing Thresholds | >$10,000 currency in / out | $0 (insiders); $5,000 (known/AML); $25,000 (unknown) |
| Filing Deadline | Within 15 calendar days of transaction | Within 30 calendar days of initial detection (60 if unknown) |
| Continuing Activity | N/A (each >$10,000 cash day triggers new CTR) | Filed every 90 calendar days for ongoing activity |
| Confidentiality Rule | Not confidential; transactor may be informed | Strictly confidential (31 U.S.C. 5318(g)(2)); tipping off is illegal |
| Subpoena Treatment | Must produce in response to valid civil legal process | Must refuse to produce; notify FinCEN & regulator immediately |
| Exemption Mechanism | Phase I and Phase II DOEP exemptions available | No exemptions permitted under any circumstances |
| Customer Notification | Permissible to explain currency reporting rules | Strictly prohibited from disclosing report or existence |
Thresholds and confidential information
Structuring is a suspicious pattern, not a requirement to file a SAR for every cash amount below the CTR threshold without considering the applicable SAR threshold and suspicion criteria. Aggregate cash-in separately from cash-out when determining a CTR: do not offset them. A SAR and supporting documentation are distinct. The SAR or information revealing its existence is confidential, with authorized disclosures to FinCEN, appropriate agencies and law enforcement and other permitted sharing under applicable rules. Underlying transaction records are not automatically confidential SAR information merely because they supported a SAR. Escalate a subpoena for a SAR under the rule’s procedures. Retain SAR documentation for five years and make supporting documents available to authorized requesting authorities.
A BSA investigator completes an internal review on March 1 uncovering a sophisticated loan structuring scheme involving an unknown suspect who deposited $38,000 in cash across five remote ATM locations. The bank is actively attempting to ascertain the transactor's identity through security camera footage. Under 12 CFR § 21.11 and 31 CFR § 1020.320, what is the maximum allowable deadline for filing the SAR?
Within 15 calendar days from the date of the first cash deposit.
Within 60 calendar days from March 1, if the bank needs additional time to identify the unknown suspect.
Within 90 calendar days from the date the case was assigned to the investigator.
Within 30 calendar days from March 1, with no extension permitted under any circumstances.
A bank's legal department receives a civil discovery subpoena in a state breach-of-contract lawsuit ordering the production of all internal BSA records, alerts, and suspicious activity reports filed concerning the defendant corporate entity. How must the compliance officer instruct the legal department under 31 U.S.C. 5318(g)(2) and 31 CFR § 1020.320(e)?
The bank must produce the SAR file under a sealed judicial protective order.
The bank must comply with the subpoena if the defendant has signed a broad discovery waiver.
Decline production of the SAR or information revealing its existence, cite the confidentiality rule, notify FinCEN and make any additional notice required by the applicable bank regulator.
The bank must redact customer identification data and produce the narrative portion of the SAR.
Sections you finish are checked off in the contents.