8.3 SARs, CTRs, OFAC, Information Sharing, and AML Red Flags
Key Takeaways
Broker-dealers file SARs for covered suspicious transactions involving at least $5,000, generally within 30 calendar days of initial detection or up to 60 days when no suspect is identified.
SARs and supporting documentation are retained for five years, and the existence or consideration of a SAR must not be disclosed to its subject.
A CTR covers more than $10,000 in currency by or on behalf of one person in one business day, aggregated when the firm knows the transactions are related.
OFAC sanctions screening and blocking or rejecting treatment depend on the applicable sanctions program; a confirmed blocked-property event is reported on the required timetable.
USA PATRIOT Act Sections 314(a) and 314(b) support government queries and voluntary protected information sharing under different conditions.
Suspicious Activity Reports
Under the broker-dealer SAR rule, a firm generally files a Suspicious Activity Report for a transaction conducted or attempted by, at, or through the broker-dealer involving at least $5,000 when it knows, suspects or has reason to suspect that the transaction involves illegal funds, seeks to evade BSA requirements, lacks an apparent lawful purpose after reasonable review, or uses the firm to facilitate crime.
The firm files no later than 30 calendar days after initial detection of facts that may constitute a basis for filing. If no suspect is identified, the period may extend to 60 calendar days, but the firm cannot delay merely to finish every investigative step. Urgent ongoing criminal activity may require immediate law-enforcement contact in addition to the SAR.
The SAR and supporting documentation are retained for five years. Personnel must not disclose a SAR or reveal that one is being considered to its subject or another unauthorized person. Customer-facing staff can request information or explain a restriction without tipping off the subject.
Currency Transaction Reports and Structuring
A Currency Transaction Report is required for more than $10,000 in currency received or paid by, through or to the institution on behalf of one person during one business day. Known related currency transactions are aggregated. Currency means coin and paper money; a check or wire is not currency merely because it represents dollars. The CTR generally is filed within 15 calendar days and retained for five years.
Structuring is arranging transactions to evade BSA reporting or recordkeeping. Two $6,000 cash deposits can require a CTR when aggregated and can also support a SAR if the pattern was designed to evade reporting. A firm policy refusing physical cash reduces exposure but does not excuse review of attempted transactions or cash equivalents used suspiciously.
OFAC Sanctions
OFAC administers sanctions programs and the Specially Designated Nationals and Blocked Persons List. Firms screen customers, beneficial owners, counterparties and transactions using risk-based controls. A potential match must be resolved using identifiers; a similar name alone is not a confirmed match.
The required response depends on the sanctions program. Some transactions must be blocked and assets placed in an interest-bearing blocked account; others must be rejected rather than blocked. A firm should not state that every OFAC match receives identical treatment. Initial reports of blocked property are generally due to OFAC within 10 business days, with other reports and records required by regulation.
Section 314 Information Sharing
Under Section 314(a), FinCEN sends law-enforcement requests through financial institutions, which search designated records and report any positive matches through the specified process, generally within 14 days. The request and search are confidential. Section 314(b) is a voluntary information-sharing safe harbor among eligible financial institutions that have filed the required notice and follow its use and confidentiality limits. It permits sharing to identify and report possible money laundering or terrorist activity; it is not permission to share data for marketing.
Packaged-Product Red Flags
| Pattern | Why it matters |
|---|---|
| Purchase followed by quick redemption despite a load or surrender charge | Customer appears indifferent to economic loss and may be moving value |
| Free-look cancellation with refund to a different person or bank | Possible layering, fraud or third-party funding |
| Repeated fund-family switches and offshore wires | Obscured trail and activity inconsistent with investment purpose |
| Multiple customers using the same address, phone or bank account | Possible nominee, synthetic identity or coordinated control |
| Sudden liquidation after an ownership or address change | Account takeover, exploitation or sanctions concern |
The principal documents the facts, sources reviewed, rationale and escalation. A decision not to file requires as much disciplined reasoning as a decision to file, and repeated alerts should be considered together rather than closed one by one.
Case Documentation
A SAR case should separate facts from inference and identify the relevant dates, accounts, persons, amounts, instruments and disposition of funds. The narrative should explain why the activity is unusual for the customer and describe supporting documents without inserting unsupported conclusions. Continuing activity is reviewed for supplemental filings under current procedures.
OFAC false-positive resolution should preserve the identifiers compared and the reason for release. A rushed name-only decision can either freeze an innocent customer or release blocked property. Updates to sanctions programs and lists require prompt screening of existing relationships under the firm's risk-based design.
A broker-dealer initially detects a covered suspicious transaction but cannot identify a suspect. What is the maximum ordinary SAR filing period?
Ninety days whenever the customer supplies records.
Fifteen business days in all cases.
No filing is required until a suspect is identified.
Up to 60 calendar days after initial detection when no suspect is identified.
A customer conducts two $6,000 currency deposits on the same business day, and the firm knows both are for that customer. What is the CTR treatment?
No CTR is required because each deposit is individually below $10,000.
File a CTR only if the customer admits structuring.
Aggregate them and file a CTR because the day's currency total is more than $10,000; also assess whether the pattern is suspicious.
Treat the deposits as securities transactions rather than currency.
Sections you finish are checked off in the contents.