One of the critical tools law enforcement has in combatting financial crime is the Suspicious Activity Report (SAR). A SAR itself is not direct evidence that a crime has occurred; it is a report that indicates criminal activity may have occurred. SARs are extremely confidential and unauthorized individuals do not have access or should not have knowledge that one has been filed. However, as the single point of filing, FinCEN shares information with law enforcement analysts who review SARs and then disseminate useful information to national and local law enforcement task forces. These task forces or agencies then evaluate whether the event(s) is elevated to a level that warrants further investigation.

Use by law enforcement

If you remember that SAR filings are written reports of exploitable leads for development and its details are the most important lead, no detail is too small for inclusion in the SAR. Law enforcement looks at common themes such as: name, times, events, amounts, or dates. In addition, they will look at frequency, type of instruments used (cash, wires, etc.), and if local law enforcement agencies were notified. All parties involved are reviewed, despite lack of complete identifying information, because these individuals could be useful if subpoenas are issued, or the scope of the investigation widens. Law enforcement also aggregates new SARs with ongoing investigations including the same subjects.

Your responsibility

As a BSA or Compliance Officer, you are required to properly monitor activity that is alerted as potentially criminal. Your internal controls and detection programs should be sufficiently designed to detect and then alert you to suspicious events. These alerts should be based on actionable data. Many analysts choose to defensively file SARs but bear in mind, quality is more important than quantity. Fine-tune your alert system so that your false alerts are minimized, and your credible alerts are maximized. There is analysis involved with this. Consider talking to your third-party software provider for tips on how to analyze and test your alerts.

Time sensitive

Timely filing of SARs is critical because the more time that has passed between the event and law enforcement’s review, the more likely the trail could go cold. A financial institution is required to file a suspicious activity report no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing a suspicious activity report (this is not necessarily the date of the activity; it is the date you determine the facts warrant filing). If no suspect was identified on the date of detection of the incident requiring the filing, a financial institution may delay filing a suspicious activity report for an additional 30 calendar days to identify a suspect. In no case shall reporting be delayed more than 60 calendar days after the date of initial detection of a reportable transaction.

Critical value of the narrative

The body of the SAR contains the basic information of who participated in the activity, where it occurred, and what occurred. It also provides contact information. However, the meat of the information is in the narrative. That is the data mine where investigators sift to hit criminal gold. Therefore, it is critical that sufficient and detailed information be reported so that the report is useful and effective.

Detailed, but concise

Paint a complete picture to intrigue law enforcement. You have one or two sentences to capture their attention. If your narrative does not quickly paint a compelling story of why it is worth their time to review further, it is likely to get pushed aside, never to be looked at again. Spend time crafting a story that tells law enforcement what they need to know. Remember, an unread narrative is a wasted narrative.

Include key words: SARs are subject to sorting algorithms that look for specific key words, zip codes, names, amounts, type of activity, etc. Be sure to slip these into your narratives so that you can be sure your SAR gets seen. While we are on this subject, it might even be helpful to paste your narrative into a Word document and run spell check just to make sure you have not misspelled a word, especially if you have included key words, which are likely to get missed if they are misspelled. The other benefit of this is you do not have to worry about losing the information if the site times out or if you inadvertently leave the site.

Go back to your school writing days. Include the “5 Ws” and even the “How” if it is applicable or known! These include:

1. Who conducted the activity and who were all the participants?
2. What type of instruments were used, such as cash, check, wire, ACH, cryptocurrency, etc.?
3. Where did the transactions take place?
4. When did the activity occur? Include the times of day and when you detected the activity.
5. Why do you believe the activity is suspicious?
6. How was the activity conducted? Including the subject’s normal types of behavior.

Detail the transactions: Include the transactions and list the dates, types, amounts, and known address locations for branches or ATMs. Including this information helps build a picture of how the suspect operates and why the activity may be suspicious. Consider if the subject is visiting multiple branches or ATM locations across the country, or even across the city.

Use an attachment if there are multiple transactions. The SAR form allows the use of an Excel attachment if the transactions are too numerous to list out. Do not be afraid to use the attachment for your benefit and to make sorting the details easier.

Ineffective vs. effective

To help create a clearer understanding of what is considered an effective narrative and what is not, we have included two sets of example narratives for you to compare. The first narrative of each example is an ineffective account of the events leading to the filing. Unfortunately, we see this quite frequently when we visit our credit union clients. The second narrative is more useful for law enforcement. Disclaimer: These narratives are not actual filings and do not contain actual events or persons; however, they represent narratives we typically see. Any similarities are purely coincidence.

Example 1:

This narrative was written to report a member who was structuring cash deposits.

Ineffective Narrative:

More Effective Narrative:

Example 2:

This set of narratives was written to report a member who was the victim of a romance scam.

Ineffective Narrative:

More Effective Narrative:

As you can see, the second narrative of each example provides detailed information that would be much more useful than the first set. By reading the second narrative, law enforcement has a clearer picture of what happened and actionable information to further an investigation.

Wrapping it up

Filing SARs is not a quick task, but it is vitally important. And failure to do so with complete, descriptive information is not only critical, but also required. Businesses and financial institutions are censured by FinCEN and their regulators for ineffective SARs, and even more so if activity occurs that is dismissed and not acted upon by the compliance officer.

If you have any questions, please feel free to contact us. We cannot write a SAR for you or review every narrative you write but we can assist you in understanding whether you are writing effective, actionable SARs.

P.s. Check out this diagram!

This chart represents the type and number of SARs filed in 2020 in the state of Ohio by depository institutions. Look at how many were for suspicious receipt of government payments/benefits (e.g. unemployment)!

Click for full size