To Follow that SAR: Suspicious Activity Reports from Red Flags to Verdict

Transcription

1 To Follow that SAR: Suspicious Activity Reports from Red Flags to Verdict Wednesday, April 5 8:50 AM Moderator: Dennis M. Lormel, CAMS, President and Chief Executive Officer, DML Associates Speakers: James A. Candelmo, CAMS, Chief AML Officer, Capital One Jim Dinkins, Senior Vice President, Director of Operations for Enterprise Financial Crimes Compliance, US Bank Luis Sierra, Attaché, Andean Region, U.S. Immigration and Customs Enforcement, Homeland Security Investigations Office of International Operations

2 SARs from Alert to Prosecution 2

3 3

4 4

5 Purpose of SARs The purpose of filing a SAR is to support law enforcement Financial institutions are responsible for identifying and reporting suspicious activity in a comprehensive and timely manner Law enforcement is responsible for conducting criminal investigations Effective SARs are used to predicate and / or enhance investigations 5

6 Suspicious Activity Reports (SARs) Most serious compliance breakdown Failure to file SARs SARs must be filed within 30 days of detecting suspicious activity Should be comprehensive and thorough Answer who, what, when, where, why, how Include all identifying data SARs make an important difference 6

7 Internal SAR Investigative Flow Alerts / referrals Transaction monitoring Negative media 314 a and b requests Law enforcement Call centers / customer complaints Front line employees Business or other internal units / teams Other Pre-investigative analysis File SAR, escalate or close Investigations SAR / no-sar decision Reporting 7

8 FinCEN Portal SAR Lifecycle Law Enforcement FinCEN Analysis Regulators Foreign FIUs Regulatory Review Prosecution Deferred Prosecution Cooperation Agreement Plea Acquittal Declination SARs Used to Predicate/Support Investigation SARs Not Investigated Civil Enforcement Action Analysis of SARs 8

9 The Why and How Key element for law enforcement is the why Why is the activity suspicious? Key element for financial institution is the how How was the financial institution used to facilitate the suspicious activity? 9

10 Keep ADApTing Your Program Analyze your suspicious activity detection and reporting program against changes to your business operations, regulatory expectations, and evolving criminal activity trends to identify gaps between current capabilities and risk tolerance Develop those aspects of your program that require improvement to close the compliance gaps and design a program that will diminish risk Apply your updated SAR program by training staff on new sensitivities and implementing program enhancements Test your revisions to ensure the updated program functions as intended 10

11 11

12 SAR Process and Consequences 12

13 Components of Effective SAR Process Capturing suspicious incidents Investigative process Written standards The right people Case management and management reporting Using investigative information to improve a program 13

14 SAR Completion and Filing per FFIEC Manual Timing of SAR filing 30 or 60 days from initial detection SAR quality Complete, thorough and timely Notify Board of Directors SAR record retention (and supporting documentation) Five years Prohibition of SAR disclosure Sharing SARs with head offices and controlling companies May share SARs 14

15 SAR Reporting Thresholds for Depository Institutions Insider abuse involving any amount Violations aggregating to $5,000 or more where a suspect can be identified Violations aggregating to $25,000 or more regardless of a potential suspect Transactions aggregating to $5,000 or more that involve potential money laundering or violations of the Bank Secrecy Act Unauthorized electronic intrusions 15

16 Timing of a SAR Filing SAR must be electronically filed through BSA E-Filing System no later than 30 calendar days from the date of initial detection of facts that may constitute a basis for filing a SAR If no subject identified, time period for filing SAR 60 days The phrase initial detection should not be interpreted as meaning the moment a transaction is highlighted for review 30 or 60 day period does not begin until appropriate review conducted and determination made that transaction under review is suspicious within meaning of SAR regulation Law enforcement notification For situations requiring immediate attention, in addition to filing SAR, bank must immediately notify, by telephone, appropriate law enforcement authority and as necessary, bank s primary regulator Source: FFIEC Manual 16

17 Perspective Challenge Subjectivity of SAR process Response Implement consistent process Documentation Timeliness 17

18 SAR Process and Consequence Workflow Internal process Alerts / referrals Escalation Pre-investigative analysis Investigation Decisioning Reporting External consequence Law enforcement investigation End game Civil law suit End game Enforcement actions End game 18

19 Perspectives of Process and Resultant Consequence Law enforcement The why Why does a financial institution believe activity suspicious? Prosecution Forfeiture Financial institution The how How is my institution being used as a facilitation tool to support suspicious activity? Prevent or minimize losses Recover losses Protect reputation 19

20 SAR Decision Process 20

21 SAR Decisioning Responsibility Moving from red flags to reportable suspicion Red flags are indicators that suspicious activity may have taken place but not necessarily Requires escalation process SAR decision responsibility Committee BSA officer Supervisor / manager Investigator 21

22 SAR / No SAR Decisioning SAR Ensure narrative is No SAR Concise Clear Chronological Complete Documentation 22

23 SAR Narrative Skills 23

24 SAR Narrative Writing an effective SAR narrative requires Compiling the appropriate information Formatting the relevant information in a cohesive manner 24

25 Compiling Information for the Narrative Requires answering six essential questions Who is conducting the suspicious activity? What instruments or mechanisms were used to facilitate the suspicious activity? When did the suspicious activity take place? Where did the suspicious activity occur? Why is the activity considered suspicious? How was the suspicious activity conducted? 25

26 Formatting the Narrative Introduction Set forth purpose of the SAR and briefly explain why the activity is suspicious Impact statement Body Answer who, what, where, when and how Elaborate on why Other information or observations that could help law enforcement Conclusion Any follow-up actions taken by institution Points of contact Documentation that may be available 26

27 Keys to Writing a Complete & Sufficient SAR Narrative Do not assume the reader is familiar with your institution s internal terminology Concise, clear, detailed narrative identifying the pertinent information in chronological order Describe the known or suspected violation and dates and reasons of any previously filed SARs Identify all involved accounts and describe the transactions raising suspicion Summarize the report and include any planned follow-up action and the location of all SAR related records 27

28 Law Enforcement Use of SARs 28

29 In July 2003, HSI launched the Cornerstone Outreach Program The key is building strong partnerships and alliances 29

30 Law Enforcement Perspective of SARs Importance of reporting suspicious activity Law enforcement direct beneficiary of SARs Front line employees and management share responsibility for submitting meaningful SARs Importance of comprehensive narrative Who, what, where, when, why, and how The why is most important Explain up front why the activity is suspicious Key words Identify crime problems Importance of collateral information The more common the names, the more identifiers you need Availability of SAR file for law enforcement Investigative and financial intelligence value of SARs 30

31 Maintaining Account (FinCEN Guidance June 13, 2007) Request by law enforcement for financial institutions to maintain accounts: Purpose: to further law enforcement efforts Ultimate decision to maintain or close account up to financial institution Notify law enforcement of decision to close if aware of pending investigation based on 314(a), subpoena, or NSL Request a written request from law enforcement Issued by supervisory agent, US Attorney s Office or Department of Justice (equivalent at state level) Express request to maintain the account and the purpose Duration of the request not to exceed 6 months Subsequent request post-expiration is permissible Document retention is recommended for 5 years post expiration 31

32 Evolution of Law Enforcement SAR Review Review process historically manual Emergence of SAR review teams Review process becoming more automated Data mining FBI Investigative data warehouse IRS Reveal Improved law enforcement and FinCEN analytics FinCEN modernization project Data extraction capability Lifecycle of a SAR 32

33 SARs and Prosecution Role of prosecutor Developing / preparing documentary evidence Developing / preparing witnesses Role of financial institutions Role of law enforcement Prosecutive results 33

34 Takeaways 34

35 Takeaways SARs intended to support law enforcement Importance of why and how ADApT (analyze, develop, apply, test) Balance process and consequence Start narrative with impact statement SARs make an important difference to law enforcement 35