FinCEN Advisory

This Advisory provides guidance to financial institutions that file Suspicious Activity Reports.

On April 1, 1996, the Suspicious Activity Reporting (SAR) system went into effect. The SAR system created, for the first time, a central repository for the reporting of certain criminal activity and suspicious financial transactions. Banks, thrift institutions, credit unions, covered affiliates and subsidiaries of bank and thrift holding companies (referred to collectively as reporting financial institutions for the purpose of this advisory) are now required to file a report when they “know, suspect or have reason to suspect” that a crime has occurred or that a transaction is suspicious (under the terms of the implementing regulations).

The information reported on the SARs is entered into a database owned by the Financial Crimes Enforcement Network (FinCEN) and the federal financial supervisory agencies (Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, Office of the Comptroller of the Currency, Office of Thrift Supervision and National Credit Union Association). FinCEN, in conjunction with the other owners, has examined the data provided in the first six months of operation. A report detailing the results of this examination will be available shortly as part of our continuing effort to make this system useful to both the law enforcement and financial communities.

Our analysis of the data indicates a need to provide guidance to reporting financial institutions on the completion of the SAR form. We believe the attached guidelines will enable the information to be reported more consistently. The following examples are illustrative of some of the areas where we believe the guidelines will be most useful.

• Item 9 on the SAR asks for the address of the branch or office of the institution where the suspicious activity occurred. Some of the reports, however, list the address of the main branch of the institution and not the address of the location of the suspected violation.
• In Item 37, the reporting financial institution is asked to characterize the suspicious activity from among 17 types of potential violations. Our review indicated that there was an unusually large number of SARs which designated the violation type as “other.” The review of the data indicates that most of the reports that listed “other” as the violation type could have been more appropriately placed in a different category. For example, the “other” box (Item 37r) is checked on reports in which “possible structuring” was indicated; in these instances, Item 37a (Bank Secrecy Act/Structuring/Money Laundering) could have been checked instead.

In order to clarify these and other issues, the attached guidelines were designed to assist reporting financial institutions when preparing the SAR. We will provide additional guidance as we continue to review and refine the SAR system.

FinCEN relies on reporting financial institutions to collect meaningful information because an effective program for detection and prevention of money laundering cannot succeed unless we enlist your cooperation and support.

FinCEN appreciates your assistance in the implementation of the SAR System. The more accurate and uniform the SAR data, the more useful it becomes for law enforcement investigations and for developing trends and patterns related to money laundering. And it is important to provide this information to the financial community to assist their anti-money laundering efforts.

We encourage you to make further suggestions about ways to increase the effectiveness of the SAR System.


Stanley E. Morris
Director

Attachment:

PREPARATION GUIDELINES FOR
SUSPICIOUS ACTIVITY REPORT (SAR)
February 1997

Generally

Leave blank any items for which you have no information.

Dates - Whenever dates should be entered, the format is “mm/dd/yy,” where “mm” is the month “dd” is the day and “yy” is the year. Zero (0) should precede any single digit number. If the month or day is not available or unknown, enter zeros in the space for “mm” and “dd.” For example, 01/00/96 indicates an unknown day in January 1996.

Numbers - Wherever the information required calls for monetary input, the format should be “$0,000,000.00,” unless otherwise noted.

Item 1 - Box a, b or c must always be marked, to reflect the status of the SAR.

Initial Report - Check box a if this is the first report of known or suspected criminal activities for the subject of this SAR.

Corrected Report - Check box b if this report is filed to correct a previously filed SAR. In order to correct a report, a new SAR must be completed in its entirety.

Supplemental Report - Check box c if this report is filed to provide additional information to a previously filed SAR. A supplemental report must be completed in its entirety.

PART I — REPORTING FINANCIAL INSTITUTION INFORMATION

Item 2 - Name of Financial Institution - You should enter the full legal name of the financial institution (FI).

Item 3 - Primary Federal Regulator - Box a, b, c, d or e must always be marked to reflect the reporting financial institution’s primary federal regulator

Item 4 - Address of Financial Institution - Enter the street address of the FI shown in Item 2. A Post Office (P.O.) Box number should be used only if there is no other street address.

Item 5 - City - Enter the city where the FI is located.

Item 6 - State - Use the U.S. Postal Service’s two letter state abbreviation.

Item 7 - Zip Code - Enter the zip code that corresponds with the address shown in Items 4, 5 and 6.

Item 8 - EIN or TIN - Enter the FI’s nine digit Employer Identification Number or Taxpayer Identification Number without any alpha characters or other substitutes.

Item 9 - Address of Branch Office(s) where activity occurred - If the location of the suspicious activity is different from that provided in Item 4, enter the street address of the branch or office where the activity occurred. A P.O. Box number may be used only if there is no other street address. Otherwise, leave Item 9 blank. If the suspicious activity occurred at more than one branch or office, write the address of one of the branches or offices. Report the additional branch or office addresses in Part VII.

Item 10 - Asset Size of Financial Institution - Enter the asset size of the FI reported in Item 2. Use whole dollar amounts. The only alpha abbreviations that may be used in this Item are M for million or B for billion.

Item 11 - City - Enter the city where the branch or office shown in Item 9 is located.

Item 12 - State - Use the U.S. Postal Service’s two letter state abbreviation.

Item 13 - Zip Code - Enter the 5 digit zip code that corresponds with the address shown in Items 10, 11 and 12.

Item 14 - Date Closed - If the FI has closed, enter the date of closure by using the method for entering dates described at the beginning of these Guidelines.

Item 15 - Account Number(s) affected - Enter the numbers of any account(s) that were affected by the suspicious activity. This Item should not reflect more than two account numbers. If more than two account(s) are affected, provide the additional account numbers in Part VII. If no account is affected, leave Item 15 blank.

Item 16 - Have any of the institution’s accounts related to this matter been closed? - Check the appropriate box. If the answer is “yes,” and the account number is already reflected in Item 15, please list the account number again. If more than one account is affected, report the additional account numbers in Part VII.


PART II — SUSPECT INFORMATION

Items 17, 18 and 19 - Name of Individual or Entity - If the suspicious activity involves an individual, enter his or her last name in Item 17, first name in Item 18 and middle initial in Item 19. If there is no middle initial, leave Item 19 blank. If an organization is involved in the suspicious activity, enter its name in Item 17 and leave Items 18 and 19 blank. If the FI has knowledge of a separate “doing business as” name, enter the individual or organization’s name in Item 17 followed by the phrase “DBA” and the name of the business.

For example, John R. Smith DBA Smith Auto Sales or Johnson Enterprises DBA PJ’s Pizzeria. If additional space is needed to report the DBA, use Items 18 and 19. If more than one Part II is necessary, attach additional copies of page 1 to report the additional subjects. If both formal and alias names are established, enter the full legal name in Items 17, 18 and 19 and the alias name or names in Part VII.

Item 20 - Address - Enter the permanent street address of the person identified in Items 17, 18 and 19. Use the U.S. Postal Service’s two letter state abbreviation code. A P.O. box should only be used if there is no other street address.

Item 21 - SSN, TIN or EIN - If an individual is shown in Items 17-19, enter his or her Social Security Number (SSN). If an organization is shown, enter its Employer Identification Number (EIN) or Taxpayer Identification Number (TIN).

Items 22, 23 and 24 - City, State, Zip Code - Enter the city in which the person shown in Items 17, 18 and 19 resides or the city in which the organization is located. Enter the state or territory in Item 23 and the five digit zip code in Item 24. If the address is outside the U.S., provide the street address, city, province, or state and postal code (if known).

Item 25 - Country - Enter the applicable two digit U.S. Postal Service’s country code that corresponds to the information in Items 23 and 24.

Item 26 - Date of Birth - If an individual is named in Items 17 - 19, enter his or her date of birth by using the method for entering dates described at the beginning of these Guidelines.

Item 27 - Telephone Number - Enter the home telephone number, including the area code for the individual entered in Items 17 - 19.

Item 28 - Telephone Number - Enter the business telephone number, including area code of the individual or organization entered in Items 17 - 19.

Item 29 - Occupation - Fully identify the occupation, profession or business of the person on whose behalf the transaction(s) was conducted. For example, secretary, shoe salesman, carpenter, attorney, housewife, restaurant owner, liquor store clerk, etc. Do not use non-specific terms such as merchant, self-employed, businessman, etc.

Item 30 - Forms of Identification for Suspect - Check appropriate box for the form of identification provided by the suspect and use box e to provide specific data such as permit or passport number and issuing authority.

For box d, “other” provide a brief explanation in the space provided. If more space is required, enter the information in Part VII.

Item 31 - Relationship to Financial Institution - Check each box that identifies the suspect relationship with the FI. More than one box may be checked. If the “other” box is checked, provide a brief explanation on the adjacent blank space. If more space is required, enter the information in Part VII.

Item 32 - Is insider suspect still affiliated with the financial institution? - If the suspect is affiliated with the financial institution at the time the report is filed, check box a. If the suspect was affiliated with the FI, but that affiliation has ceased, check box b and specify the circumstance under which the affiliation ceased in boxes c, d, or e.

Item 33 - Date - Enter the date the suspect was suspended, terminated or resigned by using the method for entering dates described at the beginning of these Guidelines.

Item 34 - Admission/Confession - If the suspect made an admission or confession, check box a. If not, check box b.


PART III — SUSPICIOUS ACTIVITY INFORMATION

Item 35 - Date of suspicious activity - Enter only one date in this Item using the method for entering dates described at the beginning of these Guidelines. If multiple or related activity is committed by the individual during the reporting period, the FI may report the activities on one SAR. Enter the date of the initial activity in this Item and the additional occurrence dates in Part VII. If other related activity occurs after the report has been made, a supplemental report must be filed.

Item 36 - Dollar amount involved - Enter the dollar amount involved in the suspicious activity. If less than a full dollar is involved, round it to the next highest dollar. Use whole dollar amounts only. In certain cases, for example making a false statement, it may be appropriate to leave blank.

An aggregated total of all transactions for multiple or related suspicious activities by the same individual within the same reporting period may be shown in this field. The break- out of this total may then be listed in Part VII.

In some cases, the “amount involved” may be determined with reference to an underlying transaction. For example, if the FI has a customer that is paying a 30-year mortgage at the rate of $1000 each month, and if the FI believes that all the payments are derived from an unlawful activity, the face value of the mortgage should be shown in Item 36 and an explanation should be provided in Part VII.

Item 37 - Summary characterization of suspicious activity - Check all box(es) which identify the suspicious activity. More than one box may be checked. If “other” is checked, enter a brief explanation in the space provided.

Item 38 - Amount of loss prior to recovery - If funds or assets are lost by the FI, enter the dollar value prior to recovery. Use whole dollars only, rounding up to the next highest dollar.

Item 39 - Dollar amount of recovery - If funds or assets are recovered by the FI, enter the dollar value of the recovery. Use whole dollars only, rounding up to the next highest dollar.

Item 40 - Has the suspicious activity had a material impact on or otherwise affected the financial soundness of the institution? - Check box a or box b, as appropriate.

Item 41 - Has the institution’s bonding company been notified? - Check box a if yes; check box b if no.

Items 42, 43, 44, 45 and 46 - Has any law enforcement agency been advised by telephone, written communication, etc. If the answer is yes, list the name of the agency and its local address in Items 42 - 46.


PART IV — WITNESS INFORMATION

Items 47, 48 and 49 - Name of Individual - If there was a witness to the suspicious activity, enter the person’s name in Items 47 - 49. The witness may or may not be an employee of the FI. If there are several witnesses, make copies of page two and provide the information on additional Part IVs for each witness.

Item 50 - Address - Enter the permanent street address of the witness.

Item 51 - SSN - Enter the Social Security Number of the witness.

Items 52, 53 and 54 - City, State and Zip Code - Enter the witness’s city, state and zip code (or foreign postal code).

Items 55 - Date of Birth - Enter the witness’s date of birth using the method for entering dates described at the beginning of these Guidelines.

Items 56 - Title - If the witness is an employee or an affiliate of the FI, enter the person’s title. If not, enter the person’s occupation or business.

Items 57 - Telephone Number - Enter the telephone number, including area code, where the witness can be contacted.

Items 58 - Interviewed - If the witness was interviewed, check box a. If not, check box b.


PART V — PREPARER INFORMATION

Items 59, 60 and 61 - Preparer’s Name - Enter the name of the person who prepared the SAR in Items 59 - 61.

Items 62 - Title - Enter the preparer’s title.

Items 63 - Phone Number - Enter a phone number, including area code, where the preparer can be contacted.

Items 64 - Date - Enter the date the SAR was prepared in the format described at the beginning of this Guidance.


PART VI — CONTACT FOR ASSISTANCE (if different than Preparer Information in Part V)

Complete this section ONLY if contact assistance will be provided by someone other than the preparer.

Items 65, 66 and 67 - Contact Name - Enter the name of the person to contact in Items 65 - 67.

Items 68 - Title - Enter the contact person’s title.

Items 69 - Phone Number - Enter the contact person’s phone number, including the area code.

Items 70 - Agency - If the contact person is employed by an agency or organization other than the FI, or by any other person, enter the name of the agency, organization or other person.


PART VII — SUSPICIOUS ACTIVITY INFORMATION EXPLANATION/DESCRIPTION

As stated in Part VII of the SAR, this section of the report is critical. The care with which it is written may determine whether or not the described conduct and its possible criminal nature are clearly understood. Provide a complete chronological account of what is unusual, irregular or suspicious about the transaction. The narrative should include the material indicated in Part VII but you should include any other material that you believe is necessary to permit investigators to understand the transaction you are reporting. If necessary, continue the narrative on a copy of this page of the SAR.

FinCEN Advisory is a product of the Financial Crimes Enforcement Network, Department of the Treasury, Post Office Box 39, Vienna, Virginia 22183. For more information about FinCEN’s programs, visit the FinCEN web site at http://www.fincen.gov. General questions or comments regarding FinCEN publications should be addressed to the Office of Communications, FinCEN, (703) 905-3773. Information may also be faxed to (703) 905-3885.