Identifying and Escalating Suspicious Activity

With Customer Identification Programs (CIP), Know Your Customer (KYC) rules, and special customer screening in place, the next layer of protection is ongoing monitoring for suspicious activity. Broker-dealers are required to detect and report suspicious transactions, and (critically) never tip off the customer about these reports.

What Triggers a Suspicious Activity Report?

Broker-dealers must file a SAR with FinCEN (Financial Crimes Enforcement Network) for any transaction (or pattern of transactions) involving at least $5,000 where the firm knows, suspects, or has reason to suspect:

• Funds are derived from illegal activity or are conducted to disguise such funds
• The transaction is designed to evade Bank Secrecy Act (BSA) requirements
• The transaction has no business or apparent lawful purpose after examining available facts
• The broker-dealer is being used to facilitate criminal activity

Who Files the SAR: the RR or the AMLCO?

This is a commonly missed distinction on the Series 7:

• A registered representative who notices suspicious activity does NOT file the SAR directly with FinCEN
• The RR's responsibility is to escalate the activity to the firm's AML compliance officer (AMLCO)
• The AMLCO evaluates the report and decides whether a SAR filing is warranted
• Only the firm (through the AMLCO) files the SAR with FinCEN

The escalation chain: RR detects suspicious activity → reports to AMLCO → AMLCO decides whether to file → firm files SAR with FinCEN.

Exam Tip: Gotchas

• If asked what a registered representative should do first upon noticing suspicious activity, the answer is always to report to the firm's AML compliance officer, not to contact FinCEN directly. The RR reports; the AMLCO files.
• The rep should also not confront the customer or conduct an independent investigation. Escalate only.

When Must a SAR Be Filed?

For a matter needing immediate attention, such as terrorist financing or an ongoing money-laundering scheme, the firm must immediately notify law enforcement by telephone in addition to filing a timely SAR.

A firm need not file a SAR to report a robbery or burglary already reported to law enforcement, or a federal-securities-law or SRO-rule violation already reported to the SEC or an SRO through the required channel.

A firm may voluntarily file a SAR even when a transaction falls below the $5,000 threshold, and filing one does not excuse the firm from any other SEC or SRO reporting duty. If more than one broker-dealer is involved in the same transaction, only one complete report is required among them.

How Long Are SAR Records Kept, and Who Can See Them?

• SAR records and supporting documentation must be retained for 5 years from filing
• Firms are prohibited from tipping off the customer that a SAR has been filed
• The "no tipping" rule applies to everyone at the firm: you cannot tell the customer, their attorney, or anyone outside the firm
• A SAR itself is confidential: a firm may disclose it only to FinCEN, law enforcement, its own regulators, or (without naming the person reported) within its own corporate structure or to another institution to prepare a joint SAR

Exam Tip: Gotchas

• The SAR threshold for broker-dealers is $5,000. (Money services businesses use a lower $2,000 threshold, but that figure is not the broker-dealer standard you are responsible for.)
• The "no tipping" rule is absolute. A SAR has been filed? You cannot tell the customer, their attorney, or anyone outside the firm.

What Triggers a Currency Transaction Report?

• Required for cash transactions exceeding $10,000 in a single business day
• Multiple transactions by or on behalf of the same person that aggregate over $10,000 in one day must also be reported
• CTRs are filed regardless of whether the transaction is suspicious; the threshold alone triggers the report
• Structuring (intentionally breaking up transactions to stay below the $10,000 threshold) is itself a federal crime
• A copy of each filed CTR must be retained for 5 years from the date of the report

How Do SAR and CTR Compare?

Exam Tip: Gotchas

• SAR = $5,000 + suspicion; CTR (Currency Transaction Report) = $10,000 + cash (no suspicion needed). The trigger is fundamentally different.
• Structuring is a crime itself, separate from whatever activity the person is trying to hide.
• CTRs look at aggregate cash transactions per day, not just individual transactions.

What Should You Check on Exam Day?

• Keep the two thresholds and triggers straight: SAR = $5,000 + suspicion; CTR = over $10,000 in cash, no suspicion required
• On suspicious activity, the RR's job stops at escalating to the AML compliance officer; only the firm files the SAR, and no one may tip off the customer
• Remember the 15-day CTR filing deadline, distinct from the SAR's 30/60-day window