With Customer Identification Programs (CIP), Know Your Customer (KYC) rules, and special customer screening in place, the next layer of protection is ongoing monitoring for suspicious activity. Broker-dealers are required to detect and report suspicious transactions, and (critically) never tip off the customer about these reports.
Suspicious Activity Reports (SARs)
Broker-dealers must file a SAR with FinCEN (Financial Crimes Enforcement Network) for any transaction (or pattern of transactions) involving at least $5,000 where the firm knows, suspects, or has reason to suspect:
- Funds are derived from illegal activity or are conducted to disguise such funds
- The transaction is designed to evade Bank Secrecy Act (BSA) requirements
- The transaction has no business or apparent lawful purpose after examining available facts
- The broker-dealer is being used to facilitate criminal activity
The RR's Role vs. the AMLCO's Role
This is a commonly missed distinction on the Series 7:
- A registered representative who notices suspicious activity does NOT file the SAR directly with FinCEN
- The RR's responsibility is to escalate the activity to the firm's AML compliance officer (AMLCO)
- The AMLCO evaluates the report and decides whether a SAR filing is warranted
- Only the firm (through the AMLCO) files the SAR with FinCEN
The escalation chain: RR detects suspicious activity → reports to AMLCO → AMLCO decides whether to file → firm files SAR with FinCEN.
Exam Tip: Gotchas
- If asked what a registered representative should do first upon noticing suspicious activity, the answer is always to report to the firm's AML compliance officer, not to contact FinCEN directly. The RR reports; the AMLCO files.
- The rep should also not confront the customer or conduct an independent investigation. Escalate only.
SAR Filing Deadlines
| Scenario | Deadline |
|---|---|
| Suspect identified at initial detection | 30 calendar days from initial detection |
| No suspect identified | May delay an additional 30 days to identify suspect |
| Maximum delay (no suspect) | 60 calendar days total from initial detection |
SAR Recordkeeping
- SAR records and supporting documentation must be retained for 5 years from filing
- Firms are prohibited from tipping off the customer that a SAR has been filed
- The "no tipping" rule applies to everyone at the firm: you cannot tell the customer, their attorney, or anyone outside the firm
Exam Tip: Gotchas
- The SAR threshold for broker-dealers is $5,000. Banks also have a $5,000 threshold, but casinos have a $5,000 threshold for specific suspicious activity and a lower $2,000 threshold in some cases. The exam focuses on the broker-dealer threshold.
- The "no tipping" rule is absolute. A SAR has been filed? You cannot tell the customer, their attorney, or anyone outside the firm.
Currency Transaction Reports (CTRs)
- Required for cash transactions exceeding $10,000 in a single business day
- Multiple transactions by or on behalf of the same person that aggregate over $10,000 in one day must also be reported
- CTRs are filed regardless of whether the transaction is suspicious; the threshold alone triggers the report
- Structuring (intentionally breaking up transactions to stay below the $10,000 threshold) is itself a federal crime
SAR vs. CTR Comparison
| Feature | SAR | CTR |
|---|---|---|
| Threshold | $5,000 | $10,000 |
| Trigger | Suspicion of illegal activity | Cash amount (regardless of suspicion) |
| Filed with | FinCEN | FinCEN |
| Customer notification | Prohibited (no tipping) | Customer may be aware |
| Filing deadline | 30 days (up to 60 if no suspect) | 15 days of transaction |
Exam Tip: Gotchas
- SAR = $5,000 + suspicion; CTR (Currency Transaction Report) = $10,000 + cash (no suspicion needed). The trigger is fundamentally different.
- Structuring is a crime itself, separate from whatever activity the person is trying to hide.
- CTRs look at aggregate cash transactions per day, not just individual transactions.