Identifying and Escalating Suspicious Activity
With Customer Identification Programs (CIP), Know Your Customer (KYC) rules, and special customer screening in place, the next layer of protection is ongoing monitoring for suspicious activity. Broker-dealers are required to detect and report suspicious transactions, and (critically) never tip off the customer about these reports.
Suspicious Activity Reports (SARs)
Broker-dealers must file a SAR with FinCEN (Financial Crimes Enforcement Network) for any transaction (or pattern of transactions) involving at least $5,000 where the firm knows, suspects, or has reason to suspect:
- Funds are derived from illegal activity or are conducted to disguise such funds
- The transaction is designed to evade Bank Secrecy Act (BSA) requirements
- The transaction has no business or apparent lawful purpose after examining available facts
- The broker-dealer is being used to facilitate criminal activity
SAR Filing Deadlines
| Scenario | Deadline |
|---|---|
| Suspect identified at initial detection | 30 calendar days from initial detection |
| No suspect identified | May delay an additional 30 days to identify suspect |
| Maximum delay (no suspect) | 60 calendar days total from initial detection |
SAR Recordkeeping
- SAR records and supporting documentation must be retained for 5 years from filing
- Firms are prohibited from tipping off the customer that a SAR has been filed
- The "no tipping" rule applies to everyone at the firm: you cannot tell the customer, their attorney, or anyone outside the firm
Exam Tip: Gotchas
- The SAR threshold for broker-dealers is $5,000. Banks also have a $5,000 threshold, but casinos have a $5,000 threshold for specific suspicious activity and a lower $2,000 threshold in some cases. The exam focuses on the broker-dealer threshold.
- The "no tipping" rule is absolute. A SAR has been filed? You cannot tell the customer, their attorney, or anyone outside the firm.
Currency Transaction Reports (CTRs)
- Required for cash transactions exceeding $10,000 in a single business day
- Multiple transactions by or on behalf of the same person that aggregate over $10,000 in one day must also be reported
- CTRs are filed regardless of whether the transaction is suspicious; the threshold alone triggers the report
- Structuring (intentionally breaking up transactions to stay below the $10,000 threshold) is itself a federal crime
SAR vs. CTR Comparison
| Feature | SAR | CTR |
|---|---|---|
| Threshold | $5,000 | $10,000 |
| Trigger | Suspicion of illegal activity | Cash amount (regardless of suspicion) |
| Filed with | FinCEN | FinCEN |
| Customer notification | Prohibited (no tipping) | Customer may be aware |
| Filing deadline | 30 days (up to 60 if no suspect) | 15 days of transaction |
Exam Tip: Gotchas
- SAR = $5,000 + suspicion; CTR (Currency Transaction Report) = $10,000 + cash (no suspicion needed). The trigger is fundamentally different.
- Structuring is a crime itself, separate from whatever activity the person is trying to hide.
- CTRs look at aggregate cash transactions per day, not just individual transactions.