Identifying and Escalating Suspicious Activity

With Customer Identification Programs (CIP), Know Your Customer (KYC) rules, and special customer screening in place, the next layer of protection is ongoing monitoring for suspicious activity. Broker-dealers are required to detect and report suspicious transactions, and (critically) never tip off the customer about these reports.

What Triggers a Suspicious Activity Report?

Broker-dealers must file a SAR with FinCEN (Financial Crimes Enforcement Network) for any transaction (or pattern of transactions) involving at least $5,000 where the firm knows, suspects, or has reason to suspect:

• Funds are derived from illegal activity or are conducted to disguise such funds
• The transaction is designed to evade Bank Secrecy Act (BSA) requirements
• The transaction has no business or apparent lawful purpose after examining available facts
• The broker-dealer is being used to facilitate criminal activity

Who Files the SAR: the RR or the AMLCO?

This is a commonly missed distinction on the Series 7:

• A registered representative who notices suspicious activity does NOT file the SAR directly with FinCEN
• The RR's responsibility is to escalate the activity to the firm's anti-money laundering compliance officer (AMLCO)
• The anti-money laundering compliance officer (AMLCO) evaluates the report and decides whether a SAR filing is warranted
• Only the firm (through the AMLCO) files the SAR with FinCEN

The escalation chain: RR detects suspicious activity → reports to AMLCO → AMLCO decides whether to file → firm files SAR with FinCEN.

Exam Tip: Gotchas

• If asked what a registered representative should do first upon noticing suspicious activity, the answer is always to report to the firm's AML compliance officer, not to contact FinCEN directly. The RR reports; the AMLCO files.
• The rep should also not confront the customer or conduct an independent investigation. Escalate only.

Can the RR Tell the Customer a SAR Was Filed?

No. Firms are prohibited from tipping off the customer that a SAR has been filed. The "no tipping" rule applies to everyone at the firm: you cannot tell the customer, their attorney, or anyone outside the firm.

Exam Tip: Gotchas

• The SAR threshold for broker-dealers is $5,000. (Money services businesses use a lower $2,000 threshold, but that figure is not the broker-dealer standard you are responsible for.)
• The "no tipping" rule is absolute. A SAR has been filed? You cannot tell the customer, their attorney, or anyone outside the firm.

What Triggers a Currency Transaction Report?

• Required for cash transactions exceeding $10,000 in a single business day
• Multiple transactions by or on behalf of the same person that aggregate over $10,000 in one day must also be reported
• CTRs are filed regardless of whether the transaction is suspicious; the threshold alone triggers the report
• Structuring (intentionally breaking up transactions to stay below the $10,000 threshold) is itself a federal crime

How Do SAR and CTR Compare?

Exam Tip: Gotchas

• SAR = $5,000 + suspicion; CTR (Currency Transaction Report) = $10,000 + cash (no suspicion needed). The trigger is fundamentally different.
• Structuring is a crime itself, separate from whatever activity the person is trying to hide.
• CTRs look at aggregate cash transactions per day, not just individual transactions.

What Should You Check on Exam Day?

• Keep the two thresholds and triggers straight: SAR = $5,000 + suspicion; CTR = over $10,000 in cash, no suspicion required
• On suspicious activity, the RR's job stops at escalating to the AML compliance officer; only the firm files the SAR, and no one may tip off the customer