Presenters: Special Agent Crystal WombleInvestigative Analyst Marilyn Willis

AMLA Mid-Atlantic Chapter Event

TopicsTopicsBenefits of SARsKeys to writing complete SAR narrativeDownloadsSupporting DocumentationExamples of cases initiated by SARs

INTRODUCTION (WHO WE ARE)

The DCFCTF (DC Financial Crimes Task Force) is a working group made up of the United States Attorney’s Office, IRS-CI, HSI, US Secret Service, US Postal Service, the District of Columbia Metropolitan Police Department and other law enforcement agencies

The purpose of our working group is to evaluate all SARS filed in the District of Columbia area to determine that those have criminal potential

Two key functions: 1)De-confliction 2) Fosters information sharing and cooperation

Our group focuses primarily on Code A violations i.e. Bank Secrecy Act, Structuring and Money Laundering

DEFINITIONSDEFINITIONS• SAR – Title 31 U.S.C. § 5318 (g) requires a

financial institution to report any transaction that it suspects 1) involves illegal activity, 2)is designed to evade the BSA requirements, & 3)has no business/lawful purpose

• CTR – Title 31 U.S.C. § 5313 requires financial institutions to file a Currency Transaction Report for each deposit, withdrawal, exchange of currency or other payments in currency of more than $10,000 by, through, or to such financial institutions

REPORTING REGULATIONS

• The Code of Federal Regulations requires banks to maintain a record of the SAR and supporting documentation for 5 years from date of the filing

• A bank is required to file a SAR no later than 30 days after the date of initial detection by the bank of facts that may constitute the basis for filing a SAR

• Federal law requires financial institutions to file CTRs with the Secretary of the Treasury within 15 days of the date on which the reportable transaction occurred.

Benefits of SARSBenefits of SARS (Bloomberg Article)

• Financial institutions help to identify potentially problematic customers or transactions

• Assist Law Enforcement with identifying problems and potential criminal activity

• Assist with existing cases to identify financial activity

SAR Review Teams In Each Of IRS-CI’s 35 Field OfficesSAR Review Teams In Each Of IRS-CI’s 35 Field Offices

A Total Of 41 SAR Review Teams Throughout The A Total Of 41 SAR Review Teams Throughout The CountryCountryNationwide Approximately 300-350 Employees Assigned To SAR-Nationwide Approximately 300-350 Employees Assigned To SAR-RT’sRT’s

Three “Lead Development Centers” Now Assigned To Do ProactiveThree “Lead Development Centers” Now Assigned To Do Proactive Analysis of SAR Data. LDC’s In Denver, Indianapolis & TampaAnalysis of SAR Data. LDC’s In Denver, Indianapolis & Tampa

LDC’s Comprised of Intelligence Analyst & Agents Doing Analytical & LDC’s Comprised of Intelligence Analyst & Agents Doing Analytical & Case Development Work Only. Case Development Work Only.

SAR Review Teams & Task Forces in US 94 Judicial Districts

56 Task Forces led by IRS-CIMore are being developed

All Types Of SAR’s Reviewed, IncludingBank SAR’s, MSB SAR’s,

Casino SAR’s, Securities and Futures SARs, etc.

SAR Review Teams In Each Of IRS-CI’s 35 Field OfficesSAR Review Teams In Each Of IRS-CI’s 35 Field Offices

Since 2006, each year, more than 1 million SARs were downloaded and reviewed.

2012 = 1,117,418

SAR Review Teams and Task ForcesSAR Review Teams and Task Forces

Multi-Agency-IRS-CI, FBI, ICE, DEA, USSS,

FDIC, USDA OIG

Led by USAO

Meet monthly

SAR ‘must-haves’SAR ‘must-haves’• Be concise & clear

• Provide a detailed description of the known or suspected criminal violation or suspicious activity

• Identify the essential elements of information (the 5 W’s)

• Be chronological & complete

• Be concise & clear

• Provide a detailed description of the known or suspected criminal violation or suspicious activity

• Identify the essential elements of information (the 5 W’s)

• Be chronological & complete

SAR NARRATIVE • The most useful section of the SAR is Part V, the narrative

section

• The narrative should include the following information:

– Who is conducting the suspicious activity– What instruments or mechanisms are being used to

facilitate the suspected transactions– When did the suspicious activity take place (list dates)– Where did the suspicious activity take place (list

branches/addresses)– Amount involved (list activities)– Why does the filer think the activity is suspicious

12

• Who is conducting the criminal or suspicious activity?

• Who is conducting the criminal or suspicious activity?

12

• Who is conducting the criminal or suspicious activity?

• Who is conducting the criminal or suspicious activity?

Describe additional details about the suspect(s) other than those provided earlier in the SAR form (Part I for SAR-MSB, SAR-SF & SAR-C or Part II for the depository institution SAR) :

Describe additional details about the suspect(s) other than those provided earlier in the SAR form (Part I for SAR-MSB, SAR-SF & SAR-C or Part II for the depository institution SAR) :

– Length of the financial relationship– Length of the financial relationship

– Employer & occupation information– Employer & occupation information

– Relationship between the suspect & the filing institution

– Relationship between the suspect & the filing institution

• What instruments or mechanisms facilitate the suspect activity/transactions?

• What instruments or mechanisms facilitate the suspect activity/transactions?

Identify & describe the transactions raising the suspicions of the financial institution. Examples include:

Identify & describe the transactions raising the suspicions of the financial institution. Examples include:

13

– Cash deposits and/or withdrawals– Cash deposits and/or withdrawals

– Checks & other monetary instruments (money orders; traveler’s checks; cashiers or bank checks)

– Checks & other monetary instruments (money orders; traveler’s checks; cashiers or bank checks)

• When did the criminal or suspicious activity occur?

• When did the criminal or suspicious activity occur?

14

– If a one-time occurrence, identify the date

– If a one-time occurrence, identify the date

– If a pattern of activity occurred over a span of time, state when the activity first initiated and then describe the activity during the duration

– If a pattern of activity occurred over a span of time, state when the activity first initiated and then describe the activity during the duration

– Identify when the activity was detected– Identify when the activity was detected

• Where did the suspicious activity take place?

• Where did the suspicious activity take place?

– Identify the branch/department location or locations within the institution where the activity occurred (name of branch, the street address for each, where in the branch (ATM, teller, etc.)

– Identify the branch/department location or locations within the institution where the activity occurred (name of branch, the street address for each, where in the branch (ATM, teller, etc.)

15

– Indicate if suspect transactions involve other domestic or international banks & identify the banks, their locations, account numbers, etc.

– Indicate if suspect transactions involve other domestic or international banks & identify the banks, their locations, account numbers, etc.

– Identify all account numbers & types of accounts affected by the transactions/activity

– Identify all account numbers & types of accounts affected by the transactions/activity

• Why does the institution think the activity is suspicious?

• Why does the institution think the activity is suspicious?

16

– First, describe the filer’s type of institution (i.e., XYZ Bank is a commercial bank with 400 branches located in 5 northeastern states; Send Money Quick is an international money transmitter with five offices in metropolitan Pretend City; We Make U Money is a securities broker, etc.)

– First, describe the filer’s type of institution (i.e., XYZ Bank is a commercial bank with 400 branches located in 5 northeastern states; Send Money Quick is an international money transmitter with five offices in metropolitan Pretend City; We Make U Money is a securities broker, etc.)

• Why does the institution think the activity or transaction is suspicious (cont.)?

• Why does the institution think the activity or transaction is suspicious (cont.)?

17

– Next, describe concisely but fully, why the institution considers the activity as suspicious – Next, describe concisely but fully, why the institution considers the activity as suspicious

– Be sure to include any relevant information about suspicious customer activity that the institution has in its files at the time the SAR is filed

– Be sure to include any relevant information about suspicious customer activity that the institution has in its files at the time the SAR is filed

• How did the suspicious activity occur?• How did the suspicious activity occur?

– In a concise, accurate and logical manner, describe how the suspect transaction or pattern of transactions were completed

– In a concise, accurate and logical manner, describe how the suspect transaction or pattern of transactions were completed

18

– For account activity, provide as completely as possible an explanation of the cycle of funds including the source of the funds in the account & application of those funds

– For account activity, provide as completely as possible an explanation of the cycle of funds including the source of the funds in the account & application of those funds

Additional Thoughts…Additional Thoughts…Remember to identify the teller or bank

representative who spoke with customerNarrate conversation with customer and

responseIf gave them CTR brochure, note that &

maintain in fileRemember to save tape if possibleIdentify transactions in narrative separatelyClosureBalance

1. The Introduction

1. The Introduction

• Provide a brief statement of the SAR’s purpose• Generally describe the known or suspected violation• Identify the date of any SARs previously filed on the

subject & the purpose of that SAR• Indicate any internal investigative numbers used by

the filing institution to maintain records of the SAR

• Provide a brief statement of the SAR’s purpose• Generally describe the known or suspected violation• Identify the date of any SARs previously filed on the

subject & the purpose of that SAR• Indicate any internal investigative numbers used by

the filing institution to maintain records of the SAR

20

2. The Body 2. The Body • Provide the relevant facts about all parties facilitating

the suspect activity or transactions• Provide the relevant facts about all parties facilitating

the suspect activity or transactions

21

Answers: Who? Answers: Who? • Identify all involved accounts and transactions in

chronological order by date and amount – do not use or insert tabular objects, tables, or pre-formatted spread sheets

Answers: What, Where, and When? Answers: What, Where, and When?

2.2. The Body (cont.)The Body (cont.)Explain in detail the filer’s position that

the activity or transaction is illegal or suspicious

Answers: Why?

Describe the method of operation of the subject:

Answers: How?

3.3. The ConclusionThe Conclusion

Summarize the report & include:

Any planned or completed follow-up actions by the institution

Names & telephone numbers of persons with additional information about the reported activity

Location within the institution where all SAR-related records are maintained

Supporting DocumentsSupporting Documents• Requests process–Phone call–Fax–Secured Email (preference)

• Documents to include–Mandate by BSA–Specific requests• Bank statements, signature cards, videos,

deposit/withdrawal slips• Electronic responses preferred

DownloadsDownloadsSAR databaseMonthlyFormatted for distributionVolume