Use and Protection of BSA Data Are Important to Nebraska Regulator

By John Munn, Director, Nebraska Department of Banking and Finance

The Nebraska Department of Banking and Finance enjoys direct access to Suspicious Activity Reports (SARs), Currency Transaction Reports (CTRs), and CTR exemption data through FinCEN. The information is invaluable in all of the Department?s examination processes and licensing functions.

The Department monitors SAR activity among our state-chartered banks on an ongoing basis and each month, SARs are downloaded, printed, and reviewed by legal staff for suggestions of criminal wrong-doing. After gaining approval from FinCEN and the Nebraska State Patrol, a SAR may be referred to the Nebraska Attorney General for follow-up with the county attorney.

In supervising mortgage and payday lending, direct access to the FinCEN data base allows the Department to know more about parties seeking licenses than would be possible without the data. Knowing a SAR exists, the Department may elect to return an application with a broad request for more information regarding past activities.

Nebraska also uses the BSA data during the evaluation process for executive officers. Nebraska is unique among states in licensing executive officers of statechartered banks. An executive officer?s license (EOL) is required for any bank employee who makes loans, invests on behalf of the bank, may hire and fire bank employees, or exercises major policy authority. In evaluating an EOL application, we determine whether any SARs have been filed relative to the candidate. We fully understand that the existence of a SAR is not evidence. If a SAR exists, we treat it as a possible indicator of the need for further fact-finding, not as an indication of any wrongdoing. To uphold SAR confidentiality rules, we do not disclose the SAR or any information concerning the existence of the SAR.

With great tools comes great responsibility. Department policies make certain that the BSA data to which we have access is carefully safeguarded. Only four of our Department staff have access to the BSA site. The four received FinCEN training, underwent a security check and were finger-printed. Downloaded BSA data files are delivered to the BSA examiner by encrypted email; the email is deleted and the email trash is emptied. At the conclusion of the examination, the file is deleted and trash emptied on the receiving computer. The information is never placed on a shared drive.

All records are stored on hard drives that employ full hard drive encryption. If retention of SAR data is needed after concluding a bank examination, select reports are printed and the electronic record destroyed. The printed records are assigned to an administrative assistant or examiner who keeps the documents under lock and key and makes them available as necessary to staff attorneys and review examiners.

Our Department is committed to handling the BSA data in line with the security and confidentiality safeguards required by FinCEN. We view FinCEN audits as an opportunity to enhance our understanding of FinCEN?s expectations for safeguarding this valuable data.

Excerpted from SAR Activity Review Issue 14, page 10