I am with a new (<2yrs old) FI; to date filed less than 10 CTRs and no SARs. While there aren't supposed to be quotas, our internal auditor thinks we should have filed a SAR by now. We use 3 different monitoring programs as well as have experienced staff with the ability to refer suspicious activity. I believe we can defend our actions. I am curious if anyone has a similar experience and if the regulators got tough about it.

It should only be questionable IF you have structuring, kiting, check fraud, loan fraud, insider fraud, or other "non-crazy money laundering issues" that are going unnoticed and unreported. It attracts attention because banks with low #s of SARs do sometimes have activity that is going unreported.

If you think through what your monitoring is looking at and know that you are capturing kiting, structuring (deposits, withdrawals, monetary instruments), check fraud, and other (loan, insider) types of activity, you can then defend your record.

If you find holes, plug them.

That is patently silly. You want an auditor who is smart enough to criticize your fishing techniques, not one who simply criticizes the fact you haven't caught a fish yet. It's a worthless criticism that expresses more ignorance than insight.

Most banks have some level of structuring, kiting, check fraud, etc. Perhaps you just have not reached that point yet.

Your auditor may be ineptly expressing a question of: are you covering all of your bases?

If you are looking at everything and truly have no reportable activity, then you don't have a problem.

A regulator (as I would) may look "more intently" to make sure no suspicious activity has occurred that was not reported because most banks have some level of suspicious activity - but if there is none, there is none.

Just make sure.

The auditor may be offering a rote recommendation based on a belief that if you haven't filed a SAR you aren't looking hard enough. That's more than likely a recommendation made out of ignorance.

On the other hand, it's possible that the message from the auditor is that he or she thinks you have missed something that you ought to have caught. You should expect more than the "you ought to have filed a SAR by now" recommendation in such circumstances; the auditor should provide the benefit if his or her observation of questionable activity.

Do yourself a favor and ask the auditor whether there's something of substance behind the recommendation.

I agree with John. Since you stated you're using monitoring programs, perhaps he was questioning your parameters? I would ask for clarification on what he basing that statement off of.

While there are most certainly not required quotas, I have heard from other compliance officers in my area that examiners are questioning the number of SARs filed (or not filed) based on the size of the FI.

B: "The [insert regulatory agency] said we are not filing enough SARs."

T: "They said that in the written report!?"

B: "No, they just said it during one of our meetings."

T: "First, your regulatory agency cannot talk. You had a field examiner who said that, not your regulatory agency. Second, it's a silly, irresponsible criticism, one they are explicitly told not to make. See the BSA-AML Examination Handbook, page 20 (document, not pdf):"

The federal banking agencies do not have targeted volumes or “quotas” for SAR and CTR filings for a given bank size or geographic location. Examiners should not criticize a bank solely because the number of SARs or CTRs filed is lower than SARs or CTRs filed by “peer” banks.

If it's dumb for an examiner to say it, I would say it's 34% dumber for an auditor to say it. I would not dispute the criticism, I would ridicule it.

You go, Ken!!