Our current internal audit firm was recently purchased and the new firm is here conducting a BSA Review this week. When I questioned why they weren't sampling SARs, the response I received was that the changes made last year implementing Chapter X no longer allow for them to review SARs only regulatory agencies can review. The auditor also said their attorney confirmed this. I am not aware of this and wanted to know if anyone else has run into this problem.

Ask them to show you where in Chapter X that it says they cannot do a SAR sampling. My guess is that they cannot do it because it is not there.

Actually, before the changes were made last year, the foundation for such sharing may have been a bit vague. Now, I think its crystal clear that sharing for purposes of BSA compliance is allowed.

I'm worried about your auditor. I'm even more worried about their attorney. Call the Helpline to confirm your position before you talk to them.

Their attorney is interpreting "agent" to mean an affilated company of the bank, not someone contracted by the bank. I have a call into the FinCEN Helpline.
e) Confidentiality of reports;
limitation of liability. No bank or other
financial institution, and no director,
officer, employee, or agent of any bank
or other financial institution, who
reports a suspicious transaction under
this chapter, may notify any person
involved in the transaction that the
transaction has been reported. Thus, any
person subpoenaed or otherwise
requested to disclose a SAR or the
information contained in a SAR, except
where such disclosure is requested by
FinCEN or an appropriate law
enforcement or bank supervisory
agency, shall decline to produce the
SAR or to provide any information that
would disclose that a SAR has been
prepared or filed, citing this paragraph
(e) and 31 U.S.C. 5318(g)(2), and shall
notify FinCEN of any such request and
its response thereto. A bank, and any
director, officer, employee, or agent of
such bank, that makes a report pursuant
to this section (whether such report is
required by this section or is made
voluntarily) shall be protected from
liability for any disclosure contained in,
or for failure to disclose the fact of such
report, or both, to the full extent
provided by 31 U.S.C. 5318(g)(3).

An agent is any person, firm, etc. hired by the bank to do work for the bank. If your auditor's interpretation is correct, a lot of banks are in trouble for hiring lawyers to file SARs for them, and a lot of banks are in trouble for doing their required independent testing for BSA compliance by hiring outside accountants and/or auditors. The only thing you have to be sure of is that there is a confidentiality agreement in place, but that is a normal process for accountants and auditors. I think you need a new auditor.

Wrong paragraph. Try this:

(ii) Rules of Construction. Provided that no person involved in any reported suspicious transaction is notified that the transaction has been reported, this paragraph (e)(1) shall not be construed as prohibiting:

[Abridged & emphasis added]

(B) The sharing by a bank, or any director, officer, employee, or agent of the bank, of a SAR, or any information that would reveal the existence of a SAR, within the bank's corporate organizational structure for purposes consistent with Title II of the Bank Secrecy Act as determined by regulation or in guidance.



To do list: New auditor, new lawyer.

Spoke with FinCEN this morning and they agree, the attorney's interpretation is not what FinCEN is suggesting. FinCEN stated agent is to be classified as "someone who has a contractual agreement to review BSA Compliance for you institution."

Next on the Audit Committee Agenda, look for a new BSA Auditor...

One sensible thought once you've identified a competent BSA auditor is to include in the contract that no SAR or documentation for a SAR may be taken or sent outside the control of the bank, whether in original or any representational format. You don't want copies kicking around offsite.