Okay, what had happened was...
Mr. X owns XYZ Properties LLC. He has multiple business and types of businesses. He employs Ms. Y and she manages his office for XYZ Properties LLC, she is a signer on the bank account. He also operates XYZ Pharmacy and employs Ms. Z there. Often Ms. Z collects the daily banking business from Ms. Y at the other company and brings all the transactions to the bank.
Mr. X wanted to purchase another property and put up half the purchase price with cash on hand. Two deposits are made to XYZ Properties LLC on consecutive days, both below the reporting threshold. Both deposits are carried to the bank by Ms. Z from the pharmacy. Based on comparison to other documents, it appears that Ms. Y completed the deposit slips. Following the cash deposits and a transfer from a LOC, a check was issued in the exact amount to a RE attorney.
The cash and RE transaction are not suspicious for this customer. Only the manner in which the two cash deposits were made appears suspicious. This has been presented to committee and there are questions as to who the suspect is. Some say Ms. Z because she was the conductor. Others say Ms. Y because she likely completed the deposit slips. And then there is Mr. X who may or may not even be aware of the manner in which the deposits were made. Who do you think the suspect or suspects should be? And, is there any guidance out there clearly outlining who should be included in the SAR? All parties, only one? I have been asked for something in writing to back things up..
As always, thanks for your insight!

Personally, I would list all parties in this scenario and describe all of the information in your narrative.

Does Ms. Z typically bring in cash deposits? Or is this an isolated event because of the purchase of another property? Has everything been "normal" up to this point?

Ms. Z, according to branch staff, typically brings all the banking for Mr. X's various businesses. She must come almost daily for the pharmacy so it seem logical that she would act as courier. I believe all the businesses are quartered in the same building or complex.

I don't think I'd list Z as a suspect. She's a courier, and you don't seem to think she's complicit. If anything, she'd get a mention in the narrative.

Would you consider non-expert examination of Ms. Y's handwriting by comparison to other documents she has written ( checks and deposit tickets)proof enough to support the suspicion that she completed the two deposits in question? In other words, she is the only other signer on the account and all the other deposits are filled out in what looks like the same handwriting, is it stretching to say it appears she completed the deposits in question? Legal counsel does not like this statement.

I think I would list all of the parties. Remember, this is a suspicious activity report, not a confirmed illegal activity report. Also, there is nothing wrong with saying that the handwriting looked similar. We do it all the time. Again, you are not providing expertise in handwriting analysis, you are only stating an opinion and a suspicion.

See this from FinCEN where handwriting similarities is mentioned.

From a SAR Review

Retread, when you say "list all of the parties" are you meaning as suspects or in the narrative.

The initial posting includes what I "know" and what I suspect based on the historical patterns I gleaned from branch staff etc. My SAR Committee is being very cautious about pointing fingers and would like proof and supportive guidance in writing.

Rant warning:
FYI my original narrative included mention of all parties and their involvement (X, XYZ LLC, Y, and Z)and using the new FincenSar I listed XYZ LLC, an entity, as the subject. I honestly cannot imagine where to go with this one at this point and my head is getting sore from thinking it to death. As for some guidance that says "if a company is involved you must include all principal and beneficial owners... or you must include all conductors as suspects... or the lady in the office who fills out the deposit slips must be included.." I just can't seem to find it. It is not as simple as filing a CTR, beneficiary here - conductor here blah blah blah.... Facts on one hand suspicion on the other, apples and pomegranates, diamonds and sandstone; steak and tofu....

Ok sorry bout that, and thanks!

I don't think there is any real guidance out there on who to list as suspects. In the end, law enforcement will decide if and when they decide to bring charges. We just list as suspects anybody who is involved in the activity in any way, shape or form. If it's a business, we list all signers and anybody else who appears to be involved. Law enforcement can sort it out in their investigation. Again, you are reporting your suspicions, not hard provable facts.

I had a similar situation very recently. A man was coming in making deposits to a business account (as payment for leasing a building). He was not an owner in the business or a signer on the account, simply making deposits.

The man was obviously structuring deposits - because of a misunderstanding of the CTR reporting threshold. He must have thought that he can't make a $10,000 cash deposit, because he was splitting the deposits into two (and sometimes three) transactions on the same or consecutive days. But it was only a $10K deposit (not over $10k). His transaction wouldn't have required a CTR, but now since he was trying to avoid what he THOUGHT was a reportable transaction, it created a whole new issue (a SAR).

Anyway, I have no idea if structuring was HIS idea, or the instruction of the owner on the account. Regardless, I listed both parties on the SAR. I explained all that I knew in the narrative.