We have been following the same process for years respecting SARS. We are a mid-sized bank and we don't have hundreds of SARS to file. We have been examined for years and they have never faulted us on our management of the SAR process, narratives, etc. etc. So, we are having a new audit firm review our stuff. They are citing two "violations" (their term). I don't see these as violations but, rther, observations of where we may improve. They comments are as follows:

The bank does not properly document the date of detection; therefore audit is unable to verify if the SARS were filed in a timely manner. (Currently our SAR files have either a report from the AML program, or note provided by a teller or similar. We do not have, in writing, a statement, "the suspicious activity was deteced first on Xx?XX/XXXX".

The bank does not document the reason for not filing a supplemental SAR after the activity warranting the filing of a previous SAR has lapsed. Our subject of SARS are put on a high risk list and we monitor, monthly, for at least a year. We do not specifically make a notation in the previous file or any separate file that "today it is 90 days (or 120) from the date of the SAR filed on XX/XX/XXXX on Jane Doe. We are not filing a supplemental SAR because...there is no further suspicious activity)"

This all sounds nice, going forward, but are these actually violations? I can't see where this is spelled out in the Examination manual or elsewhere.

Comments welcome.

If I understand correctly, and maybe I don't, you don't document the date you determine that unusual activity is determined to be suspicious? If that's correct, my question would be "When does the 30 or 60 day clock start?" I don't think you need an official statement, but there should be a date when the activity is determined to be suspicious. I would tend to agree with your auditors.

Regarding your second comment. You file a SAR on X. You place X on your high risk list. You monitor their activity for some determined time frame. But you do not conduct a subsequent review prior to the subsequent SAR filing deadline? How do you document if X's activity post SAR filing is suspicious or not? I would agree with your auditors with this as well.

I will say this though. I've never seen an auditor write something up as a "violation." I've seen various verbiage from findings, observations, enhancements, recommendations, etc. My biggest issue would be with how they write up the findings.

In my part of NY the OCC would expect that information. Proper documentation is always a concern and always strive to improve. If it was to be an actual violation the violation citation should be included in the finding so you would be able to review it to ensure that your ongoing processes are in compliance with the entire regulation.

They are not "violations" and I would insist they use a different term. You cannot choose your regulator, but your auditor reflects a choice.

1. According to the reg, the date of initial detection starts the clock. According to subsequent guidance, the clock starts to run when the bank made a decision that the SAR filing was necessary. If you use a SAR filing committee, their minutes should clearly reflect the date of the decision. Your auditor's suggestion is apparently an effort to make it easier for them to evaluate which you are using.

It's a judgment call, but I would not do it. If a reviewer says I'm late, we'll discuss it based on facts and circumstances. A file review should alert them to the date of detection; you're not obligated to cut their meat for them.

2. The Exam Manual says that the reason for non filing should be documented. They are apparently presuming that if you filed one SAR on a customer, that you would obviously need to file another and should explain why you didn't.

Maybe. I'll agree that the 90 day review should be documented. However, as far as needing to write down "We found no suspicious activity in this 90 day period, so we didn't file a SAR," sounds a tad childish to me.

Same for me Ed. But if I had to guess, you and I are in the same neck of the woods.

Actually we are.

I agree with Ken. Maybe a recommendation - violation - no way.

I'll join this chorus as well.

I would also pay specific attention to the other part of Ken's quote that I really like:

" You cannot choose your regulator, but your auditor reflects a choice."

Here, we do list in the narative "the Bank first detected the activity on xyz date" so it's clear to all when we did versus having to go fish through documents. As for the 90 day follow up, if we filed an initial SAR and found one was not needed 90 days later for whatever reason, I type up a quick memo or even handwrite a quick note, the date and a brief reason why we didn't file (i.e. activity stopped, transaction appeared isolated, etc). We do both these things by choice and not due a past criticism but agree with the others, these are not "violations" and would argue that if they are insistent, they use the "best practice recommendation" language, typically what we find auditors will use.

Our BSA Compliance Program clearly states that the 30 day clock starts when our SAR Committee determines something is suspicious. Examiners accepted this at the last exam with one exception, employee fraud.

In the case of employee fraud they indicated that the clock starts on the day of termination.

The SAR rules require that a SAR be filed no later than 30 calendar days from the date of the initial detection of facts that may constitute a basis for filing a SAR. If no suspect can be identified, the time period for filing a SAR is extended to 60 days. Organizations may need to review transaction or account activity for a customer to determine whether to file a SAR. The need for a review of customer activity or transactions does not necessarily indicate a need to file a SAR. The time period for filing a SAR starts when the organization, during its review or because of other factors, knows or has reason to suspect that the activity or transactions under review meet one or more of the definitions of suspicious activity.67

The phrase "initial detection" should not be interpreted as meaning the moment a transaction is highlighted for review. There are a variety of legitimate transactions that could raise a red flag simply because they are inconsistent with an accountholder’s normal account activity. For example, a real estate investment (purchase or sale), the receipt of an inheritance, or a gift, may cause an account to have a significant credit or debit that would be inconsistent with typical account activity. The bank’s automated account monitoring system or initial discovery of information, such as system-generated reports, may flag the transaction; however, this should not be considered initial detection of potential suspicious activity. The 30-day (or 60-day) period does not begin until an appropriate review is conducted and a determination is made that the transaction under review is “suspicious” within the meaning of the SAR regulation

http://www.ffiec.gov/bsa_aml_infobase/pages_manual/OLM_015.htm

I do not believe that the clock starts at day of termination

They just flat made that up.

agreed

Ed made a critical point:



There will be no citation for either criticism. While the Manual does say that decisions not to file a SAR should be documented, you cannot "violate" the Manual.

Note too, that replying to the audit is your prerogative. In this case, if they did not revise their language, my reply would say they were asked for citations and did not provide them and that they had elevated their personal opinions to the status of legal requirements.

Some auditors liked me. Some didn't.

Note too, that replying to the audit is your prerogative. In this case, if they did not revise their language, my reply would said they were asked for citations and did not provide them and that they had elevated their personal opinions to the status of legal requirements.


What is not to like

And that simply makes zero sense at all.

let's not assume that just because one is an auditor that they have any greater understanding of the manual or the rules and that their word is gospel.

I need to retract the part of my first response regarding indicating when the activity was first detected. I found a FinCEN slide show on writing the SAR narrative from 2003. One of the bullet points is:

*Identify when the activity was detected.

As far as I am concerned, if FinCEN has ever said something in writing (regardless of the medium) whatever they said represents the correct answer. Thus, indicating when the activity was detected now falls under the heading of good advice as far as I'm concerned.

Regardless, you cannot "violate" a slide show. That part of the auditor's observation remains inaccurate.

Thank you, everyone. You made excellent points and how to address the violation language. I am all for outside help but I find they try to elevate best practices to violations with too much zeal. Behind this is the need to point out how vital they are to our success. I will put something in the files to flag 90 day review.

So, we got our prelim report. The audit is not using violations but is citing/quoting the examination manual in support of their "findings". Never saw this before/ Anyone else?

If it is in the Exam manual there is a good chance that it will be picked up and cited by the regulator (even if not a violation). Better for internal/external to find it than the regulators.

^ agree 100%. Most of the Big 4 audit firms base their AML IA's off of the exam manual.

Let me agree. The bank should be following the exam manual. That is how regulators and any auditor worth their fee will judge the program. That manual lays out the expectations.

Every external BSA firm that we've ever encountered uses the term "findings" in the audit report.

Audit finding is pretty standard lingo for an audit. I was a little suspect about your original post and the fact you claimed they wanted to use the term "violation..."