Our auditors asked to see the actual information that was being transmitted to FinCEN for or CTR's and SAR's. We had to request this from our AML vendor. They wanted to see the lines of information and are comparing it to each CTR and SAR. Has anyone else has an auditor or examiner ask for this information? Our vendor says that this is a first for them.

Last time our auditor was here, he said that they usually look at the batch file (which I'm assuming would be the lines of info that you're talking about). I gave him a printout of the CTRs & SARs, but I have a feeling that next year he'll be asking for what you're talking about.

Where's rlcarey?

He has long said (and somewhat raved in our private communications) that banks need to actually look at what they are submitting and that they would be appalled if they did so. Not every vendor's software is as foolproof as they claim.

Any auditor or examiner worth their weight in salt should be asking to review the actual batch submission files that are sent to FinCEN. Just because some screen on the front-end system looks correct, unless you review the actual submission files, how would you ever know what is actually being transmitted.

I can't tell you how many errors I have found in the submission files from some of the main AML software vendors.

You have a five year retention period for this data:

FinCEN Currency Transaction Report (FinCEN CTR) Electronic Filing Requirements

"Filers are required to retain a copy of the FinCEN CTR data and all original supporting documentation or business record equivalent for five years from the date of the report."

The data they are referencing has nothing to do with what appears in the AML software - it is the data transmission files. These should be readily available for both auditors and examiners.

Yeah, right. I think that's universal vendor code for, "It's almost time for me to go and I don't want to look into this." This is most often followed by "I suppose we can provide this info, for a fee."

The way some vendors process submissions involves aggregating not only your bank's data, but data from all the other banks they are supporting into one huge file, which is then submitted. Obviously, this provides a huge hurdle in extracting your information and determining whether it's prepare correctly.

For a different reason (merger), I'm looking for the requirement for SARs.

I didn't see the same verbiage in the FinCEN SAR electronic filing instructions but I'm still looking...anyone know? It seems the same logic would apply - retain the "data" that is being transmitted through the vendor (not just a copy of the SAR).

It is right on the first page:

Filers are required to retain a copy of the FinCEN SAR data and all original supporting documentation or business record equivalent for five years from the date of the suspicious activity report.

Ugh, I was word searching through an older version of the instructions. I'll save the newest one. Thanks Randy!

Some of the vendors will say that even after your have reported it multiple times. It is a stock answer.

My come back is "Am I to believe that my FI is the only one who complies with regulation".

I have also asked to speak with the Vendors compliance officer. At one I was told that I was speaking to her. My response was that they need a better one. That shocked my boss and the Compliance Officer who were on the conference call with me but of course we were right.

Thanks for the responses.