Due to the fact that I'm a newbie and have never been through an exam, I'm looking for some guidance regarding the decision not to file a SAR, as I'd rather know sooner than later and not get slammed!

My question is regarding automated BSA/AML systems, and the cases/alerts/whatever you call them that they create. By clearing/working these alerts, the operators are placing notes on the alert stating why the activity isn't suspicious if they are "waiving" the alert, and including an Excel spreadsheet when applicable. Is this considered a documented decision not to file a SAR? My assumption is yes, because you've explained why you decided to waive the alert, you've documented the reasons why you don't deem the activity to be suspicious, and you've shown that you've completed your due diligence.

The only thing I could possibly see going wrong with this is an examiner wanting memos in which these decisions are documented. I guess this may be one of those scenarios in which it's left up to opinion, however I was looking to get some feedback on the process in which other people are documenting their decisions not to file.

Thanks!

In your shoes, I would say that a simple "alert" does not suggest your bank ever considered filing a SAR. It prompted some enhanced due diligence, but once the activity was identified as the normal course of the customer's business the investigation was stopped. As you say, the activity simply was not suspicious.

There has to be a point when an investigation goes beyond the "alert" stage when the scale tips. As you say, examiners will likely value their opinion more than anyone else's, but others may be in a better position to tell you where they have been told the exact tipping point is.

We use BAM and BAM+ which creates alerts. The alerts are reviewed by our BSA analysts and either cleared or sent to case. Each of these actions requires an entered comment and is then part of an audit trail (analyst name, date and comment) that can be reproduced at any time for an auditor or examiner. We consider cases as SAR/no SAR, while alerts, as Ken suggested do not reach that level.

Thank you both for your responses.

Devsfan touched on exactly what I was about to comment on, the case creation from alerts. Currently, we do not have a procedure in place (not my doing, trust me!) in which alerts are escalated to cases. We may down the road once the training wheels come off this program, but for now that's just how it is. In addition, we don't file SARs though the BSA/AML program. As a result, we simply review the alerts, and in the event that it's file-worthy, we take it to the others in the department and it gets filed. In this process, we never want to bring something to the table that we're not real confident will get filed, so 99.99% of these "escalated" scenarios are filed.

I guess to play devils advocate, because I'm sure somewhere down the line someone will, who's to judge how long someone worked on an alert or the amount of investigation associated?

The Big/Regional banks have been using these types of metrics for quite some time. It's actually quite useful to determine the effectiveness of analysts.