Once I've filed a SAR on a customer and that customer is then added to the High Risk list, then how long should I keep the customer on the High Risk list? At least for three months, six months, or a year? Any suggestions? Thank you,

We just had an outside auditor tell us that if we did not plan to conduct (separate) high risk reviews on SAR customers, we should not classify them as high risk just for that reason. So we lowered the points to medium. They get reviewed every 90 days anyway, so that made sense to me.

Once you file a SAR on a customer they will be reviewed at least one more time during the supplemental SAR review and again if a supplemental SAR is filed. If you quit filing the SARs, then the customer has either stopped the suspicious activity, you've gained understanding of the activity and determined it's not suspicious or your closing the account. I would not place a SAR customer on my HR customer list ever. The SAR will affect their risk score which in our system lowers some alerting thresholds. But that's it.

I am actually surprised to hear that I don't have to consider a SAR customer as a high risk customer because from my BSA experience, I've always been asked by FDIC examiners whether or not, all of my SAR customers had been put on the High Risk list. Also I had one examiner go as far as telling me to put a customer on the High Risk list just because the customer seemed to be related to another customer that I had filed a SAR for, even though the non-SAR customer had never conducted any suspicious activity.

Maybe I will try your suggestions and see what happens. Thank you.

I'm also in the camp of don't add a SAR customer to your high risk list. I stupidly did it once when an auditor suggested it and then got nailed for not following my high risk customer procedures. As an example, I file a SAR for suspected structuring, I'm going to review their account in 90 days to see if the activity continues, but I'm not going to do other things like review check volumes, ACH volumes, etc., like I would for a high risk customer because it's not applicable, either their structuring or their not. If they're not, then I don't file and I don't worry about them unless structuring pops back up.

If in my region we do not list this as a High Risk Customer there would be a lot of explaining to the Regulators. A High Risk review would take less time than dealing with the examiners .

I do bump my SAR subjects to the High Risk category. They are subject to expanded high risk reviews under my established schedule and procedures. In addition to the 90-day SAR follow-up review, generally, a SAR customer will be subject to at least one high risk review (6 month) and at least one moderate risk review (1 year after risk rating change from high to moderate), all dependent on what I see in the reviews. It gives me a better picture of "Has the activity stopped?" and the ability to make a case to examiners that "yes, that one SAR was just an isolated thing", etc. What I've found is that even though I have a few more peeps added to my review schedule, the "one-off, errant SAR customers" usually come off pretty quickly. The ones who remain on the review schedule deserve it.

The process of elevating SARs to high risk, IMO, has enhanced my program and my examiners are very pleased with what I am doing, so much so that they don't push me to implement recommendations that they typically make at other banks.

Our SAR customers are considered high risk after the filing. We review them every 90 days even if there is no follow up activity or a follow up report. The risk points drop off each year they go without additional suspicious activity or filings. After 5 years "clean" the SAR risk points disappear. It may seem like overkill; however, the reviews do not have to take hours, a quick scan of the past 90 days and some notes are all it takes. I think we all have those customers who love to test our patience with an occasional structured transaction every 18 months or so, this helps make sure that it does not go unnoticed or written off as a one off transaction when it may have in fact happened before.

This is a good discussion; there is no "rule" that any third party reviewer could cite a bank to saying that anyone you filed a SAR on is automatically classified as "high risk."

It's a function of your system for identifying high risk customers and the effects of such a classification. Assuming high risk customers are identified via a scoring system, adding "points" for a SAR filing means that any employee working with identifying high risk customers will know about all SAR filings. That might be an overshare.

The only thing about a SAR filing that might be automatic is the need for subsequent monitoring, at least for the next 90 days.
This is art, not science...several approaches are defensible.

Yep! I like that.. we are all BSA artists:)

IMHO, it's best to classify all SAR Subjects as high risk. While you're activity filing SARs upon them, the 90-Day Reviews become their de-facto "EDD Review" unless they have additional business characteristics which require additional steps (e.g. confirming MSB licensing). Once you are no longer actively filing, keep them on the high risk list for at least one year.

When examiners ask for a list of my HR customers - I give them a list of HR customers we have under EDD review & a list of customers we file SARs on. My SAR customers are high risk - but they follow slightly different procedures & timelines than my EDD customers.