Due to the confidentiality restrictions when filing a SAR, what information can be given to the board of directors when they are informed of the SAR filing?

FDIC Part 353.3(f) states that the bank must promptly inform the board of the SAR filing but doesn't state what information, if any, can be disclosed to the board about the SAR.

We were always under the impression that we could only inform the board that there was a SAR filing but not discuss any details with them - is this true or only the opinion of one of our past examiners?

You can give them the SAR itself, if you want too. Most banks just summarize as to not put the board into the position of accidently disclosing actual content or names.

Is it best then, to leave out any specific details from board minutes and just put in the minutes the fact that a SAR was filed but with no names or summary of what occured?

Board Minutes

The Bank filed 6 SARs during the period of xx/xx/xx to xx/xx/xx

2 SARs were filed for structuring.
2 SARs were filed for unexplained transactions not normally associated to the business type the customer indicates in which they are engaged.
2 SARs were filed for fraudulent check activity.

How much you want to fil in the blanks orally, is up to the bank. Usually discussion remains in general terms.

Also, where do I find the penalties for violation of SAR confidentiality? (want to make sure everyone knows how important the confidentiality is)

Thanks

The civil penalties for disclosing the filing of a SAR have more than doubled as of August 1 or so. Now they can range from $53,907 to $215,628 per violation.

31 CFR 1010.821, at https://www.bankersonline.com/regulations/31-1010-821

In general, SAR filing reporting to the board should be statistical (example given above by Randy in post number ending in 9888). There might be situations when discussion of a particular SAR is needed., for example, if the activity described in the SAR exposes the bank to litigation, notoriety or other risks. In such cases, board minutes on the discussion should not reflect that the discussion is about a SAR filing. In fact, the discussion of the activity probably should be led by someone other than the BSA Officer.

FFIEC Examination Manual (2014) page 72 (document, not pdf):

Notifying Board of Directors of SAR Filings

Banks are required by the SAR regulations of their federal banking agency to notify the board of directors or an appropriate board committee that SARs have been filed. However, the regulations do not mandate a particular notification format and banks should have flexibility in structuring their format. Therefore, banks may, but are not required to, provide actual copies of SARs to the board of directors or a board committee. Alternatively, banks may opt to provide summaries, tables of SARs filed for specific violation types, or other forms of notification. Regardless of the notification format used by the bank, management should provide sufficient information on its SAR filings to the board of directors or an appropriate committee in order to fulfill its fiduciary duties, while being mindful of the confidential nature of the SAR.

Note, reporting SARs to the board is required by your regulatory agency, not the BSA or FinCEN. I'm sure that FinCEN thinks its the stupidest thing a bank could do. So does the ABA based on their published comments. The amount of detail provided is only an issue in community banks. Mega banks just report the activity to the board of directors in charts and graphs.

I report suspicious activity reports to the audit committee of the board of directors on a quarterly basis. I report the SAR number and the basics regarding the reason for the filing, for example structuring, unexplained large cash transactions, etc. In addition to NOT mentioning names I try to avoid going into a great deal of detail regarding the incidents. The board needs to have a general understanding of the number and types of incidents that we are filing for in order to see the trends and to make sure that we are doing our job and that staffing is adequate. That is not to say that certain filings will draw some more detailed questions from the committee. In these cases we remind everyone of the extreme confidentiality of the discussion and exclude specifics from the meeting minutes.

I've seen several FDIC exams where they wrote the bank up for reporting SARs to the board on a quarterly basis. Their regulation (as well as the OCC and FRB's) says they are to be reported "promptly." The FDIC concluded that quarterly wasn't "promptly." As the information is non specific and there is no benefit to getting it to the board "promptly," it's a nickel dime criticism at best. I would still take care to avoid it.

Thankfully, of all the things that the FDIC in our region seems to nit pic about, they have never questioned the quarterly reporting of SARs. When we were an OCC bank it was never mentioned and the examiners from the state department of banking are good with quarterly. I guess with the vague word "promptly" it leaves us open to all sort of criticism and it would depend on what regional examiners feel is "Best Practice" based on what they see at other banks in the region.