We've recently been criticized by an auditor for not providing account numbers in Item 27 (Financial institution TIN and account number) when we file a SAR for fraud where our account holder is the victim only. They are saying that because the fraud was through our customers account then our customers account number should be provided in item 27.
The SAR instructions says (emphasis added) - "Check box 27a "No known acct. involved" if no account related to the subject is involved in the suspicious activity. We are under the impression that item 27a should be marked if the account doesn't belong to the subject. What is the proper way for handling this situation. If you could provide us with support for your response it would be helpful for us in our attempt to have this finding removed from the audit.