We've recently been criticized by an auditor for not providing account numbers in Item 27 (Financial institution TIN and account number) when we file a SAR for fraud where our account holder is the victim only. They are saying that because the fraud was through our customers account then our customers account number should be provided in item 27.

The SAR instructions says (emphasis added) - "Check box 27a "No known acct. involved" if no account related to the subject is involved in the suspicious activity. We are under the impression that item 27a should be marked if the account doesn't belong to the subject. What is the proper way for handling this situation. If you could provide us with support for your response it would be helpful for us in our attempt to have this finding removed from the audit.

Thanks.

The quote from the SAR instructions that you cited should be all the proof you need. Let the auditor explain why they are contradicting the SAR instructions.

SAR XML User Guide from FinCEN (version 1.4 Feb 2020). They agree with the auditor.

Page 163 Item 27: An account is related to a subject if the subject owns the account, has control over the account, or conducted activity in or through an account the subject does not own or control.

Thanks for the update, that's good to know.