We had a customer give out account information to an unknown subject that had contacted her by Facebook - told her a story about being out of town and needing to get money being deposited on to another party who was in some sort of distress. The money came direct deposit to the customers account. She told the bank about the deposits and wanted them returned. After some research they were deposits from Colorado Dept of Labor and Employment. The bank returned the deposits as suspicious. The deposits were in the names of two individuals. When completing the SAR - should the customer be named in Part 1 subject information with her account information or leave that part blank - by not completing Part 1 the system makes us mark unknow box to be able to leave it blank

This is something I struggle with too. It really depends on the feeling you get from the customer as to whether you believe they were a victim or part of the scheme. One customer we believed to truly be the victim of a romance scam. Another customer, we believed to be involved after he told us he had been exited by multiple banks and not been given a reason. We got the out of state UI ACH 2 days after the account was opened in another name. We returned it, filed, and exited him too. At some point you stop becoming a victim and are complicit. Where that line is, is the tough decision.

If a customer facilitates money laundering, whether wittingly or not, we consider them a subject. This includes people who may simultaneously be victims, as may be the case in romance scams. If someone receives stolen funds and carries out instructions that appear to aid a criminal, or just keep the money for themselves, they're a subject. Law enforcement can determine whether their excuse warrants them not being charged.

In the case in the OP, I would not consider the customer a subject: She received the deposits, reported them to the bank, and requested they be returned. I don't consider that to be aiding in a crime.

I disagree with ColoradoAML. You only list suspects and mention the person who fell for the fraud (victim) in the narrative. If the victim is not really a "victim" meaning they know what is going on but are just trying to make a quick buck then they become a suspect.

I know you're not alone in disagreeing with our approach, so I'll add some support for people to consider as they're working it out for their programs.

I came to the decision to list all money mules as subjects based primarily on the FBI's money mule guidance, which states that "Acting as a money mule is illegal and punishable, even if you aren’t aware you’re committing a crime." https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/money-mules

To my view, it's not my responsibility to determine whether or not they knew what they were doing, should have known what they were doing, or were complicit. It's a crime regardless. Doing this also make law enforcement aware of money mules, so that they can be tracked, contacted and dissuaded from laundering in the future. For example: https://www.justice.gov/opa/pr/us-l...-2300-money-mules-global-crackdown-money

Finally, it greatly simplifies our process when someone wants to debate what motivated our customer, or whether or not we should believe them when they say they didn't know what they were doing. If a criminal knew that to get out of their crime, all they have to do is tell the bank they didn't know what they were involved in, the most convincing criminals will never have a SAR filed. I often wonder when a new customer comes to our bank and immediately attempts to wire stolen funds overseas to their "fiancé" whether the bank that probably just kicked them out reported them or not.

The narrative will include an explanation regarding how the mule received instructions or met the criminal, as appropriate and applicable, and law enforcement can use that in their decision to pursue the case, or can disregard it entirely.

whether one agrees with your approach or not, your bank took steps to "greatly simplify the process" and i bet there aren't too many "should we file a sar or not" conversations.

people often forget that filing a sar is not saying someone is guilt or innocent, just that activity is suspicious.

When banks experience unemployment fraud transactions, and the amount (singly or aggregately) is less than $5,000, are you opting to file a SAR, or just make a note-to-file of sorts since the amount is below the threshold?

I am filing a SAR in all instances of UI Fraud.

At this point in time we are also filing SARs on all instances of UI Fraud

Also, those with the ACH credit unemployment fraud transactions, are you keeping the accounts open, restricting usage, closing the accounts, or doing something else?

Entirely depends on the situation.....

We had a customer open an account and within 24 hours received a fraud UI payment from another state. His explanation was sketchy at best, we closed the account. Another customer was clearly the victim of a romance scam, we returned the funds to the state and kept the account open... no further suspicious activity on that.

We file fraud reports with the originating state if we are able (some states have easy reporting, others have it locked down so you can't get in without a registration number). We then provide those details in our SAR narrative.

We have filed two individual SARs regarding unemployment fraud which also had other reportable activities occurring. The rest of them have been lumped into a cumulative, reoccurring filing with unknown suspect and detailed narratives. We've been lucky that we haven't had a whole lot so all but one filing has been voluntary under the threshold.

We also reported several occurrences to our local USSS office per some of the guidance published along the way. At first they weren't really sure what to do with the info but eventually they got some internal procedures sent to them. If you have funds that you can't return for whatever reason (e.g. you don't have the full amount available to return) then local USSS can recover it on behalf of the issuing state.

We have exited nearly all customers who have received fraudulent deposits. They were either new customers or unwilling to cooperate in our investigation. We did have one who we determined to be innocent and cooperated fully so we issued him a new account number and online banking credentials.