Could someone please help me understand whether or not the bolded prong of the SAR filing requirements is applicable to someone who has their billpay hacked at your FI and a fraudster sends out $5,100 to a payee? In those cases, we have always (And I worry mistakenly) defaulted to the rule of $25K on unidentified subjects. We haven't had any examiner issue arise from this, nor have we had our consultants bring it up, but I wonder if this has been a big mistake on our end since obviously any and all transactions fraudulents completed through your FI likely has a criminal activity component. Any thoughts?

FI's are required to file SARs with respect to:

Criminal violations involving insider abuse in any amount.

Criminal violations aggregating $5,000 or more when a suspect can be identified.

Criminal violations aggregating $25,000 or more regardless of a potential suspect.

Transactions conducted or attempted by, at, or through the bank (or an affiliate) and aggregating $5,000 or more, if the bank or affiliate knows, suspects, or has reason to suspect that the transaction:

May involve potential money laundering or other illegal activity (e.g., terrorism financing). 54

Is designed to evade the BSA or its implementing regulations. 55

Has no business or apparent lawful purpose or is not the type of transaction that the particular customer would normally be expected to engage in, and the bank knows of no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction.

I was stumped as well...

hmmmm
you customer has billpay through your FI.
the billpay is hacked and sends out $5200.00.
can the customer provide you any information about where it went?
i would think even if the information filled in to initiate a billpay transaction could be false, the customer would still be able to provide your FI with a "suspect"

Good point, and thank you for the reply JennKK2! That's my confusion. Those recipients in my experience of the funds are often mules with no real identifiable information to where we could formulate an opinion that they should be the subject of a SAR. It just seems so flimsy, and there would be thousands of SARs per month of "attempted by, at, or through the bank" with virtually worthless subjects, especially if you consider the amount of fraudulent transactions our Fraud Monitoring and BSA/AML Software catch and thwart. My team of 4 BSA personnel would have to jump considerably, but if that's what it means then I suppose we have interpreted it improperly for the past 50+ years and have some ground to make up.

I also looked at the SAR FAQ for clarification and it was more or less useless.

Violations aggregating $5,000 or more where a suspect can be identified. Whenever the bank detects any known or suspected Federal criminal violation, or pattern of criminal violations, committed or attempted against the bank or involving a transaction or transactions conducted through the bank and involving or aggregating $5,000 or more in funds or other assets........and the bank has a substantial basis for identifying a possible suspect or group of suspects. If it is determined prior to filing this report that the identified suspect or group of suspects has used an “alias,” then information regarding the true identity of the suspect or group of suspects, as well as alias identifiers, such as drivers’ licenses or social security numbers, addresses and telephone numbers, must be reported."

I feel like the payee on a funds transfer for fraud isn't a substantial basis for filing a $5,100 bill pay fraud SAR when the true identity isn't known.....who knows? Maybe our examiners and consultants missed a HUGE hole in our system?

Sorry if I misunderstand the question, but how could someone who receives $5,100 in fraudulent funds not be a subject in a SAR? What else could be happening other than that person committing or facilitating fraud?

Good question. What happens is fraudsters will often phish info out of our customers, use their banking credentials to initiate a transfer to a mule at another FI who receives the funds and so on, layering the funds. In this case we often use 314(b) to to reach out to the other FI and determine whether or not the their customer is the criminal. 10/10 times, their customer was also being swindled in a romance/phishing/lottery fraud by someone else and layering it to yet another party. What I'm getting at is the way these fraudsters move the funds through multiple victims accounts, you are almost never getting enough info to form a reasonable belief that you have uncovered the true identity and able to file a SAR in the way I've historically understood. In these cases we wait until it either meets or aggregates up to 25K and file with everything we know (e.g. IP Address, e-mail addresses associated, etc..).

I hope that makes sense!

That makes sense. In my understanding, acting as a money mule is illegal regardless of whether the person doing it is witting or unwitting. Otherwise, these customers who help steal money and give it to criminals repeatedly are effectively immune, and every money mule would just use the same excuses that they just thought they landed the perfect job or found the love of their life.

From the FBI: "Acting as a money mule is illegal and punishable, even if you aren’t aware you’re committing a crime." https://www.fbi.gov/how-we-can-help...fety/common-scams-and-crimes/money-mules

It simplifies things quite a bit for me to remember that it's our job to report suspected criminal activity, not to determine if someone needs to be prosecuted. If no one reports this person, and they're committing fraud at multiple banks with dozens of suspects, are we collectively doing what we're supposed to be doing to stop fraud?

If we have a payee name that a fraudulent payment is directed to then we consider that to be a suspect and thus subject to a $5,000 threshold.

Boy that really creates a massive burden, especially when an innocent grandma is on the receiving end of a transfer and thought she was getting funds from her fiancé. Sounds like a lot of SARs with useless info, so the bad guy wins either way. Dang….

I’ll check with FinCEN to ensure the final answer and report back, but if this holds true I’ve got some proposals to make to hire more people. 😀

To maybe restate my point another way, if money was stolen from me and sent to someone else, and that person went on to send it to some crook, I would not consider them an innocent victim. They may be a victim of a scam, and they may deserve some sympathy, but that doesn't make them innocent and doesn't mean that they didn't conduct criminal activity that falls in SAR reportable thresholds.

I don't think they are completely innocent, naïve perhaps and certainly collateral damage in the true perpetrator/subjects scheme. For example, if you fell in love with a person you met online, thought things were getting serious, and you sent $6,000 to who you thought was your significant other to help them move to be closer to you and the funds went to Jane Smith (sorry I don't know what gender/orientation you are). On the other end of that transaction, Jane Smith also fell in love with someone and was told she would get some money from her significant other and lo and behold - your wire shows up in her account - and she follows the instructions to send the funds to a "travel agent" Bob to arrange the flight for her sweetheart to show up. Meanwhile, the real fraudster, whose true identity is unknown, just scammed you out of $6,000 and layered it through another of their victims - Jane Smiths- account to Bob who will continue the layering sequence. Is it fair to say a SAR should be filed on you as someone who sent the original funds for the fraudsters scheme? Jane who received the funds from whom she thought was her loved one? Would it be Bob the travel agent? All three?? I hope you see where I'm coming from..... when you have seemingly innocent people roped into a fraudsters scheme it isn't a simple - A sent money to B, so SAR must be on B even though B isn't probably the real subject.

That's why this $5K rule on an A to B situation seems crazy when A was duped and B isn't a true identity of the fraudster....I'm still waiting to hear from FinCEN....

If someone is scammed into sending $6,000 of their own money, they are a victim of fraud and should not be a subject. If someone moves $6,000 of fraudulently obtained money, regardless of the pretexts under which they sent the funds, they are acting as a money mule and should be listed as a subject. Trying to determine the motivations of someone committing criminal activity through the institution seems like it overcomplicates the situation needlessly and seems like it puts you at risk of noncompliance and at risk of allowing criminal activity to continue unreported.

I do understand your point, but someone being tricked into committing a crime doesn't mean they didn't do it or are immune from consequences. If someone tells me that the speed limit in a school zone doesn't apply to me, that doesn't prevent police from pulling me over.

Quote

What I'm getting at is the way these fraudsters move the funds through multiple victims accounts, you are almost never getting enough info to form a reasonable belief that you have uncovered the true identity and able to file a SAR in the way I've historically understood.

i didnt think we had to form a reasonable belief we knew who the suspect was in order to file a SAR. the hacker created a bill pay transaction therefore you have a suspect. someone good or bad is getting the money. they are another scammer or they arent; regardless the transaction creates a "paper trail". again you can get your IT involved. alot of scammers and hackers do actually use the same names and locations.

Jenn - If you identify the recipient is another victim, does that change your opinion?

no it does not change my opinion. how would you know the recipient is not?

314(b) is generally how I find out

i definitely understand the scenarios you provided above, and agree there would be an enormous amount of SARs. but if i KNEW the person receiving the funds was NOT a bad guy, i would put that information in the SAR narrative along with the 314b information. consistency in the decision not to file a SAR would be key if you have followed the guidance and nothing meets the threshold definition, then i would not file a SAR.

Thank you for your response Jenn. We have consistently erred on the side of identification with a substantial basis (can positively ID the perp), but hopefully when FinCEN gets back to me it will put it to rest. I tend to think they will side with you and the others who have posted similar sentiments about identifying the payee as the subject.

Total BSa I am hoping you post back here once you hear on this, as I am interested in hearing what they had to say on this. Thank you!

Snowgirl - I certainly will. I haven't heard anything from my e-mail, so I'm going to call them today and see what is happening with the response. I haven't forgotten about you! It's certainly a big deal pending upon how they fall on this issue.

Here is the info I received on 11/14 from FinCEN. I only had to e-mail and leave several voicemails like a crazy ex-lover, but we do what we have to do right? Thoughts??

Good day,

Thank you for your recent inquiry. The financial institution will rely on it’s investigation to determine how much information that they have on a subject. Please refer to page 139 of the FinCEN Suspicious Activity Report (FinCEN SAR) Electronic Filing Requirements:
XMLUserGuide_FinCENSAR.pdf (treas.gov)

A financial institution must report any transaction that requires reporting under the terms of 31 CFR Chapter X if the transaction is conducted or attempted by, at, or through the financial institution and involves or aggregates at least $5,000 ($2,000 for money services businesses, except as provided in Section 6 of this document) and the financial institution knows, suspects, or has reason to suspect that the transaction or pattern of transactions of which the transaction is a part:
• Involves funds derived from illegal activity or is intended or conducted in order to hide or disguise funds or assets derived from illegal activity (including, without limitation, the ownership, nature, source, location, or control of such funds or assets) as part of a plan to violate or evade any Federal law or regulation or to avoid any transaction reporting requirement under Federal law or regulation;
• Is designed, whether through structuring or other means, to evade any requirement of 31 CFR Chapter X or any other regulation promulgated under the Bank Secrecy Act, Public Law 91-508, as amended, codified at 12 U.S.C 1829b, 12 U.S.C. 1951-1959, and 31 U.S.C. 5311-5332.
• Has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage, and the financial institution knows of no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction, or
• Involves the use of the financial institution to facilitate criminal activity.

Please review page 147 of the FinCEN Suspicious Activity Report (FinCEN SAR) Electronic Filing Requirements:

XMLUserGuide_FinCENSAR.pdf (treas.gov)
Part I Subject Information: Complete a Part I section on each known subject involved in the suspicious activity. Persons who are victims of the suspicious activity are not subjects and should not be recorded in a Part I section. Victim information, if necessary for a complete description of the suspicious activity, should be recorded in Part V. If the subject is or all subjects are unknown, complete a single Part I record with box 2b checked to show that all subject information was unavailable for critical Items 4, 5, 11, 12, 13, 14, 15, 16, 17, and 18. These critical items (denoted with an asterisk “*”) except Item 27 must be blank. Record the nature of the unknown subject(s) in Part V. If the suspicious activity involves known and unknown subjects, complete a Part I section on each known subject and record the nature of the unknown subject(s) in Part V. Do not complete Part I records on the unknown subjects when there are known subjects.