We have a customer that we have recently discovered is kiting between us and another FI. The returned items were recently brought to the attention of the BSA Department. However, it appears that this customer has been kiting without incurring losses for quite some time. At this point, the loss is always covered, but the customer is definitely using float times to their advantage.

I can see this type of activity going back at least 2 years, it just wasn't caught because the checks weren't always returned as NSF.

How far back do I go on the SAR? We are over the $5k threshold just for the past 3 months, so we meet that test. But do we research this all the way back to the beginning when we can tell it started (over 2 years ago) and list all of the activity?

If you conclude that two years of transactions are suspicious, you file the SAR on two years of transcations. Carefully document the investigation process paying particular attention to the date and the "how" that you became aware of the kite so an auditor or examiner doesn't try to claim that the SAR is filed late. As long as you file within 30 days of determining that this activity was suspicious, the SAR is timely.

and make sure you start returning checks before the other bank does, or you will be left with the loss...and close that account, too, if not already done

Another anon opinion here:

If I found that going back 2 years was going to take hours and hours, I would generally be satisfied with reporting "a reasonable timeframe," such as, the past 90 days, or "year to date," or whatever amount of research would be sufficient to satisfy myself that it was indeed suspicious and needed to be on a SAR. But for instance if you already looked at 2 years and think it might go back 5 years, I'd certainly stop at 2 years.

One risk is that someone will allege, with their 20/20 hindsight, that you should have caught this years ago.

And it is possible that they would be correct with their assumption that is should have been caught previously.

Having documented procedures for how to determine a review period would probably resolve this problem. It at least gives you something you can point to when an examiner asks why you stopped "here" instead of "there." If they don't like the procedures, fine, but at least it's not arbitrary. The last thing you want to do is fail to report something that's suspicious because it's too much work or it takes too much time. That kind of thinking seems to end up with CMPs.

Consider implementing something simple like when suspicious activity is discovered, the previous 90 days will be reviewed to determine if it's a broader pattern. If so, go back 90 more days; if not, stop.

If you think this activity happened for five years, there's not a great compliance-supported reason for you not to review five years of activity.

when did you determine that this activity was happening?