SAR Log

Just got written up for not having a SAR Log. ANyone have something you are willing to share?

There's no requirement for a log. Was it an auditor or an examiner who claimed there is? Does your policy say you'll keep one?

He said it was a Fincen requirement, I am trying to google it now to find it.

BTW, it was an auditor.

Never heard of that. Where you might be in trouble is, like John said, your policy states you have one.

I would ask your auditor where in the reg it states that a log is required.

Found this.....

Under a FinCEN advisory published Tuesday, compliance departments should limit the disclosure of investigations that might lead to SARs to those on a “need-to-know” basis. Reviews of the reports should be held in a designated “restricted area” for SAR viewing, and each instance that a bank employee accesses a report should be logged, according to FinCEN.

Nothing in our policy about that.

Financial Crimes Enforcement Network
Advisory
FIN-2010-A014
Issued: November 23, 2010
Subject: Maintaining the Confidentiality of Suspicious Activity Reports


Additional risk-based measures to ensure the confidentiality of SARs could include, among other appropriate security measures, limited access on a "need-to-know" basis, restricted areas for reviewing SARs, logging of access to SARs, the use of cover sheets for SARs, or supporting documentation that indicates the filing of a SAR, or electronic notices that highlight confidentiality concerns before a person may access or disseminate the information.

Ah! That kind of log. It still doesn't appear to be a requirement, but a suggested way to mitigate the risk of revealing the existence of a SAR filing. So what else have you done to address that risk? It may be that you're adequately addressing it, and you haven't said it in so many words in your risk assessment.

They are kept in an administrative office in a locked filing cabinet, aside from training, polices etc.

IMHO - He was fishing. He was not able to find very much. He even prefaced by saying this is nit-picky but.....

So Does anyone have a SAR log they are going to share?

There's not much to this, in substance or otherwise. In essence, SARs are held in a secure storage unit. There is an inventory. Case numbers make development and maintenance of the inventory much easier. (If you're looking for a conceptual model look at the way your bank handles keys for unrented safe deposit boxes.)

* You take a SAR out, you date and initial the log and say why you removed it.

* You put it back, you date and initial the log to that effect.

* Some poor fool checks the inventory from time to time.

You're just lucky he did not write you up for not having cover sheets on each SAR! Now that, that's really a substantive contribution to SAR security.

P.S. If that's all he can find, you need a new auditor.

In most banks that I work with, the BSA Officer has sole access to SARs filed and no one but them has or is granted access, so it makes the SAR log rather moot. In other banks in which SARs are maintained electronically, access is limited and the system tracks access.

Ditto here on both counts.

My files are maintained electronically & accessible only to me (& in a week my new assistant, YAY! )


The electronic software "logs" everytime a case or SAR is viewed, so I guess that works for me.

For my old paper files, the only thing I've ever logged was on the inside cover when I've mailed supporting docs to Law Enforcement.

I don't think SAR logs are required. However, having a SAR is probably a best practice if you don't have an AML tool or you are a manual institution for the purpose of tracking. Auditor's and examiners are very visual and they want to see that you are tracking your 90-day follow up reviews.

I also use a SAR log for my quarterly reporting to the audit committee. I use it to provide stats on the type of suspicious filed (Structuring, kiting, etc) and the total count filed.

And ditto on rlcarey's post about BSA Officers. However, my new credit union I work for shares the SAR info with various depts and management, which I strongly disagree with. In my past banks we would even redact acct #s and client names before providing SAR copiies to auditors/examiners (per that banks policy).

Cheech,
Since things are pretty manual for me, i do keep a log on a spreadsheet. My headers include: date filed, accounts, customer, amount, from date, to date, 90 day follow up and reason for filing. Internal Audit and our Regulator really liked it.

Definitely not a BSA requirement but really works. I'm looking forward to Verafin within the next couple of weeks. I also keep a log for my SAR referrals.

Curious, huezoslb. Where did you hear about Verafin?

I wanted Bankers Tool Box but our former CIO was the one who ironed out the details. I have no idea how he heard of it.

On my log like huezoslb's, I added date reported to the board of directors.

OK, this is not a log of SAR's - this a log of anyone who has accessed, such as me (BSA Asst.), BSA Officer, Auditors, Examiners.

No such log kept here. I file SARs in a locked cabinet and am the only one with access.

I keep the SARs in a locked file cabinet and I am the only one with a key. I did have to give them to the examiners recently and once they reviewed them they went into a locked vault at the main office by a member of the SAR committee. The only log I keep of them is my 90 day review where I list all the SARS, the status, the date reviewed, and comments on if the behavior has or has not continued. Again, the log is kept in my cabinet.

Under lock and key, only accessable by me.

Verafin is great for logging who accesses the SAR in the software - their audit logs are extensive.

That's how we roll Randy. I'm the only with access, no need for an access log.

Locked Cabinet here too, only access is myself and my BSA Officer... We do keep a log on a spreadsheet but this is mainly a tracking of what we have filed. It comes in handy when the examiners come and ask what we have filed since the last exam. We don't keep track of who looks at the files and when, etc.

I write up the majority of our SARs. I don't print them, so I don't have a paper log. I fill them out on my PC using Adobe, and I save it in a file aptly named "SARs filed". It is on my personal drive.

I email them to the BSA Officer (CO), who reviews them and mails them off. I don't know if she keeps a file, but that is up to her, and kept confidential if she does.

No log needed, really.

I, personally, don't mind getting "written up" by our Auditors. it tells me that we have a good Audit team, and it is usually to bring some mundane detail back to the surface for me to work on. They're happy, I'm happy, my boss is happy. The CO is happy, because we are then better prepared for the REAL auditors, the OCC.

Thanks for everyone's input.