SAR Reporting unidentified suspect

We were suggested by our internal auditor that we don't need to file SARs on fraud cases of identity theft, because there is no suspect. Lately,identity theft case has increased in our financial institution in the past year by 20%. We have been filing SARs even if don't have a suspect. Thoughts?

First, welcome to BankersOnline threads. Second, we may want to evaluate if your internal auditor has sufficient subject matter expertise to perform an independent BSA Audit as this is one of the five BSA Pillars.

The BSA Exam Manual is very specific about the requirements for SAR filings at the $25,000 threshold when a subject cannot be identified.

•Criminal violations involving insider abuse in any amount.
•Criminal violations aggregating $5,000 or more when a suspect can be identified.
•Criminal violations aggregating $25,000 or more regardless of a potential suspect.
•Transactions conducted or attempted by, at, or through the bank (or an affiliate) and aggregating $5,000 or more, if the bank or affiliate knows, suspects, or has reason to suspect that the transaction: ◦May involve potential money laundering or other illegal activity (e.g., terrorism financing).54
â—¦Is designed to evade the BSA or its implementing regulations.55
â—¦Has no business or apparent lawful purpose or is not the type of transaction that the particular customer would normally be expected to engage in, and the bank knows of no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction.

The FinCEN even has a checkbox in Part I that can be used when a subject is not identified. (Note the Electronic Filing Instructions state this box is only to be used when no subjects are identified. If I identify a subject, but then there are additional unknown subjects, instead of having multiple Part I's with only that box checked, describe the unknown subjects as best as you can in the narrative.) For example, I identify the subject to whom the ID thief wired funds in Part I, but describe the unknown subject who called the customer to steal their information in the narrative since they never provided their name on the phone.

We struggle with this too. I would love to apply the $25K threshold, because that would eliminate most of it, however, quite often we have SOME sort of suspect info, even if we think it's bogus or that they are unwitting participants (still, they got the funds).

You are correct Daisy. Even the same bogus name mentioned in a SAR could help law enforcement link connected crimes if the same fake alias is used. Larger dollars and more indictment counts mean longer prison sentences.

It's darned depressing. A lot of work and in five years of being a BSA Officer never once have I received a law enforcement request for supporting docs on one of these.

Thank you guys!
I should have mentioned that we don't have the name(s) of the suspect because they are using our online application. All we have available is the information of the possible victim, therefore, since there is no suspect information they (auditors) believe we don't have to report it. A little frustrating because as Daisy mentioned we have never received law enforcement request for supporting docs.

If you have other identifiers, such as email addresses and IP addresses, I would encourage you to consider filing, even if the dollar threshold is not met. Getting these identifiers into the system can prove useful for law enforcement when searching for related cases.

Of course, if the dollar threshold ($25k) is met on these applications, then you have an obligation to report, as Brian pointed out above.

Emphasizing the third bullet in Brian's post, if you do not have a subject the dollar threshold where reporting is required is $25,000. Your auditors' opinions have no bearing on that. Reports on amounts below the thresholds are still protected by the safe harbor, but may be a simple waste of time.

Responding to others, there is no published guidance on how much information you would have to have in order to say you could identify a suspect. (Assuming that any name you were given is fictitious is a bit child like.)

Complaining about not getting requests from law enforcement for supporting documentation after you did all that work is kind of like complaining about not getting sick even though you paid for health insurance. I've dealt with banks that have received the requests, then the subpoena's that will follow in the event of a prosecution. They all decide that they would rather have missed the opportunity.