Somewhere in a secret location near Washington D.C., teams of law enforcement analysts are reviewing suspicious activity reports (SARs). Law enforcement task forces around the country are meeting on a routine basis to discuss and review SAR filings, and local police departments may also be reviewing your recently filed SAR. Gone are the days when banks and law enforcement disagreed on the importance of such information and whether it was being used. You can be certain this information is being used — extensively.

But what does law enforcement look for? The common answer is that “it depends.” Well so much for that accurate description. It depends upon the skill and experience of the analyst, the motivation of the writer and the researcher, and many other variables. This much is known, your SAR filing is received by the Financial Crime Enforcement Network (FinCEN) and then through various access points it is redirected for research by law enforcement.

Just as there is a purpose and a method of writing a good SAR, there likewise are good ways to analyze and interpret a SAR. The remainder of this article will describe what law enforcement looks for, and this in turn may strike a chord with those filing the SAR.

All SARs are Good

The first important concept is that there are no bad SAR filings—only the consideration that some are better than others. Law enforcement is accustomed to receiving conflicting information, partial information, utterances captured in the heat of a moment and outright lies. Law enforcement is equipped and experienced in seeking the truth and getting to the important details that matter.

SAR filings are written reports of exploitable leads for development, and it is the details that are most important. Law enforcement appreciates all SAR filings. No detail is too small for inclusion in the SAR narrative. Certainly the who, what, where, when, why and how should guide the writer of the SAR to add details of those involved such as, their identifying documents, their employment, the timeline of the events, amounts involved, and most importantly what the writer suspects may be going on.

It is important to recognize that law enforcement does not understand business and commerce as a financial institution does. The author of the SAR should know their customer and be able to provide some information in the SAR narrative regarding the suspect’s line of business. Law enforcement will always have to review the SAR from the perspective of the author. Be a good informant by providing business context if needed to explain what may be normal business and why this activity deviates from the norm.

Multiple SARs May Be Better

Multiple filings of SARs occur naturally when the suspect of a bank or money services business (MSB) continues to conduct suspicious activity and the bank or MSB chooses to file a new SAR the next month or the following month. These filings are seen for what they are, consecutive activities usually of the same pattern, being conducted in multiple months and usually by the same parties. Law enforcement reviews these types of SARs and then calculates individual monthly (or some other frequency) activity, and then works toward an aggregation of the total activity. These multiple filings are important to the law enforcement officer, but sometimes become “routine” without new information other than changing the filing date and the amounts.

What can be of more value and importance to law enforcement are the findings of additional SARs filed by other banks on the same suspect or groups of suspects. These additional SARs allow the investigator to see multiple perspectives of suspicious activity that may have occurred at two banks or other financial institutions. In addition, these multiple filings allow the investigator to receive expert opinions of two or more bank AML officers who know what is normal for a business practice. This information is of tremendous value to the law enforcement officer who may not know the business or industry.

What does law enforcement look at first?

The law enforcement officer will also look to the SAR to see if any other law enforcement agencies have been contacted. Two or more law enforcement officers working on the same case may bring more synergy to the overall investigation.

The law enforcement officer also looks “between the lines” of the SAR to determine whether accounts were closed, duration of the activity before closure and the duration of time before establishing new business relationships with a new bank. Opening and closing accounts in proximity to normal geographical areas of residence or work will also be reviewed.

Two things need to be accomplished by law enforcement when looking at a SAR. The first is to develop a potential theory relating to the criminal scheme being reported. The second is to develop a methodology or plan to conduct the actual investigation.

Law Enforcement Begins the Analysis

With these thoughts in mind, the law enforcement officer can begin research and will determine the ordering and the steps to conduct during the investigation. It is important that law enforcement does not jump to conclusions, and certainly it is acceptable to not completely understand the SAR at the beginning of the investigation. What is important is that the potential criminal scheme development is unbiased, fluid, and can be changed, re-focused and re-examined throughout the investigation.

Law enforcement may not at first understand the SAR narrative you have written, despite your best efforts to simplify or explain the matter. They will attempt to relate what is being obviously stated in the SAR, and try to make sense of it. In spite of your formatting, columns, tabs, and other edits, all may be lost between processing at your bank and ultimately what law enforcement is able to view on their computer screen. Hopefully, if the matter is technical in nature, the SAR narrative will break it down into smaller easier to understand pieces.

Sometimes the investigator will have to copy and paste the entire SAR into a word document. The investigator who uses this method will add personalized paragraph breaks to determine major themes that occur throughout the SAR narrative. Common themes might focus on times, events, amounts or dates. This will greatly improve the chances to answer the question: What is going on?

Understanding the SAR

Getting over the initial shock regarding the size of the scheme, complexity of the business or industry, or other mental blocks will be easier for law enforcement to understand by reviewing smaller portions of SAR information. Was this all cash-in? Is there corresponding cash or checks going out? Is there a balance to deposits and withdrawals? Where is the money going? To whom? What is the frequency? Will drawing a simple diagram help to visually show what is going on? Are there employee witnesses? Is there someone in the industry to help explain how one of these normal businesses would be run legally? How is this one different? How is this one the same? Comparing and contrasting logic can be an ally to the investigators at this stage of review.

Everyone needs to take a mental break at this point. Most investigations do not uncover the true extent of what has occurred until the case is completed — and even then there always seems to be the perennial “one who got away” (or they were involved but not enough evidence for prosecution). At this early stage, analysts and investigators are only attempting to see if this SAR matches any other SAR or case with which they have been involved. Are the directions of the cash, checks and money orders similar? Did another person in their office or region have a case or investigation that involved this specific type of money orders? Have they seen or heard of another similar scheme in another geographical area? Did they read something in ACAMS regarding this type of fraud and now they are seeing it firsthand?

The Investigation Begins

Re-contacting the financial institution to verify the SAR information is always a key step for the smart investigator. A bank or money services business will be a wealth of knowledge as to the SAR and the activity described. Other departments or areas of a financial institution will have to be considered for a possible subpoena to find such things as loan documents, safe deposit boxes or perhaps investments.

Business partners, spouses, boyfriends, girlfriends may soon find themselves being witnesses to the investigation and they in turn will have their information re-run through investigative databases (including BSA data checks) to make initial assessments whether or not they are involved or should be approached as witnesses. Findings of additional SARs and BSA documents may lead the investigator to delay initial contacts with principal suspects and broaden the scope of the investigation.

At this stage, a complete search of all BSA documents should be conducted before any field activities begin. Having examples of information from prior BSA helps investigators prepare questions, and can be used as a gauge to validate answers. It is often in the questioning phase of investigation where law enforcement obtains a confession based upon a complete and comprehensive understanding of all of these facts. The truth does not lie.

The Investigation Continues

In summary, the SAR is only a lead. Much more work will be required to properly assess this information in relation to other pieces of evidence as the investigation progresses. The SAR filing alone is never prima facie evidence of a crime as the SAR cannot be disclosed; however, it is the careful analysis of the SAR information in conjunction with additional building blocks that lead law enforcement to successful prosecutions.

The partnership of financial industry and law enforcement is important and continues to grow. Financial crimes are becoming extremely complex. Having the financial industry on the front lines to help law enforcement identify these crimes will be the key to protecting our financial system and mutual financial future.  

Erick Malette, CAMS, CFE, contractor to a government client, previously worked as a special agent for United States Treasury Department, erick.malette@cox.net