SAR Optimization for Financial Institutions

The first two articles in this series, published in the December 2024-February edition of ACAMS Today¹ and on ACAMSToday.org² respectively, focused on suspicious activity report (SAR) optimization for law enforcement (LE)―how to determine the most valuable SARs from an LE standpoint from a seemingly endless stream of reports submitted by the banking industry. Let us pivot our focus now to the primary source of SARs―financial institutions (FIs)―and how they can optimize reported information to maximize report usefulness for LE.

Background

From the early days of the “criminal referral form” to today’s electronically filed SAR, FIs have served as an integral component in the U.S. fight against money laundering and terrorist financing. While FIs and their products and services have changed in size and complexity over the years, the SAR filing requirements and related guidance have stagnated. Financial Crimes Enforcement Network (FinCEN) statistics³ show that SAR filings have grown exponentially in recent years, leading to questions about their value and usefulness from the exhausted banking compliance teams struggling to meet anti-money laundering/Bank Secrecy Act (AML/BSA) regulatory and auditor expectations.

FinCEN NPRM―‘Highly Useful’

One source of hope that has yet to be finalized as of this writing is the FinCEN Notice of Proposed Rulemaking (NPRM) titled “Proposed Rule to Strengthen and Modernize Financial Institution AML/CFT [Countering the Financing of Terrorism] Programs,”⁴ published in July 2024. This document outlined intent to establish examiner training that would “focus on the overall effectiveness of AML/CFT programs and consider the highly useful quality of their outputs.” A key provision of this rulemaking is the direction for FIs to review and evaluate their FinCEN filings based on known or detected threat patterns or trends that “may also help [FIs] minimize a type of SAR filing characterized by some industry sources as a ‘defensive filing’ and focus on generating highly useful reports to relevant government authorities.”

Assuming that examiner training is established through publication of a Final Rule, FinCEN can utilize the new examiner training protocol to develop and publish updated guidance for FIs to use when filing SARs. This guidance should also be incorporated into the Federal Financial Institutions Examination Council’s (FFIEC) AML/BSA examination manual⁵ so that FIs are reviewed on current standards and best practices going forward.

As a by-product of reviewing their SAR filings for threat patterns and trends, FIs should be encouraged by their federal regulators to reevaluate current transaction monitoring rules and models to align with reporting on FinCEN’s National Priorities⁶ and other recently released FinCEN advisory typologies⁷ (such as check fraud, elder financial exploitation and fentanyl trafficking) in order to “identify suspicious financial activities, better focusing bank resources to the AML task, which will increase the likelihood for better [LE] outcomes.” This will cut down on the dreaded “defensive SAR” filing―a report that is filed that is perceived to “check the box” to satisfy a regulatory or audit requirement but has little to no value for LE and where the activity in question represents little to no risk to the FI. The end result will be fewer―but better―SARs, which will stem the deluge of information that is flooding LE and negatively impacting their investigative efficiency.

SAR Narrative Content

Once FIs have homed in on the SARs that should be filed, the next logical step is improving what is included in the reports (as well as what old habits should be left in the past). Based on numerous information gathering sessions with LE, the SAR content they find most useful in narratives includes:

Previous SAR filing document control numbers, prior arrest or conviction records, and negative news search results for subjects;
Counterparty information and associated negative news search results;
Beneficial ownership information;
Ownership structure and incorporation details for entities;
Shell company information;
Victim information (demographic information such as name, Social Security number [SSN], date of birth [DOB], address, relationship to the suspect);
External bank account information (bank name, routing number, account number);
Wiring instructions;
IP addresses;
Source of funds (if known, and if not, a statement to that effect);
Politically exposed persons (PEPs); and
High-risk areas (countries, or jurisdictions like High Intensity Drug Trafficking Areas, High Intensity Financial Crime Areas and Geographic Targeting Orders).

On the flip side, SAR narrative content that is not useful or necessary includes:

Restating subject information already found in Part I;
Restating branch transaction address information already listed in Part III;
Typing in all caps; and
Including lengthy strings of transaction information that can instead be sent with the report as a CSV attachment.

Of particular interest to SAR consumers in LE is the concept of “BLUF”: bottom line up front. This helps the reader to quickly determine if the SAR they are reviewing is of interest and falls within their charging jurisdiction. Neglecting to include a brief summary at the onset may result in an otherwise outstanding SAR being passed over by LE due to failure to engage early in the report.

Technological Advances in SAR Consumption

“Optimized SARs” from FIs―those that are more organized and contain all of the critical data points―will result in better, more timely investigations from LE. As outlined in the second article in this series,⁸ SAR optimization on the LE side is realized when entity resolution, network generation and natural language processing (NLP) come together to form risk-based scoring models that aid in the prioritization of SARs for LE to investigate. These methods enable LE to be able to process SARs in totality, rather than report by report.

We must understand what these concepts mean in order to know why they matter and how they can be used.

Entity resolution: This refers to linking elements in a single or multiple files such that records referring to the same object are treated as a single record. Records are matched based on the information that they have in common. In banking terms, this means resolving disparate customer information in various systems (deposit, loan, card, etc.) to one “master record” that points all systems’ information to the same person or entity. In LE terms, this means resolving disparate subject information across multiple SARs to one master record that ties that same subject to all of their SARs, regardless of what institution filed them.
Network generation: This refers to how resolved entities and inferred relationships generate networks that can be tuned to prioritize relevant links. In banking terms, this means connecting commonalities in customer records (postal addresses, phone numbers, email addresses, account numbers, crypto wallets, IP addresses, etc.) across banking systems. In LE terms, it means the same thing: linking elements that exist in multiple SARs in order to create a nexus of SARs that otherwise would not have been connected together. This nexus could potentially extend by many previously unknown degrees of separation, allowing for more efficient prosecution of complex crime rings.
NLP: This refers to techniques to break language into pieces, then working to understand relationships between the pieces and how they work together to create meaning. In banking terms, this means using standardized language to refer to crime types and activity (often found in FinCEN documents) in order to make it easier for external consumers (LE, etc.) to connect reports. Standardized verbiage will allow for the creation of typology mapping outside of the traditional checkboxes that currently exist on the SAR form. In LE terms, this means using automation to ascertain that a report has no known source of funds, or that victim demographic information is present, or that a 314(a) or 314(b) reference was made based on data extracted from a pattern in the narrative. It can also be used to identify risk factors in the narrative, such as high-risk countries, PEPs or fentanyl trafficking.

FI SAR Optimization

So, how do FIs write SARs that allow for these same technologies to rank the highest priority reports for LE? The simple answer is to create a template system for each crime type to ensure that each reportable typology has the same information reported each time, provided the information is available to the FI. This would be an excellent way for FinCEN to modernize SAR filing guidance―stating specifics that should exist for each report typology, allowing for more objective audit/examination standards, and better ingestion and review by LE.

For example, in a SAR reporting elder financial exploitation perpetrated through a romance scam that utilized virtual currency as a mode of transfer, the following data points should be included:

Subject information if there is any.
Victim information. This should be clearly outlined in the narrative. Include the victim’s full name, SSN, DOB, address, phone number and email address. Ensure that the victim’s internal bank account(s) are included.
External bank accounts where funds were sent (bank name, routing number and account number).
Virtual currency. Include any information about wallet address or other crypto-related identifiers. If a Bitcoin ATM was used, include the address.
Methods of communication. Include any phone numbers used to call the victim, any email addresses used and any social media platforms used. Social media handles for the victim and perpetrator should be identified. Include all IP addresses used to access the victim’s online banking or mobile banking applications.

Each of these data points can be extracted from the SAR by LE applications and used to resolve entities that may assist in identifying a previously unknown subject and/or may create a network diagram connecting this SAR/case to others within a previously unknown nexus. Identifying both subjects and related cases/criminal networks more quickly will raise the value of the SAR in the eyes of LE.

Conclusion

SARS serve as both the initiation and confirmation of many LE investigations

SARs serve as both the initiation and confirmation of many LE investigations. In order to make the process more efficient for both the producers and consumers of SARs, steps should be taken to standardize report narrative content to improve the creation of reports and their ultimate use. Public-private collaboration is imperative to continued success in the fight against financial crime. SAR optimization will improve prosecution of money laundering and terrorist financing―a rarity in which we all win.

Jane Bell, CAMS, senior industry consultant, SAS, North Carolina, USA, jane.bell@sas.com,