Financial Crimes Enforcement Network FinCEN

A bank, a broker-dealer or another covered institution files reports, and FinCEN collects, analyzes and disseminates what they report. The statute that underlies these reports describes their purpose, which is explained in the next section.

FinCEN's fact sheet on information sharing refers to financial institutions that are subject to FinCEN's anti-money laundering program requirements, a group that includes banks, casinos, money services businesses, brokers and dealers, insurance companies and others.

What the Bank Secrecy Act Is For

The Bank Secrecy Act is the foundation for most reporting duties in this area. Congress stated its purposes in 31 U.S.C. 5311, which lists five objectives for the subchapter.

The first is to require reports and records that are highly useful in criminal, tax, or regulatory investigations, risk assessments, or proceedings, and in intelligence or counterintelligence activities to protect against terrorism. The second is to prevent money laundering and terrorism financing through financial institution compliance programs. The third is to facilitate the tracking of money that has been sourced through criminal activity or is intended to promote criminal or terrorist activity. The fourth is to assess money laundering, terrorism finance, tax evasion and fraud risks to the United States financial system and national security. The fifth is to establish frameworks for information sharing among financial institutions, regulators and law enforcement, so that money launderers and terrorist financiers can be identified and apprehended.

The second and fifth objectives explain why institutions are required to have compliance programs and why the law gives them a way to share information. The first explains why the reports exist at all.

The Reports Financial Institutions File

FinCEN's page on Bank Secrecy Act forms lists several filings and who makes them. The suspicious activity report, called a SAR, is filed by banks, broker-dealers, futures commission merchants and introducing brokers in commodities, state and tribal casinos and card clubs, and money services businesses. The currency transaction report, called a CTR, is filed by each financial institution other than a casino, and by state and tribal casinos and card clubs. The page also lists the FBAR, filed by each U.S. person who has a financial interest in financial accounts in a foreign country when the aggregate value exceeds ten thousand dollars; Form 8300, filed by each person engaged in a trade or business who receives over ten thousand dollars in cash; the report of international transportation of currency or monetary instruments, filed by those who transport more than ten thousand dollars into or out of the United States; and the designation of exempt person, filed by banks to exempt certain customers from currency transaction reporting.

A broker-dealer's most familiar filing is the suspicious activity report, which is closely tied to the day-to-day monitoring of customer accounts.

The Suspicious Activity Report for Broker-Dealers

The regulation for broker-dealers is 31 CFR 1023.320. It provides that every broker or dealer in securities within the United States must file reports of suspicious transactions with FinCEN.

A transaction is reportable when it involves or aggregates funds or other assets of at least five thousand dollars and the broker-dealer knows, suspects or has reason to suspect that the transaction falls into one of four categories. The first is that it involves funds derived from illegal activity or is intended or conducted in order to hide or disguise funds. The second is that it is designed, whether through structuring or other means, to evade any requirements of the chapter. The third is that it has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage. The fourth is that it involves use of the broker-dealer to facilitate criminal activity.

On timing, the regulation provides that a SAR shall be filed no later than thirty calendar days after the date of the initial detection of facts that may constitute a basis for filing. If no suspect was identified at that time, the filing can be delayed by an additional thirty calendar days to identify a suspect, but not more than sixty calendar days after the initial detection.

The regulation also requires the broker-dealer to maintain a copy of any SAR filed and the original or business record equivalent of any supporting documentation for five years. It provides that a SAR is confidential and shall not be disclosed except to authorized parties, and it provides protection from liability for SAR disclosures under the statute it cites. A reader who works with SARs should read the regulation's confidentiality provisions closely, because they restrict who may be told that a report was filed.

An Illustration

An illustration shows how the four categories read. Suppose a firm notices that a customer repeatedly deposits amounts just below a reporting threshold across several days and then asks to wire the money out. A firm reviewing that pattern would consider whether it fits the second category, which concerns transactions designed through structuring or other means to evade requirements, and whether the amounts reach the five thousand dollar threshold in the aggregate. The illustration is simplified. It does not describe any actual customer, and it does not say that any particular pattern of activity requires a report. Whether a report is required depends on the facts and on the regulation.

FINRA Rule 3310 and Red Flags

FINRA's role is different from FinCEN's. FINRA Notice 19-18 provides guidance on suspicious activity monitoring and reporting obligations under FINRA Rule 3310, the anti-money laundering compliance program rule.

FINRA's rule text sets out what the written program must contain. The rule provides that each member shall develop and implement a written anti-money laundering program reasonably designed to achieve and monitor the member's compliance with the requirements of the Bank Secrecy Act. The program must establish and implement policies and procedures that can be reasonably expected to detect and cause the reporting of suspicious transactions, and policies, procedures and internal controls reasonably designed to achieve compliance with the Bank Secrecy Act. It must provide for independent testing for compliance, which the rule requires annually on a calendar-year basis, or every two years for firms that do not execute transactions for customers or hold customer accounts. The member must designate and identify to FINRA an individual or individuals responsible for implementing and monitoring the day-to-day operations of the program, must provide ongoing training for appropriate personnel, and must include appropriate risk-based procedures for conducting ongoing customer due diligence.

The notice organizes potential red flags into six categories. They are customer due diligence and interactions, securities deposits, securities trading, money movements, insurance products, and other indicators. Under money movements, for example, the notice lists structuring, frequent large transfers, third-party payments and wire transfers to high-risk jurisdictions. The notice states that the list is not exhaustive, that it does not guarantee compliance, and that it does not provide a safe harbor from regulatory responsibility.

The division of labor is simple. FinCEN's regulation says when a broker-dealer must file a report. FINRA's rule says the firm must have a written program to detect and report such transactions.

The Customer Identification Program

Another duty that comes from FinCEN's regulations is the customer identification program. Under 31 CFR 1023.220, a broker-dealer must obtain certain identifying information before opening an account. The regulation lists the name, the date of birth for an individual, the address, and an identification number, which for a U.S. person is a taxpayer identification number.

The regulation also requires procedures for verifying the identity of each customer. Verification can use documents, such as a driver's license, or non-documentary methods, such as independently verifying the customer's identity through a comparison of information provided by the customer with information obtained from a consumer reporting agency, public database or other source.

The regulation requires a broker-dealer to retain the identifying information records for five years after the account is closed and the verification records for five years after the record is made. It also requires procedures for giving customers adequate notice that the broker-dealer is requesting information to verify their identities.

Information Sharing Under Section 314(b)

The Bank Secrecy Act's fifth purpose, information sharing, is carried out in part through Section 314(b). FinCEN's fact sheet explains that Section 314(b) gives financial institutions the ability to share information with one another, under a safe harbor that offers protection from liability, for the purpose of identifying money laundering, terrorist financing, fraud and related crimes.

Any financial institution subject to FinCEN's anti-money laundering program requirements may participate, and the fact sheet lists brokers and dealers among them. The safe harbor has three conditions. The institution must register with FinCEN through its Financial Industry Portal. Before sharing, it must take reasonable steps to verify that the other institution is also a Section 314(b) registrant. And it must establish and maintain procedures to safeguard the security and confidentiality of shared information and use it only for authorized purposes. The fact sheet lists purposes that include identifying activities that may involve terrorist financing or money laundering, decisions about establishing or maintaining accounts, and compliance with anti-money laundering obligations.

FinCEN Compared With the SEC and FINRA

The three organizations have different subjects. FinCEN is a Treasury bureau whose subject is financial intelligence and the Bank Secrecy Act's reporting and compliance duties. The SEC regulates the securities markets and broker-dealers. FINRA is a self-regulatory organization for broker-dealers, and its Rule 3310 requires member firms to have an anti-money laundering program. A broker-dealer therefore faces all three in this area: FinCEN's regulations, the SEC's oversight of broker-dealers, and FINRA's rule.

Common Misunderstandings

One misunderstanding is that FinCEN is part of the SEC or of FINRA. It is a bureau of the Treasury Department.

A second misunderstanding is that FinCEN's only product is the SAR. Its page lists several filings, including the CTR, the FBAR, Form 8300 and others.

A third misunderstanding is that a firm may tell a customer that a SAR was filed. The regulation provides that a SAR is confidential and shall not be disclosed except to authorized parties.

A fourth misunderstanding is that every transaction of five thousand dollars or more requires a SAR. The regulation applies the threshold to transactions that the broker-dealer knows, suspects or has reason to suspect fall into one of four categories.

A fifth misunderstanding is that FINRA's red flag list is a complete test. FINRA's notice states that the list is not exhaustive and does not provide a safe harbor.

A sixth misunderstanding is that Section 314(b) sharing is required. The fact sheet describes it as an ability that gives institutions a safe harbor if they register and meet the conditions.

Key Points

FinCEN is a bureau of the Treasury Department whose mission is to safeguard the financial system from illicit activity, counter money laundering and the financing of terrorism, and promote national security through the collection, analysis and dissemination of financial intelligence.

Congress stated the purposes of the Bank Secrecy Act in 31 U.S.C. 5311, including requiring highly useful reports and records, preventing money laundering through compliance programs, and establishing information sharing.

Under 31 CFR 1023.320, broker-dealers must file a SAR for covered transactions of at least five thousand dollars that fall into one of four categories, generally within thirty calendar days of initial detection, and must keep records for five years and keep the SAR confidential.

Under 31 CFR 1023.220, broker-dealers must collect and verify identifying information through a customer identification program. FINRA Rule 3310 requires a written anti-money laundering program, and Section 314(b) allows registered institutions to share information under a safe harbor.