Federal Register Notice Implicates Debate Over BSA Reporting Burden
As we have blogged (here, here, and here), the Financial Crimes Enforcement Network (“FinCEN”) consistently has stressed the importance of Suspicious Activity Reports (“SARs”) and other Bank Secrecy Act (“BSA”) filing requirements to anti-money laundering (“AML”), counter-terrorism and law enforcement efforts. These vigorous pronouncements can be contrasted with certain critiques by industry groups and some commentators regarding the true operational value (or lack thereof) of BSA reporting requirements to law enforcement and financial institutions’ AML programs, particularly when compared to the overall costs associated with the current and rigorous regulatory regime. Lurking behind this debate is the possibility that some requirements of the BSA maybe reduced – or “reformed,” depending upon one’s perspective – through legislation. A recent regulatory filing by FinCEN illustrates this tension and ongoing debate.
On May 26, 2020, FinCEN issued a notice in the Federal Register (“Notice”) to renew the Office of Management and Budget (“OMB”) control numbers assigned to the SAR reporting regulations. The Notice is required in order to give the financial industry and affected stakeholders an opportunity to comment on existing regulatory requirements, as well as associated burdens. Although FinCEN has encouraged the industry to review the Notice and comment, it likely will not be surprised if at least some industry groups push back and criticize the associated estimates regarding burden. Regardless, the Notice provides interesting insights and statistics into current SAR reporting.
In 2019, 12,148 financial institutions submitted 2,751,694 SARs. Almost half of those SARs, however, came from just ten banks and money service businesses. By contrast, 56% of financial institutions each filed 10 SARs or fewer. Thus, although the total amount of annual SAR filings continues to rise, the very largest financial institutions appear to account for an extremely disproportionate share of all SAR filings. Indeed, the Notice states that “[s]lightly less than 2% of the filing population . . . submitted 81% of all reports.” FinCEN’s implicit message appears to be that the SAR filing regime in practice is not onerous for the majority of financial institutions subject to the filing requirement – particularly smaller institutions less able to bear regulatory costs.
In support, the Notice provides the two following tables regarding the source of 2019 SAR filings:
At OMB’s recommendation, FinCEN also revised its methodology of calculating the burden of filing SARs, including the time and effort estimates involved in the determination not to file a SAR. Traditionally, FinCEN has assigned an estimate of one hour to a SAR filing, which “included only the filer’s annual operational burden and cost associated with (a) producing and filing the report, and (b) storing a copy of the filed report.” In the notice, FinCEN concedes that because every SAR filed is the product of a bank’s subjective analysis, the amount of work which will vary on a case-by-case basis. As such, FinCEN purports to revise that estimate to reflect the costs associated with “(a) determining whether alerts that were elevated for further review merit filing a SAR, and (b) documenting the decision not to file a SAR when a case does not merit it.”
In order to address these additional burdens, FinCEN seeks to categorize estimates based on a SAR’s complexity, as opposed to assigning a single burden estimate to a SAR. The complexity factors FinCEN has concentrated on are: “(a) The number of persons identified as subjects; (b) the number of distinct suspicious activities selected; (c) the length of the narrative section; and (d) whether or not the report contains an attachment.” Based on these factors, and consistent with the implicit theme that the SAR reporting regime is not that onerous in practice for the majority of filers, FinCEN determined that “[n]early three quarters of original SARs filed by depository institutions report only up to two subjects involved in up to five suspicious activities, described in a narrative that does not exceed one page, and on their face do not appear complex.” Overall, 83% of all SARs involve narratives of one page or less, and 60% identify up to two suspicious activities.
Regardless of the statistics, the Notice also offers an interesting observation regarding the general incidence and recognition of suspicious activity: “The higher the number and complexity of the filer’s business lines, the higher the number of suspicious transactions identified and the longer the narrative.” Whether this correlation is the cause for why larger financial institutions tend to file more SARs, or is instead simply the by-product of this phenomenon, is subject to debate.
The Bottom Line
This chart in the Notice may be the most important, and also the subject of the greatest skepticism and critique: FinCEN’s estimate of total annual costs for SAR reporting under the Paperwork Reduction Act (“PRA”), targeted at about $206 million.
Almost surely, this estimate is very low, especially because the above numbers, by FinCEN’s own admission, fail to account for the massive, predicate costs involved in having the elaborate BSA/AML systems which must exist in order to review a firehose of financial transactions and ultimately file a discrete number of SARs. Effective BSA/AML systems require complex software; sufficient know-your-customer and customer identification policies; good risk assessments; technical knowledge; ongoing training; oversight; ongoing fine-tuning; independent testing; and investigations into transactions. A SAR filing does not occur in a vacuum. Rather, it is the product, at least at more sophisticated institutions, of a complex and intentional — and therefore expensive — process.
Accordingly, the Notice describes six stages involved in the filing of a SAR; FinCEN’s cost estimates only try to account for the final three stages:
Stage One: Maintaining a monitoring system commensurate with the size of the filer.
Stage Two: Reviewing alerts issued by the monitoring system.
Stage Three: Transforming alerts into cases to be reviewed through a fuller investigation.
Stage Four: Case review to determine whether an event needs to be reported in a SAR.
Stage Five: Documentation of the determination whether to file a SAR.
Stage Six: The SAR filing process, including the drafting of the narrative section.
Generally, these stages involve a process of automated and human review and culling, in which innumerable financial transactions produce a limited body of alerts, which in turn produce an even smaller amount of cases and ultimately lead to certain SAR filings. But the Notice’s cost estimates do not account for the bottom bulk of this process, or the fixed costs built into just maintaining a BSA/AML program. To its credit, FinCEN admits this, and explains its need and desire for more “granular” information, as well as its intention to address these issues in a future notice:
FinCEN would need information regarding (i) the levels of burden and cost attributed to differing monitoring systems; (ii) varying levels of complexity in determining whether alerts represent true alerts; and (iii) the amount of research involved in assembling cases to determine whether true alerts warrant the filing of a SAR. Furthermore, FINCEN would need additional information to identify the proportion of these costs that are strictly connected to the filing of a SAR relative to the same costs associated with a filer’s other regulatory or business requirements. FinCEN intends to address the information required for the estimate of the burden and cost of Stages 1 to 3 in a future notice. FinCEN acknowledges that each state of the SAR production contributes to the next (including those states of the process not included in this notice).
Finally, the Notice lists the topics in which FinCEN is particularly interested for comments. First and foremost is a desire for comments suggesting “factors that may affect the burden and cost of SAR reporting,” particularly factors that “FinCEN could quantify by analyzing the contents of the BSA database, or by referring to statistical information publically available, and without coducting a formal survey of the reporting financial institutions[.]” Other issues in which FinCEN is interested include commentary on the first three stages of the SAR filing process; the calculation of labor costs; how FinCEN has categorized the universe of SAR filings; and the reasonableness of assumptions made by FinCEN when calculating the burden associated with filing different categories of SARs, such as the number of minutes required for each category of report.
A Consistent Message: The BSA Reporting Awards
As observed, the Notice has been preceded by continued messaging by FinCEN that SARs are critical and the current regulatory reporting regime is not only appropriate but necessary. Part of that messaging includes the annual awards issued by FinCEN designed to highlight the value of BSA reporting: specifically, the FinCEN Director’s Law Enforcement Awards Program, which rewards successful utilization of BSA reporting to pursue and prosecute criminal investigations. Shortly before issuing the Notice, on May 19, 2020, Director Blanco issued a press release announcing the 2020 award recipients, with an official ceremony to be held on October 29, 2020 in Washington D.C. According to the press release, the awards program “demonstrates the critical role that the financial industry’s BSA filings play in criminal cases, and underscores the importance of a successful partnership between financial institutions and law enforcement agencies. The investigations being recognized are a key example of how vital BSA reporting is toward keeping our country strong, our financial system secure, and our families safe from harm.”
The 2020 awards included seven categories: SAR Review Task Force (awarded to the FBI); Significant Fraud (awarded to Immigration and Customs Enforcement-Homeland Security Investigations); Cyber Threat (awarded to Immigration and Customs Enforcement-Homeland Security Investigations); State and Local Law Enforcement (awarded to the New York State Police); Third Party Money Launderers (awarded to Internal Revenue Service-Criminal Investigation); Transnational Organized Crime (awarded to the Drug Enforcement Agency); and Transnational Security Threat (awarded to the FBI). Regardless of the details of the particular investigations and the particular recipients, FinCEN’s messaging remains clear and consistent: the current SAR reporting regime is effective and necessary, and should not be altered.
Even if everyone agrees that BSA reporting forms are indeed critical, the exact extent and details of such reporting may be contested by industry and others in the comment period for the Notice.