FinCEN SAR Guidance

Welcome to the Compliance Cohort’s resource page for FinCEN SAR Guidance. If you are new to the Compliance Cohort, we are glad you are here and invite you to take a look at our free membership where members have access to free BSA training videos, articles, and other resources that are beneficial for BSA officers and other BSA professionals. You can learn more about our free membership here.

As a BSA professional responsible for completing and filing Suspicious Activity Reports, it is important to understand the rules and regulations that dictate how to do so correctly. To accomplish this, it is important to have all of the FinCEN SAR guidance issued over the years to ensure that nothing is missed when completing a Suspicious Activity Report.

FinCEN SAR Guidance Links and Other Resources

The following FinCEN SAR guidance links can be used by any BSA professional when completing Suspicious Activity Reports:

FinCEN SAR Advisories

When looking at FinCEN SAR Guidance, the first place one should look is to applicable SAR advisories released by FinCEN. To simplify this process for BSA professionals, we have compiled a list of the most relevant SAR advisories released by FinCEN. Each of these advisories from FinCEN provides guidance relating to a different applicable SAR topic and provides specific instructions for completing Suspicious Activity Reports for each topic.

Here is a listing of the most recent SAR advisories released from FinCEN and how they apply to completing Suspicious Activity Reports:

Topic: Corrupt Foreign PEPs

Advisory Name: Advisory on Human Rights Abuses Enabled by Corrupt Senior Political Figures and their Financial Facilitators

Advisory Date: 6/12/18

Advisory Number: FIN-2018-A003 Advisory Link: https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2018-a003

Applicable SAR Instructions:

  • See FIN-2008-G005

  • When filing, select SAR field 35(I) and include term "Financial Facilitator FIN-2018-A003" in SAR narrative and in SAR field 35(z)

  • If transactions may potentially relate to a terrorist activity, call the FI Hotline at 866-556-3974 to expedite delivery of said information.

Things to look for:

  • Use of third parties when it is not normal business practice

  • Use of third parties when it appears to shield the identity of a PEP

  • Use of family members or close associates as legal owners

  • Use of corporate vehicles (legal entities and legal arrangements) to obscure ownership, involved industries, and/or countries

  • Declarations of information from PEPs that are inconsistent with other information, such as publicly available asset declarations and published official salaries

  • The PEP or facilitator seeks to make use of the services of a financial institution or a designated non-financial business or profession (DNFBP) that would normally not cater to foreign or high-value clients

  • The PEP or facilitator repeatedly moves funds to and from countries with which the PEP does not appear to have ties

  • The PEP or facilitator has a substantial authority over or access to state assets and funds, policies, and operations

  • The PEP or facilitator has an ownership interest in or otherwise controls the financial institution of DNFBP (either privately or ex officio) that is a counterparty or a correspondent in a transaction

  • Transactions involving government contracts that are directed to companies that operate in an unrelated line of business (e.g., payments for construction projects directed to textile merchants)

  • Transactions involving government contracts that originate with, or are directed to, entities that are shell corporations, general “trading companies,” or companies that appear to lack a general business purpose

  • Documents corroborating transactions involving government contracts (e.g., invoices) that include charges at substantially higher prices than market rates or that include overly simple documentation or lack traditional details (e.g., valuations for goods and services)

  • Payments involving government contracts that originate from third parties that are not official government entities (e.g., shell corporations)

  • Transactions involving property or assets expropriated or otherwise taken over by corrupt regimes, including individual senior foreign officials or their croneis

Topic: Email Compromise Fraud Schemes

Advisory Name: Advisory to Financial Institutions on Email Compromise Fraud Schemes

Advisory Date: 9/6/16

Advisory Number: FIN-2016-A003 Advisory Link: https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2016-a003

Applicable SAR Instructions:

  • When filing, provide all available information, including cyber-related information, in the SAR narrative. Specifically, provide the following information:

  • Scheme Details

    • Dates and amounts of suspicious transactions

    • Sender’s identifying information, account number, and financial institution

    • Beneficiary’s identifying information, account number, and financial institution

    • Correspondent and intermediary financial institutions’ information, if applicable

    • Relevant e-mail addresses and associated Internet Protocol (IP) addresses with their respective timestamps and

    • Description and timing of suspicious e-mail communications

  • Communication with other FI’s under the auspices of Section 314(b) is encouraged by FinCEN when determining if a SAR filing is necessary

  • Reference advisory FIN-2016-A003 and include the key terms “BEC Fraud” when a business is the scheme victim and/or “EAC Fraud” when an individual is the scheme victim in the SAR narrative and SAR field 31(z) to indicate a connection between the suspicious activity being reported and possible BAC or EAC fraud. Include one or both terms to the extent a distinction is able to be made.

Topic: Human Smuggling and Human Trafficking

Advisory Name: Guidance on Recognizing Activity that May be Associated with Human Smuggling and Human Trafficking – Financial Red Flags

Advisory Date: 9/11/2014

Advisory Number: FIN-2014-A008

Advisory Link: https://www.fincen.gov/sites/default/files/shared/FIN-2014-A008.pdf

Applicable SAR Instructions:

  • Include one or both of the following terms in the Narrative and Suspicious Activity Information to the extent that a distinction is able to be made.

    • Advisory Human Smuggling

    • Advisory Human Trafficking

  • Include an explanation of why the institution knows, suspects, or has reason to suspect that the activity is suspicious.

  • Do not identify the potential victim of human smuggling or trafficking as the subject of the SAR. Rather, include the potential victim’s information in the narrative portion of the SAR.

Topic: Funnel Accounts and TBML in Mexico; BMPE; MX Restriction

Advisory Name: Update on US Currency Restrictions in Mexico: Funnel Accounts and TBML

Advisory Date: 5/28/14

Advisory Number: FIN-2014-A005

Advisory Link: https://www.fincen.gov/sites/default/files/shared/FIN-2014-A005.pdf

Applicable SAR Instructions:

  • Include “MX Restriction” in SAR narrative and Suspicious Activity Information sections of SARs to indicate a possible connection between the suspicious activity being reported and the enacted US currency restrictions on Mexican financial institutions

  • Include specific reference to the terms “funnel account” and/or “TBML” where appropriate.

Topic: St. Kitts and Nevis Passport

Advisory Name: Abuse of the Citizenship-by-Investment Program Sponsored by the Federation of St. Kitts and Nevis

Advisory Date: 5/20/14

Advisory Number: FIN-2014-A004

Advisory Link: https://www.fincen.gov/sites/default/files/shared/FIN-2014-A004.pdf

Applicable SAR Instructions:

  • Include the term SKN Passport in both the narrative portion and in the “Other” fields in Part II items 29 through 38, as applicable

  • Be sure to consider any OFAC obligations if they believe that customers using the SKN passports are blocked persons

Topic: Tax Refund Fraud

Advisory Name: Tax Refund Fraud and Related Identity Theft

Advisory Date: 3/30/12

Advisory Number: FIN-2012-A005

Advisory Link: https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2012-a005

Applicable SAR Instructions:

  • Include the term “tax refund fraud” in the narrative section of the SAR and provide a detailed description of the activity

Topic: Tax Refund Fraud

Advisory Name: Update on Tax Refund Fraud and Related Identity Theft

Advisory Date: 2/26/13

Advisory Number: FIN-2013-A001

Advisory Link: https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2013-a001

Applicable SAR Instructions:

  • Include the term “tax refund fraud” in the narrative section of the SAR and provide a detailed description of the activity

  • As these are time sensitive transactions, a FI may contact their local IRS Criminal Investigation Field Office to alert them that a SAR has been filed related to tax refund fraud

Topic: Third-Party Payment Processors

Advisory Name: Risk Associated with Third-Party Payment Processors

Advisory Date: 10/22/12

Advisory Number: FIN-2012-A010

Advisory Link: https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2012-a010

Applicable SAR Instructions:

  • When reporting suspicious activity, 1) check the appropriate box on the SAR form to indicate the type of suspicious activity and 2) include the term “Payment Processor” in both the narrative portion and subject occupation portions of the SAR

Topic: Mexican Currency Restriction

Advisory Name: Newly Released Mexican Regulations Imposing Restrictions on Mexican Banks for Transactions in U.S. Currency

Advisory Date: 6/21/12

Advisory Number: FIN-2010-A007

Advisory Link: https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2010-a007

Applicable SAR Instructions:

  • If a financial institution has determined that a transaction is suspicious and thus has an obligation to file a SAR with FinCEN; AND if the facts and circumstances of the transaction lead the financial institution to suspect that the transaction is being entered into as a result of the Mexican currency restrictions, then the financial institution should include the specific term "MX Restriction" within the narrative portion of the SAR filing and highlight the exact dollar amount(s) associated with the suspicious activity

  • Include all information available for each party suspected of engaging in this activity (including the individual or company name, address, phone number, and any other identifying information)

  • If currency is shipped from Mexico, include information on the common carrier, courier, or shipper of the currency, and information on the point of exportation of the currency from Mexico and the point of importation in the United States, if known

Topic: Mexican Currency Restriction

Advisory Name: Update on US Currency Restrictions in Mexico

Advisory Date: 7/18/12

Advisory Number: FIN-2012-A006

Advisory Link: https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2012-a006

Applicable SAR Instructions:

  • Include “MX Restriction” in the narrative portion of the SAR

Topic: Account Takeover Fraud

Advisory Name: Account Takeover Activity

Advisory Date: 12/19/11

Advisory Number: FIN-2011-A016

Advisory Link: https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2011-a016

Applicable SAR Instructions:

  • Include the term “account takeover fraud” in the narrative section of the SAR and provide a detailed description of the activity

  • If the account takeover involves computer intrusion, check the box for "computer intrusion." In addition, financial institutions can check the "other" box and note "account takeover fraud" in the space provided

  • If the account takeover involved other delivery channels such as telephone banking or fraudulent activities such as social engineering, financial institutions can check the "other" box, note "account takeover fraud," and include a short description of the additional information in the space provided

  • If the account takeover involves a wire transfer, then in addition to selecting the "other" box and noting "account takeover fraud," the box for "wire transfer fraud" should be checked

  • If the account takeover involves an ACH transfer, financial institutions can check the "other" box and note "account takeover fraud - ACH"

  • Account takeovers often involve unauthorized access to PINs, account numbers, and other identifying information. Financial institutions may need to check the box for "identity theft," in addition to selecting the "other" box and noting "account takeover fraud." Additional boxes should be checked if appropriate (e.g. "terrorist financing")

Topic: Bankruptcy

Advisory Name: The US Trustee Program’s Civil Enforcement Activity Targets Bankruptcy-Related Mortgage Fraud and Mortgage Rescue Schemes (SAR Activity Review – October 2011)

Advisory Date: 10/12/11

Advisory Number: SAR Activity Review – October 2011

Advisory Link: https://www.fincen.gov/sites/default/files/shared/sar_tti_20.pdf#page=61

Topic: Commercial Real Estate Fraud (CREF)

Advisory Name: Advisory on Activities Potentially Related to CREF

Advisory Date: 3/30/11

Advisory Number: FIN-2011-A007

Advisory Link: https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2011-a007

Applicable SAR Instructions:

  • Include the term CREF within the narrative portion of all relevant SAR filings, even though the SAR form lists “commercial loan fraud” as a check box

  • Report the exact dollar amounts associated with the commercial real estate activity

  • Include all information available for all parties suspected of participating in this fraudulent activity in the Suspect/Subject Information Section

Topic: Elder Financial Exploitation

Advisory Name: Advisory to Financial Institutions on Filing Suspicious Activity Reports Regarding Elder Financial Exploitation

Advisory Date: 2/22/11

Advisory Number: FIN-2011-A003

Advisory Link: https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2011-a003

Applicable SAR Instructions:

  • Select the appropriate characterization of suspicious activity in the Suspicious Activity Information section of the SAR

  • Include the term “elder financial exploitation” in the narrative portion of all SARs filed

  • Include an explanation of why the institution knows, suspects, or has reason to suspect that the activity is suspicious in the narrative section

  • The potential victim should not be reported as the subject of the SAR, but rather included in the narrative portion of the SAR

Topic: Informal Value Transfer System (IVTS)

Advisory Name: Informal Value Transfer Systems

Advisory Date: 9/1/10

Advisory Number: FIN-2010-A011

Advisory Link: https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2010-a011

Applicable SAR Instructions:

  • File a SAR if an FI knows, suspects, or has reason to suspect that an IVTS is operating in violation of the registration requirement under the BSA for money transmitters and not acting solely as agents of others, or, even if registered, is being used in the illegal transmittal of funds

  • Check the appropriate box indicating the type of suspicious activity being reported

  • Note the abbreviation “IVTS” in the narrative

  • Include an explanation as to why the FI knows, suspects, or has reason to suspect that an IVS may be involved in the reported activity in the narrative section of the SAR

Topic: Home Equity Conversion Mortgage (HECM)/Federal Housing Authority (FHA)

Advisory Name: Advisory to Financial Institutions on Filing Suspicious Activity Reports Regarding Home Equity Conversion Mortgage Fraud Schemes

Advisory Date: 4/27/10

Advisory Number: FIN-2010-A005

Advisory Link: https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2010-a005

Applicable SAR Instructions:

  • Provide complete and sufficient descriptions of known or suspected criminal violations or suspicious activity in the SAR narrative sections

  • Include the term “HECM” within the narrative portions of all relevant SAR filings

  • Highlight the exact dollar amounts associated with the HECM loan proceeds

  • Include all information available for each party suspected of engaging in this fraudulent activity in the Suspect/Subject Information Section of the SAR

    • Include individual or company name, address, phone number, and any other identifying information

  • If the FI is aware of any other type of FHA-insured mortgage fraud, include the term “FHA” in the narrative portions of the relevant SAR filings

  • If a senior homeowner is a victim of the scam, do not include them as a suspect unless there is reason to believe the homeowner knowingly participated in the fraudulent activity

  • When a senior homeowner is simply a victim of a scam, include sufficient information in the narrative portion of the SAR about the senior homeowner and his or her property to assist law enforcement in investigating and prosecuting these potential crimes

Topic: Trade Based Money Laundering (TBML); Black Market Peso Exchange (BMPE)

Advisory Name: Advisory to Financial Institutions on Filing Suspicious Activity Reports regarding Trade-Based Money Laundering

Advisory Date: 2/18/10

Advisory Number: FIN-2010-A001

Advisory Link: https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2010-a001

Applicable SAR Instructions:

  • Check the appropriate box in the Suspicious Activity Information section of the SAR form

  • Include the abbreviation “TBML” or “BMPE” in the narrative portion of all relevant SARs filed

  • Include an explanation of why the institution suspects, or has reason to suspect, that the customer is participating in this type of activity in the narrative section

Topic: SIGTARP (Special Inspector General for the Trouble Asset Relief Program)

Advisory Name: Advisory to Financial Institutions on Filing Suspicious Activity Reports Regarding TARP-related Programs

Advisory Date: 10/14/09

Advisory Number: FIN-2009-A006

Advisory Link: https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2009-a006

Applicable SAR Instructions:

  • Check the appropriate box on the SAR form to indicate the type of suspicious activity

  • Include the term “SIGTARP” in the narrative portion of the SAR

  • Include all information available for each party suspected of engaging in the suspicious activity in the Suspect/Subject Information Section of the SAR

    • Include information such as individual or company name, address, phone number and any other identifying information

Topic: Foreclosure Rescue Scam

Advisory Name: Guidance to Financial Institutions on Filing Suspicious Activity Reports regarding Loan Modification/Foreclosure Rescue Scams

Advisory Date: 4/6/09

Advisory Number: FIN-2009-A001

Advisory Link: https://www.fincen.gov/resources/statutes-regulations/guidance/guidance-financial-institutions-filing-suspicious-activity

Applicable SAR Instructions:

  • Provide complete and sufficient descriptions of known or suspected criminal violations or suspicious activity in the narrative section

  • Include the term “foreclosure rescue scam” in the narrative portions of all relevant SARs filed

  • Include all information available for each party suspected of engaging in this fraudulent activity in the Suspect/Subject Information Section of the SAR

    • Include information such as individual or company name, address, phone number and any other identifying information

  • The homeowner should not be listed as a subject when they are simply a victim, but rather should have their information listed in the narrative section of the SAR

  • If there is reason to believe the homeowner knowingly participated in the fraudulent activity, they should be listed in the subject section of the SAR

Topic: Foreclosure Rescue Scam

Advisory Name: Updated Advisory to Financial Institutions on Filing Suspicious Activity Reports Regarding Loan Modification/Foreclosure Rescue Scams

Advisory Date: 6/17/10

Advisory Number: FIN-2010-A006

Advisory Link: https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2010-a006

Applicable SAR Instructions:

  • Include the term “foreclosure rescue scam”

  • Include all information available for each party suspected of engaging in suspected fraudulent activity

    • Include information such as individual or company name, address, phone number, and any other identifying information

  • When the homeowner is believed to be simply a victim, include all available information in the narrative portion of the SAR about the homeowner and his or her property

    • The homeowner should not be listed as a suspect unless there is reason to believe the homeowner knowingly participated in the fraudulent activity

Topic: Foreign Corruption

Advisory Name: Guidance to Financial Institutions on Filing Suspicious Activity Reports regarding the Proceeds of Foreign Corruption

Advisory Date: 4/17/08

Advisory Number: FIN-2008-G005

Advisory Link: https://www.fincen.gov/resources/advisories/fincen-guidance-fin-2008-g005

Applicable SAR Instructions:

  • Provide a detailed description of the known or suspected criminal violation or suspicious activity in the narrative sections of SARs