CUNA Comment Letter
Revised Suspicious Activity Report by Depository Institutions (Second Notice)
July 19, 2006
Mr. Neil M. McNamara
National Credit Union Administration
1775 Duke Street
Alexandria, VA 22314-3428
Dear Mr. McNamara:
The Credit Union National Association (CUNA) appreciates the opportunity to provide additional input regarding the proposed revisions to the Suspicious Activity Report (SAR) form, which has been submitted by the Financial Crimes Enforcement Network (FinCEN) and the Banking Supervisory Agencies to the Office of Management and Budget (OMB) for approval. By way of background, CUNA represents approximately 90% of our nations more than 8,800 state and federal credit unions, which serve 89 million members. CUNA responded to the agencies first request for comments in February with respect to modifying and reformatting the SAR form to standardize that report with SARs being filed by other financial institutions. The SAR form is also being revised to support joint filing by providing the necessary data blocks and instructions for completing a jointly filed SAR. In addition, the list of information that should be included in the Narrative Section would be expanded to aid the filing institution in the completion of the SAR, which would improve the forms utility to law enforcement. According to the second notice, based on the feedback received from CUNA and others, the agencies have made some additional changes in the form that are intended to further improve the form.
Summary of CUNAs Comments
- CUNA generally supports the draft SAR revisions, as they should make the form more understandable and user-friendly for institution staff.
- We strongly urge the regulators to issue additional guidance on when to file a SAR to lessen the number of "defensive" SAR filings as well as to reconsider their decision to maintain existing reporting thresholds and filing deadlines.
- We request that the regulators publish the guidance on joint SAR filing for public comment before it is issued in final form.
- In the Narrative section (Part V), we continue to recommend that the instructions be modified so they are more orderly and the words "Supporting documentation should not be filed with this report." are as prominent as possible. We also think that the block that asks for the total amount involved in the known or suspicious activity is the logical spot to indicate U.S. or foreign currency as opposed to the narrative section.
- We believe more detailed guidance on filling out the form, including checking boxes, in the case of continuing suspicious activity and correction/amendment of a prior report would help prevent confusion.
- It would be helpful to filers if the agencies clarified the Instructions even further with regard to multiple subjects.
- The General Instructions section should still define the term "computer intrusion" for purposes of SAR reporting.
- It would facilitate credit unions contacting the FinCEN Financial Institutions Hotline to report suspected terrorist-related activity if that telephone number were provided in the Instructions.
- While the agencies have increased the estimated time to complete a SAR, we believe the estimate remains too low.
Discussion of CUNAs Comments
CUNA welcomes the continuing efforts of the regulatory agencies to simplify, shorten and clarify the SAR form in order to facilitate the completion and filing of SARs by credit unions and other financial institutions. As the proposed changes are designed to contribute to this effort, CUNA generally supports the reformatting and other modifications in the draft SAR. We appreciate the statement in the second notice that the planned effective date for the new form of January 1, 2007 would be adjusted as necessary to provide adequate lead-time for institutions. We have some comments on the SAR package submitted to OMB which we would like considered before the SAR form is finalized.
As in our comments back in April, CUNA encourages the regulators to issue guidance to help alleviate the burden of filing SARs. Clarification of examination procedures/standards for SARs would help lessen the pressure institutions may feel to file "defensive" SARs. Although the regulators indicated in the second notice that the current reporting threshold limits and filing deadlines are appropriate, we continue to urge the agencies to consider modifications in upcoming rulemaking and guidance. Specifically, we feel the time for filing a SAR should be increased from no later than 60 days after the date of the initial detection of facts, which includes a delay for an additional 30 days if needed to identify a suspect. In addition, we request that the regulators eliminate the rule requiring institutions to file a follow-up SAR every 90 days if the reportable activity continues and instead require a follow-up SAR only if and when the activity pattern changes.
Several commenters requested more guidance concerning joint filing and voiced concern regarding data sharing. The agencies note in the second notice that such guidance has been drafted and is under review. The guidance is expected to be issued prior to the effective date of the new SAR form. Given that agency examiners will expect institutions to follow the guidance when it is issued, we urge the agencies to publish the guidelines in proposed form with a public comment period so institutions will have a chance to review it and provide feedback.
With regard to the SAR form itself, we reiterate several suggestions pertaining to the Narrative section (Part V), the most critical section of the SAR. First, the information requested in item l (indicate whether U.S. or foreign currency) should be moved to Section II Suspicious Activity Information, as it is more appropriate there. Second, when indicating the total amount of money involved in the suspicious activity, it makes sense to note whether the money is in U.S. or foreign denomination. Third, we continue to feel the instructions below the block with letters "a" through "s" to the end of the page seem rather disjointed and may be somewhat confusing. Therefore, we still recommend moving the blocks with those instructions up to the block titled Explanation/description of suspicious activity(ies). In order to make the words "Supporting documentation should not be filed with this report. Maintain the information for your files." stand out as prominently as possible, we recommend placing that language as the only instruction in the block right above the narrative block.
The first draft of the new SAR form contained 2 check boxes at the very top one box for amending or correcting a prior report (data item 1) and one box for updating a prior report (data item 1a). CUNA advocated that the agencies provide more guidance as to what the two boxes are intended to encompass. The agencies decided to make box 1a clearer by amending the box to say "recurring" report instead of "updated" report. Further, the Instructions now explain this box should be checked for a "recurring report filed on continuing activity". We appreciate the change, but believe the Instructions could better clarify whether one or both boxes should be checked in the case of continuing suspicious activity. In our view, it would be clearer if the boxes were numbered 1a, 1b and 1c instead of 1, 1a and 1b. Further, we reiterate the suggestion to include instructions underneath boxes 1 and 1a stating "If box 1 or 1a is checked, complete sections I-IV and note any changes in Part V." Accompanying that addition, letter r in the Narrative section could be changed to: "If correcting or amending a prior report, it is not necessary to repeat the previous narrative. Note only the changes here in Part V."
We have concerns remaining with regard to filling out the form in the case of multiple suspects. Most importantly, it would be beneficial to define what constitutes "multiple subjects". It would also be helpful to explain more fully how to complete the corresponding data items. According to the draft form, proposed data item 42, "Relationship of subject (Part I) to the above listed financial institution,'' would be moved from Part II, current data item 30, to Part III. Based on comments that the placement in Part III would pose a problem with reporting multiple subjects, the Instructions have been revised accordingly. However, we feel the revised Instructions are not sufficiently clear. While the Instructions for Item 2 (including a check box if multiple subjects) state that the filer should complete a separate Part I (Subject Information) for each subject, they do not indicate that the filer should also complete a separate Item 42 for each subject.
CUNA has four specific recommendations for the General Instructions section. As we suggested previously, while the draft SAR still contains the check box titled "Computer Intrusion" in the Summary of Characterization of Suspicious Activity section (Part II Suspicious Activity Information), the definition of what that term encompasses for purposes of the SAR reporting requirement has been eliminated. While a very detailed explanation may not be necessary, we believe that it would be valuable to define "computer intrusion" as a computer-related security event involving unauthorized individual(s) gaining access to ("hacking into") the institutions computer system (mainframe). The definition should clarify that the breach of a members/customers personal computer does not constitute a "computer intrusion" for purposes of SAR reporting. Further, a breach of the institutions website or spoofing would not be covered under the definition, nor would phishing or spamming.
In addition, it would be helpful for the agencies to clarify the definition of "customer" in Part III, Item 42.
FinCEN guidelines suggest that institutions report continuing suspicious activity by filing a report at least every 90 days (Federal Financial Institutions Examination Councils BSA/AML Examination Manual). We continue to believe it would be helpful to explain the guidelines for continuing suspicious activity in Part A (When to file) as well as to add this information to Instructions for Item 22 where it states "A new report must be filed for other related suspicious transactions committed after the initial detection period."
The notice indicates that depository institutions reporting possible terrorist activity must file a SAR and should also contact FinCENs Financial Institutions Hotline. Although the FinCEN Helpline telephone number is listed in the Instructions, we promote including this Hotline guidance as well as the Hotline number so it is immediately handy for the institution staff responsible for filling out SARs and they can contact the Hotline in an expeditious a manner as possible.
Finally, the regulators initially indicated that the SAR form requires about one hour to complete. As a result of several commenters challenging that figure, in the notice to OMB the agencies have adjusted that figure to 2 hours in order to take into account the routine recordkeeping requirement pertaining to SARs. If the final estimate will take into account recordkeeping, then we encourage the agencies to adjust the figure to also include the time required to research and provide analyses in the narrative section regarding instances of suspected structuring. As structuring involves one person or several persons acting in conjunction, withdrawals or deposits at a single or multiple branches at one or more financial institutions over a single or multiple-day period, it can prove very complex and time-consuming to investigate. Therefore, we believe the estimated burden should be adjusted upward in order to reflect the necessary resources devoted to such research and analysis.
Thank you for the opportunity to share our comments on the SAR form. We believe such public notice and comment on important agency forms can result in significant improvements; and we encourage the agencies to have a similar public comment period for the Currency Transaction Report (CTR) form. If you have any further questions, please contact me at firstname.lastname@example.org or at (202) 508-6743.
Senior Regulatory Counsel