We recently hosted a webinar, "Key Issues to Consider Regarding SAR Filings, Due
Diligence and Failure to File," in which we addressed
what financial institutions need to know about filing a
Suspicious Activity Report (SAR) with Treasury's Financial
Crimes Enforcement Network (FinCEN).
We set forth below a non-exhaustive list of suggested practices for
your organization to consider with respect to handling SARs.
| SAR Confidentiality Best Practices | |
| Dos | Don'ts |
|
Review applicable policies and procedures to determine
whether your company has mandated certain SAR handling
procedures.
Tip: Look for language about taking steps to avoid
producing or disclosing SARs and documents referencing
SARs. |
Avoid printing a hard copy.
Tip: If printing is necessary, consider printing on different-color paper and keeping in a segregated file. |
|
Establish clear SAR confidentiality protocols within your
team.
Tip: Document review protocols should provide an
overview of SAR confidentiality and instructions for maintaining
SAR confidentiality. |
Avoid unnecessary sharing—in hard or electronic copy,
or discussion in public places.
Tip: If SARs are maintained on a public drive, place in
a password-protected ZIP file, do not use a filename that indicates
that the file is a SAR and consider restricting
access. |
|
Include SAR handling instructions in dealings with third
parties/contractors (e.g., email review, analytics).
Tip: The SAR handling instructions may be identical to,
or based on, the SAR confidentiality protocols for the team. |
Avoid referencing specific SARs in writing unless
necessary.
Tip: When referencing SARs in writing, include a header on the document or on your email that states "BSA CONFIDENTIAL / CONTAINS SAR INFORMATION." |
|
Store electronic copies of SARs and SAR information in a
restricted, password-protected file.
Tip: Apply these protocols to work product that the
team creates (e.g., chronologies). Where possible, use a
header or footer: "BSA CONFIDENTIAL / CONTAINS SAR
INFORMATION." |
Avoid referencing specific SARs in redaction markings or
privilege logs.
Tip: FinCEN has instructed financial institutions to use language such as "nonpublic supervisory information." |
| Destroy copies of SARs when they are no longer needed. |
Do not mention specific SARs in internal
documents.
Tip: General references are ok (e.g., "Review
SARs" or "Draft SAR") but "Review SAR re: John
Doe" could lead to an unauthorized disclosure. |
| Consult with AML experts, especially if asked to produce SARs. |
Do not assume that a government requestor is entitled to
SARs. |
|
Produce SAR information carefully.
Tip: Produce SAR information separately from other
documents in the production, and label the SAR information
"BSA CONFIDENTIAL / CONTAINS SAR DATA." Discuss
production with the government ahead of time. |
Avoid sending SARs and SAR information out of the United
States. Tip: We recommend careful controls around cross-border transmission of SARs and SAR information (there is a limited exception to the prohibition for sharing SARs "up" to foreign parents, but financial institutions should handle this with care). Consider sharing sanitized records that do not reveal the existence of a SAR. |
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.