Analysis & Commentary: FinCEN’s Proposed Burden Estimate for Preparing and Filing SARs

On May 26, 2020, the Financial Crimes Enforcement Network (FinCEN) published a Notice in the Federal Register titled “Proposed Updated Burden Estimate for Reporting Suspicious Transactions Using FinCEN Report 111 – Suspicious Activity Report.” This Notice is required under the Paperwork Reduction Act (PRA): government agencies are required to periodically assess and estimate the burdens and costs of their regulatory regimes.

This Notice is ground-breaking.

It is the first Notice where:

1. 1. FinCEN has analyzed the Suspicious Activity Report (SAR) database to quantitatively assess the numbers, characteristics and types of SARs filed, and has evaluated SAR filings by institution type, by the type of SAR filing work required for completion, and by the various types of involved financial institution employees
   2. FinCEN is actively providing this information and seeking feedback from the private sector on other available information that could be incorporated into future analyses

In prior Notices, FinCEN has simply estimated that the SAR filing process takes a total of two hours for each and every SAR filed. With this Notice, FinCEN identified and attempted to capture burden and cost estimates for five categories of SARs, two types of SAR filings (batch and discrete), six stages in the SAR filing process, and four types of employee positions involved in the process.

The five SAR categories described include:

1. Depository institutions’ (i.e., banks’ and credit unions’) original SAR filings with standard content
2. Depository institutions’ original SAR filings with extended content
3. Non-depository institutions’ (e.g., investment firms’ or insurance companies’) original SAR filings with standard content
4. Non-depository institutions’ original SAR filings with extended content
5. All filers’ continuing activity SARs

The standard and extended SAR content analysis examined combinations of:

1. The number of named suspects
2. The number of suspicious activity categories marked on the SAR form
3. The length and composition of the narrative
4. Whether or not the SAR included an attachment

In the Notice, FinCEN also outlines six stages in the SAR filing process:

1. Maintaining a transaction monitoring system
2. Reviewing alerts
3. Transforming alerts into cases
4. Reviewing cases
5. Documenting the determination whether or not to file a SAR
6. Filing the SAR

The current two-hour per SAR PRA estimate only considered stage six, filing the SAR. The new Notice adds stages four and five to the PRA estimate. FinCEN acknowledged that further data, including comments from the private sector, are required to successfully include stages one through three.

There are four types of employees or positions involved in the SAR process, as outlined in the Notice to assess cost and burden estimates:

1. General supervision or employees for process oversight
2. Direct supervision
3. Clerical employees for SAR investigation
4. Clerical employees for SAR filing

Accurate details on these employee roles, such as the associated costs, including salaries and benefits, and the relative time each employee spends on the each of the five SAR categories, across the six stages of the SAR filing process, is key to calculating accurate PRA burden estimates.

In this Notice, FinCEN has changed their PRA burden estimate of 120 minutes per SAR to an estimated 25 to 315 minutes per SAR, including only the last three of the six stages in the SAR filing process. Stages four and five are now included as the “supplemental annual PRA burden” in the new PRA estimate. Previously, FinCEN only included stage six in their 120 minutes per SAR estimate.

FinCEN is inviting comments on these new estimates, as well as input from institutions regarding how to accurately include and estimate the burdens of the first three stages of the SAR filing process.

The comment period ends July 27, 2020.

Insights & Analysis

Very simply, FinCEN is proposing updates to the way it estimates the burden – both time and cost – for preparing and filing Suspicious Activity Reports and is seeking comments on these proposed updates. FinCEN’s newfound ability to analyze SAR filing data has allowed them to shift their PRA burden estimate from a two-hours-for-all-SARs approach to a much more nuanced, data-driven approach.

Summary of the total time to prepare, file and record a SAR: FinCEN PRA burden and cost estimate

FinCEN recognizes that there is a complex process to monitor for and alert on unusual activity; to determine whether or not to investigate that activity; to investigate the unusual activity and, if it is suspicious, to prepare and file a SAR, or otherwise document why the activity is not suspicious. FinCEN acknowledges that it “lacks the granular data to estimate the costs of certain steps in that process.” In fact, FinCEN lacks the data to include the burdens for stages one through three, which arguably may be the most burdensome stages of the SAR filing process from both time and cost perspectives.

While the definition of the SAR process is powerful for the purposes of the PRA burden and cost estimates, I believe that the SAR process should not be distinct from consideration of financial institutions’ overall Bank Secrecy Act (BSA) and AML programs, processes, and the associated burden and cost.

The singular purpose of the BSA/AML program regime is to provide timely, actionable intelligence to law enforcement and the intelligence community by way of BSA reports and record keeping – primarily SARs and Currency Transaction Reports (CTRs). Therefore, integral to the SAR production process are the program requirements of risk assessment, Customer Identification Programs (CIPs), Customer Due Diligence (CDD), training, independent testing, and BSA examination management.  These additional costs should be included in future Notices.

All SARs are not Created Equal

This is also where FinCEN acknowledges that not all SARs are the same. While FinCEN identifies five SAR categories for its burden estimates, the SAR type categories are further differentiated by:

1. Whether the filing is an original SAR or a “continuing activity” SAR
2. Whether the SAR was filed by a bank or credit union (i.e., a depository institution) or another type of SAR filer (i.e., a non-depository institution)
3. Whether the SAR is of “standard” complexity or “extended” complexity
4. Whether SARs are batch-filed or filed as discrete, stand-alone SARs

FinCEN provides a breakdown of the 12,148 financial institutions, by type, that filed SARs in 2019. However, FinCEN notes “not all financial institutions identify suspicious activity that would warrant a SAR filing.”

Source: Proposed Updated Burden Estimate for Reporting Suspicious Transactions Using FinCEN Report 111 – Suspicious Activity Report – FinCEN

Providing the total number of financial institutions by type within this chart would allow for a comparison of the significant number of institutions that did not report at least one suspicious transaction in 2019. Based on publicly available data, I have provided the following estimates of those institutions:

• Banks – Federal Deposit Insurance Corporation (FDIC) data shows that there were 5,186 banks at the end of 2019. 95% of banks filed at least one SAR in 2019, which means that 5%, or 250 banks, didn’t file a single SAR in 2019. 
• Credit Unions – National Credit Union Administration (NCUA) data shows that there were 5,236 credit unions at the end of 2019. A September 2019 Government Accountability Office (GAO) report showed 3,422 credit unions. Using the NCUA data, 62% of credit unions filed at least one SAR in 2019, which means that 38%, or 2,001 credit unions, didn’t file a single SAR in 2019. The GAO data would suggest that 95% of credit unions filed a SAR.
• Money Services Businesses (MSBs) – There are 22,736 MSBs registered with FinCEN. Less than 10% of registered MSBs filed at least one SAR in 2019.

FinCEN reports that “Nearly three quarters of original SARs filed by depository institutions report only up to two subjects involved in up to five suspicious activities, described in a narrative that does not exceed one page, and on their face do not appear complex.”

This statement emphasizes the need for better understanding of SAR filing efforts, and the quality of information being provided to law enforcement; FinCEN has determined that the majority of the 2.7 million reports filed in 2019 were not complex.

It is incumbent on the financial services industry to provide FinCEN with data and information on the first three stages of the SAR filing process, as well as insight into the other aspects of regulatory programs that are not reflected in these six stages, such as BSA requirements of risk assessment, CIP, CDD, etc. – these requirements are integral to, and part of, the SAR production and filing process and must be included in adequate assessments.

Request for Comments

While financial institutions are invited to provide general comments, FinCEN has six specific information requests, including comments on:

1. Other factors that may affect the burden and cost of SAR reporting, that can be determined from the BSA Database and other publicly available, reliable sources
2. Characterization of the first three stages of the SAR filing process, and the general case conversion rate utilized in those stages (including maintaining a transaction monitoring system; reviewing alerts; and transforming alerts into cases)
3. Four types of employees or positions required in the SAR filing process, their costs, including salaries and benefits, and the relative time each employee spends on the five types of SARs across all stages of the SAR filing process
4. Estimates calculated for i) the hourly burden to review of all cases based on true positive alerts, and ii) the decision not to file SARs based on the proportion of cases that were not converted into original SARs
5. Segmentation and categorization of SARs by filing method, and the complexity used to determine burden estimates
6. Other assumptions made in the calculation of the associated burden, such as minutes required by category

Financial institutions must take this opportunity to provide FinCEN with tangible, publicly available data: anecdotal comments must be replaced with data-driven information to allow for improved public- and private-sector decision making.

How to Provide Comments

Instructions and guidance comments are provided in the Notice. Written comments are welcome and must be received on or before July 27, 2020.

Comments may be submitted by any of the following methods:

• Federal E-rulemaking Portal: http://www.regulations.gov.
• Mail: Policy Division, Financial Crimes Enforcement Network, P.O. Box 39, Vienna, VA 22183.

For further information you can contact the FinCEN Regulatory Support Section at 1-800-767-2825 or electronically at frc@fincen.gov.