The Financial Crimes Enforcement Network (FinCEN)1 is issuing this guidance to clarify:
(1) The Bank Secrecy Act (BSA) requirement that financial institutions provide Suspicious Activity Report (SAR) supporting documentation in response to requests by FinCEN and appropriate law enforcement or supervisory agencies;2
(2) What constitutes “supporting documentation” under SAR regulations;3 and
(3) When legal process is required for disclosure of supporting documentation.
(1) Disclosure of Supporting Documentation to FinCEN and Appropriate Law Enforcement or Supervisory Agencies
When a financial institution files a SAR, it is required to maintain a copy of the SAR and the original or business record equivalent of any supporting documentation for a period of five years from the date of filing the SAR.4 Financial institutions must provide all documentation supporting the filing of a SAR upon request by FinCEN or an appropriate law enforcement5 or supervisory agency.6
When requested to provide supporting documentation, financial institutions should take special care to verify that a requestor of information is, in fact, a representative of FinCEN or an appropriate law enforcement or supervisory agency. A financial institution should incorporate procedures for such verification into its BSA compliance or anti-money laundering program. These procedures may include, for example, independent employment verification with the requestor’s field office or face-to-face review of the requestor’s credentials.
Disclosure of SARs to appropriate law enforcement and supervisory agencies is protected by the safe harbor provisions applicable to both voluntary and mandatory suspicious activity reporting by financial institutions.7
(2) What Constitutes Supporting Documentation
“Supporting documentation” refers to all documents or records that assisted a financial institution in making the determination that certain activity required a SAR filing. A financial institution must identify supporting documentation at the time the SAR is filed,8 and this documentation must be maintained by the institution as such. The manner in which a financial institution maintains supporting documentation may vary from institution to institution, but each institution should prescribe its own method in its anti-money laundering program written procedures. For instance, a financial institution’s procedures may require that all supporting documentation for a particular SAR be segregated in a single file folder or scanned and maintained in a data file.
What qualifies as supporting documentation depends on the facts and circumstances of each filing. As indicated in each of the SAR forms, financial institutions should identify in the SAR narrative the supporting documentation, which may include, for example, transaction records, new account information, tape recordings, e-mail messages, and correspondence. While items identified in the narrative of the SAR generally constitute supporting documentation, a document or record may qualify as supporting documentation even if not identified in the narrative.
(3) No Legal Process is Required for Disclosure of Supporting Documentation
The Right to Financial Privacy Act (RFPA) generally prohibits financial institutions from disclosing a customer’s financial records to a Government agency without service of legal process, notice to the customer and an opportunity to challenge the disclosure.9 However, no such requirement applies when the financial institution provides the financial records or information to FinCEN or a supervisory agency in the exercise of its “supervisory, regulatory or monetary functions.”10 In addition, no such requirement applies when FinCEN or an appropriate law enforcement or supervisory agency requests either a copy of a SAR or supporting documentation underlying the SAR.
With respect to supporting documentation, rules under the BSA state explicitly that financial institutions must retain copies of supporting documentation, that supporting documentation is “deemed to have been filed with” the SAR, and that financial institutions must provide supporting documentation upon request.11 FinCEN has interpreted these regulations under the BSA as requiring a financial institution to provide supporting documentation even in the absence of legal process. FinCEN understands that this is in accord with the RFPA, which states that nothing in the act “authorize(s) the withholding of financial records or information required to be reported in accordance with any Federal statute or rule promulgated thereunder.”12