On September 1, 2020, the Financial Crimes Enforcement Network (FinCEN) issued a statement regarding unlawfully disclosed Suspicious Activity Reports (SARs). FinCEN stated it is aware that various media outlets intended to publish a series of articles based on unlawfully disclosed SARs, as well as other sensitive government documents, from several years ago.
As FinCEN has stated previously, the unauthorized disclosure of SARs is a crime that can impact the national security of the United States, compromise law enforcement investigations, and threaten the safety and security of the institutions and individuals who file such reports. FinCEN has referred the matter to the U.S. Department of Justice and the U.S. Department of the Treasury’s Office of Inspector General.
SAR disclosure violations are subject to both civil and criminal penalties, including up to five years imprisonment. In addition, financial institutions could be liable for civil money penalties resulting from anti-money laundering program deficiencies (i.e., internal controls, training, etc.) that led to the improper SAR disclosure.
Financial institutions are reminded that in order to receive the protections it and its employees receive under the BSA/ AML rules with respect to SAR filings, institutions are required to ensure appropriate policies and procedures are in place to mitigate its risk of unlawful disclosure. The statement (https://www.fincen.gov/sites/default/ files/advisory/FIN-2010-A014. pdf ) provides:
“Additional risk-based measures to ensure the confidentiality of SARs could include, among other appropriate security measures, limited access on a need-to-know basis, restricted areas for reviewing SARs, logging of access to SARs, the use of cover sheets for SARs, or supporting documentation that indicates the filing of a SAR, or electronic notices that highlight confidentiality concerns before a person may access or disseminate the information.”
FinCEN encourages organizations and authorities, both governmental and non-governmental, to be vigilant in safeguarding SAR confidentiality. This includes ensuring all employees, agents, and individuals appropriately entrusted with information in a SAR are informed of the individual obligation to maintain SAR confidentiality. This obligation applies not only to the SAR itself, but also to information that would reveal the existence of the SAR. (Neither admit nor deny the existence of a SAR.) Such persons should also be informed of the consequences for failure to maintain such confidentiality, which could include civil and criminal penalties.
If you or your institution become aware of an unauthorized disclosure of a SAR or if your institution receives a subpoena for a SAR, you should immediately contact FinCEN’s Office of Chief Counsel as well as your primary federal regulator, as may be applicable in a corresponding SAR rule.
InCompliance Newsletter - Subscribe Here