Suspicious Activity Investigation Flashcards

What are the key components of a well-documented SAR investigation file?

Answer: Documentation of the alert trigger, research conducted (internal and external), timeline of suspicious activity, analysis of the activity, the filing decision rationale, and records of any law enforcement communications

A complete SAR investigation file must document the entire investigation lifecycle: the triggering event, all research steps, the analytical findings, the SAR filing decision rationale, and all communications with law enforcement — providing a clear, defensible record.

What is the 'no tipping off' rule and how does it affect account management decisions after a SAR is filed?

Answer: Financial institutions cannot notify a customer that a SAR has been filed or is being considered about them, which means account closure decisions and customer communications must be managed carefully to avoid revealing SAR-related concerns

The tipping off prohibition means institutions must handle any account management actions — including account closures, product restrictions, or customer inquiries — in ways that do not reveal or suggest that a SAR has been filed.

What is the difference between a 'voluntary SAR' and a 'mandatory SAR'?

Answer: All SAR filings by covered financial institutions are mandatory when the filing threshold is met; 'voluntary' SARs refer to filings below the mandatory threshold or by non-covered entities filing on a discretionary basis

Covered financial institutions are required to file SARs when the mandatory filing threshold and criteria are met. 'Voluntary' SARs are filed at an institution's discretion — either below the mandatory dollar threshold or by entities not legally required to file — as a good-faith disclosure of suspicious activity.

What are 'transaction monitoring scenarios' (rules) and how are they developed?

Answer: Algorithmic rules or analytical models within a transaction monitoring system designed to detect specific suspicious activity patterns; developed based on regulatory guidance, known ML typologies, the institution's risk profile, and historical SAR data

Transaction monitoring scenarios are detection rules or models designed to identify specific suspicious patterns — such as structuring, rapid fund movement, or unusual cash activity — developed based on the institution's business model, ML typologies, and regulatory guidance.

How should an institution handle a FinCEN 314(a) inquiry for a customer who has a current SAR investigation open?

Answer: Respond to the 314(a) inquiry as required (confirm or deny the match), continue the internal investigation, and ensure confidentiality is maintained for both the SAR and the 314(a) response

Institutions must respond to 314(a) inquiries confirming or denying whether the named individual has current accounts or conducted transactions, while simultaneously maintaining confidentiality of both the SAR investigation and the 314(a) response — they are separate, confidential processes.

What is 'alert disposition' in a transaction monitoring system and what documentation is required?

Answer: The process of reviewing transaction monitoring alerts and documenting the outcome — either closing the alert with documented rationale or escalating to a full investigation — required to demonstrate the appropriateness of AML decisions to regulators

Alert disposition is the analyst review of each transaction monitoring alert, resulting in either a documented close (with clear rationale why the activity is not suspicious) or escalation to a formal investigation. All dispositions must be documented to support regulatory examination.