12 C.F.R. Subpart B—Reports of Suspicious Activities
Title 12 - Banks and Banking
(a) Purpose and scope. This section ensures that national banks file a Suspicious Activity Report when they detect a known or suspected violation of Federal law or a suspicious transaction related to a money laundering activity or a violation of the Bank Secrecy Act. This section applies to all national banks as well as any Federal branches and agencies of foreign banks licensed or chartered by the OCC. (b) Definitions. For the purposes of this section: (1) FinCEN means the Financial Crimes Enforcement Network of the Department of the Treasury. (2) Institution-affiliated party means any institution-affiliated party as that term is defined in sections 3(u) and 8(b)(5) of the Federal Deposit Insurance Act (12 U.S.C. 1813(u) and 1818(b)(5)). (3) SAR means a Suspicious Activity Report on the form prescribed by the OCC. (c) SARs required. A national bank shall file a SAR with the appropriate Federal law enforcement agencies and the Department of the Treasury in accordance with the form's instructions, by sending a completed SAR to FinCEN in the following circumstances: (1) Insider abuse involving any amount. Whenever the national bank detects any known or suspected Federal criminal violation, or pattern of criminal violations, committed or attempted against the bank or involving a transaction or transactions conducted through the bank, where the bank believes that it was either an actual or potential victim of a criminal violation, or series of criminal violations, or that the bank was used to facilitate a criminal transaction, and the bank has a substantial basis for identifying one of its directors, officers, employees, agents or other institution-affiliated parties as having committed or aided in the commission of a criminal act, regardless of the amount involved in the violation. (2) Violations aggregating $5,000 or more where a suspect can be identified. Whenever the national bank detects any known or suspected Federal criminal violation, or pattern of criminal violations, committed or attempted against the bank or involving a transaction or transactions conducted through the bank and involving or aggregating $5,000 or more in funds or other assets where the bank believes that it was either an actual or potential victim of a criminal violation, or series of criminal violations or that it was used to facilitate a criminal transaction, and the bank has a substantial basis for identifying a possible suspect or group of suspects. If it is determined prior to filing this report that the identified suspect or group of suspects has used an alias, then information regarding the true identity of the suspect or group of suspects, as well as alias identifiers, such as drivers' license or social security numbers, addresses and telephone numbers, must be reported. (3) Violations aggregating $25,000 or more regardless of potential suspects. Whenever the national bank detects any known or suspected Federal criminal violation, or pattern of criminal violations, committed or attempted against the bank or involving a transaction or transactions conducted through the bank and involving or aggregating $25,000 or more in funds or other assets where the bank believes that it was either an actual or potential victim of a criminal violation, or series of criminal violations, or that the bank was used to facilitate a criminal transaction, even though there is no substantial basis for identifying a possible suspect or group of suspects. (4) Transactions aggregating $5,000 or more that involve potential money laundering or violate the Bank Secrecy Act. Any transaction (which for purposes of this paragraph (c)(4) means a deposit, withdrawal, transfer between accounts, exchange of currency, loan, extension of credit, or purchase or sale of any stock, bond, certificate of deposit, or other monetary instrument or investment security, or any other payment, transfer, or delivery by, through, or to a financial institution, by whatever means effected) conducted or attempted by, at or through the national bank and involving or aggregating $5,000 or more in funds or other assets, if the bank knows, suspects, or has reason to suspect that: (i) The transaction involves funds derived from illegal activities or is intended or conducted in order to hide or disguise funds or assets derived from illegal activities (including, without limitation, the ownership, nature, source, location, or control of such funds or assets) as part of a plan to violate or evade any law or regulation or to avoid any transaction reporting requirement under Federal law; (ii) The transaction is designed to evade any regulations promulgated under the Bank Secrecy Act; or (iii) The transaction has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage, and the institution knows of no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction. (d) Time for reporting. A national bank is required to file a SAR no later than 30 calendar days after the date of the initial detection of facts that may constitute a basis for filing a SAR. If no suspect was identified on the date of detection of the incident requiring the filing, a national bank may delay filing a SAR for an additional 30 calendar days to identify a suspect. In no case shall reporting be delayed more than 60 calendar days after the date of initial detection of a reportable transaction. In situations involving violations requiring immediate attention, such as when a reportable violation is ongoing, the financial institution shall immediately notify, by telephone, an appropriate law enforcement authority and the OCC in addition to filing a timely SAR. (e) Reports to state and local authorities. National banks are encouraged to file a copy of the SAR with state and local law enforcement agencies where appropriate. (f) Exceptions. (1) A national bank need not file a SAR for a robbery or burglary committed or attempted that is reported to appropriate law enforcement authorities. (2) A national bank need not file a SAR for lost, missing, counterfeit, or stolen securities if it files a report pursuant to the reporting requirements of 17 CFR 240.17f–1. (g) Retention of records. A national bank shall maintain a copy of any SAR filed and the original or business record equivalent of any supporting documentation for a period of five years from the date of the filing of the SAR. Supporting documentation shall be identified and maintained by the bank as such, and shall be deemed to have been filed with the SAR. A national bank shall make all supporting documentation available to appropriate law enforcement agencies upon request. (h) Notification to board of directors—(1) Generally. Whenever a national bank files a SAR pursuant to this section, the management of the bank shall promptly notify its board of directors, or a committee of directors or executive officers designated by the board of directors to receive notice. (2) Suspect is a director or executive officer. If the bank files a SAR pursuant to paragraph (c) of this section and the suspect is a director or executive officer, the bank may not notify the suspect, pursuant to 31 U.S.C. 5318(g)(2), but shall notify all directors who are not suspects. (i) Compliance. Failure to file a SAR in accordance with this section and the instructions may subject the national bank, its directors, officers, employees, agents, or other institution-affiliated parties to supervisory action. (j) Obtaining SARs. A national bank may obtain SARs and the Instructions from the appropriate OCC District Office listed in 12 CFR part 4. (k) Confidentiality of SARs. SARs are confidential. Any national bank or person subpoenaed or otherwise requested to disclose a SAR or the information contained in a SAR shall decline to produce the SAR or to provide any information that would disclose that a SAR has been prepared or filed, citing this section, applicable law (e.g., 31 U.S.C. 5318(g)), or both, and shall notify the OCC. (l) Safe harbor. The safe harbor provision of 31 U.S.C. 5318(g), which exempts any financial institution that makes a disclosure of any possible violation of law or regulation from liability under any law or regulation of the United States, or any constitution, law, or regulation of any state or political subdivision, covers all reports of suspected or known criminal violations and suspicious activities to law enforcement and financial institution supervisory authorities, including supporting documentation, regardless of whether such reports are required to be filed pursuant to this section or are filed on a voluntary basis. [61 FR 4337, Feb. 5, 1996]
Title 12: Banks and Banking
PART 21—MINIMUM SECURITY DEVICES AND PROCEDURES, REPORTS OF SUSPICIOUS ACTIVITIES, AND BANK SECRECY ACT COMPLIANCE PROGRAM
Subpart B—Reports of Suspicious Activities
§ 21.11 Suspicious Activity Report.
