When Wachovia Bank agreed to a settlement with the U.S.government on charges that it failed to prevent drug traffickersfrom laundering more than $100 million through accounts at thebank, it became the financial institution with the unfortunatedistinction of having paid the largest penalty, $160 million, for aviolation of the Bank Secrecy Act. Under terms of the deferredprosecution agreement, Wachovia forfeited $110 million and paid a$50 million fine to the Treasury.

The U.S. Attorney for the Southern District of Florida calledWachovia's failure to properly monitor and report on suspiciousactivity “systematic,” a problem that allowed more than $400billion in unmonitored funds to be channeled through accounts atthe bank between 2004 and 2007 by currency exchange houses inMexico, primarily by way of wire transfers.

Was this a case of a financial institution being duped by a gangof sophisticated criminals? From all appearances, that wasn't thecase. Simply put, the Suspicious Activity Report program of theFinancial Crimes Enforcement Network was not followed. FinCENrequires that financial and nonbanking financial institutions fileSuspicious Activity Reports to report “known or suspectedviolations of federal law” in compliance with the Bank SecrecyAct.

One of the primary goals of a SAR is to help the governmentcombat domestic and international money laundering. Wachovia is notalone. Other financial institutions have been assessed significantpenalties because of noncompliance with the SAR filing requirementsin addition to possible criminal action against the executives ofthe financial institutions.

With the passage of the USA PATRIOT Act in 2001, the SAR hasbecome one of the key tools to fight terrorist financing and hasserved to increase the volume of SARs filed with FinCEN. As aconsequence, institutions are faced with the need to:

- Store and easily retrieve a paper trail for filed reports.

- Define and manage a process to file SARs.

- Track the decision-making process leading up to filing a SAR,including determination that a SAR needs to be filed, decisions onwhy the SAR was filed, determination date for the SAR and whoapproved the filing and when.

- Manage a single point of contact.

- Store FinCEN's acknowledgement of the SAR.

There are no exceptions. Every institution must participate andhave its SAR program audited.

Despite the dramatic rise in the number of SARs filed and theno-excuses approach the government has toward compliance with theprogram, many credit unions run their SAR programs fromspreadsheets and slips of paper that can be easily misplaced.What's more, a credit union can benefit by using the SAR program asa way to help prevent fraud, but only if it uses a mechanism thatpermits trend analysis that comes from looking at the SARsthemselves.

Using such a system, a credit union can identify wheresuspicious activity is occurring, the specific fraud types andwhich customers tend to be associated with such activity. Beyondgaining such important insight, managing a SAR program is easier torun, more likely to be compliant and, in all likelihood, lesscostly than what might be in place.

There are options that can help a credit union address SARrequirements. The salient features to look for in such a solutioninclude automated alerts for filing timely Suspicious ActivityReports and SAR report creation. Also look for the ability to seepatterns between and among potentially related cases. Improvedproductivity, prosecutions and recoveries as well as providing theCU's management with the information needed to communicate successand assure compliance are also important.

During the fraud or financial crime investigation process, thebulk of the data required for SAR reporting is collected. Aworthwhile fraud control and management system provides for aseamless flow of data from the case screens into the SAR withoutrequiring reentry of data, reducing errors and increasingproductivity.

A SAR needs to be filed no later than 30 calendar days from thedate of the initial detection of the suspicious activity, unless nosuspect can be identified. In that case, the time period for filinga SAR is extended to 60 days. The time period for filing a SARstarts when a CU, during its review or because of other factors,knows or has reason to suspect that the activity or transactionsunder review meet one or more of the definitions of suspiciousactivity.

When the time period starts is a key concept. A CU needs to beable to present its findings in an auditable, trackable manner whenthe detection date is defined. The detection date can be changed toget more days to file, if necessary. Often times, CUs choose not tochange the detection date and file the SAR based on the informationthey have at hand. A supplementary SAR can be filed later when moreinformation is discovered. This leads to what is called a“defensive SAR filing.”

The 30/60 day rule of the SAR program kicks in from the day thedetermination is made that a SAR must be filed. Consequently, it isof paramount importance that a SAR does not fall through the cracksin the sense that those responsible for timely filing of completedSARs are aware of the current status of the filing.

If it is determined that a SAR will not be filed, suchinformation can be documented and saved with the case details. Thisis especially helpful during compliance audits and in the eventthat the case is reopened on the basis of information obtained inthe future.

As a result of the recent high profile BSA enforcement actions,like the Wachovia situation, FinCEN is concerned that institutionsare filing defensive Suspicious Activity Reports without a formalreview process and which is leading to a dilution of the value ofsuspicious reporting as a whole. An effective automated fraudcontrol and management solution provides the ability to link casemanagement with SAR generation while allowing customers to definean auditable, transparent workflow around the process.

It's also an excellent way to avoid Wachovia's fate.

N. Venu Gopal is CEO of Aithent Inc. He can bereached at 212-725-7646 ext. 2700 [email protected]