Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

A cornerstone compliance obligation for U.S. broker-dealers is to identify, investigate, and report suspicious transactions conducted or attempted at or through the broker-dealer. Although this duty has been in place since 2002, the Securities and Exchange Commission’s (SEC) Division of Examinations includes suspicious activity reports (SARs) compliance among its examination priorities annually; a handful of firms are subject to enforcement proceedings and steep penalties for failing to file the required SAR each year.

contentpilot/introduction

In this alert, we review broker-dealer SAR obligations, consider how some broker-dealers have fallen short, and outline what a securities broker should do to satisfy those obligations.

core/paragraph

core/heading

The Bank Secrecy Act (BSA) and the implementing regulations (31 C.F.R. § 1023.320) promulgated by the Department of Treasury’s Financial Crimes Enforcement Network (FinCEN) require broker-dealers to file SARs with FinCEN. Generally, a transaction must be reported if:

core/list

A SAR must be filed no later than 30 days after the broker-dealer initially detects facts that may constitute a basis for filing. But the broker-dealer may extend this reporting by an additional 30 days if no suspect can be identified at the time of initial detection, so long as reporting is not delayed by more than 60 days after the date of initial detection. Both the SAR and all supporting documentation must be maintained for a period of five years from the date the SAR is filed. SEC Rule 17a-8 requires every registered broker-dealer to comply with these rules, as does the Financial Industry Regulatory Authority’s (FINRA) Rule 3310.

The SAR rule imposes a broad test: If the broker-dealer has “reason to suspect” a transaction falls within the rule, it must timely file a SAR. Over the years, FinCEN and FINRA have published guidance identifying “red flags” that may be a “reason to suspect” that a transaction is suspicious and that, at a minimum, warrant a further investigation of the transaction by the broker-dealer. Common examples of such red flags include:

The presence of one or more red flags is not itself <a>dispositive</a>, but red flags the broker-dealer identifies must be disclosed within the SAR narrative (along with other key elements, including the who, what, when, where, why, and how of the transaction).

A broker-dealer must develop and implement a written anti-money laundering (AML) program that is reasonably designed to achieve compliance with the SAR requirements (among others). Such a program must provide for transaction monitoring and investigation, ongoing customer due diligence, and appropriate training for compliance personnel.

A broker-dealer’s failure to establish such a program is a violation of FINRA Rule 3110, as well as Section 17(a) of the Exchange Act and Rule 17a-8. Similarly, a broker-dealer’s failure to file a SAR in circumstances where it would be required by the SAR rules is a violation of Section 17(a) and Rule 17a-8.

Recently Charged SAR Obligation Violations and Lessons Learned

In August 2024, the SEC announced a $1.2 million fine against a registered broker-dealer who “failed to file a single SAR” during the period at issue. The broker-dealer was found to have failed to either “have” or “implement” a reasonably designed AML program to detect, investigate, and report suspicious activity. The broker-dealer, whose AML compliance department consisted of its chief compliance officer and a single compliance associate, missed numerous common red flags in more than 1,800 transactions, failed to monitor for such transactions, and “did not allocate sufficient compliance and operations resources” to implement its AML program. The SEC emphasized the great disparity between the relatively minimal time the compliance department spent on AML tasks and the broker-dealer’s volume of transactions.

Takeaway: Commit ample resources to implementing a compliance program. A broker-dealer must do more than create an AML program; it must devote resources, including investments in technology solutions and personnel, to the program. A broker-dealer must follow through and do more than just talk the talk.

Insufficient Oversight of Delegated AML/SAR Compliance Programs

In 2023, the SEC announced a $6 million fine against a registered broker-dealer whose parent company (a national bank) was held responsible for creating and implementing an enterprise-wide SAR program insufficient to monitor its subsidiary broker-dealer. According to the SEC’s order, the parent company set its monitoring system to alert on transactions valued at $25,000 or more, rather than the $5,000 threshold applicable to broker-dealers, when the transaction was suspected of using the broker-dealer to facilitate criminal activity. The parent company, it turned out, had failed to adjust its procedures and monitoring thresholds after acquiring the broker-dealer in 2009. As a result, over the course of nearly 10 years, the broker-dealer failed to detect that type of suspicious activity and did not file any SARs. The SEC did credit the parent company and broker-dealer’s pre-investigation identification of the issue and corrective measures taken, but still determined that the pair willfully violated Section 17(a) and Rule 17a-8.

Takeaway: Exercise oversight of third parties, tailor the compliance program to your business, and bring it in-house if appropriate. Broker-dealers often outsource compliance functions, in whole or in part, to affiliates, including non-broker-dealer parents or subsidiaries, or even third-party vendors. One size, however, does not fit all, and the broker-dealer remains responsible for compliance and will be liable for any violations. Therefore, broker-dealers must exercise oversight of their compliance partners and ensure that the programs they implement are consistent with the broker-dealer’s regulatory obligations, risk profile, and overall business. The independent testing obligation of FINRA Rule 3110(c) prescribes the bare minimum testing and audit requirements for firms; more frequent testing may be warranted when the compliance function resides outside the broker-dealer or requires coordination between multiple firms.

Takeaway: Remediation and cooperation matter. Broker-dealers may identify issues on their own, before a FINRA or SEC examination, and should be proactive when that happens, documenting the issues and all corrective actions taken. They should also be prepared to disclose and share the results of any internal investigation with appropriate regulatory bodies. While it is difficult to glean from settled orders the extent to which remediation mitigates regulatory penalties, at a minimum, self-reporting and remediation may keep a violation from being treated as a higher “tier” violation under the Exchange Act (15 U.S.C. § 78u(d)(3)), which authorizes more severe penalties for violations involving a “deliberate or reckless disregard” for regulatory obligations. Ignoring, or at least failing to redress, known issues is likely to be considered at least reckless.

Finally, several broker-dealers have faced FINRA and SEC enforcement actions and paid civil penalties as a result of their approach to so-called “continuing activity” SARs. A continuing activity SAR is basically a follow-up to a previously filed SAR, where the broker-dealer has observed that suspicious activity previously reported has continued. According to FinCEN guidance, a broker-dealer may file a continuing report after a 90-day review, but no later than 120 days after the date of the related prior SAR.<a href="#_edn2" id="_ednref2">[ii]</a> Firms have struggled to apply this guidance, either failing entirely to undertake a review for continuing activity within the 90 days following original SAR filing, filing continuing activity SARs after 120 days from the original filing, or failing to provide an adequate description of the facts relevant to the continuing activity (as opposed to the originally reported activity).

Takeaway: Know the rules and train compliance teams. Training is a core aspect of any compliance program and it is especially important for broker-dealers’ AML programs, where FINRA mandates “ongoing training for appropriate personnel.” Training in AML/SAR programs should address the nuances and timing issues related to continuing activity reporting, as well as how to craft adequate SAR narratives, whether for initial or continuing reports. It is also worth noting that if the activity observed during the 90-day review period is not a “continuation” of the original activity, the broker-dealer is not relieved of its obligation to file a SAR to report any new suspicious activity identified; policies, procedures, and training programs must account for that.

SAR obligations are here to stay and remain a centerpiece of regulatory priorities for both the SEC and FINRA. To avoid unwanted scrutiny or the prospect of stiff civil penalties, a broker-dealer must be well-versed in the SAR requirements and develop a reasonably designed and managed compliance program.

core/separator

<a id="_edn1" href="#_ednref1">[i]</a> FINRA <a href="https://www.finra.org/rules-guidance/notices/19-18" target="_blank" rel="noreferrer noopener">Regulatory Notice 19-18</a> provides an extensive list of potential red flags that may arise at all phases of the customer relationship, from intake through account closure, and also identifies potential red flags associated with securities trading, money movements, and insurance products.

<a id="_edn2" href="#_ednref2">[ii]</a> See<a href="https://www.fincen.gov/sites/default/files/shared/FinCEN%20SAR%20ElectronicFilingInstructions-%20Stand%20Alone%20doc.pdf" target="_blank" rel="noreferrer noopener">“FinCEN Suspicious Activity Report (FinCEN SAR) Electronic Filing Instructions”</a> at 84 (2012).

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2024/10/Broker-Dealer-Update-Suspicious-Activity-Reporting-Compliance-Primer.pdf

Suspicious Activity Reporting Compliance: A Primer

Services