Mary, your trusted employee, has embezzled money from your bank. Or, Bryan, a long time customer, has used a deposit account at your bank to defraud his employer (and maybe his employer’s customers). You have just started to put the pieces together after that initial gut-wrenching admission that it looks as though the worst has happened. You ask yourself, “Okay, now what do I do?”
The first thing to consider is whether a Suspicious Activity Report is required. The obligation to file a SAR with the Financial Crimes Enforcement Network may depend on (1) who committed the crime and (2) the dollar amount involved. In the case of Mary, the bank insider, there is no dollar threshold to your reporting obligation. Whenever a depository institution detects a known or suspected federal criminal violation (against the depository institution or involving transactions conducted through it) and there is reason to believe that a director, officer, employee, agent or other institution-affiliated party has committed or assisted in the commission of the crime, a SAR must be filed, regardless of the dollar amount involved.
Because Bryan is an outsider to your bank and has been identified, the threshold for reporting his crime to FinCEN is $5,000. If a depository institution believes that it is the victim of a financial crime, or is being used by an outsider to commit a financial crime but the identity of the perpetrator is unknown, a SAR must be filed if the crime involves $25,000 or more. However, any suspected money laundering must be reported (whether or not a perpetrator can be identified) if the amount involved is $5,000 or more. Generally speaking, robberies or burglaries reported to local law enforcement agencies need not be reported to FinCEN.
SARs are required to be filed within 30 calendar days after the date the facts underlying the suspected crime are initially detected. If no culprit is identifiable on discovery, the depository institution may take an additional 30 days to file the SAR while attempting to identify the responsible person or persons. Ongoing schemes, like money laundering, may also require other, more-immediate reporting to law enforcement agencies (such as by telephone).
Your bank has now filed the SAR. Whom may you tell; whom may you not tell? A depository institution and its directors, officers, employees, agents, current and former, are prohibited by federal law from generally disclosing the existence of the SAR and specifically from notifying any person involved in the reported transaction that the transaction has been reported via a SAR. That means that even if the bank decides to fire Mary for her embezzlement, it may not tell her that a SAR has been filed with FinCEN. Similarly, Bryan may not be told that a SAR has been filed, even if the deposit account is closed.
On a separate but related note, a depository institution should never threaten to report a crime or threaten criminal prosecution as a method of inducing repayment by the perpetrator.
Under many circumstances the threat of criminal prosecution to gain a pecuniary advantage is itself a crime (blackmail). This could involve personal criminal liability for the bank officer making the threat as well as for the bank.
Sureties and Insurers
All depository institutions are required to purchase a fidelity bond. Typical bond provisions require that a loss be reported within a relatively short time frame; sometimes it will be a specified number of days and sometimes it will simply be to report it “as soon as possible.” When does the clock start ticking on the reporting obligation? Certainly by the time a depository institution has sufficient information to file a SAR, but perhaps earlier. A typical bond requires notice after “discovery,” with discovery defined to be when the depository institution first becomes aware of facts that would cause a reasonable person to assume that a loss covered by the bond has occurred.
In general, it is advisable to make an initial report to the bonding company as soon as possible after discovery of the basic facts underlying any loss. Even if the depository institution is not sure if a loss has occurred, the amount of the loss or even who the perpetrator is, the best practice is to inform the surety of what is known. Additional reports, filling in details, correcting mistakes or otherwise clarifying what was previously reported can always be filed.
Be sure you make a report to the right surety. Bonds usually are “claims-made,” meaning that they cover losses discovered during the period the bond is in effect, regardless of when the loss actually occurred. This is in contrast to occurrence-type policies that cover insured losses occurring during the period the policy is in place, regardless of when discovered and reported. Thus, the report of a loss goes to the surety under the bond in effect at the time of discovery, even if there was a different surety at the time of loss.
FinCEN generally prohibits the disclosure of the existence of a SAR. Even so, the narrative portion of the SAR may be a helpful start to the disclosure made to the bonding company. Do not send in a copy of the SAR, but you may crib from the description in the SAR, if it is helpful.
In addition to the bank’s surety, you should review your directors and officers insurance policy (sometimes referred to as an errors and omissions policy) for possible coverage. In addition to providing protection to directors and employees, D&O policies often insure the depository institution and its holding company from various liabilities and losses. Some losses may be covered by both the bond carried by a depository institution and the D&O policy purchased by the depository institution or its holding company. If both provide coverage, you certainly want to take advantage of the double coverage (which may increase limits of coverage, or reduce deductibles/retentions).
As with the bond, prompt reporting is often a requisite to maintaining coverage for a reported loss under a D&O policy. If you are unsure if a loss is covered, it is better to report the event and have the insurer decline coverage, rather than find out later that had a timely report been filed, the insurer would have paid your bank for its loss. Many D&O policies (like bonds) are claims-made rather than occurrence policies, heightening the need for prompt reporting. It is a good idea to also check other insurance for additional coverage, such as general liability policies and umbrella policies.
The SAR is the only required communication to regulators regarding a financial crime. However, most depository institutions find it advisable to communicate early-on with their direct state and federal regulators. This is especially important where the crime may affect the reliability or accuracy of previously filed regulatory reports or where the capital of the depository institution may be materially affected.
Larry K. Harris is a shareholder in the St. Louis office of Polsinelli Shughart PC. Contact him at 314-889-7063 or lharris(at)polsinelli.com.
Copyright (c) February 2013 by BankNews Media