FinCEN: Reliabilty of 

Suspicious Activity Reports 

OIG-03-035 December 18, 2002

Office of Inspector General

******* 

The Department of the Treasury 

Contents 

Audit Report....................................................................................................3 

 Results in Brief...............................................................................................4 

 Background ...................................................................................................7 

Finding and Recommendations .......................................................................10 

Finding: Data in the SAR System Was Not Always Complete or Accurate......10 

Incomplete SARs ...................................................................11 

Inaccurate SARs....................................................................12 

“Other” and “Unknown/Blank” Categorized Violations................13 

Data Entry Errors ...................................................................14 

SARs Reviewed by OIG ..........................................................14 

 Recommendations ...................................................................................19 

OIG Comments to Other Management Responses ........................................23 

Appendices

 Appendix 1: Objectives, Scope and Methodology ........................................26 

 Appendix 2: Management Response ..........................................................28 

 Appendix 3: Major Contributors to this Report.............................................31 

 Appendix 4: Report Distribution.................................................................32 

Abbreviations

 BSA Bank Secrecy Act 

 CBRS Currency and Banking Retrieval System 

 FinCEN Financial Crimes Enforcement Network 

FMFIA Federal Manager’s Financial Integrity Act 

IRS DCC Internal Revenue Service Detroit Computing Center 

 LEA Law Enforcement Agency 

OCC Office of the Comptroller of the Currency 

 OTS Office of Thrift Supervision 

 PACS Patriot Act Communications System 

 SAR Suspicious Activity Report 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 1 
This Page Intentionally Left Blank
OIG Audit 

Report

The Department of the Treasury 

Office of Inspector General 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 3 

 

 December 18, 2002 

 James F. Sloan 

 Director 

 Financial Crimes Enforcement Network 

The Financial Crimes Enforcement Network (FinCEN) administers 

the Bank Secrecy Act (BSA) of 1970, which along with the 

implementing regulations, requires financial institutions to file 

Suspicious Activity Reports (SARs). SARs are filed on any 

transaction relevant to a possible violation of law or regulation. 

The SARs provide law enforcement agencies (LEAs) with a paper 

trail to investigate money laundering schemes and other illegal 

activities. The events of September 11, 2001 intensified the 

importance of SARs in tracing financial crimes and transactions 

used to finance terrorist activities. 

Our objective was to profile SARs to assess the nature and extent 

of fraudulent activities affecting institutions regulated by the Office 

of the Comptroller of the Currency (OCC) and the Office of Thrift 

Supervision (OTS). We have deferred this objective to a future 

period. However, during the course of our fieldwork, a related 

matter came to our attention that we believe warranted FinCEN’s 

immediate action. It concerns the reliability of the data in the 

Suspicious Activity Reporting System (SAR System), a single 

centralized database of all SARs filed by financial institutions and 

their regulatory agencies. Although we reported on this issue 

nearly four years ago, the problem has continued.1

 

1 FinCEN’s Suspicious Activity Reporting System (OIG-99-032), January 25, 1999.
We conducted fieldwork at FinCEN, OCC and OTS Headquarters in 

the Washington, D.C. area. We contacted FinCEN, OCC and OTS 

officials to discuss SARs and obtain reports on SAR data for OCC 

and OTS regulated institutions. We contacted law enforcement 

officials at the Federal Bureau of Investigation, the United States 

Secret Service, and the Internal Revenue Service to find out 

whether these agencies used the SARs to develop comprehensive 

analyses of trends and patterns in financial crimes activities. 

We originally provided FinCEN a discussion draft of this report in 

August 2002. At the time, FinCEN officials took issue with the 

audit finding, foremost suggesting that improvements have been 

made that the OIG had not considered and FinCEN wanted to show 

evidence of improvements and actions taken. As a result, we 

extended the audit fieldwork to corroborate, consider and 

incorporate any additional information in support of their 

improvements and corrective actions. This included meetings with 

FinCEN and Internal Revenue Service Detroit Computing Center 

(IRS DCC) officials in August and September 2002. See 

Appendix 1 for a detailed discussion of the audit objectives, scope 

and methodology. 

Results in Brief 

SAR data is considered critical to LEAs in identifying money 

laundering and other financial crimes. The events of 

September 11, 2001 intensified the importance of SARs in tracing 

financial crimes and transactions used to finance terrorist activities. 

Additionally, Congress directed the President to develop a national 

strategy for combating money laundering and related financial 

crimes in the Money Laundering and Financial Crimes Strategy Act. 

The Department of Treasury’s 2002 National Money Laundering 

Strategy reflects two themes in its approach to money laundering 

enforcement efforts: (1) the need for interagency coordination and 

cooperation in conducting anti-money laundering policy, and (2) the 

need to ensure the information financial institutions are required to 

report is useful, and can be used effectively by the Government. 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 4 
The regulatory and LEA officials we interviewed believed the SAR 

System was very useful in identifying suspected bank insider abuse 

and BSA violations. However, they indicated that the usefulness 

of the SAR System would be enhanced, if it included more 

complete and accurate SAR data. The SAR System sometimes 

lacked critical information and included inaccurate data because 

SAR filers disregarded SAR form instructions, did not always 

understand the violations listed on the SAR form, or were 

concerned with personal liability. Additionally, IRS DCC contracted 

personnel sometimes made errors while creating electronic 

databases from paper SARs. Furthermore, the errors and 

omissions were not always corrected before or after SARs were 

added to the SAR System. FinCEN required only minimal SAR edits 

and data perfection routines, and limited contacts with SAR filers. 

As previously stated, the subject of SAR data inaccuracy is a 

repeat condition. In our January 1999 audit report, we advised 

FinCEN that critical information needed by LEAs was not being 

captured on the SAR form. We recommended that the Director of 

FinCEN issue instructions along with the planned revised SAR form 

to financial institutions requiring critical data fields on the SAR form 

be completed, and ensure all paper SARs transferred onto magnetic 

tape were reviewed for accuracy prior to loading the data onto the 

SAR System. 

FinCEN concurred and issued a revised SAR form with instructions 

for completing the critical data fields. FinCEN further stated, with 

the assistance of IRS DCC, it had incorporated a process of SAR 

document editing and error correction. The SARs were being 

reviewed for specific requirements and accuracy; and in some 

cases, IRS DCC was calling or writing to the SAR filer for additional 

information. FinCEN also reported it was producing listings of 

errors found on the forms, and had already started following up 

with the pertinent banks through their regulatory agencies. 

Despite additions to the SAR form and the reported increase in 

controls at IRS DCC since the last audit report, regulatory and LEA 

officials continued to find SARs with incomplete and inaccurate 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 5 
data. In addition, during a recent OIG audit of a failed bank we 

found numerous SARs with incomplete and unclear data. 

During August and September 2002 we met with FinCEN and 

IRS DCC officials to solicit input on the discussion draft of this 

report. Although FinCEN Headquarters personnel believed 

significant progress had been made in SAR accuracy, operating 

officials from both organizations agreed there was still an on-going 

problem with SARs having missing and incomplete data and were 

working to identify these problems and form corrective actions. 

FinCEN officials believe the SAR System contains missing and 

incomplete data because SAR filers make human errors, and the 

Currency and Banking Retrieval System (CBRS), where the SAR 

System resides, allows the errors and omissions to go uncorrected. 

FinCEN personnel stated they were working on a proposal to 

improve the data in the SAR System that includes applying 

additional manual and system edits and data perfection routines, 

corresponding with filers regarding invalid and missing data, and 

enhancing outreach efforts. The major objective of the outreach 

program will be to shift the focus of training from compliance with 

filing SARs to the importance of the accuracy of the SARs filed. 

Many of the enhancements discussed by FinCEN and IRS DCC 

personnel could address some of the weaknesses identified if 

properly implemented. 

In this report we recommend the Director of FinCEN ensure 

FinCEN, in coordination with IRS DCC and the five Federal 

regulatory agencies, (1) implements procedures to increase editing, 

mandatory data, and feedback with financial institutions and 

regulators, (2) revises the SAR form or find other means to address 

the problems with narrative write-ups and identifying violations, 3) 

eliminates duplicate SARs in the system, and 4) addresses the 

problems arising from SARs filed via the internet. In addition, we 

also believe that the reported finding warrants management 

consideration as to whether the reported weaknesses merit the 

designation as a material weakness under the Federal Manager’s 

Financial Integrity Act (FMFIA), as defined in Office of Management 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 6 
and Budget Circular A-123, Management Accountability and 

Control. 

In its December 11, 2002 written response to our draft report, 

FinCEN generally concurred with the reported finding and five 

recommendations. We believe the FinCEN completed or planned 

corrective actions, if properly implemented, would address our 

recommendations to improve the accuracy and completeness of 

SARs. 

Although FinCEN concurred with the finding and recommendations, 

FinCEN did not agree that the reported finding constituted a 

material weakness under the FMFIA. FinCEN believes that the data 

quality has been consistently improving and the current error rate is 

well within acceptable limits. We are mindful that the FMFIA 

material weakness designation is the sole responsibility of FinCEN 

management and not the OIG. However, we believe consideration 

was and still is warranted because of the vital role that accurate 

SAR data plays in accomplishing FinCEN’s core mission related to 

BSA and attendant money laundering enforcement programs. See 

Appendix 2, for the complete text of FinCEN’s response. 

Background

The Secretary of the Treasury has delegated the duties and powers 

under the BSA to FinCEN. The authority to examine financial 

institutions for BSA compliance was delegated to the applicable 

Federal regulatory agencies. Financial institutions are required to 

establish and maintain a program to monitor and ensure compliance 

with BSA and the implementing regulations. 

One aspect of BSA requires financial institutions to file a SAR on 

any transaction relevant to a possible violation of law or regulation. 

This occurs when a financial institution observes a transaction that 

has no business or apparent lawful purpose. This also occurs 

when a transaction is not the type in which a particular customer 

would normally be expected to engage, and the institution knows 

of no reasonable explanation for the transaction after examining 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 7 
the available facts, including the background and possible purpose 

of the transaction. 

Recognizing that an effective regulatory regime depends on the 

cooperation of the public and private sectors, the Department of 

Treasury’s Under Secretary for Enforcement initiated a joint SAR 

System feedback program. To implement the initiative, a BSA 

Advisory Group Feedback subcommittee was created in the Fall of 

1999 that included representatives from the banking, law 

enforcement, and regulatory communities. The subcommittee 

meets on a regular basis to discuss methods for improving 

feedback to financial institutions. FinCEN is responsible for 

coordinating the entire Department of Treasury SAR System 

feedback initiative. 

The subcommittee decided to produce a periodic SAR Activity 

Review—Trends, Tips and Issues twice a year. The first three SAR 

Activity Reviews were published in October 2000, June 2001 and 

October 2001. The SAR Activity Reviews included tips on SAR 

form preparation and filing to assist in ensuring the accuracy and 

completeness of SAR filings. FinCEN also released SAR Bulletins 

that provided guidance to financial institutions that file SARs. 

The profits of crime that creep into the United States’ financial 

system each year are staggering. According to FinCEN’s responses 

in its report on Frequently Asked Questions, drug trafficking alone 

accounts for tens of billions of dollars a year. Their report also 

discussed the necessity for intense financial investigations as being 

essential to identifying narcotics trafficking, organized crime, 

money laundering, and bank fraud. 

The events of September 11th intensified the importance of the 

SAR System in tracing financial crimes and transactions used to 

finance terrorist activities. In fact, supporting the LEA’s counterterrorism investigations became FinCEN’s top priority. The 

financial data and information contained in FinCEN’s databases, 

from SARs, Currency Transaction Reports, and other required BSA 

financial transaction reports, became critical to LEA terrorist 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 8 
investigations in identifying relationships between people, places, 

organizations, and financial transactions. 

The importance of accurate and reliable SAR data has also been 

heightened with the passage of the USA PATRIOT Act of 20012

. 

Under the act, SAR reporting requirements have been expanded to 

other financial institutions beyond depository institutions such as 

money service businesses, insurance companies, securities brokers 

or dealers, currency exchanges, and investment bankers to name 

just a few. While the specific implementing regulations for many of 

these businesses are still being developed, LEAs and FinCEN will 

ultimately be confronted with a growing volume of SARs. 

The SAR System

In 1996, FinCEN, in consultation with each Federal regulator 

(Federal Reserve Board, OCC, Federal Deposit Insurance 

Corporation, OTS, and National Credit Union Administration) 

entered into a partnership agreement with the IRS DCC to establish 

a SAR System. The SAR System was established by this group on 

April 1, 1996 to provide a single collection point for all SARs and 

provide LEAs with critical information to develop comprehensive 

analyses of trends and patterns in financial crime activity. 

FinCEN operates and maintains the SAR System through IRS DCC. 

FinCEN also determines the number of system edits and data 

perfection routines. Financial institutions file SARs on paper or 

magnetic tape with IRS DCC. Upon receipt of the paper SAR at 

IRS DCC, each is date-stamped, given a document control number, 

reviewed for errors, consolidated, and sent to a contractor. The 

contractor creates and electronically transmits the database to IRS 

DCC, and returns the paper SARs. IRS DCC uses the database to 

update the SAR System with the most current SAR data. Magnetic 

tapes of SAR data sent to IRS DCC by financial institutions are 

loaded directly onto the SAR System. There are no system edits to 

identify forms with invalid fields or missing data. In October 2002, 

FinCEN launched the Patriot Act Communications System (PACS), 

 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 9 

2

 31 U.S.C. 5318 (g), USA PATRIOT Act, Title III, Section 356, and 31 CFR 103
designed to allow financial institutions to file SARs and other BSA 

reports, over the Internet. SARs filed over the internet can be 

accomplished either individually or by batch. 

SAR System Access

The SAR System on-line database is available to regulatory and 

LEA personnel by telephone modem hook-up to IRS DCC. The 

Internal Revenue Service, Criminal Investigation Division, has direct 

access to the SAR System. OCC and OTS receive periodic 

downloads from FinCEN on SARs filed for the institutions they 

regulate. The Federal Bureau of Investigations and the U.S. Secret 

Service download SAR System data in bulk from IRS DCC onto 

their individual internal computer systems. 

SAR Statistics

The SAR System database is quite large and as of 

December 31, 2000 it was comprised of more than 505,000 SARs 

filed since April 1, 1996. OCC-regulated institutions filed 273,760 

SARs, or 54 percent of the total, and OTS-regulated institutions 

filed 54,282 SARs, or 11 percent of the total. 

Finding and Recommendations 

Finding Data in the SAR System Was 

Not Always Complete or Accurate 

The regulatory and LEA officials we interviewed indicated that the 

SAR System contained incomplete and inaccurate SAR data. 

Specifically, SAR filers often left out critical information and 

included inaccurate data. These errors occurred because filers did 

not follow SAR form instructions, did not have a clear 

understanding of the violations listed on the SAR form, were 

concerned with personal liability, and filers or IRS DCC filing or 

loading a SAR more than once. Additionally, contractor personnel 

sometimes made errors while creating electronic databases from 

paper SARs. Furthermore, these errors and omissions were not 

always corrected prior or subsequent to SAR inclusions in the SAR 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 10 
System. FinCEN required only minimal edits and data perfection 

routines, and only contacted SAR filers for completely 

unacceptable SARs3

. 

As a result, the SAR System did not have all of the critical data 

LEAs needed to identify funds derived from illegal activities, or 

activities intended or conducted in order to hide or disguise funds 

or assets derived from illegal activities, as part of a plan to violate 

or evade any law or regulation, or avoid any transaction reporting 

requirement under Federal law. Also, because IRS DCC did not 

routinely correspond with filers concerning the errors made in filing 

SARs, the filers were not provided feedback and an opportunity to 

improve on submitting accurate and reliable SARs. 

Incomplete SARs

The SAR form clearly states “ALWAYS COMPLETE ENTIRE REPORT.” 

The SAR Activity Reviews emphasize that information in SAR 

filings should be as complete as possible. However, the regulatory 

and LEA officials told us the SAR forms were not always complete. 

For example, one LEA official provided 6-month statistics 

documenting 2,355 SARs involving $178 million in losses with no 

violations indicated. Without the violations, the SAR usefulness to 

LEAs is minimized because there is no basis for evaluating the 

data. 

FinCEN reported in the SAR Activity Review of October 2000 

problems with listing regulators and advised filers to always 

identify the organization’s primary Federal regulator. However, the 

regulatory and LEA officials continued to notice the SAR System 

included SARs with no regulators indicated. In fact, in one LEA 

database approximately 500 of 14,000 SARs downloaded from the 

SAR System did not indicate a regulator. As a result, when 

regulators queried the SAR System or received FinCEN downloads, 

they received understated data on SARs filed by the institutions 

they supervised. Additionally, the statistics and trends analytic 

 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 11 

3 Unacceptable SARs include those with pages missing or illegible writing.
reports, issue papers, and publications could not accurately profile 

the statistics by regulator. 

Also, some SAR narrative sections did not have a narrative, but 

instead had the statement “see attached.” However, attachments 

were not forwarded to FinCEN or IRS DCC. The SAR Activity 

Review of October 2000 addressed this issue stating the narrative 

section of the SAR should provide a detailed description of the 

known or suspected violation of law or suspicious activity, and 

supporting documentation should never be attached to a SAR form. 

Without having the supporting document available, any relevant 

information needed by the LEAs or regulators would not be entered 

into the SAR system. Without the narrative, it was difficult to 

determine what occurred or what further information was available 

on supporting documents held at the financial institution. 

Inaccurate SARs

SARs did not always accurately indicate the location where the 

suspicious activity occurred. In some cases, the SAR System 

indicated the main office location or a central office location that 

forwarded the SARs, rather than the branch or office of where the 

reported violation occurred. This has been an on-going issue that 

FinCEN addressed as far back as FinCEN Advisory, Issue 8, 

February 1997. In addition, the SAR form instructs filers to 

indicate where the suspicious activity “occurred.” As a result, 

LEAs did not have all of the accurate information needed to 

perform analyses to find patterns and identify illegal activities by 

location. 

The regulatory and LEA officials we interviewed also indicated that 

SAR filers did not always understand the SAR violation “computer 

intrusion.” Reports on computer intrusion should only describe a 

computer hacking incident involving a financial crime. However, 

some SAR filers included anything related to computers, such as 

hacking into the financial institution’s website or email. These 

filers incorrectly reported computer intrusion along with other 

violations involving a computer. As a result, financial institution 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 12 
personnel provided misleading SAR information and crime computer 

intrusion instances were overstated. 

“Other” and “Unknown/Blank” Categorized Violations

In addition to having no violation listed on the forms as discussed 

previously, SAR filers frequently filed under "other" instead of a 

specific violation. This choice was made even when the filer was 

reporting a known violation such as money laundering or check 

kiting. Even though the SAR form specifically disclosed the SAR 

was confidential and the Safe Harbor Law provided the filers 

protection from civil liability, filers chose “other” due to concerns 

over personal liability. The FinCEN Advisory of August 1996 

thoroughly discussed the “Safe Harbor” provision of the BSA as it 

applies to reports of suspicious transactions. Filers also chose 

“other” when they did not have a clear understanding of the SAR 

violations listed on the SAR form. According to the SAR Activity 

Review dated October 2001, some violations such as identity theft 

and pretext calling properly belonged in "other." 

The SAR Activity Reviews dated October 2000 and June 2001 

reported "other" at 7.3 and 7.2 percent, respectively, of total SAR 

filings for the audit period covered, ranking it as the third most 

frequently reported violation out of the 19 violation categories 

listed on the SAR form. 

The SAR Activity Reviews reported "unknown/blank" at 3.8 

percent of total SAR filings, classifying it as the eighth most 

frequently filed SAR as of the June 2001 SAR Review. The 

"unknown/blank" categorization represented SARs with characters 

that did not match an established violation, SAR fields with 

unrelated symbols, or SAR fields void of data. 

Together SARs filed under "other" or categorized as 

"unknown/blank" represented 11 percent of all SAR violations filed 

from April 1996 through December 2000. These SAR filings were 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 13 
not readily identifiable and not accurately included in SAR trends 

and patterns. 

Data Entry Errors

Finally, regulatory officials told us some errors and omissions 

occurred when the IRS DCC contractor created electronic 

databases from paper SARs. The regulatory and LEA officials 

found some SAR data in the SAR System contained inaccurate or 

incomplete data when compared to the original SARs completed by 

the financial institution personnel. 

SARs Reviewed by OIG

During a recent audit of a failed bank, we found bank personnel 

had filed many SARs with incomplete or unclear data. The bank 

had filed approximately 220 SARs between April 1996 and July 

2001. These SARs reflected a gross potential loss exposure of 

$44 million, including $33 million related to mortgage fraud, and 

$7.3 million to auto loan fraud. We reviewed the 220 SARs in an 

attempt to gain information on possible suspicious activities 

involving the bank’s affiliates or related entities. We could clearly 

identify only four SARs related to an affiliate since many of the 

220 SARs were incomplete or unclear. 

Initiatives to Improve SARs

The BSA Advisory Group Feedback subcommittee, which 

comprises representatives from the banking, law enforcement and 

regulatory communities, meets on a regular basis to discuss 

methods for improving feedback to financial institutions. Some 

LEA officials did not believe FinCEN had been consistently 

responsive in correcting the data problems discussed at these 

meetings. Also, one FinCEN official thought the meetings could be 

held more frequently. 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 14 
The subcommittee was responsible for producing the periodic SAR 

Activity Review—Trends, Tips and Issues twice a year. These 

reviews included tips on SAR form preparation and filing, to assist 

in ensuring the accuracy and completeness of SAR filings. FinCEN 

also released SAR Bulletins that provided guidance to financial 

institutions that file SARs. These efforts may have begun to pay 

off some dividends, as officials from one LEA believed that 

although the reliability of the SAR data remained low, it had 

improved by about 50 percent since mid-1999. 

FinCEN and IRS DCC Agree to Condition

During our extended August and September 2002 fieldwork with 

FinCEN and IRS DCC to solicit input on the discussion draft, 

officials from both organizations agreed there is an on-going 

problem with SARs having missing and incomplete data. SARs are 

frequently filed without the basic information, such as the narrative 

portion, identification of a suspect, or a characterization of the 

suspicious activity. SARs are still filed with only “see attached” in 

the narrative section. Additionally, the officials have received 

duplicate SARs and SARs with missing data in the SAR System 

even though the data was included in the original SAR form. 

Multitude of Causes for Incomplete and Inaccurate SARs

FinCEN officials believe the SAR System contains missing and 

incomplete data because SAR filers make human errors and the 

CBRS, where the SAR System resides, allows the errors and 

omissions to go uncorrected. Additionally, previous outreach 

efforts have concentrated more on getting financial institutions just 

to file the SARs versus improving the accuracy of the data 

submitted and the importance of accurate data. 

Duplicate SARs in the SAR System resulted from IRS DCC double 

posting of SARs and financial institutions filing the same SAR more 

than once. This occurs because there are no procedures or 

computer checks established for matching SARs to determine 

duplicate postings. FinCEN personnel stated there were 3,300 

duplicates in the system last year that were caused by IRS DCC 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 15 
posting or financial institutions filing SARs twice. FinCEN 

personnel identified these SARs by reviewing 10 fields, including 

the “correction” field, and the first 1,000 characters in the 

narrative. 

Draft Proposal for SAR Improvements

During our extended fieldwork, the SAR point of contact in the 

Office of Compliance and Regulatory Enforcement at FinCEN 

Headquarters briefed us on his study of the problems with SARs 

and outlined his proposal for improvements. The Office of 

Compliance and Regulatory Enforcement works with SAR filers, 

LEAs, the Office of Information Technology at FinCEN, and the IRS 

DCC. The Office of Compliance and Regulatory Enforcement and 

the Office of Information Technology share SAR program and 

technical responsibilities at FinCEN, while IRS DCC updates and 

maintains the SAR System. The point of contact stated the 

proposal is in the draft stage and will need the coordinated 

approvals of FinCEN, IRS DCC and the remaining members of the 

SAR System Group. 

The proposal includes expanding the definition for unacceptable 

SARs to include SARs without basic data, applying additional 

manual and system edits and data perfection routines to the SARs, 

corresponding with filers regarding invalid and missing data, and 

enhancing outreach efforts. FinCEN and IRS DCC officials believe 

the SARs provide LEAs with excellent investigative leads, yet 

receive less edits and resolution routines compared to other BSA 

reports. 

It should be noted that since the proposal was still in draft and had 

not been presented to senior management, the point of contact did 

not provide us a copy for our review. Therefore, all our comments 

on the proposal are based solely on briefings provided by the point 

of contact and IRS DCC personnel who are working on the 

proposal. 

Processing Paper SARs

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 16 
The draft proposal recommends that IRS DCC increase the 

definitional criteria for unacceptable SARs. IRS DCC implemented 

a process in 1996 for providing an initial review of paper SARs and 

immediately returning to filers those SARs deemed unacceptable. 

Unacceptable SARs include those with pages missing or illegible 

writing. Based on this limited criteria, accuracy and completeness 

are not grounds for returning SARs. The SAR point of contact and 

IRS DCC officials believe the unacceptable criteria needs to be 

increased to cover additional types of omissions and 

inconsistencies. 

Currently, once unacceptable SARs are separated out and returned 

to filers, the remaining SARs are subjected to manual edits. IRS 

DCC applies manual edits on only five SAR items, such as editing 

the dollar amount of the recovery to whole dollars. Other BSA 

reports, such as the Report of Foreign Bank and Financial 

Accounts, the Currency Transaction Report by Casinos, and the 

Report of Cash Payments Over $10,000 Received in a Trade or 

Business (Form 8300), receive 37, 20 and 19 edits respectfully. 

Although the draft proposal recommends increasing the edit 

checks, IRS DCC and FinCEN officials commented on the trade-off 

with resources and cost have to be considered, as well as, 

significance of data when matched against the other BSA reports. 

After manual editing occurs, the SARs are sent to the keying 

contractor to create, and electronically transmit via the internet 

back to IRS DCC, a database of the SARs. IRS DCC uploads the 

transmitted SAR database to the CBRS, where the various BSA 

reports reside. The system edits BSA reports to identify fields with 

invalid data, missing data in mandatory fields, and provides an error 

register. 

A BSA Specialist performs on-line data perfection of the invalid 

fields by sitting down with the error register, calling up the form on 

the database, comparing it to the hard copy, and making 

corrections on-line. System edits to identify invalid fields include 

14 error codes for SARs, as compared to 18, 43, and 7 

respectively for the 3 previously mentioned BSA reports. In 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 17 
addition to the system errors, the error register also identifies 

missing mandatory fields for other BSA reports. Specifically, the 

error register looks at 14, 38, and 29 fields respectively for the 

other BSA reports and none for SARs. Again, one must recognize 

the resource, cost, and data significant trade-offs. 

SARs Filed by Magnetic Media

SARs filed directly by financial institutions on magnetic media are 

uploaded directly onto the CBRS, but no edits, error corrections or 

correspondence with filers occur. However, validity checks and 

mandatory field checks are applied to Currency Transaction 

Reports, another BSA report, that are filed by magnetic media and 

entered directly into the CBRS. Also, for Currency Transaction 

Reports, acknowledgement tapes are returned to the filers with 

document control numbers and error messages. The 

acknowledgement tapes provide a means to let filers make 

corrections. The draft proposal recommends that IRS DCC apply 

system edits to SARs filed by magnetic media. The biggest cost 

trade-off here relates to the cost of changing or upgrading 

computer programs. 

Enhanced Outreach Efforts

Personnel emphasized the need to refocus the SAR Outreach 

Program. The presentations FinCEN, IRS DCC, and the regulators 

provide to financial industry groups need to refocus on SAR data 

quality, and not just on the compliance aspect. Outreach efforts 

need to emphasize the importance of SAR data and how the utility 

of the data is adversely affected by poor quality reports. The 

proposal includes recommending that IRS DCC provide regulatory 

agencies the capability of retrieving SAR error registers from the 

SAR system, to review with financial institutions that made the 

errors. This would provide regulators with tools to discuss 

repeated SAR problems with specific banks and trends within their 

institutions. This process is available for Currency Transaction 

Reports. 

Internet Filing of SARs

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 18 
The PACS is designed to allow participating financial institutions to 

quickly and securely file SARs over the internet. The electronic 

filing expedites the reporting process, making the information 

available to LEAs more quickly, and reduces financial institution 

filing costs. PACS allows financial institutions to electronically file 

discrete (single) or batched forms. FinCEN and IRS DCC officials 

told us discrete SARs filed over the PACS have some mandatory 

fields. However, batch SARs filed over PACS do not. 

The American Banker reported on October 22, 2002 that U.S. 

Treasury officials expect as many as 1,500 of the country’s largest 

banks to use PACS to file SARs. These large banks generally use 

batch filings, which means a majority of SARs filed by PACS will 

not be screened for missing mandatory fields prior to acceptance 

into the system. Also, once in the system, FinCEN and IRS DCC 

officials told us IRS DCC is applying the same minimal data 

integrity routines to SARs filed by PACS as it does to SARs filed in 

paper or magnetic format. 

Planned Enhancements

The various planned enhancements brought to our attention by 

FinCEN and IRS DCC personnel confirmed our originally reported 

weaknesses in the discussion draft, brought to our attention 

additional types of inaccurate and or incomplete SAR data, and 

clearly demonstrated the need to improve on the accuracy and 

reliability of SAR data. 

Recommendations

The Director of FinCEN should provide enhanced leadership of BSA 

by working with its partners in the financial and regulatory 

communities to ensure: 

1. FinCEN, in coordination with IRS DCC and the five Federal 

regulatory agencies, review the SAR processing procedures to 

evaluate the need to: 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 19 
a. Expand the criteria for unacceptable SARs to reduce the 

number of incomplete and inaccurate SARs upfront, 

including rejecting SARs with inadequate narratives; 

b. Increase the number of manual edits applied to SARs to 

be in line with other BSA reports, taking into account the 

relevance of the information required by users; 

c. Increase the number of system edits that identify invalid 

data or inconsistent information versus the cost 

associated with system changes; 

d. Designate mandatory fields for SARs and, subsequently, 

system edits that identify missing data in the mandatory 

fields; 

e. Establish a systematic procedure as to when to 

correspond with fliers regarding missing, incomplete, or 

invalid SAR information; 

f. Enhance outreach efforts to include providing regulatory 

agencies with the capability of retrieving SAR error 

registers to review with financial institutions; and 

g. Assess the adequacy of existing internal controls to 

ensure that SAR data submitted is accurate and reliable. 

We did not review in detail the various planned proposals to 

address many of the reported problems, particularly with 

respect to the cost benefits to FinCEN, LEAs, and SAR filers. 

However, we believe the various proposals as explained to us 

conceptually address many of the reported problems, and as 

such would merit due consideration by senior management 

when planning corrective actions. 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 20 
Management Response and OIG Comments

FinCEN concurred and stated FinCEN has discussed proposed 

enhancements with the five Federal regulatory agencies. By 

June 2003, FinCEN will prepare an overall implementation plan 

that considers many of the suggestions OIG provided in this 

recommendation. We believe FinCEN’s planned management 

actions address the recommendation, if properly implemented. 

2. In the absence of expanding the definition of “Unacceptable” 

SARs subject to returning the SAR to the filer due to incomplete 

information (see recommendation 1.a.), expand the “Outreach” 

training to focus on explaining the importance of a clear and 

complete narrative and the procedures for maintaining 

attachments at the financial institution.

Management Response and OIG Comments

FinCEN concurred and is improving its industry outreach efforts 

to specifically focus on providing complete and accurate data, 

including the importance of a clear and complete narrative and 

the procedures for maintaining any needed attachments at the 

financial institution. The specific activities will be outlined in 

the overall implementation plan by June 2003. In addition, the 

next SAR Activity Review will highlight the necessity of 

complete and accurate data. We believe FinCEN’s planned 

management actions address the recommendation, if properly 

implemented. 

3. To better ensure that all violations are accurately listed, 

consideration should be given to include a statement on the 

SAR form, Part III, Suspicious Activity Information for filers to 

contact FinCEN for assistance in identifying the violation being 

reported. 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 21 
Management Response and OIG Comments 

FinCEN concurred with providing a point of contact for 

institutions needing assistance in identifying violations being 

reported. Rather than revising the SAR form, FinCEN will 

include in its outreach information, broad suggestions for 

identifying violations and refer financial institutions to their 

Federal regulators for more specific assistance. FinCEN’s 

planned corrective actions will be completed by June 2003. 

We believe FinCEN’s planned actions are responsive to the 

intent of the recommendation. We also further suggest that 

during its planned outreach efforts that consideration also be 

given to referring financial institutions to FinCEN given the 

advantages and benefits of better ensuring consistent and 

uniform guidance. In so doing, FinCEN might be better able to 

systematically monitor the extent and nature of inquiries to 

readily identify any needed revisions to the SAR form and 

instructions. 

4. To better ensure against duplicative SAR filings, develop internal 

controls that would match new SARs against SARs already 

input into the database. 

Management Response and OIG Comments 

FinCEN concurred and is now evaluating alternative approaches 

to deal with duplicate SARs posted to the SAR database. This 

wll include determining the costs of enhanced internal controls 

to implement a cost effective solution. This corrective action 

will also be incorporated into the overall implementation plan 

with a targeted completion of June 2003. We believe FinCEN’s 

planned management actions address the recommendation. 

5. To address the erroneous information from submissions via the 

PACS, reassess system controls covering the accuracy and 

completeness of this new media. Consideration should be given 

to areas such as edits and mandatory fields for financial 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 22 
institutions using commercial software for both individual and 

batch processing. 

Management Response and OIG Comments 

FinCEN concurred in concept, agreeing that adequate system 

controls and edits are necessary to assure complete SAR data. 

FinCEN stated the system error resolution procedures are the 

same for SARs filed on magnetic media and PACS, and 

improving data perfection routines at IRS DCC will result in 

more complete and accurate data. We agree that the cited 

actions address the intent of the recommendation. However, 

we would further suggest that the cited corrective actions be 

closely monitored in light of the difference between batch and 

discrete SAR filings as noted by FinCEN and IRS DCC officials. 

OIG Comments to Other Management Responses

We believe the data reliability weaknesses warrant management 

consideration in designating the reported weaknesses as a material 

weakness under FMFIA. In its response to the draft report, FinCEN 

disagreed that the reported weaknesses constituted a material 

weakness, and that the Federal regulators, as co-owners of the 

SARs, had equal responsibility for the issues raised in the report, 

and that joint concurrence with the Federal regulators was required 

on SAR issues. 

With respect to the material weakness designation, we would 

respectfully clarify the issue that under FMFIA, the Office of 

Management and Budget (OMB) Circular A-123, and Treasury 

Directive 40-04, it is the bureau’s, not the OIG’s, responsibility to 

report on management deficiencies identified in audit reports that 

have the potential of meeting the Department’s material weakness 

criteria. The OIG was only bringing to FinCEN’s attention 

conditions that we believed warranted consideration as to the 

material weakness designation for the following reasons: 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 23 
1. The reliability of SAR data is vital to accomplishing one of 

FinCEN’s core missions with respect to the BSA and the 

attendant money laundering enforcement programs. 

2. As noted in the report, the same data reliability concern was 

previously reported by the OIG in 1999 and despite the 

corrective actions cited by FinCEN, regulatory and law 

enforcement agencies (SAR data users) continued to find 

SARs with incomplete and inaccurate data. 

3. The reported data reliability problems are associated with 

regulated financial institutions that have been filing SARs 

since April 1996, and FinCEN may likely face a large influx 

of SARs filed by new institutions, which are likely not as 

familiar as banks with the SAR filing requirements. More 

specifically, the USA PATRIOT Act has expanded the type of 

financial institutions subject to SAR filing to include other 

institutions such as security brokers/dealers, currency 

exchanges, credit card operators, insurance companies, 

finance companies, and casinos just to name a few. Again, 

we believe the importance of correcting the data reliability 

weaknesses has only been heightened given the expanded 

number of potential SAR reporting entities. 

4. The importance of complete and accurate SAR data is 

further underscored by the Department of Treasury’s 2002 

National Money Laundering strategy, which reflects two 

themes that have driven the Administration’s approach to 

money laundering enforcement. One of those themes is the 

need to ensure that the information that the financial 

institutions are required to report is useful, and can be used 

effectively by the government. 

In its December 11, 2002 response to the draft report, FinCEN also 

stated that the material weakness designation was not warranted 

given that the current SAR data error rate was well within 

acceptable limits. We were unable to assess the applicability of 

that claim with respect to the noted weaknesses in this report. It 

should be noted that at no time did FinCEN bring to our attention 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 24 
documented information as to the nature and extent of any error 

rate assessments, the precise acceptable error rates used, or how 

many of our reported data weaknesses were specifically covered 

by these assessments. However, the cited assessments will be 

included in any future OIG follow-up audits to this report. 

Finally, FINCEN’s response to the draft report emphasized the 

shared responsibility with the Federal regulators for the reported 

issues and the need for joint concurrence on SAR matters. We 

agree, as noted in Recommendation 1, that as co-owners of the 

SARs that Federal regulators have a key and important role in the 

overall enforcement of the BSA. However, it should be noted that, 

as in our prior report in 1999, our reported findings and 

recommendations address only those functions, processes, and 

operations under the direct control of FinCEN and not the Federal 

Banking regulators. Furthermore, we believe these specific 

weaknesses with respect to SAR data reliability will need to be 

addressed to fully combat financial crimes, money laundering and 

now terrorist financing, and that the vital role of accurate and 

complete SAR data once filed by financial institutions cannot be 

deferred across SAR owners. 

* * * * * * 

We would like to extend our appreciation to FinCEN for its 

cooperation and courtesies extended to our audit staff during the 

audit. If you have any questions, please contact John A. Richards, 

Supervisory Auditor, at (415) 977-8810 ext. 225. Major 

contributors to the report are listed in Appendix 3. 

/S/ 

Benny W. Lee 

Regional Inspector General for Audit 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 25 
Appendix 1 

Objectives, Scope and Methodology

The objective of the audit was to profile SARs to assess the nature 

and extent of fraudulent activities affecting institutions regulated 

by OCC and OTS. We have deferred this objective to a future 

period. During the course of our fieldwork, a related matter came 

to our attention that we believe warranted FinCEN’s immediate 

action. Specifically, this matter relates to the reliability and 

accuracy of SARs and the SAR System. 

The scope of the audit included the data in the SAR System 

database as of December 31, 2000, which comprised more than 

554,000 violations from over 505,000 SARs filed since 

April 1, 1996. We also reviewed the SAR Activity Reviews of 

October 2000, June 2001 and October 2001, which provided 

suspicious activity trends and patterns based on the SAR System 

database. 

To accomplish our objectives, we conducted interviews with 

FinCEN, IRS DCC, OCC and OTS officials, reviewed the policies 

and guidelines surrounding SAR filings and SAR processing 

procedures, and requested reports on SAR data. We also 

interviewed law enforcement officials at the Federal Bureau of 

Investigation, the United States Secret Service, and the Internal 

Revenue Service to determine whether these agencies used the 

SAR System to develop comprehensive analyses of trends and 

patterns in financial crime activities, and whether they were 

satisfied with SARs’ usefulness in fighting crimes. 

We requested from OCC and OTS 18 reports on SAR data (9 for 

each regulator) for institutions they regulated. We requested the 

reports on SAR data from FinCEN through the regulators at 

FinCEN’s request. FinCEN was concerned with sharing Right to 

Financial Privacy data that FinCEN did not own. 

We assessed the reliability of 10 of the 18 reports on SAR data by 

comparing for reasonableness the report totals and data received 

from FinCEN to the report totals and data published in the SAR 

Activity Reviews, for the period covered by the audit. The eight 

remaining reports were not assessed because of delays in receiving 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 26 
Appendix 1 

Objectives, Scope and Methodology

the reports from the regulators. Due to unreliability and late arrival 

issues with the reports, as well as the Right to Financial Privacy 

issue, we were unable to accomplish our initial objective to profile 

SAR data. The report does not, therefore, address any of the 

issues relating to this work. 

We conducted fieldwork between March 2001 and March 2002 in 

accordance with generally accepted government auditing 

standards. We originally provided FinCEN a discussion draft of this 

report on August 1, 2002. At the time, FinCEN officials took issue 

with the audit finding, foremost suggesting that improvements 

have been made that were not being considered and that the report 

was based on hearsay from SAR users. Thus, FinCEN wanted to 

show evidence of improvements and actions taken. As a result, 

we agreed with FinCEN to extend the audit fieldwork to 

corroborate, consider and incorporate any additional information in 

support of their improvements and corrective actions. This 

included meetings with FinCEN and IRS DCC officials in August and 

September 2002. 

During the August and September meetings, we reviewed 

documents showing how SARs were processed, e.g. paper and 

magnetic filings, data edits, and follow-up actions, at IRS DCC. 

This information was provided for all BSA reports to show 

comparisons on the amount of coverage among the different 

reports. Briefings were also presented to show efforts proposed to 

enhance the accuracy of SARs and efforts being considered to 

improve the “Outreach” programs. 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 27 
Appendix 2 

Management Response 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 28 
Appendix 2 

Management Response 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 29 
Appendix 2 

Management Response 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 30 
Appendix 3 

Major Contributors to this Report 

John A. Richards, Supervisory Auditor 

Charlotte C. Bergh, Auditor-in-Charge 

Gale Dwyer, Auditor 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 31 
Appendix 4 

Report Distribution 

The Department of the Treasury

Under Secretary for Enforcement 

Assistant Secretary (Enforcement) 

Deputy Assistant Secretary (Enforcement) 

Director, Office of Organizational Improvement 

Director, Office of Strategic Planning 

Director, Office of Public Affairs 

Director, Office of Finance and Budget Execution 

Director, Office of Accounting and Internal Control 

Assistant Director, Office of Internal Control 

Financial Crimes Enforcement Network

Director, Financial Crimes Enforcement Network 

Deputy Chief Financial Officer 

Office of the Comptroller of the Currency

Comptroller of the Currency 

Office of Thrift Supervision

Director, Office of Thrift Supervision 

Office of Management and Budget

OIG Budget Examiner 

Law Enforcement Agencies

Chief, Financial Crimes, Federal Bureau of Investigations 

Director, Financial Crimes, Internal Revenue Service 

Director, Financial Crimes, United States Secret Service 

FinCEN: Reliability of Suspicious Activity Reports (OIG-03-035) Page 32