1

March 29, 2021

Compliance Issues Related to Suspicious Activity Monitoring and Reporting 

at Broker-Dealers

I. Introduction

The Division of Examinations* (“EXAMS”) conducts examinations of broker-dealers and mutual funds

regarding their compliance with anti-money laundering (“AML”) requirements. Such compliance is

critically important to helping the Commission and law enforcement pursue misconduct that could 

threaten the safety of investor assets and the integrity of the financial markets.

1

 In sharing its

observations from these examinations of broker-dealers, EXAMS seeks to remind firms of their 

obligations under AML rules and regulations and to assist broker-dealers in reviewing and enhancing 

their AML programs, in particular their monitoring for and reporting of suspicious activity to law 

enforcement and financial regulators. Mutual funds also may benefit from the examination observations 

discussed here.

II. Relevant Regulation and Guidance

The Bank Secrecy Act (“BSA”) and implementing regulations establish the basic framework for AML 

obligations imposed on financial institutions.2

 The Financial Crimes Enforcement Network (“FinCEN”), 

a bureau of the Department of Treasury, adopted the “AML Program Rule” and the “SAR Rule” to 

implement AML programs and suspicious activity monitoring and reporting requirements for brokerdealers.3

 Rule 17a-8 under the Securities Exchange Act of 1934 (“Exchange Act”) requires broker-

 * The views expressed herein are those of the staff of the Division of Examinations. This Risk Alert is not a rule, 

regulation, or statement of the Securities and Exchange Commission (the “SEC” or the “Commission”). The 

Commission has neither approved nor disapproved the content of this Risk Alert. This Risk Alert has no legal 

force or effect: it does not alter or amend applicable law, and it creates no new or additional obligations for any 

person. This document was prepared by EXAMS staff and is not legal advice.

1 This Risk Alert discusses certain issues identified in select examinations of a number of broker-dealers 

completed during the past several years. This Risk Alert does not discuss all types of deficiencies or 

weaknesses that have been identified by staff.

2 12 U.S.C. §§ 1829b, 1951-1959; 31 U.S.C. §§ 5311-5314, 5316-5332. AML regulations, which are located at 

31 C.F.R. Chapter X, impose a number of additional requirements, such as with respect to customer 

identification programs, beneficial ownership and customer due diligence, and wire transfer recordkeeping, that 

this Risk Alert does not discuss. 

3 The AML Program Rule and SAR Rule, now codified at 31 C.F.R. § 1023.210 and § 1023.320, respectively,

were adopted in 2002 and have since been amended. See, e.g., Financial Crimes Enforcement Network, 

Confidentiality of Suspicious Activity Reports, 75 Fed. Reg. 75593 (Dec. 3, 2010) (amending 31 C.F.R. 

§ 1023.320); Financial Crimes Enforcement Network, Customer Due Diligence Requirements for Financial 

Institutions, 81 Fed. Reg. 29398 (May 11, 2016) (amending 31 C.F.R. § 1023.210). Self-regulatory 

organizations’ rules also contain AML requirements. See, e.g., FINRA Rule 3310.
2

dealers to comply with the reporting, recordkeeping, and record retention requirements of the BSA, 

including those regarding Suspicious Activity Reports (“SARs”).

4

A. AML Policies and Procedures and Internal Controls

Under the AML Program Rule, a broker-dealer is required to establish and implement policies, 

procedures, and internal controls reasonably designed to, among other things, identify and report 

suspicious transactions as required by the BSA and its implementing regulations. An AML program 

should be tailored to address the risks associated with a firm’s particular business, taking into account 

factors such as size, location, activities, customers, and other risks of (or vulnerabilities to) money 

laundering. Moreover, in order to be able to identify suspicious transactions, a broker-dealer should look 

for indicators of illicit activities (generally referred to as “red flags”) and incorporate those red flags into 

its policies and procedures. Awareness by firm personnel of red flags and how to respond to those red 

flags, including escalating awareness of the red flags to appropriate firm personnel, will help ensure that a

firm is in a position to identify the circumstances that warrant further due diligence and possible 

reporting. 

B. Suspicious Activity Reporting

The SAR Rule requires broker-dealers to file with FinCEN a report of any suspicious transaction relevant 

to a possible violation of law or regulation. Generally, a broker-dealer must file a SAR for any 

transaction involving funds or other assets of at least $5,000 that are conducted or attempted by, at, or 

through the broker-dealer and for which the broker-dealer knows, suspects, or has reason to suspect that, 

among other things, the transaction (or pattern of transactions of which the transaction is a part): 

(1) involves funds derived from illegal activity or is intended or conducted to hide or disguise funds 

or assets derived from illegal activity as part of a plan to violate or evade any federal law or 

regulation; 

(2) is designed to evade any requirements set forth in regulations implementing the BSA; 

(3) has no business purpose or apparent lawful purpose or is not the sort in which the particular 

customer would normally be expected to engage, and the broker-dealer knows of no reasonable 

explanation for the transaction after examining the available facts, including the background and 

possible purpose of the transaction; or 

(4) involves use of the broker-dealer to facilitate criminal activity. 

A broker-dealer is expected to conduct due diligence in determining whether to file a SAR on particular 

transactions based on the facts existing at the time. Under the SAR Rule’s objective “knows, suspects, or 

has reason to suspect” standard, a SAR is required if, on the facts existing at the time, a reasonable 

broker-dealer in similar circumstances would have suspected the transaction was subject to SAR 

 4 The failure to file a SAR or maintain records as required by the SAR Rule would be a violation of Section 17(a) 

of the Exchange Act and Rule 17a-8. See SEC v. Alpine Securities Corp., 982 F.3d 68 (2d Cir. 2020). A

broker-dealer’s failure to follow its own AML procedures could also constitute a failure to “document 

accurately” its AML compliance program in violation of Section 17(a) and Rule 17a-8. 
3

reporting.

5 A broker-dealer must file a SAR “no later than 30 calendar days after the date of the initial 

detection ... of facts that may constitute a basis for filing a SAR.”6

In its SAR filing instructions (and various advisories), FinCEN has provided guidance that filers include a 

clear, complete, and concise narrative of the activity, including what was unusual or irregular that caused 

suspicion. FinCEN also has highlighted that the care with which the narrative section is drafted is 

important to law enforcement’s ability to understand the nature and circumstances of the suspicious 

activity and its possible criminality. Furthermore, FinCEN has urged financial institutions to identify the 

five essential elements of information – who? what? when? where? and why? – of the suspicious activity 

being reported.

FinCEN, FINRA, and the SEC have provided additional guidance and tips on a number of SAR-related 

areas, including the potential for fraud associated with the sale of low-priced or microcap stocks and 

indicators of suspicious activity related to broker-dealer SAR obligations in connection with such 

transactions. Links to SEC staff’s bulletin on risks associated with omnibus accounts transacting in lowpriced securities, a risk alert on microcap issues published by EXAMS, and other resources are provided 

in an appendix to this Risk Alert.

III. Staff Observations Related to Suspicious Activity Monitoring and Reporting 

A. AML Policies and Procedures and Internal Controls 

Inadequate policies and procedures – EXAMS observed broker-dealers that did not establish reasonably 

designed policies and procedures and internal controls necessary to adequately identify and report 

suspicious activity as required under the BSA. For example:

• Some firms did not include any red flags in their policies and procedures to assist with identifying 

activity for further due diligence, or failed to include red flags associated with securities 

transactions. Relatedly, firms did not tailor the red flags they did include in their policies and 

procedures to address risks associated with the type of activity in which their customers regularly 

engaged, for example, activity in low-priced securities, which can be associated with improper 

sales of unregistered securities and market manipulation such as pump-and-dump schemes.

• Some firms with large volumes of daily trading failed to establish and implement automated 

systems to monitor and report suspicious activity associated with trading in large volumes. 

Instead, firms unreasonably relied on a manual review of trading and did not establish procedures 

or controls designed to identify trends or suspicious patterns across multiple accounts.

• Where firms incorporated low-priced securities transactions into their automated monitoring, 

some firms set the threshold for generating an alert at securities worth less than $1 per share, thus 

failing to adequately monitor transactions in securities priced between $1 and $5 per share, which 

also are considered to be low-priced securities or “penny stocks.”7 Some firms also failed to 

incorporate transactions in low-priced securities occurring on an exchange.

 5 Financial Crimes Enforcement Network, Amendment to the Bank Secrecy Act Regulations—Requirement that 

Brokers or Dealers in Securities Report Suspicious Transactions, 67 Fed. Reg. 44048, 44053 (July 1, 2002).

6 31 C.F.R. § 1023.320(b)(3).

7 17 C.F.R. § 240.3a51-1 (defining “penny stock”).
4

• Some firms set SAR reporting thresholds at amounts significantly higher than the $5,000 

threshold specified in the SAR Rule and thus failed to identify and report potentially suspicious 

transactions involving amounts between $5,000 and the firms’ elevated thresholds.

• Some introducing firms inappropriately deferred to their clearing firms to identify and report 

suspicious transactions in customer accounts and failed to adopt their own procedures that take

into account the high-risk nature of their customers’ activity,

8 e.g., trades in low-priced, 

unregistered securities.

Failure to implement procedures – Some firms that had reasonably designed written policies and 

procedures did not implement their procedures adequately and did not conduct adequate due diligence on 

or report suspicious activity that, per their own procedures, appeared to trigger a SAR filing requirement. 

EXAMS observed that, by not adequately implementing their procedures, some firms did not:

• File SARs on transactions that appeared identical in nature to transactions for which the firm had 

routinely filed SARs without distinguishing the transactions from those on which SARs were 

filed previously.

• Reasonably use available transaction reports and systems to monitor for suspicious activity. 

• Follow up on red flags identified in their procedures, such as prearranged or non-competitive 

trading, including wash or cross trades or potential insider trading.

• Comply with firm prohibitions on accepting trades for securities priced at less than one penny per 

share, which firms may impose because such trades may be indicative of possible suspicious 

activity, and the firms did not conduct due diligence to determine whether to file SARs on those 

transactions. 

B. Suspicious Activity Monitoring and Reporting

Failure to respond to suspicious activity – EXAMS observed that weak policies, procedures, and internal 

controls, or the failure to implement existing policies and procedures, ultimately resulted in firms not

conducting or documenting adequate due diligence in response to known indicators of suspicious activity

especially with respect to activity in low-priced securities, which are particularly susceptible to market 

manipulation. By not doing so, some firms did not file SARs when it appeared that the broker-dealers 

knew, suspected, or had reason to suspect that they were being used to facilitate unlawful activity, 

including possible improper sales of unregistered securities, and pump-and-dump schemes and market 

manipulations of thinly traded, low-priced securities. In fact, EXAMS observed that even when firms 

were presented with activity in this high-risk area involving low-priced securities that also included one 

or more of the following red flags reflected in the 2014 EXAMS Risk Alert and FINRA Notice to 

Members 19-18, firms did not review the activity and follow up to consider filing SARs:

9

 8 FINRA has reminded introducing firms that, while they may rely on tools provided by their clearing firms, 

introducing firms have their own independent responsibility to perform suspicious activity monitoring and 

reporting and are not able to defer to others to perform their obligations. Frequently Asked Questions (FAQ) 

regarding Anti-Money Laundering (AML), FINRA, https://www.finra.org/rules-guidance/key-topics/aml/faq

(last visited Mar. 29, 2021) (FAQ no. 22).

9 The existence of one or more of these examples of red flags would not necessarily trigger a broker-dealer’s 

obligation to file a SAR. Whether a broker-dealer has an obligation to file a SAR depends on the totality of 

facts and circumstances in a particular situation. See Section II.B above discussing the SAR Rule.
5

• Large deposits of low-priced securities, followed by the near-immediate liquidations of those 

securities and then wiring out the proceeds (generally referred to as “deposit, sale, and withdrawal 

activity”).

• Patterns of trading activity common to several customers including, but not limited to, the sales of 

large quantities of low-priced securities of multiple issuers by the customers.

• Trading in thinly traded, low-priced securities that resulted in sudden spikes in price or that 

represented most, if not all, of the securities’ daily trading volumes. 

• Trading in the stock of issuers that were shell companies or had been subject to trading 

suspensions or whose affiliates, officers, or other insiders had a history of securities law 

violations. 

• Questionable background of customers such as the fact that they were the subject of criminal, 

civil, or regulatory actions relating to, among other things, securities law violations.

• Trading in the stock of issuers for which over-the-counter stock quotation systems had published 

warnings because the issuers had ceased to comply with their SEC financial reporting obligations 

or for which the firms relied on a “freely tradeable” legal opinion that was inconsistent with 

publicly available information. 

In addition, EXAMS observed that firms did not reasonably account for information that was publicly 

available or in the firms’ possession when evaluating activity in customer accounts, including, for 

example: 

• Customer sales of the shares of issuers subject to simultaneous promotional activity. 

• Trading in low-priced stock by customers that were affiliates or control persons of the issuer.

• Liquidations of large volumes of low-priced securities concentrated within introducing brokerdealers or broker-dealer counterparties that firms identified as high risk or whose activity 

exhibited several of the characteristics identified in this and the preceding sections.

Filing inaccurate or incomplete SARs – EXAMS observed that broker-dealers, in some cases, did not 

include details known to the firm of individual customer trades or issuers that were suspicious or, in other 

cases, did not make use of specific structured data fields on the SAR. As a result, EXAMS observed 

firms who each filed hundreds of SARs or more containing the same generic boilerplate language, which

failed to make clear the true nature of the suspicious activity and the securities involved, rendering the 

SAR less valuable to law enforcement and regulators trying to understand the activity and its criminal or 

regulatory implications. Examinations revealed that a number of firms filed SARs that contained 

inaccurate information or lacked sufficient detail on key aspects of the suspicious activity. Examples of 

these instances include the following: 

• Not including or inaccurately capturing key information despite having such information 

available in the firm’s own internal records, e.g., social security numbers; dollar amounts for 

customers’ losses from identity theft and account-takeover fraud; customers’ disciplinary history

and account numbers; details relating to foreign customers and sub-accountholders; and concerns 

about suspected promoters and issuers of low-priced securities.

• Reporting the deposit of low-priced securities but failing to report the liquidation of the same 

securities shortly thereafter and the disposition of the proceeds, or reporting that a customer 
6

deposit of low-priced securities was an “initial” deposit, despite firm records indicating one or 

more previous deposits of the same security.

• For cyber-intrusions, not including details known at the time of reporting regarding the method 

and manner of cyber-intrusions and schemes to “take over” customer accounts, including the 

method of transferring out funds, how the account was accessed, bank account information, 

phone/fax numbers, email addresses, and IP addresses.

V. Conclusion

In fulfilling their important AML obligations, broker-dealers play a vital front-line role in assisting 

regulators and law enforcement in identifying and addressing suspicious activities to prevent our financial 

systems from being used for criminal purposes. EXAMS encourages broker-dealers to review and

strengthen their applicable policies, procedures, and internal controls related to their suspicious activity 

monitoring and reporting processes to further their compliance with federal AML rules and regulations.

This Risk Alert is intended to highlight for firms risks and issues that EXAMS staff has identified. In addition, this 

Risk Alert describes risks that firms may consider to (i) assess their supervisory, compliance, and/or other risk 

management systems related to these risks, and (ii) make any changes, as may be appropriate, to address or 

strengthen such systems. Other risks besides those described in this Risk Alert may be appropriate to consider, 

and some issues discussed in this Risk Alert may not be relevant to a particular firm’s business. The adequacy of 

supervisory, compliance and other risk management systems can be determined only with reference to the 

profile of each specific firm and other facts and circumstances.
7

Resources

SEC Staff Statements

1. EXAMS has prepared online research guides, or “source tools,” that contain compilations of key 

AML laws, rules, orders, and guidance applicable to broker-dealers and mutual funds. AntiMoney Laundering (AML) Source Tool for Broker-Dealers, 

https://www.sec.gov/about/offices/ocie/amlsourcetool.htm, Anti-Money Laundering (AML) 

Source Tool for Mutual Funds https://www.sec.gov/about/offices/ocie/amlmfsourcetool.htm.

2. Staff Bulletin: Risks Associated with Omnibus Accounts Transacting in Low-Priced Securities, 

Division of Trading and Markets (Nov. 12, 2020), https://www.sec.gov/tm/risks-omnibusaccounts-transacting-low-priced-securities.

3. Investor Spotlight on Microcap Fraud, https://www.investor.gov/additionalresources/spotlight/microcap-fraud.

4. Broker-Dealer Controls regarding Customer Sales of Microcap Securities, EXAMS National 

Exam Program Risk Alert, Vol. IV, Issue 3 (Oct. 9, 2014), 

https://www.sec.gov/about/offices/ocie/broker-dealer-controls-microcap-securities.pdf.

FINRA Guidance

5. Guidance to Member Firms Concerning Anti-Money Laundering Compliance Programs Required 

by Federal Law, Notice to Members 02-21, FINRA (April 2002), https://www.finra.org/rulesguidance/notices/02-21.

6. Unregistered Resales of Restricted Securities, Reg. Notice 09-05, FINRA (Jan. 2009), 

https://www.finra.org/sites/default/files/NoticeDocument/p117716.pdf.

7. FINRA Provides Guidance to Firms Regarding Suspicious Activity Monitoring and Reporting 

Obligations, Reg. Notice 19-18, FINRA (May 6, 2019), https://www.finra.org/rulesguidance/notices/19-18.

8. Anti-Money Laundering (AML) Template for Small Firms (updated Sept. 8, 2020), 

https://www.finra.org/compliance-tools/anti-money-laundering-template-small-firms.

FinCEN Guidance

9. FinCEN maintains a library of advisories, bulletins, fact sheets, and administrative rulings at: 

https://www.fincen.gov/resources/advisoriesbulletinsfact-sheets; 

https://www.fincen.gov/index.php/resources/statutes-regulations/guidance; 

https://www.fincen.gov/resources/statutes-regulations/administrative-rulings.

10. Suggestions for Addressing Common Errors Noted in Suspicious Activity Reporting, FinCEN

(Oct. 10, 2007), https://www.fincen.gov/resources/statutes-regulations/guidance/suggestionsaddressing-common-errors-noted-suspicious.
8

11. The SAR Activity Review Trends Tips & Issues, In Focus: The Securities and Futures Industry, 

FinCEN (May 2009), https://www.fincen.gov/sites/default/files/shared/sar_tti_15.pdf (noting that 

broker-dealers were failing to identify the “systematic sale of ... low-priced securities shortly 

after being deposited, transferred or journaled into [an] account” as suspicious activity). 

12. Account Takeover Activity, FIN-2011-A016, FinCEN (Dec. 19, 2011), 

https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2011-a016.

13. FinCEN SAR Electronic Filing Instructions, FinCEN (July 2020), 

https://bsaefiling.fincen.treas.gov/docs/XMLUserGuide_FinCENSAR.pdf.

14. Advisory to Financial Institutions on Cyber-Events and Cyber-Enabled Crime, FIN-2016-A005, 

FinCEN (Oct. 25, 2016), https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2016-

a005.

15. FAQs regarding the Reporting of Cyber-Events, Cyber-Enabled Crime, and Cyber-Related 

Information through SARs, FinCEN (Oct. 25, 2016), 

https://www.fincen.gov/sites/default/files/shared/FAQ_Cyber_Threats_508_FINAL.PDF.

Other Guidance

16. Risk Based Approach Guidance for the Securities Sector, FATF (2018), https://www.fatfgafi.org/media/fatf/documents/recommendations/pdfs/RBA-Securities-Sector.pdf.