Audit Report

OIG-18-041

TERRORIST FINANCING/MONEY LAUNDERING

The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain 

March 9, 2018 

Office of

Inspector General 

Department of the Treasury
This Page Intentionally Left Blank 
Contents 

The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page i 

Audit Report ............................................................................................... 1 

Results in Brief ............................................................................................ 2 

Background ................................................................................................ 5 

Audit Results .............................................................................................. 8 

Invalid and Non-Responses in Critical Data Fields as well as Omitted SubRecords Remain Challenges for FinCEN ..................................................... 9 

Recommendations .............................................................................. 15

Inconsistent and Incomplete Filer Responses Continued to Impact 

Data Quality ........................................................................................... 17 

Recommendation ............................................................................... 21

Certain Controls Over BSAR Processing Were Weak .................................... 22 

Recommendations .............................................................................. 26 

Appendices

Appendix 1: Objective, Scope, and Methodology ........................................ 29

Appendix 2 Summary Statistics on Review of Critical Data Fields in BSARS 

Received at FinCEN: May 2013 through April 2014 .................. 32

Appendix 3: Management Response ......................................................... 33

Appendix 4: Major Contributors to This Report ........................................... 37 

Appendix 5: Report Distribution ................................................................ 38 

Abbreviations

 BSA Bank Secrecy Act 

 BSA ID Bank Secrecy Act Identification Number 

 BSAR Universal Suspicious Activity Report 

 FinCEN Financial Crimes Enforcement Network 

 GAO Government Accountability Office 

 JAMES Joint Audit Management Enterprise System 

OIG Office of Inspector General 

 SOR System of Record 
Contents 

The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page ii

 TIN Taxpayer Identification Number
OIG Audit 

Report

The Department of the Treasury 

Office of Inspector General 

The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 1

March 9, 2018 

Kenneth A. Blanco 

Director 

Financial Crimes Enforcement Network 

This report presents the results of our audit of the quality of data 

included in Universal Suspicious Activity Reports (BSAR) collected 

by the Financial Crimes Enforcement Network (FinCEN) and stored 

on FinCEN’s system of record (SOR) for Bank Secrecy Act (BSA) 

data.1 One of the critical functions FinCEN is responsible for under 

the BSA is the collection, maintenance, and dissemination of data 

on suspicious activities included in reports filed by financial 

institutions.2

 FinCEN and the law enforcement community use 

BSAR data to identify trends and develop intelligence information 

on money laundering and terrorist financing activities. It is vital that 

BSAR data be accurate and complete. 

Our objective for this audit was to determine if FinCEN’s 

implementation, in March 2012, of the BSAR and FinCEN’s April 

2013 mandate that all reports be filed electronically has helped the 

quality of the suspicious activity report data provided by filers. To 

accomplish our objective, we evaluated filer responses in 39 data 

fields included in BSARs received at FinCEN from May 2013 

through April 2014. We performed our fieldwork from May 2014 to 

January 2016 with subsequent follow up through January 2017. 

Appendix 1 provides a more detailed description of our audit 

objective, scope, and methodology. 

1

 The SOR is an information storage system that is the authoritative data source for all BSA data 

collected by FinCEN. 

2

 Public Law 91-508, 84 Stat. 1114 through 1136 (October 26, 1970). 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 2 

Results in Brief

We reviewed data included on more than 1.75 million discrete and 

batch filed BSARs received at FinCEN from May 2013 through April 

2014. Discrete filed BSARs are entered on-line through forms 

available on FinCEN’s web-based BSA E-Filing System. Batch filed 

BSARs are included in text files received by FinCEN daily from 

financial institutions. Based on our review of data included in these 

filings, we found that FinCEN’s implementation of the BSAR and 

the electronic filing mandate have contributed to its ongoing efforts 

to further the quality of suspicious activity report data. Validation 

edits implemented on discrete filed BSARs submitted through 

FinCEN’s E-Filing System beginning in March 2012, ensured that 

filers provided responses to most of the 42 data fields FinCEN 

deemed critical.3

 

For the majority of subject-related critical data fields as well as the 

information relating to any institutional branch that may have been 

involved in the suspicious activity, filers have been provided with 

the option to confirm that the information is unknown or not 

applicable to the suspicious activity being reported. These 

additional fields are used to justify non-responses in the associated 

critical data fields for discrete filed BSARs. Similar options 

regarding reporting information as unknown or not applicable are 

available to institutions that submit BSARs to FinCEN in batch files. 

Although FinCEN did not reject batch filed BSARs with errors and 

omissions in critical data fields, FinCEN’s validation edits identified 

submissions with certain errors that required filers to submit 

corrected reports, and isolated other reporting issues where filers 

needed to improve in future filings. The results of FinCEN’s 

validation edits were provided back to filers in acknowledgement 

3

 The 42 critical data fields were identified as critical by FinCEN, meaning they required a filer response 

and were not to be left blank in FinCEN’s BSA E-Filing System. We reviewed filer responses included 

in 39 of the 42 critical data fields. We did not evaluate filer responses in the 3 data fields used to 

record Taxpayer Identification Number (TIN) type values for the reporting financial institution, 

institution location where the suspicious activity occurred, and each subject, because we were unable 

to validate if the proper TIN type values were entered. We did, however, confirm that entries are 

required in these 3 fields for discrete filings. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 3 

records generated for each batch filed BSAR uploaded to FinCEN’s 

SOR.

4

Our review of 39 critical data fields for more than 1.75 million 

discrete and batch filed BSARs received at FinCEN, during the 

period May 2013 through April 2014, found one or more data 

quality errors in 33.5 percent of the filings.5

 The most common 

errors identified related to critical data fields with no entries when a 

response for that data field was expected, and included many 

batch filed BSARs where the filers did not include sub-records in 

the submissions that would contain the critical information.6 The 

results of our review, while not directly comparable to the results 

attained in our prior audit of suspicious activity report data quality, 

are indicative of improvement in data quality which may be 

attributable to the implementation of the BSAR and FinCEN’s 

electronic filing mandate.7

 FinCEN acknowledged the importance of 

the critical data fields and efforts to ensure data integrity. 

According to FinCEN, imperfect BSARs still provide value to law 

enforcement and missing information in certain contexts do not 

result in fatally flawed BSARs. 

We also found inconsistencies in how filers report certain critical 

data fields such as institution name or address, and examples 

where FinCEN’s address enhancement tool, designed to improve 

BSAR address information based on limited information provided by 

the filers, did not always work as intended. FinCEN’s controls also 

did not ensure that filers provided the prior document numbers 

assigned to the original filings when submitting discrete BSARs to 

continue reporting on a suspicious activity, nor did FinCEN institute 

4

 Acknowledgement records generated by FinCEN include the BSA Identification Number (BSA ID) 

assigned to each BSAR as well as information on errors identified by FinCEN’s validation edits on 

certain data fields.

5

 Data quality errors are defined as non-responses in data fields where responses were expected, as 

well as responses that were not in compliance with FinCEN filing instructions and guidance. 

6

 Each batch filed BSAR can be comprised of up to 19 sub-record types, each containing certain detail 

information relating to a segment of BSAR data. While certain of these sub-records are required to be 

included in the filings, other sub-records are optional based on the filers responses in key data fields 

included in the required sub-records. 

7

 In our prior audit, SAR Data Quality Requires FinCEN’s Continued Attention (OIG-10-030; issued 

January 19, 2010), we evaluated 17 data fields deemed critical by FinCEN. We identified one or more 

data quality issues in 59 percent of the filings evaluated. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 4 

procedures to ensure filers re-submitted BSARs when directed to 

do so. FinCEN officials reported that a system modification 

implemented in July 2016 ensures that a response in the prior 

document number data field is provided by the filer when 

submitting discrete BSARs to continue reporting on a suspicious 

activity. Batch filed BSARs, however, continue to be accepted in 

cases where a valid response in the prior document number field is 

not provided. FinCEN does not notify or follow-up with filers 

regarding missing or invalid prior document numbers. 

In addition, we identified 11 critical fields where FinCEN’s BSA EFiling System inappropriately accepted space bar entries as valid 

responses in these fields. FinCEN officials reported that this 

deficiency was corrected in July 2016 and that the BSA E-Filing 

System no longer allows space bar entries as valid responses. 

We are recommending that FinCEN (1) address areas for which

additional filer education is needed for specific instances or 

systemic errors identified with specific filers or the filer community 

to reduce invalid and non-responses, including guidance on the 

mechanics for proper reporting of data fields for which the values 

requested are unknown; (2) implement controls in FinCEN’s 

validation edits that systemically identify batch filed BSARs that do 

not include a subject address or institution branch sub-record when 

these records are expected; (3) develop a methodology to 

systemically identify inconsistent and incomplete filer responses in 

critical data fields for all filings, and identify filers with systemic 

issues and notify them as deemed appropriate; (4) implement 

controls to ensure that BSARs in which a valid response is not 

provided in the prior document number field are systemically 

identified as errors by FinCEN and filers are notified of this 

condition; and (5) implement controls to identify and track BSAR 

filings with primary errors and determine if filers comply with 

FinCEN policy requiring correction and resubmission. FinCEN should 

take action, where appropriate, against filers that fail to comply 

with FinCEN’s resubmission policy. 

In a written response, which is included in its entirety as appendix 

3, FinCEN management concurred with our recommendations. 

FinCEN management stated that it follows its standard operating 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 5 

procedures and provides outreach and engagement with filers who 

have demonstrated systemic errors. FinCEN will continue to use 

education and outreach as a means to help filers become more 

diligent in submitting requested information. FinCEN management 

has also implemented a SAR data quality review program to 

identify significant systemic BSAR errors made by individual 

financial institutions and report such errors to the institutions. 

FinCEN management states that this program along with its file 

validation processes provide the balance of data quality with data 

timeliness and usefulness. 

FinCEN management also stated that it is committed to ensuring 

that BSAR information received is not only relevant but also reliable 

and useful. While management recognizes the audit report 

highlights data quality issues which could be further perfected, 

FinCEN stated that it must and will continue to balance this goal 

against its goal of getting the most valuable data to law 

enforcement as quickly as possible. Further, FinCEN will continue 

to use its data management process to regularly review and 

prioritize form field edit and validation requirements when forms are 

updated or changed. 

We consider FinCEN’s actions taken to be responsive to our 

recommendations. We have summarized the response in the 

recommendation sections of this report. Management will need to 

record the actual date of completed corrective actions in the Joint 

Audit Management Enterprise System (JAMES), Treasury’s audit 

recommendation tracking system. 

Background 

FinCEN’s mission is to safeguard the financial system from illicit 

use, combat money laundering, and promote national security 

through the collection, analysis, and dissemination of financial 

intelligence and the strategic use of financial authorities. Among its 

responsibilities, FinCEN administers the BSA, the nation’s most 

comprehensive Federal anti-money laundering and counter terrorism 

financing statute. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 6 

The BSA, as amended, requires U.S. financial institutions to assist 

U.S. government agencies in detecting and preventing money 

laundering, terrorist financing, and other financial crimes. 

Regulations promulgated under the BSA require financial 

institutions to file reports of suspicious activities with FinCEN for 

transactions exceeding $5,000 (or $2,000 for certain types of 

financial institutions), that the institutions know, suspect, or have

reason to suspect are intended to evade any federal law or 

regulation, involve illegally obtained funds, or have no business or 

apparent lawful purpose.8

 

Universal Suspicious Activity Reports 

FinCEN collects information on suspicious activities through reports 

filed by financial institutions. This information is stored on FinCEN’s 

SOR and accessed by authorized users through FinCEN Query, its 

on-line tool used to search, retrieve, and analyze BSA data. In 

March 2012, FinCEN introduced a new suspicious activity report 

form designed for use by all industry members.9 The BSAR, 

developed through dialogue with FinCEN’s federal law enforcement 

and regulatory partners, contained standardized data fields 

applicable to all industry members as well as other fields to indicate 

suspicious activity characterizations most relevant to each type of 

industry member. Forty-two data fields included in the BSAR have 

been deemed critical by FinCEN, with most requiring a filer 

response when attempting to submit BSARs through FinCEN’s BSA 

E-Filing System. 

Beginning in April 2013, FinCEN mandated all filers use the BSAR 

and submit filings to FinCEN electronically, through one of two 

methods. Discrete filed BSARs are entered through on-line forms 

and submitted individually or in groups through FinCEN’s BSA EFiling System. Validation edits for discrete filed BSARs ensured 

8 31 C.F.R. 1020.320 (depository institutions), 31 C.F.R. 1021.320 (casinos), 31 C.F.R. 1022.320 

(money services businesses), 31 C.F.R. 1023.320 (brokers or dealers in securities), 31 C.F.R. 

1024.320 (mutual funds), 31 C.F.R. 1025.320 (insurance companies), 31 C.F.R. 1026.320 (futures 

commission merchants and introducing brokers in commodities), 31 C.F.R. 1029.320 (loan or finance 

company) and 31 C.F.R. 1030.320 (housing government sponsored enterprise).

9

 FinCEN mandated all filings be submitted electronically in the new BSAR format no later than July 1, 

2012. In response to problems encountered by several institutions, FinCEN allowed filers to submit 

reports on paper forms, until March 31, 2013. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 7 

that filers entered responses for almost all of the critical data fields. 

Batch filings involve the submission of one or more BSARs in text 

files through the BSA E-Filing System or directly transferred from 

the filing institution’s server to FinCEN’s server. Each batch filed 

BSAR can be comprised of up to 19 sub-record types, each 

containing information relating to certain topical areas of the BSAR. 

Five types of sub-records must be included for each BSAR, while 

the remaining 14 sub-record types are optional, depending on the 

availability or applicability of information covered by these subrecords.

10 FinCEN’s validation process ensures filers include the 

five required sub-record types for each BSAR submitted in batch 

files. 

Information provided by FinCEN identified 1,751,166 BSARs were 

received during the period May 2013 through April 2014. 

Approximately 26 percent (458,218) of these BSARs were discrete 

filings while the remaining 74 percent (1,292,948) were included in 

batch file submissions. Table 1 below identifies BSAR filings by 

institution type and filing method. 

 Table 1: BSARs Received May 2013 through April 2014 by Institution Type & Filing Method 

Institution Type Batch Discrete1 Total 

Depository institutions 821,682 173,527 995,209

a. 

Money services businesses 440,124 217,653 657,777

Casinos and card clubs 17,577 20,882 38,459

Other financial institutions 4,371 30,544 34,915

Securities and futures firms 7,613 13,414 21,027

Insurance companies 1,449 2,094 3,543

Unidentified2 132 104 236

Total 1,292,948 458,218 1,751,166

Source: Department of the Treasury Office of Inspector General (OIG) analysis of BSAR dat

Note 1: Discrete totals include 869 reports filed on paper forms and loaded to the SOR by 

FinCEN through BSA E-Filing System entries. 

Note 2: The Filing Institution Type data field did not include a response for these BSARs.

10 FinCEN Suspicious Activity Report Electronic Filing Requirements, December 2013. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 8 

FinCEN Performed Periodic Data Quality Studies 

FinCEN performs periodic data quality studies of BSAR data by 

developing statistics on the numbers and percentages of errors in 

the critical data fields identified during FinCEN’s validation 

processing of filer BSAR submissions. Through these studies, 

FinCEN can identify overall problem areas in the quality of BSAR 

data and the specific filers that have high percentages of errors in 

responses to critical data fields. FinCEN has included guidance to 

filers, addressing certain data quality issues found in its studies in 

some of FinCEN’s annual SAR Stats Technical Bulletin publications. 

FinCEN also targets filers with high percentages of errors in the 

critical data fields which indicate systemic reporting problems. 

FinCEN requires these filers to correct the deficiencies and 

conducts follow-up studies to ensure appropriate and timely 

corrective actions were taken. 

Audit Results 

FinCEN’s implementation of the BSAR and the electronic filing 

mandate have contributed to its ongoing efforts to further data 

quality. FinCEN has designed controls and issued filing 

requirements and guidance to require responses for most of the 

critical data fields and allow filers to justify non-responses for a 

number of these data fields. FinCEN’s front end validation edits on 

discrete filings were designed to prevent discrete BSAR 

submissions without a response entered in almost all of the critical 

data fields. Filers were provided the option to indicate that values 

for certain individual critical data fields or entire segments of BSAR 

data were unknown, or were not applicable to the suspicious 

activity being reported on. 

FinCEN’s validation edits on batch filed BSARs were performed 

when the files were received. FinCEN loaded batch filed BSARs to 

its SOR unless (1) the structure of the batch file was invalid, 

(2) one or more of the required sub-records were not included for 

any BSAR in the batch file, or (3) one or more fatal errors defined 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 9 

in FinCEN’s filing requirements were found in the batch file.11

FinCEN’s policy is to accept all batch filed BSARs regardless of any 

errors or omissions in the filer responses. FinCEN officials stated 

that while the 39 data fields evaluated by the OIG have been 

identified as critical, errors or omitted responses in some of these 

fields are less impactful than others as the data can often be 

derived from analyses of responses in other data fields. The 

absence of information in one or more of these fields does not 

invalidate the value of the information provided in the BSAR. 

Despite FinCEN’s efforts, challenges remain in the bureau’s efforts 

to continue to improve the quality of BSAR data.

Finding 1 Invalid and Non-Responses in Critical Data Fields as well 

as Omitted Sub-Records Remain Challenges for FinCEN

Our review of responses to 39 critical data fields in 1,751,166 

batch and discrete filed BSARs received at FinCEN during the 

period May 2013 through April 2014, found one or more data 

errors in 33.5 percent (586,190) of the filings. Of these totals, 16 

percent (94,166) related to discrete filings while the remaining 84 

percent (492,024) were associated with batch filings. These errors 

included invalid responses provided by filers, along with the 

unjustified omission of subject address or institution branch subrecords, and non-responses in critical data fields where responses 

were expected. Appendix 2 summarizes the number of BSARs with 

invalid responses we found in the 39 critical BSAR data fields we 

reviewed. 

Sub-Record Omissions Limited the Value of BSAR Information 

Our review found 46,942 batch filed BSARs where subject address 

sub-records were not provided by the filer for one or more of the 

subjects included in the filings. In each of these cases the 

checkbox in the subject master record was not used to certify that 

all critical subject information was unknown and justify the 

omission of the address sub-records. Similarly, 173,004 batch filed 

BSARs noted that a branch of the financial institution was involved 

in the suspicious activity, but no branch sub-record was included in 

11 Fatal errors include BSARs submitted without required information about the filing institution or the 

institution where the suspicious activity occurred. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 10

the filings.12 We considered each of the critical data fields that 

should have been included in the subject address and institution 

branch sub-records for the impacted BSARs to be unjustified 

omissions. 

FinCEN’s Suspicious Activity Report Electronic Filing Requirements

instructs batch filers to not include branch sub-records when no 

branch of the institution is involved in the suspicious activity and to 

omit subject address sub-records if all of the subject information is 

unknown.13 The filers are also instructed to justify the sub-record 

omissions by populating related fields in the institution location and 

subject master sub-records. Our testing confirmed that filers did 

not activate the fields that would justify the omission of the 

institution branch or subject address sub-records for the 219,946 

filings noted above. 

FinCEN officials confirmed that batch file processing parameters did 

not result in the rejection of batch files when expected subject 

address sub-records were not provided by the filers for one or more 

BSARs in the files. In addition, FinCEN’s validation edits for batch 

filed BSARs uploaded to FinCEN’s SOR did not identify subject 

address sub-record omissions as errors in acknowledgement 

records provided to the filers. FinCEN officials stated that in some 

cases, filers did not provide one or more address sub-records for 

each subject in the BSAR, while in other cases, filers 

misinterpreted FinCEN’s filing instructions and did not sequence the 

address sub-records properly in their submissions. In these cases, 

the address sub-records provided by the filers were linked to one 

subject when uploaded to FinCEN’s SOR, while other subjects were 

loaded with no address sub-records linked. These conditions would 

only be rectified if filers subsequently identified the issue and 

submitted corrected BSARs with all subject address sub-records 

appropriately sequenced. 

FinCEN recognized the importance of subject address information, 

and have proposed adding validation error messages to 

12

 Filers are required to submit a record for the branch involved in the suspicious activity unless the “no 

branch involved” checkbox is activated in the associated institution location record. For the 173,004 

BSARs noted, the filers did not activate this checkbox. 

13 FinCEN’s Suspicious Activity Report Electronic Filing Requirements, Dec. 2013.
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 11

acknowledgement records where an expected subject address subrecord was not provided to alert filers of the deficiencies in their 

submissions. FinCEN did revise its batch filing instructions in 2014 

to clarify the proper sequencing of sub-records. Regarding the 

omitted institution branch sub-records, FinCEN officials stated that 

this issue was considered to be a minor reporting error, not 

warranting the rejection of an entire batch of BSARs. 

In January 2017 FinCEN officials stated that proposed system 

changes to include validation error messages in acknowledgement 

records for batch filed BSARs with omitted sub-records remained 

outstanding. Because FinCEN classified these issues as routine, 

FinCEN planned to consider the proposed changes in the upcoming 

BSAR update and renewal cycle. FinCEN stated that it plans to 

obtain stakeholder input on these issues to determine if the 

proposed changes should be made. 

Filers Failed to Provide Responses in Many Critical Data Fields 

Our review found many BSARs where filers did not enter a 

response in one or more critical institutional or subject related data 

fields or justify the non-responses where appropriate. These types 

of non-responses primarily impacted batch filed BSARs as nonresponses in discrete filings were minimal, due to FinCEN’s controls 

that required entries for most of these data fields. The data field 

with the highest number of non-responses was the prior document 

number, a field designed for filers to provide the unique number 

assigned by FinCEN to each BSAR previously uploaded to FinCEN’s 

SOR.

14 Table 2 below identifies the counts of BSARs that had the 

highest number of non-responses in the critical data fields. 

14 The prior document number data field was designed for the filer to enter the BSA ID or older 

Document Control Number assigned to prior filings that the new submission was intended to correct 

or amend, or was submitted to continue to report on the same activity. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 12

Table 2: Critical Data Fields with Highest Volumes of Non-Responses

Field Description

# of BSARs

With NonResponses

Prior Document Number 105,099

Suspicious Activity Amount Involved 21,012

Subject Identification – Issuing Country 13,519

Subject - State 7,696

Subject - Country 6,509

Financial Institution Location - Legal Name 4,867

Financial Institution - Contact Office 4,749

Financial Institution - Name 4,665

Subject - Last Name 4,458

Subject - Date of Birth 4,438

Subject - First Name 4,299

Type of Suspicious Activity 2,510

Financial Institution Location-Institution Type 1,273

Source: OIG analysis of BSAR data.

For certain critical data fields such as the institution name, or the 

type of suspicious activity that was the basis for the filing, FinCEN 

expected responses to be provided by the filer. For many of the 

other critical data fields, FinCEN provided mechanisms for filers to 

justify non-responses if the values were unknown. For example, for 

nine critical subject data fields, FinCEN’s filing requirements stated 

that filers are to activate checkboxes to indicate cases where the 

subject values are unknown. FinCEN considered non-responses to 

be valid when identified as unknown in the accompanying 

checkboxes. 

Non-responses found in critical institutional data fields such as the 

name, institution type or contact office as well as the type of 

suspicious activity being reported is troubling in that data for these 

fields should always be known to the filer. The non-responses 

identified in our results point to filer uncertainty in entering BSAR 

information or simple carelessness in completing the submissions, 

factors that if fully addressed by FinCEN, would improve data 

quality. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 13

Invalid Filer Responses Diminished Data Quality 

Our review also found issues with filer responses to many critical 

data fields such as the examples described below. 

 Suspicious Activity Type: 135,152 BSARs where the filer

selected “other” for the suspect activity type, and entered

words in the associated “other suspect activity description”

data field that did not meet FinCEN’s standard for a brief

description of the activity or were specifically prohibited by

FinCEN filing requirements and guidance.

 Financial Institution Address: 27,597 BSARs with a post

office box entered for the filing institution address. A number

of these responses included a street address after the post

office box entry in the institution address field.15 FinCEN’s

filing requirements prescribe that a post office box or rural

route number should only be used if no other street address

information is available. We researched street addresses for

18 of the filers with the highest number of post office box

entries included in the institution address field. We found

street addresses for each of the 18 filers, comprising 16,852

submissions.

 Financial Institution Name: 17,920 BSARs where filers failed

to provide a valid response for the financial institution name.

In many cases, filers provided the institution’s address in this

field or entered a generic response such as “Main Office” or

“Financial Institution”, that were not the actual name of the

institution. This was a concern since the filers should always

be able to provide accurate responses for this critical data

field.

 Prior Document Number: 13,719 BSARs where filers failed

to provide a valid prior document number or properly indicate

that the value was unknown when filing corrected or

15 FinCEN’s address enhancement tool often removed the street address values when attempting to 

standardize filer responses in the enhanced address data field. The filer’s original address responses 

and FinCEN’s enhancements are both retained in the SOR. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 14

amended BSARs or BSARs to continue reporting on 

previously reported activities. 

According to Government Accountability Office’s (GAO) Standards 

for Internal Control in the Federal Government “management 

obtains relevant data from reliable internal and external sources in a 

timely manner based on the identified information requirements...

Reliable internal and external sources provide data that are 

reasonably free from error and bias and faithfully represent what 

they purport to represent.”16 When filers provide responses not in 

line with the purpose of the values that FinCEN intended in its data 

collection efforts, the overall quality and usefulness of the BSAR 

data is diminished. 

FinCEN filing requirements also prescribe how filers are to complete 

many of the critical data fields included in the BSAR. These 

requirements also instruct filers on values that should not be used 

such as “see narrative” or “same as above” in text fields, as well 

as certain terms or words that are prohibited. FinCEN’s goal is for 

filers to provide consistent responses that are accurate, useful to 

the user community, and properly entered in the data fields 

designed to capture the information. In some cases, FinCEN’s 

instructions include the options available to filers on how to 

respond when information is unknown or not applicable. Rather 

than entering a response that is of limited or no value such as “do 

not know”, “not applicable”, or “not sure”, FinCEN includes several 

checkboxes to be used when data is unknown in critical data 

fields. 

We believe that while FinCEN’s BSAR and electronic filing mandate 

have contributed to both the volume of responses received and the 

number of responses deemed valid, FinCEN needs to continue to 

identify areas of concern such as unjustified omissions, nonresponses, and invalid entries, and work with filers to further 

improve data quality. 

16 GAO, Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1); issued Nov. 

1999. GAO’s September 2014 revision (GAO-14-704G), which became effective in 2016, also 

includes these requirements. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 15

Recommendations

We recommend that the Director of FinCEN: 

1. Address areas for which additional filer education is needed for

specific instances or systemic errors identified with specific

filers or the filer community to reduce invalid and nonresponses, including guidance on the mechanics for proper

reporting of data fields for which the values requested are

unknown.

Management Comments: 

FinCEN management concurred with the recommendation. 

According to management’s response, FinCEN follows a data 

quality standard operating procedure and provides appropriate 

outreach and engagement with filers who have demonstrated 

systemic errors. 

OIG Comment: 

FinCEN’s actions meet the intent of our recommendation.

2. Implement controls in FinCEN’s validation edits that

systemically identify batch filed BSARs that do not include a

subject address or institution branch sub-record when these

records are expected.

Management Comments: 

FinCEN management concurred with the recommendation. 

According to management’s response, FinCEN assesses data 

quality through its standard operating procedure process and 

reaches out to filers appropriately. Within this process, FinCEN 

continuously reviews and prioritizes data validations as well as 

form instructions through data management. Putting validation 

as a first priority requires rejecting batches which may contain 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 16

highly valuable data with only a few errors or omissions, and 

FinCEN does not want to do this. As such, FinCEN has 

implemented controls since the inception of this audit to 

systematically review data quality. As part of its current SAR 

data quality assessment process, FinCEN’s Data Quality & 

Metrics Section quarterly report identifies all institutions that 

filed BSARs with a missing subject address or institution branch 

address. When this quarterly SAR error report identifies 

institutions where such errors appear to be systemic, a formal 

data quality assessment is conducted to verify that it is 

systemic and to search for other errors in the BSARs. When 

systemic errors are verified, a formal assessment document is 

prepared and sent to FinCEN’s Liaison Division, which then 

conducts outreach to the financial institution to have the errors 

corrected. FinCEN later conducts follow-up assessments to 

verify that the cited errors have been corrected. According to 

FinCEN management this process has greatly reduced missing 

data. In addition, FinCEN will continue to use its data 

management process to regularly review and prioritize form field 

edit and validation requirements when forms are updated or 

changed. 

OIG Comment: 

FinCEN’s actions meet the intent of our recommendation. In 

January 2017, FinCEN officials stated that a system change 

was proposed to its validation process to alert filers when a 

batch filed BSAR did not include a subject address or institution 

branch sub-record. FinCEN planned to consider the proposed 

change in the upcoming BSAR update and renewal cycle. With 

that said, during our exit meeting, a FinCEN official stated that 

rejecting an entire batch of BSARs that may contain a few 

errors in the subject address or institution branch fields may 

result in FinCEN losing valuable timely data that would be 

beneficial for its law enforcement partners. We agree with 

FinCEN that an entire batch of BSARs should not be rejected for 

containing a few errors in the subject address or institution 

branch fields. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 17

Finding 2 Inconsistent and Incomplete Filer Responses Continued to 

Impact Data Quality 

FinCEN’s implementation of the BSAR and electronic filing mandate 

have focused on requiring filers to provide responses to critical data 

fields, and, for many data fields, justifying non-responses when the 

information is unknown or not applicable. Our analyses, however, 

found inconsistent and incomplete responses provided by filers, as 

well as numerous responses in critical data fields that, while not

classified as invalid, were examples of poor quality reporting, often 

not in conformance with FinCEN filing requirements and guidance, 

and of limited value to users. 

The filer responses entered in the critical data fields as well as 

information included in other related fields on the BSAR, indicated 

that, in some cases, it was likely that the values were known to 

the filers but were not provided. For example, we noted responses 

where the filers provided information on the city, state and zip 

code, but did not provide a value in the country code, in some 

cases, indicating the country was unknown. In other cases, the 

filers provided the institution name with a “Doing Business As” 

designation in place of the institution name or the filers entered 

responses such as “See Narrative” or “See Above.” Clearly the 

filers could have provided appropriate responses in these fields 

since the filings originated from the financial institutions. 

Inconsistent Responses in Critical Data Fields Impedes Data Quality 

Our analysis identified inconsistencies in filer responses for all of 

the critical data fields evaluated. Inconsistencies found included 

spelling and transposition errors entered by filers, along with 

inappropriate use of abbreviations and special characters or 

designations prohibited by FinCEN. Inconsistent responses degrade 

the overall quality and usefulness of BSAR data. 

GAO defines consistency as “data that are clear and well defined 

enough to yield similar results in similar analyses.” “If data are 

entered at multiple sites, inconsistent interpretation of data entry 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 18

rules can lead to data that, taken as a whole, are unreliable.”17

When filers do not enter responses in critical data fields

consistently or fail to adhere to FinCEN filing requirements 

regarding responses that are prohibited, the quality and reliability of 

the BSAR data is diminished. 

Basic information relating to the filer is included in the institution 

level information of the BSAR, and is designed to identify the filer’s 

location, and how to contact the filer if needed. We expected some 

measure of consistency in responses for filing institution data as 

opposed to subject related data fields where the filer may not know 

the precise information about the subject. Our review, however, 

noted issues with responses in all areas of BSAR data provided by 

filers that we believe could be improved. 

For example, our analysis of 12,654 BSARs filed by one institution 

over the 12 month period evaluated, revealed that the filer spelled 

the name of the financial institution 85 different ways, including 

several misspellings of the institution’s name. We also found 

numerous errors and inconsistencies in this filer’s responses for the 

institution’s address, city, state, and zip code, as well as 8 

variations in the institution TIN provided. Although we did not 

consider most of these responses to be erroneous, the 

inconsistencies degraded the quality of the data on FinCEN’s SOR

and could have been avoided. Inconsistent responses in 

institutional level data could also make it difficult for users to 

accurately determine the number of BSARs filed by an institution. 

We also found many responses provided in the institution 

telephone contact number data field to be inconsistent with the 

telephone number format required by FinCEN filing requirements. 

For example, we identified 24,410 entries where the institution 

telephone contact number provided a “1”, along with the area code 

and telephone number. These responses were inconsistent with 

FinCEN filing requirements which instructed filers to provide only 

the area code and seven-digit telephone number for North America 

locations. 

17 GAO, Assessing the Reliability of Computer-Processed Data (GAO-09-680G); issued July 2009. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 19

Our review of the field designed to capture the name of the filing 

institution’s contact office found 6,742 filings that included a 

telephone number in this field rather than the name of the contact 

office. There were 1,491 filings where the filer entered responses 

in this field such as “See Above” or “Same as 92”, referencing filer 

responses entered in other BSAR data fields. In these cases, 

because of the responses provided, the filer had the information to 

provide an accurate response but failed to enter the information as 

instructed. 

Another example of inconsistent responses was found in our 

analysis of the institution and subject city data fields. Our review 

identified numerous variations in the responses provided for the 

same city values. Responses such as “St. Louis”, “STL”, “PHX”, 

“Vancouver/BC”, and “NYC” were found in some submissions, 

while other submissions for these same locations included values 

such as “Saint Louis”, “Vancouver”, “Phoenix”, and “New York”, 

or other variations of these values. FinCEN’s filing requirements 

instruct filers not to use abbreviations and prohibits the use of 

special characters such as a period or a slash in responses. Despite 

FinCEN’s requirements, we found special characters or 

abbreviations entered in responses to many data fields in the 

BSARs reviewed. While the intended value of many of these 

responses could be derived from the filer provided information, 

these inconsistencies make it more difficult for users of the data to 

retrieve and analyze the data. 

The quality of filer responses in both institution and subject address 

data fields were of particular concern. Our review identified 

numerous instances where the filers’ responses were incomplete, 

which limited the value of the information. For example, we found 

entries where the address provided was listed as a shopping 

center, or included the business name along with an address or 

portion of an address. In other examples, we found subject or 

institution address entries such as “112 B”, “114 S” and “US 

25E.” It appeared from these responses that the filer was aware of 

the address values, but failed to provide full responses. 

Critical data fields such as the institution or subject address require 

added filer attention to provide the best possible responses unlike 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 20

state or country fields which have limited responses that can be 

entered. The use of prohibited abbreviations, special characters, 

different naming conventions, and incomplete addresses are 

examples of issues with responses that could be avoided. 

FinCEN’s filing requirements provide filers with instructions on how 

to enter responses for data fields, including those fields that do not 

have a finite set of values. When filers fail to adhere to FinCEN 

instructions, the quality and the usefulness of the BSAR data is 

degraded and more difficult to use. FinCEN officials stated that 

they were aware of consistency issues in filer responses and that 

although FinCEN’s validation testing does not assess responses to 

all critical data fields for consistency, if the condition is noted 

during FinCEN quality assurance reviews, FinCEN will instruct the 

filer to correct the issues in future filings. FinCEN performs followup studies on specific financial institutions to determine if identified 

problems have been corrected. 

FinCEN’s Enhancement Tool Was Used to Normalize Address 

Related Responses 

FinCEN implemented an enhancement tool, using a commercial, 

off-the-shelf software package designed to normalize filer 

responses included in certain critical data fields such as the

address, city, state, zip code, and country values for both 

institution and subject related information. The enhanced values 

were stored on FinCEN’s SOR along with the original filer 

responses. The enhancements included capitalization of all entries, 

updates of abbreviations to full wording, and correction of certain 

inaccuracies in filer reporting, such as the use of an incorrect zip 

code for the city and state reported. 

We identified cases in which valid filer responses were updated in 

the enhanced data fields to incorrect values. For example, in one 

instance, a filer correctly reported an institution’s address in 

Canada. FinCEN’s enhancement process, however, incorrectly 

modified the state and zip code supplied by the filer, to values 

associated with the state of Iowa, and modified the enhanced 

country code to the United States. While both the original 

responses and enhanced fields were available to users, updates 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 21

such as this make it difficult to determine which pieces of 

information are correct. In another case, the software correctly 

enhanced an invalid response in the subject city field to “Houston” 

but updated the country code for these same records from “US” to 

“UN”. 

FinCEN officials noted that while inaccurate enhanced values in its 

SOR could be manually corrected, FinCEN does not control how the 

software package evaluates address entries. FinCEN relied on the 

values reported by filers and the enhancement methodology in the 

vendor package. While we recognize the value of FinCEN’s efforts 

to enhance and normalize filer responses, increased emphasis on 

FinCEN’s outreach to filers to provide better quality responses to all 

critical data fields, would further improve overall BSAR data quality 

along with FinCEN’s address enhancements. 

Recommendation

3. We recommend that the Director of FinCEN develop a

methodology to systemically identify inconsistent and incomplete 

filer responses in critical data fields for all filings, and identify filers 

with systemic issues and notify them as deemed appropriate. 

Management Comments: 

FinCEN management concurred with the recommendation. As part 

of its current SAR data quality assessment process, FinCEN’s Data 

Quality & Metrics Section quarterly report identifies all institutions 

where errors appear to be systemic. A formal data quality 

assessment is conducted to verify that it is systemic and to search 

for other errors in the BSARs. When systemic errors are verified, a 

formal assessment document is prepared and sent to FinCEN’s 

Liaison Division, which then conducts outreach to the financial 

institution to have the errors corrected. FinCEN later conducts 

follow-up assessments to verify that the cited errors have been 

corrected. According to FinCEN management, this process has 

greatly reduced missing data. In addition, FinCEN will continue to 

use its data management process to regularly review and prioritize 

form field edit and validation requirements when forms are updated 

or changed. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 22

OIG Comment: 

FinCEN’s actions meet the intent of our recommendation. FinCEN’s 

data quality assessment and data management process 

demonstrate FinCEN’s commitment to data quality. 

Finding 3 Certain Controls Over BSAR Processing Were Weak 

FinCEN controls did not ensure filers provided the prior BSA 

document number when submitting new BSARs intended to correct 

or amend prior filings, or to continue reporting on suspicious 

activities. In addition, FinCEN did not ensure batch filers resubmitted BSARs when required to do so, and its BSA E-Filing 

System inappropriately accepted space bar entries as valid 

responses for certain critical data fields. 

BSARs to Correct or Amend Prior Filings or to Continue Reporting 

on an Activity Were Accepted Without Prior Document Numbers. 

Our analysis found that, contrary to FinCEN filing requirements, 

105,099 BSARs filed to amend or correct prior submissions, or 

filed to continue reporting on suspicious activities, did not include 

any value for the prior document number data field. There were 

18,504 of these BSARs that were discrete filings while the 

remaining 86,595 BSARs were batch filed. Without the document 

number assigned to the prior filing, FinCEN could not link the new 

submissions with the prior filings in the SOR. 

FinCEN assigns a BSA ID to each BSAR uploaded to the SOR. For 

batch filings, BSA IDs are included in acknowledgement records 

returned to the filers to confirm FinCEN’s acceptance of their 

submissions. For discrete filings, the BSA ID number is provided to 

filers once each record has been accepted for inclusion in FinCEN’s

SOR. 

FinCEN filing requirements require filers to provide either the BSA 

ID or older Document Control Number assigned to the prior filing in 

the prior document number data field when submitting a BSAR to 

correct or amend a prior filing, or to continue reporting on a 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 23

suspicious activity.18 The prior document numbers help FinCEN and 

users of BSA data link BSAR filings associated with the same 

activity reported in prior filings. Filers are also instructed to enter all 

zeros for this data element if the previously assigned document 

number is unknown. 

We analyzed the 105,099 BSARs submitted to correct or amend 

prior submissions or to continue reporting on suspicious activities, 

in which the filers did not provide a response in the prior document 

number data field. We found that FinCEN was unable to link any of 

the 105,099 submissions to prior filings. Conversely, our review of 

165,630 BSAR filings where a prior document number was 

provided by the filer, we found that FinCEN was able to link 

147,334 of these submissions to the prior BSAR filings. For the 

remaining 18,296 submissions, we found that filers did not provide 

a valid BSA ID, entered older Document Control Numbers no longer 

in use, or included only a “0”, denoting that the prior document 

number was unknown to the filer. 

FinCEN’s validation edits over discrete filed BSARs did not include 

edit checks to ensure filers provided a valid response for the prior 

document number data field when filing BSARs to continue 

reporting on previously reported suspicious activity.19 FinCEN 

officials acknowledged that this deficiency existed in the BSA EFiling System during the audit period, and reported that a system 

modification to require an entry in the prior document number field 

was implemented in July 2016. 

FinCEN’s validation process for batch filed BSARs did not include 

edits for the prior document number data field to identify improper 

reporting conditions and alert filers of the deficiencies. FinCEN’s 

policy was not to reject batch files that include errors such as non18 For BSAR submissions associated with older filings, filers can enter Document Control Numbers that 

were used by FinCEN prior to the introduction of BSA IDs. 

19 Our testing determined that a response in the prior document number field was required for discrete 

filed BSARS submitted to correct or amend prior filings. Despite this control, our analyses identified 

1,014 discrete filed BSARs correcting prior submissions with no entry in the prior document number 

field. It was unclear if blank spaces were entered in this field to circumvent controls in the BSA EFiling System which require an entry be made. The 1,014 BSARs are included in the count of 18,504 

BSARs with no prior document number previously noted. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 24

responses or invalid entries in the prior document number data 

field. 

FinCEN Did Not Ensure that Batch Filers Submitted BSARs to 

Correct Prior Submissions Found to Have Primary Errors 

As part of FinCEN’s load process, responses in many critical data 

fields included in batch filed BSARs are evaluated to determine if 

responses were provided, and in many cases, to determine the 

validity of the responses. FinCEN classifies errors noted in filer 

responses as primary and secondary level filing errors.20

Information on the results of FinCEN’s validation of batch filed 

BSARs uploaded to the SOR is provided to the filers in 

acknowledgement records. 

FinCEN’s filing requirements state that primary errors in BSAR 

filings are errors that violate electronic filing requirements or 

instructions and so degrade the quality of suspicious activity report 

data that they must be corrected. FinCEN further recommends that 

corrections be made no later than within 30 days of filers receiving 

error notifications.21 The requirements also note that FinCEN 

monitors filings to identify financial institutions that fail to correct 

primary errors or prevent previously reported errors of any type in 

future filings and that FinCEN may report such failures to the 

financial institution’s primary regulator or BSA examiner.

Interviews with FinCEN officials determined that FinCEN had no 

mechanism in place to ensure that filers comply with resubmission 

requirements for BSARs with primary errors. While FinCEN 

instructs filers that they are required to correct submissions, 

FinCEN did not systemically evaluate subsequent submissions to 

determine if corrected BSARs were submitted and the issues 

resolved. 

20 Examples of primary errors include the failure to provide a valid primary Federal regulator code, a 

subject last name, or TIN, unless the subject values are unknown. Secondary errors are responses 

that violate FinCEN’s electronic filing requirements or instructions, but have a lesser impact on the 

quality of suspicious activity report data. Secondary errors include zip codes that end in four zeros, 

missing dates of birth, or invalid telephone numbers. 

21

 All secondary errors noted in filings with primary errors must also be corrected by filers. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 25

In accordance with its requirements, FinCEN should establish a 

mechanism for monitoring filer compliance with BSAR resubmission 

requirements to ensure corrections are made timely, non-compliant 

filers are identified, and corrective actions taken. 

Controls Over Discrete Filings Allowed Space Bar Entries as Valid 

Responses for Certain Critical Data Fields 

Our testing of FinCEN’s public BSA E-Filing User Test System

found that for 11 critical data fields, the test system accepted 

space bar entries as valid responses.22 For example, we attempted 

to simulate submission of a discrete BSAR with no entry in the 

Subject First Name data field. The test system returned an error 

message indicating that an entry was required for this field unless 

the “Subject First Name Unknown” checkbox was activated by the 

filer. When we entered one or more spaces as the response in the 

Subject First Name data field, the value was accepted as a valid 

response. We found similar results in our testing of 10 other critical 

data fields.23 

FinCEN’s controls for the BSA E-Filing System were designed to 

require filers to enter responses in the 11 critical data fields tested, 

or, where applicable, require filers to indicate that the piece of 

information requested was unknown. We believe that the 

acceptance of space bar entries as valid responses is contrary to 

FinCEN’s intent for these data fields, as well as FinCEN’s filing 

requirements instructing filers on how to report unknown values. 

FinCEN officials were unaware of this system defect but confirmed 

that FinCEN’s BSA E-Filing System used by financial institutions 

had the same controls in place as found on the test site. The 

officials agreed that the controls for the BSA E-Filing System

allowed filers to use space bar entries as valid responses for the 

critical data fields tested by OIG. FinCEN officials stated that a 

system modification was implemented in July 2016 preventing 

22 FinCEN’s BSA E-filing User Test System is designed for users to familiarize themselves with the 

information needed to submit BSARs and is designed to work in the same fashion as the BSA E-Filing 

System. 

23 These data fields included the filing institution name, address, city, and contact office, the institution 

location legal name, address, and city, and the subject’s last name, address, and city. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 26

space bar entries from being accepted as valid responses in critical 

data fields by the BSA E-Filing System. We were unable to verify 

FinCEN’s corrective action regarding this issue since we could not 

access the BSA E-Filing System. We did, however, note that 

FinCEN’s BSA E-Filing User Test System continued to accept blank 

space entries as valid responses as of our January 2017 update. 

Recommendations

We recommend that the Director of FinCEN: 

4. Implement controls to ensure that BSARs where a valid

response is not provided in the prior document number field are

systemically identified as errors by FinCEN and filers are notified

of this condition.

Management Comments: 

FinCEN management concurred with the recommendation. As 

part of its current SAR data quality assessment process, 

FinCEN’s Data Quality & Metrics Section quarterly report 

identifies all institutions where errors appear to be systemic. A 

formal data quality assessment is conducted to verify that it is 

systemic and to search for other errors in the BSARs. When 

systemic errors are verified, a formal assessment document is 

prepared and sent to FinCEN’s Liaison Division, which then 

conducts outreach to the financial institution to have the errors 

corrected. FinCEN later conducts follow-up assessments to 

verify that the cited errors have been corrected. According to 

FinCEN management this process has greatly reduced missing 

data. In addition, FinCEN will continue to use its data 

management process to regularly review and prioritize form field 

edit and validation requirements when forms are updated or 

changed. 

OIG Comment: 

FinCEN’s actions meet the intent of our recommendation. 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 27

5. Implement controls to identify and track BSAR filings with

primary errors and determine if filers comply with FinCEN policy

requiring correction and resubmission. FinCEN should take

action, where appropriate, against filers that fail to comply with

FinCEN’s resubmission policy.

Management Comments: 

FinCEN management concurred with the recommendation. As 

part of its current SAR data quality assessment process, 

FinCEN’s Data Quality & Metrics Section quarterly report 

identifies all institutions where errors appear to be systemic. A 

formal data quality assessment is conducted to verify that it is 

systemic and to search for other errors in the BSARs. When 

systemic errors are verified, a formal assessment document is 

prepared and sent to FinCEN’s Liaison Division, which then 

conducts outreach to the financial institution to have the errors 

corrected. FinCEN later conducts follow-up assessments to 

verify that the cited errors have been corrected. According to 

FinCEN management this process has greatly reduced missing 

data. In addition, FinCEN will continue to use its data 

management process to regularly review and prioritize form field 

edit and validation requirements when forms are updated or 

changed. 

OIG Comment: 

FinCEN’s actions meet the intent of our recommendation. 

During our exit meeting, FinCEN’s Intelligence Research 

Specialist explained that the filers with systemic filing issues are 

dealt with through FinCEN’s data quality studies. He stated that 

for filers with systemic problems, including primary errors, he

contacts the filers to reaffirm the need for them to refile. During 

our exit meeting, FinCEN officials told us that developing a 

system control to identify and track BSAR filings with primary 

errors and determine if filers comply with FinCEN policy 

requiring correction and resubmission would require weighing 

the costs of establishing such a system against the actual 
The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 28

benefits of capturing even the most minor errors, given that 

FinCEN finds its existing protocols sufficient. 

* * * * * *

We appreciate the cooperation and courtesies extended to our staff 

during the audit. If you wish to discuss the report, you may 

contact me at (617) 223-8638. Major contributors to this report 

are listed in appendix 4. A distribution list for this report is included 

as appendix 5. 

/s/ 

Sharon Torosian

Director, Manufacturing and Revenue
Appendix 1 

Objective, Scope, and Methodology 

The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 29

The objective of this audit was to determine if the Financial Crimes 

Enforcement Network’s (FinCEN) implementation, in March 2012, 

of the universal suspicious activity report (BSAR) and FinCEN’s 

April 2013 mandate that all of these reports be filed electronically 

has helped the quality of the suspicious activity report data 

provided by filers. 

To accomplish our objective, we interviewed FinCEN officials and 

reviewed FinCEN policies, procedures, filing requirements, and 

other guidance to gain an understanding of processes and 

procedures used to receive, process, and disseminate BSAR 

information to users, and to evaluate the quality of the filer 

provided data. To determine if BSAR data was meeting the needs 

of stakeholders, we interviewed representatives from the Internal 

Revenue Service-Criminal Investigation Division, United States 

Secret Service, United States Immigration and Customs 

Enforcement, and the Federal Bureau of Investigation. We also 

interviewed representatives from the Office of the Comptroller of 

the Currency regarding the quality of BSAR data. 

To assess the quality of BSAR data provided by filers, we obtained 

information on more than 1.75 million BSARs, received at FinCEN 

from May 1, 2013 through April 30, 2014, submitted in batch files 

and through FinCEN’s Bank Secrecy Act (BSA) E-Filing System, and 

stored on FinCEN’s system of record (SOR) for BSA data. This 

information included all BSAR data fields included in filer

submissions, in the same format that FinCEN distributed to law 

enforcement agencies that use bulk BSAR data generated from 

FinCEN’s SOR.

24

 

For the BSARs included in our population, we examined filer 

responses included in 39 of 42 data fields deemed critical by 

FinCEN that required a filer response in FinCEN’s on-line BSA E24 The Federal Bureau of Investigation, Internal Revenue Service-Organized Crime and Drug 

Enforcement Task Force Fusion Center, United States Immigration and Customs Enforcement, and 

the United States Secret Service obtain bulk BSAR data from FinCEN. These agencies also have 

access to BSA data in FinCEN’s SOR.
Appendix 1 

Objective, Scope, and Methodology 

The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 30

Filing System.

25 The 39 data fields were associated with the 

financial institution, the subject(s) associated with the suspicious 

activity, the nature of the suspicious activity, and the filer’s 

narrative description of the activity. We examined the content of 

the critical data fields to identify the number of omissions and to 

assess the quality of the responses provided by filers. 

In assessing omissions in filer responses, we evaluated the purpose 

of each data field along with any associated fields used to indicate 

that the information for the field in question was unknown or 

unavailable to the filer. We also assessed filer responses included in 

certain fields of required sub-records to determine if optional subrecords should have been provided by the filer. We considered all 

fields in the optional sub-records to be unjustified omissions when 

the filer should have included one or more optional sub-records in 

the submissions, based on responses to other key data fields in 

required records. We did not assess non-responses in the subject 

TIN data field because the values in the associated “Subject TIN 

Unknown” data field included in the extract files provided by 

FinCEN was not reliable.26 As a result, we could not determine 

when non-responses in the subject TIN data field were justified. 

In assessing the quality of the 39 critical data fields, we applied 

standards for appropriate responses included in FinCEN’s BSAR 

filing instructions and other FinCEN publications. For example, in 

assessing the quality of BSAR narratives, we used FinCEN’s 

standard that an acceptable BSAR narrative should be 50 or more 

characters.27 For responses included in the institutional and subject 

TIN fields, we assessed the values in the responses that were 

provided to information on TIN numbering sequences found in 

Social Security Administration and Internal Revenue Service 

25

 We did not evaluate filer responses in three data fields for Taxpayer Identification Number (TIN) type 

values for the reporting financial institution, institution location where the suspicious activity 

occurred, and each subject, because we were unable to validate if the proper TIN type values were 

entered.

26 FinCEN’s process used to generate the extract files used for our audit, in many cases, incorrectly 

populated the Subject TIN Unknown field with a blank indicating that the Subject TIN was known. 

FinCEN’s system of record, however, correctly displayed the filer response for this field certifying 

that the Subject TIN was unknown. 

27 Financial Crimes Enforcement Network Standard Operating Procedures: Suspicious Activity Report 

and Currency Transaction Report Data Quality Studies (July 2014).
Appendix 1 

Objective, Scope, and Methodology 

The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 31

guidelines. Other criteria used for assessing the quality of data 

included external data sources as well as state, country, and zip 

code tables identified on FinCEN’s web site for the validation of 

values in the individual fields and logical combinations of the 

responses in these combined fields. For the review of telephone 

numbers, we assessed the area codes reported for U.S. locations 

against data from the North American Numbering Plan.28 

We performed our fieldwork from May 2014 to January 2016 with 

subsequent follow up through January 2017. 

We conducted this performance audit in accordance with generally 

accepted government auditing standards. Those standards require 

that we plan and perform the audit to obtain sufficient, appropriate 

evidence to provide a reasonable basis for our findings and 

conclusions based on our audit objectives. We believe that the 

evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives. 

28 The North American Numbering Plan is an integrated telephone numbering plan serving 20 countries 

and territories primarily in North America and the Caribbean. 
Appendix 2 

Summary Statistics on Review of Critical Data Fields in BSARS Received at 

FinCEN: May 2013 through April 2014 

The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 32

Field Description

BSARs

With 

Invalid

Responses

Percent

Of BSARs 

With Invalid

Responses1

Percent 

Batch

Percent

Discrete

Financial Institution Branch-Country 173,422 9.90% 99.92% 0.08%

Type of Suspicious Activity 135,152

36 

7.72% 81.35% 18.65%

Prior Document Number 118,818 6.79% 84.35% 15.65%

Subject-State 60,495 3.45% 89.50% 10.50%

Subject-City 56,033 3.20% 98.12% 1.88%

Subject-Country 55,083 3.15% 98.00% 2.00%

Subject-Zip Code 52,026 2.97% 96.38% 3.62%

Subject-Address 50,355 2.88% 99.20% 0.80%

Financial Institution Location-Institution Type 35,176 2.01% 67.77% 32.23%

Subject-Financial Institution Account Number 35,092 2.00% 97.30% 2.70%

Subject-Financial Institution Taxpayer Identification Number 33,265 1.90% 99.94% 0.06%

Subject-Identification Type 28,763 1.64% 95.68% 4.32%

Financial Institution-Name 22,585 1.29% 93.26% 6.74%

Suspicious Activity Amount Involved 21,012 1.20% 66.41% 33.59%

Subject Taxpayer Identification Number 19,865 1.13% 79.94% 20.06%

Financial Institution-Address 17,053 0.97% 66.96% 33.04%

Financial Institution-Contact Office 15,678 0.90% 36.22% 63.78%

Subject Identification-Issuing Country 14,343 0.82% 97.79% 2.21%

Financial Institution-Institution Type 13,930 0.80% 11.84% 88.16%

Subject-Date of Birth 10,934 0.62% 80.09% 19.91%

Financial Institution Location-Address 8,225 0.47% 74.55% 25.45%

Subject-First Name 7,367 0.42% 81.92% 18.08%

Financial Institution Location-Taxpayer Identification 

Number

6,594 0.38% 69.78% 30.22%

Subject-Last Name 5,797 0.33% 74.50% 25.50%

Financial Institution Location-Legal Name 5,246 0.30% 67.40% 32.60%

Financial Institution Location-Regulator 4,957 0.28% 89.37% 10.63%

Financial Institution-Contact Office Phone Number 3,528 0.20% 60.57% 39.43%

Financial Institution-Regulator 3,426 0.20% 83.80% 16.20%

Suspicious Activity Narrative 2,754 0.16% 16.92% 83.08%

Financial Institution-Taxpayer Identification Number 2,415 0.14% 50.93% 49.07%

Financial Institution Location-City 1,412 0.08% 76.20% 23.80%

Financial Institution Location-Country 1,070 0.06% 86.54% 13.46%

Financial Institution Location–Zip Code 994 0.06% 46.18% 53.82%

Type of Filing (Corrected, Amended, Continuation) 653 0.04% 84.07% 15.93%

Financial Institution-State 400 0.02% 98.75% 1.25%

Financial Institution-City 362 0.02% 35.08% 64.92%

Financial Institution-Zip Code 354 0.02% 41.24% 58.76%

Suspicious Activity Start Date 244 0.01% 55.74% 44.26%

Financial Institution-Country 242 0.01% 53.72% 46.28%

Source: OIG analysis of BSAR data. 

Note 1: The number of BSARs identified with errors or omissions in each critical data field divided by the population of 

1,751,166 BSARs evaluated.
Appendix 3 

Management Response 

The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 33
Appendix 3 

Management Response 

The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 34
Appendix 3 

Management Response 

The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 35
Appendix 3 

Management Response 

The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 36
Appendix 4 

Major Contributors to This Report 

The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 37

Kenneth Dion, Audit Manager 

Jenny Hu, Auditor-In-Charge 

James Shepard, Auditor 

Kevin Guishard, Referencer 
Appendix 5 

Report Distribution 

The Universal Suspicious Activity Report and Electronic Filing Have 

Helped Data Quality But Challenges Remain (OIG-18-041) Page 38

The Department of the Treasury

Counselor to the Secretary 

Under Secretary, Office of Terrorism and Financial Intelligence 

Office of Strategic Planning and Performance Improvement 

Office of the Deputy Chief Financial Officer, Risk and Control 

Group 

Financial Crimes Enforcement Network

Director 

OIG Audit Liaison 

Office of Management and Budget

OIG Budget Examiner 

U.S. Senate 

Chairman and Ranking Member 

Committee on Banking, Housing, and Urban Affairs 

Chairman and Ranking Member 

Committee on Finance 

U.S. House of Representatives 

Chairman and Ranking Member 

Committee on Financial Services 
This Page Intentionally Left Blank 
Treasury OIG Website 

Access Treasury OIG reports and other information online: 

http://www.treasury.gov/about/organizational-structure/ig/Pages/default.aspx

Report Waste, Fraud, and Abuse 

OIG Hotline for Treasury Programs and Operations – Call toll free: 1-800-359-3898 

Gulf Coast Restoration Hotline – Call toll free: 1-855-584.GULF (4853) 

Email: Hotline@oig.treas.gov

Submit a complaint using our online form: 

https://www.treasury.gov/about/organizational-structure/ig/Pages/OigOnlineHotlineForm.aspx