Bitcoins and SAR Narratives

You probably know about Bitcoin, unless you have been living in total seclusion for the last few years. The big controversy usually centers on determining if it is legal tender. But imagine if you are confronted with a transaction involving Bitcoin. Do you file a Suspicious Activity Report (“SAR”)?  

It so happens that the Financial Crimes Enforcement Network (“FinCEN”) has been giving that very concern laser-like attention! In July 2014’s “SAR Stats,” FinCEN observed that the “rapid adoption and price fluctuation of Bitcoin” has put convertible virtual currencies in the spotlight over the past year.[1] The same attributes of virtual currencies that attract lawful users, such as the capacity for anonymity as well as their speed and global reach, attract criminal actors engaged in illicit financing. FinCEN is observing a rise in the number of SARs flagging virtual currencies as a component of suspicious activity. Bitcoin is considered one of the “emerging payment methods.” Consequently, it is important to understand virtual currencies in order to properly complete the SAR Narrative. 

So let’s define Bitcoin. 

Bitcoin is a type of virtual currency. It is also known as a crypto-currency or a math-based currency or digital currency. A virtual currency is considered “decentralized” because it allows users to conduct transactions peer-to-peer without a central administrator. It is a software-based payment system described by one Satoshi Nakamoto in 2008,[2] and introduced as open-source software in 2009. Payments are recorded in a “public ledger” using its own unit of account, which naturally is also called Bitcoin. Payments work peer-to-peer without a central repository or single administrator - which has led the US Treasury to call Bitcoin a “decentralized virtual currency.”[3]  

In keeping with the general architecture of the Internet, transactions and new currency issuances are conducted without a central administrator or trusted third party. Instead, as an open-source software, its protocol links users into a network that: (1) secures the network from attack; (2) broadcasts transactions; (3) verifies and settles transactions; (4) issues new currency; and (5) publishes new transactions to a shared, “distributed ledger of all transactions” called the “block chain.”[4] The rate of coin creation, the total Bitcoin to be created (say, 21 million), and other variables (viz., network difficulty adjustments), are also in the software protocol. Other crypto-currencies may differ on the basis of these and other variables.[5] 

Besides “mining,” Bitcoins can be obtained in exchange for fiat money, products, and services. Users send and receive Bitcoins electronically for an optional transaction fee using wallet software on a personal computer, mobile device, or a web application.[6] Mining is the maintaining of the block chain, and those who do so are rewarded with newly created Bitcoins and transaction fees. Miners may be located anywhere in the world; they process payments by verifying each transaction as valid and adding it to the block chain.[7]

FinCEN’s view of SAR data and Bitcoin transactions 

Financial institutions, including, but not limited to, Virtual Currency Exchangers, other Money Transmitters, other types of Money Services Businesses, and Depository Institutions may all be involved in the chain of transactions making up the lifecycle of a user’s purchase, use and sale of Bitcoin for currency of legal tender.[8] FinCEN regards SAR data “crucial in assessing transactions involving Bitcoin or other virtual currencies.”[9] Indeed, any financial institution that is required to file a SAR and accepts transactions in Bitcoin should be giving consideration not only to the SAR filing mandates but also sharing information relating to such virtual currency transactions. FinCEN encourages the use of information sharing under 314(b) in this context.[10] 

Bitcoin has seen its share of black market activity. There has been increasing FinCEN and law enforcement scrutiny regarding the use of Bitcoin for illegal activities.[11] In October 2013 the FBI shut down the “Silk Road”, allegedly an online black market, and seized 144,000 Bitcoins worth $28.5 million at the time.[12] Although the United States is still considered “Bitcoin-friendly” compared to other governments, in China buying Bitcoins with Yuan is subject to restrictions, and Bitcoin exchanges are not allowed to hold bank accounts.[13] 

Different financial institutions are more likely to see different elements of the same suspicious activity due to their participation in and perspective on the transaction chain.  

According to FinCEN, while Depository Institutions do not currently interact directly with the Bitcoin economy (i.e., accepting deposits in Bitcoin, conducting transactions in Bitcoin, and so forth), they may see cash, ACH, or Wire and Funds Transfer deposits and withdrawals associated with the following entities, as outlined in the SAR Stats. 

Mortgage Fraud: Data Confirms Spike in 2006-2007

The Financial Crimes Enforcement Network (FinCEN) has released an analysis of Mortgage Fraud SAR Filings in Calendar Year 2012. The report was issued on August 20, 2013. This publication updates FinCEN’s prior Mortgage Loan Fraud (MLF) assessments examines Suspicious Activity Report (SAR) filings from January through December 2012 (CY 2012).

The report provides new information on the volume of SAR filings, geographic locations of subjects, and other filing trends in CY 2012. Tables covering non-geographic aspects are compared with filings from corresponding periods in2011. A section provides updated statistics on foreclosure rescue-related SARs during 2012, and filers’ voluntary use of the new FinCEN SAR e-filing report for voluntary mortgage fraud reporting through March 31, 2013.

This article offers an outline of the FinCEN report. Please visit our Library to download it.

IN THIS ARTICLE

MLF SAR Filings by Year SAR Received, 2001-2012

Mortgage Loan Fraud (MLF) SARs
Time Elapsed from Activity Date to Reporting Date

Number of Mortgage Loan Fraud SAR Filings by Year
with and without the Term “Repurchase” in Narrative

Mortgage Loan Fraud SAR Subjects - Top 20 States and Territories

Foreclosure Rescue Scams

Number of Mortgage Loan Fraud SAR Filings by Year
with Term “Foreclosure Rescue” in Narrative, 2003-2012

__________________________________________________________________________

MLF SAR Filings by Year SAR Received, 2001-2012

FinCEN’s data on suspected mortgage fraud shows that reports declined 25% in 2012  (from 92,561 to 69,277) as compared to the previous year. The past three years of suspected mortgage fraud suspicious activity reports (MLF SARs), if counted by the date they were received by FinCEN, accounted for approximately 46% of the past decade’s mortgage fraud SARs.

We take this to mean that filing increases or decreases are not necessarily indicative of overall increases or decreases in MLF activities over a bracketed period, as the volume of SAR filings in any given period does not directly correlate to the number or timing of suspected fraudulent incidents in that period.

However, one of the inherent features of mortgage fraud is that the suspicious activity associated with it is often only recognized and reported years after loan origination, after a review of origination documents is prompted by a loan default, repurchase demand, or other factors. As a result, many mortgage fraud SARs are filed much later than the date that the suspicious activity actually began. Thus, in 2012, 57% of SARs reported mortgage loan fraud (MLF) activities that started more than 5 years before the SAR was filed.

The bulk of FinCEN’s MLF SARs, regardless of filing date, references suspicious activity that the filers believe began in calendar years 2006 and 2007.

Mortgage Loan Fraud (MLF) SARs
Time Elapsed from Activity Date to Reporting Date

This chart depicts the number of annual mortgage fraud SAR filings based on the year FinCEN received the SAR versus the year that the filer believed the suspicious activity actually began (which was usually at the time of the loan origination).

It should be noted that the chart shows there was an extraordinary concentration of suspicious mortgage origination activity beginning in 2006 and 2007, the years immediately preceding the financial crisis of 2008.

FinCEN: Accountant and Elder Abuse

We have been keeping track of FinCEN's SAR Activity Review – Trends, Tips & Issues virtually from its inception.

In its just issued May 2013 report, FinCEN provides new information regarding two areas of importance:

1) The Suspicious Activity Report (SAR) filing patterns related to elder financial exploitation before and after the publication of FinCEN's Advisory to Financial Institutions on Filing Suspicious Activity Reports Regarding Elder Financial Exploitation ("Advisory"), in February 2011, and

2) An analysis of trends related to SAR filings involving accountants and involving insider abuse within depository institutions.

In this newsletter, I would like to provide you with some insights regarding each of these areas of concern reviewed in the FinCEN report, with a brief review of elder abuse trends and a much more extensive review of suspicious financial activity involving accountants.*

_______________________________________________________

Elder Abuse - Trends
Accountant Abuse - The Gatekeeper
Sampling the Data
Separating the Wheat from the Chaff
Accountants Abuse - Trends
Conclusion
Library

_______________________________________________________

Elder Abuse - Trends

A comparison of the filing rates pre- and post-advisory of SARs with narratives containing the two key search phrases “elder financial exploitation” and “elder financial abuse,” shows a very significant increase in relevant filings post-Advisory.

Between March 1, 2011, and August 31, 2012, filers submitted 7,651 total SARs, a 382 percent increase from the 12-month period prior to the release of the Advisory during which filers completed 1,589 relevant SARs. Post-Advisory filing trends showed continued increases in filing incidences.

SARs generally reported patterns of financial exploitation perpetrated by a relative or caregiver against elderly victims. Narratives most frequently described the perpetrator coercing or cajoling the victim into completing financial transactions that benefited the perpetrator at the expense of the victim.

There are reported instances where the perpetrator reportedly abused a power of attorney over the victim’s account.

Furthermore, so-called "sweetheart scams" were on the rise. A “sweetheart scam” involves the fraudster feigning romantic intentions towards a victim, thus gaining the victim’s affection. The perpetrator then uses the goodwill engendered to defraud the victim. This fraud may impact the victim’s financial accounts and/or identity security, and may even cause the victim to unwittingly facilitate financial fraud against others on the perpetrator’s behalf.

An increased trend in elder financial abuse was noted in the 18 month period after the issuance of the Advisory. Depository Institutions filed 6,026 elder financial exploitation-related SARs in this period. FinCEN determined that institution filers identified “abuse by a relative or caregiver” as the most reported months post-Advisory.

Monthly post-Advisory filing numbers indicate that filers continued to increase their submissions of SARs related to elder financial exploitation more than a year and a half after issuance of the Advisory. FinCEN reports that this trend suggests that many filers have incorporated FinCEN’s elder financial exploitation guidance into their AML monitoring programs. Sample narratives showed filers checked “Other” most often as the characterization of suspicious activity when describing suspicious transactions involving elderly customers.

FinCEN: SAR Narrative, PowerPoint, and Mortgage Loan Fraud

On September 18, 2012 FinCEN held an Informational Webinar regarding the new FinCEN Suspicious Activity Report (SAR).

The corresponding, full PowerPoint presentation of the recorded version of this Webinar is available HERE.

For those interested in actually viewing the Webinar, HERE is the link to the FinCEN webpage.

Recently, FinCEN issued two important reports (available in our Library): 

- SAR Activity Review – Trends, Tips & Issues (Issue 22)

- Mortgage Loan Fraud Update - Suspicious Activity Report Filings in 2nd Quarter 2012 

The first report offers significant insight and guidance in monitoring suspicious activity, and the second report provides important insights regarding SAR filings related to mortgage loan fraud. For years we have worked with our bank clients on auditing their SAR filings and AML compliance, and I can vouch for the practical advantages of reading these on-going FinCEN reports to enhance your risk management responsibilities.

_____________________________________________________

IN THIS ARTICLE

SAR Narrative: "5 W's and the How"

Mortgage Loan Fraud - Statistics and Charts

Foreclosure Rescue Scams on the Rise

California: Highest 2012-Q2 Foreclosure Rescue SARs

_____________________________________________________

SAR Narrative: "5 W's and the How"

In the recent SAR Activity Review, sections are provided that outline the basic aspects toward filing a SAR. In particular, the section  on writing an effective SAR Narrative is important to consider.

FinCEN rightly states that the narrative "is a critical part of the SAR because it is where the filer can summarize and provide a more  detailed description of the activity being reported." For that reason, it is essential that the narrative be clear, complete and thorough.

This section of the FinCEN report offers the "5 W's" that I have written about extensively as a way to develop the SAR narrative. (See, for instance, my article, Anti-Money Laundering Program - Preparation is Protection, August 2012.)

Our clients have learned  how to use this narrative method. The FinCEN report does not mention the "How" narrative that I have advocated - and which I will discuss below. In my view, the Anti-Money Laundering Program should have an appendix devoted exclusively to the SAR Narrative procedures, especially outlining  the "5 W's and the How" method of writing it.

The narrative must be clear, complete and thorough and the method I advocate is an effective means toward accomplishing these  goals.

FinCEN's outline is rather brief, so I will provide a much more extensive set of action steps for you to follow.

The following are the "5 W's" method provided by FinCEN, after which I will add some remarks about narrating the "How".

Who is conducting the suspicious activity?

While one section of the SAR form calls for specific suspect information, the narrative should be used to further describe the suspect or suspects, including occupation, position or title within the business, and the nature of the suspect’s business(es). If more than one individual or business is involved in the suspicious activity, identify all suspects and any known relationships amongst them in the Narrative Section.

While detailed suspect information may not always be available (i.e., in situations involving non-account holders), such information should be included to the maximum extent possible. Addresses for suspects are important: filing institutions should note not only the suspect’s primary street addresses, but also, other known addresses, including any post office box numbers and apartment numbers when applicable. Any identification numbers associated with the suspect(s) other than those provided earlier are also beneficial, such as passport, alien registration, and driver’s license numbers.

Interview: Anti-Money Laundering Program for Nonbanks

Monday, August 13, 2012, marks the commencement of the Anti-Money Laundering Program.

 

Specifically, this is the effective date for implementing the regulatory compliance requirements for Residential Mortgage Lenders and Originators (RMLOs). 

 

From August 13, 2012 forward, RMLOs must have established an Anti-Money Laundering Program (AML Program) and, as required, file Suspicious Activity Reports (SARs).   

 

The Financial Crimes Enforcement Network (FinCEN), a bureau of the Department of the Treasury, issued regulations earlier this year that require RMLOs to establish AML Programs and report suspicious activities under the mandates of the Bank Secrecy Act.

For additional background information, please refer to my March 2012 article, entitled Anti-Money Laundering Debuts for Nonbanks. *

This month, I am publishing yet another article on AML compliance, this time the subject is about drafting the Anti-Money Laundering Program. The article is entitled Anti-Money Laundering Program - Preparation is Protection. When published, I will notify you and send you the download link.

INTERVIEW: ANTI-MONEY LAUNDERING COMPLIANCE

Recently, I was interviewed by Paul Donohue, the Founder of Abacus Mortgage Training and Education, for his highly-regarded Abacus Mortgage Mastery Series.

I discussed at considerable length the many compliance features and guidelines of the Anti-Money Laundering Program. We had a detailed and engaging discussion about anti-money laundering as it relates to RMLOs.

I suggest that you listen to this interview, because it covers a broad range of issues and will help you to be prepared for implementing FinCEN's Anti-Money Laundering Program for RMLOs.

There are two ways for you to listen to the interview:

• Listen to the full Interview.
  • Click the Interview button on our website.

• Download the full interview (MP3) to save for future reference and AML training plans. 
  • Click the MP3 button on our website.

INTERVIEW

 

Anti-Money Laundering Compliance

 

CLICK

____________________________________________________________

* Jonathan Foxx is the President & Managing Director of Lenders Compliance Group

Mortgage Fraud in California, Nevada, and Florida

The Financial Crimes Enforcement Network (FinCEN) released its First Quarter 2012 on June 26, 2012, entitled Mortgage Loan Fraud Update - Suspicious Activity Report Filings in 1st Quarter 2012.*

This update of mortgage loan fraud suspicious activity reports, known as MLF SARs, shows that California, Nevada, and Florida lead the nation in the number of MLF SAR subjects per capita.

Of the 50 most populous Metropolitan Statistical Areas (MSAs) ranked by the number of MLF SAR subjects reported, the top nine are MSAs located in California, Nevada, and Florida. The Californian cities of Los Angeles, Long Beach, and Santa Ana ranked first in the nation for mortgage loan fraud SARs.

A closer look indicates that 19% of Q1 MLF SARs report activity that occurred within the past two years. Of this more recent activity, there were sharp increases in debt elimination schemes: comparatively, 14% reported in Q1-2012 versus 9% in Q1-2011. Foreclosure rescue scams show a dramatic increase: comparatively, 8% of these Q1-2012 filings versus less than 2% in Q1-2011.

In total, financial institutions filed 17,651 MLF SARs in the first quarter of 2012, which is down from 25,485 filed in the same quarter of 2011. According to the report, previous record levels were attributable to mortgage loan repurchase demands prompting reviews of dated mortgages. I would expect this trend to continue, inasmuch as 72% of Q1 filings are still reporting suspicious activity that occurred more than four years ago.

An interesting statistic is the extent to which mortgage fraud was prevented: 41% of the mortgage loan transactions were spotted and stopped before completion, up slightly from 40% in the CY 2011. However, that also means 59% of the subject transactions were not prevented before completion.

Let's look at some charts, sourced from the FinCEN report.

IN THIS ARTICLE

CHART 1:
Quarterly MLF Filings, Q1 2006 through Q1 2012
CHART 2:
Mortgage Loan Fraud - MLF SAR
CHART 3:
Mortgage Loan Fraud SAR Subjects-Top 20 States & Territories 
CHART 4:
Categories of Fraud Addressed in MLF SAR Narratives

New Fraud Patterns

____________________________________________

Chart 1: Quarterly MLF Filings, Q1 2006 through Q1 2012

FinCEN reported an unusual spike in MLF SAR filings during 2011 Q1 through Q3, primarily due to mortgage repurchase demands on banks. Those repurchase demands prompted review of mortgage loan origination and refinancing documents, where filers discovered fraud, which was then reported on SARs.

Chart 2: Mortgage Loan Fraud - MLF SARs

During both 2012 and 2011 Q1, a majority of reported activities actually began during or before 2008.

Chart 3: Mortgage Loan Fraud SAR Subjects - Top 20 States and Territories

Based on per capita rankings, California remained the top ranked state, as it was in Q4 and CY 2011. Nevada ranked 2nd, rising from its 5th place ranking in 2011 Q4. Florida's 3rd ranking was consistent with its showings between 2nd and 4th in the 2011 quarterly reports. Arizona and New York rounded out the top five per capita rankings. Arizona jumped into 4th from rankings in the 6th through 11th range during 2011, while New York jumped into 5th from rankings in the low to mid-teens during 2011.

Chart 4: Categories of Fraud Addressed in MLF SAR Narratives

Some noteworthy changes from CY 2011 include an increase in debt elimination schemes, which were addressed in 14% of 2012 Q1 sample SARs, up from 9% in CY 2011. In addition, foreclosure rescue scams (other than debt elimination) were noted in 8% of 2012 Q1 sample SARs, but had been described in less than 2% of CY 2011 reports. Appraisal fraud was described in 3% of 2011 Q1 reports, down from 12% of CY 2011 reports.

 

New Fraud Patterns

 

Homeowners' Insurance Fraud
FinCEN noted two SARs describing homeowners' insurance fraud related to mortgage fraud in the aftermath of home fires. In one instance, a home with two mortgages burned down. The borrower asked that the insurance check be payable to him instead of the mortgage lender, and did repay the first mortgage. But the subject ignored payment requests and subsequent demand letters from the filer on the second mortgage. In the other case, the filer suspected arson on a rental property insured for several times the mortgaged value. This subject repaid his mortgage loan with insurance proceeds and pocketed the additional insurance money.

Keys for Cash
One filer was notified by local law enforcement, based on a confirmed lead from a local realtor, about persons illegally occupying bank owned properties ("REOs"). The subjects moved into various bank owned properties claiming to have long term leases. However, the subjects' true objective appeared to be inducing lenders into paying them to vacate the premises.

Library

Financial Crimes Enforcement Network

Mortgage Loan Fraud Update -
Suspicious Activity Report Filings in 1st Quarter 2012

June 26, 2012

____________________________________________

* Jonathan Foxx is the President & Managing Director of Lenders Compliance Group

Anti-Money Laundering Program for RMLOs

A new era in filing requirements is about to begin. For the first time, the Financial Crimes Enforcement Network, known as “FinCEN,” will require nonbank mortgage lenders and originators to implement an Anti-Money Laundering program (“AML Program”) and file Suspicious Activity Reports (“SARs”) for certain loan transactions.[i] FinCEN is establishing this AML program in accordance with the Bank Secrecy Act (“BSA”).[ii] The guidelines relating to the AML requirement become effective on April 16, 2012, and the AML Program’s effective compliance date is August 13, 2012.[iii] The AML program and SAR filing regulations, which I will refer to as “FinCEN’s rule,” are considered to be “the first step in an incremental approach to implementation of regulations for the broad loan or finance company category of financial institutions.” [iv]

 

The Bank Secrecy Act defines the term "financial institution" to include, in part, a loan or finance company. This terminology, however, can reasonably be construed to extend to any business entity that makes loans to or finances purchases on behalf of consumers and businesses. Thus, nonbank residential mortgage lenders and originators, and mortgage brokers, are grouped into the "loan or finance company" category.[v] However, the term ‘‘loan or finance company’’ is actually not concisely defined in any FinCEN regulation, and there is no legislative history on the term itself. Nevertheless, FinCEN is applying this term to extend to any business entity that makes loans to or finances purchases on behalf of consumers and businesses. [vi] Therefore, residential mortgage lenders and originators (“RMLOs”) are covered by the scope of the ‘‘loan or finance company’’ term. I will use the acronym “RMLO” in this article, inasmuch as my principal focus herein relates to residential mortgage lenders and originators.

 

FinCEN can issue regulations requiring financial institutions to keep records and file reports that are determined to have a high degree of usefulness in criminal, tax, or regulatory investigations or proceedings, or in the conduct of intelligence or counterintelligence activities, including analysis, to protect against international terrorism. Federally regulated depository institutions have been required to have AML Programs,[vii] and now, as of the aforementioned effective compliance date, RMLOs must also comply with FinCEN’s regulations relating to implementing an AML Program and the filing of SARs.

 

Over the last few years,[viii] FinCEN has issued studies and analyses that used SARs to discover suspected mortgage fraud and money laundering that involved both banks and residential mortgage lenders and originators.[ix] According to FinCEN, these reports “underscore[d] the potential benefits of AML and SAR regulations for a variety of businesses in the primary and secondary residential mortgage markets.”[x]

 

Residential mortgage lenders and originators, the RMLOs, are considered to be the primary providers of mortgage finance, and have a unique position with respect to direct contact with the consumer. Thus, they are presumably able to assess and identify money laundering risks and fraud.[xi] At this time, FinCEN is not proposing a definition of “loan or finance company’’ that would encompass other types of consumer or commercial finance companies, or real estate agents and other entities involved in real estate closings and settlements.

 

In this article, I am going to unpack the AML Program for you in a way that will give you some familiarity with its scope, while perhaps also making its implementation a bit less daunting than it might otherwise seem to be. Nevertheless, many RMLOs will find that setting up the AML Program will be a challenging endeavor. Information, issuances, and relevant documentation are available in the FinCEN section of my firm’s website Library.

 

Please keep in mind that, as is the case with many applications of legal and regulatory compliance, there are aspects and nuances that will require recourse to a competent risk management professional to obtain comprehensive guidance and reliable information.[xii]

 

AML PROGRAM

 

Residential mortgage lenders and originators, the RMLOs, are required to establish an AML Program that includes, at a minimum:

 

(1) Development of internal policies, procedures, and controls.

(2) Designation of a compliance officer.

(3) Ongoing employee training program.

(4) Independent audit function to test for compliance.