Bitcoins and SAR Narratives

You probably know about Bitcoin, unless you have been living in total seclusion for the last few years. The big controversy usually centers on determining if it is legal tender. But imagine if you are confronted with a transaction involving Bitcoin. Do you file a Suspicious Activity Report (“SAR”)?  

It so happens that the Financial Crimes Enforcement Network (“FinCEN”) has been giving that very concern laser-like attention! In July 2014’s “SAR Stats,” FinCEN observed that the “rapid adoption and price fluctuation of Bitcoin” has put convertible virtual currencies in the spotlight over the past year.[1] The same attributes of virtual currencies that attract lawful users, such as the capacity for anonymity as well as their speed and global reach, attract criminal actors engaged in illicit financing. FinCEN is observing a rise in the number of SARs flagging virtual currencies as a component of suspicious activity. Bitcoin is considered one of the “emerging payment methods.” Consequently, it is important to understand virtual currencies in order to properly complete the SAR Narrative. 

So let’s define Bitcoin. 

Bitcoin is a type of virtual currency. It is also known as a crypto-currency or a math-based currency or digital currency. A virtual currency is considered “decentralized” because it allows users to conduct transactions peer-to-peer without a central administrator. It is a software-based payment system described by one Satoshi Nakamoto in 2008,[2] and introduced as open-source software in 2009. Payments are recorded in a “public ledger” using its own unit of account, which naturally is also called Bitcoin. Payments work peer-to-peer without a central repository or single administrator - which has led the US Treasury to call Bitcoin a “decentralized virtual currency.”[3]  

In keeping with the general architecture of the Internet, transactions and new currency issuances are conducted without a central administrator or trusted third party. Instead, as an open-source software, its protocol links users into a network that: (1) secures the network from attack; (2) broadcasts transactions; (3) verifies and settles transactions; (4) issues new currency; and (5) publishes new transactions to a shared, “distributed ledger of all transactions” called the “block chain.”[4] The rate of coin creation, the total Bitcoin to be created (say, 21 million), and other variables (viz., network difficulty adjustments), are also in the software protocol. Other crypto-currencies may differ on the basis of these and other variables.[5] 

Besides “mining,” Bitcoins can be obtained in exchange for fiat money, products, and services. Users send and receive Bitcoins electronically for an optional transaction fee using wallet software on a personal computer, mobile device, or a web application.[6] Mining is the maintaining of the block chain, and those who do so are rewarded with newly created Bitcoins and transaction fees. Miners may be located anywhere in the world; they process payments by verifying each transaction as valid and adding it to the block chain.[7]

FinCEN’s view of SAR data and Bitcoin transactions 

Financial institutions, including, but not limited to, Virtual Currency Exchangers, other Money Transmitters, other types of Money Services Businesses, and Depository Institutions may all be involved in the chain of transactions making up the lifecycle of a user’s purchase, use and sale of Bitcoin for currency of legal tender.[8] FinCEN regards SAR data “crucial in assessing transactions involving Bitcoin or other virtual currencies.”[9] Indeed, any financial institution that is required to file a SAR and accepts transactions in Bitcoin should be giving consideration not only to the SAR filing mandates but also sharing information relating to such virtual currency transactions. FinCEN encourages the use of information sharing under 314(b) in this context.[10] 

Bitcoin has seen its share of black market activity. There has been increasing FinCEN and law enforcement scrutiny regarding the use of Bitcoin for illegal activities.[11] In October 2013 the FBI shut down the “Silk Road”, allegedly an online black market, and seized 144,000 Bitcoins worth $28.5 million at the time.[12] Although the United States is still considered “Bitcoin-friendly” compared to other governments, in China buying Bitcoins with Yuan is subject to restrictions, and Bitcoin exchanges are not allowed to hold bank accounts.[13] 

Different financial institutions are more likely to see different elements of the same suspicious activity due to their participation in and perspective on the transaction chain.  

According to FinCEN, while Depository Institutions do not currently interact directly with the Bitcoin economy (i.e., accepting deposits in Bitcoin, conducting transactions in Bitcoin, and so forth), they may see cash, ACH, or Wire and Funds Transfer deposits and withdrawals associated with the following entities, as outlined in the SAR Stats. 

Mortgage Fraud: Data Confirms Spike in 2006-2007

The Financial Crimes Enforcement Network (FinCEN) has released an analysis of Mortgage Fraud SAR Filings in Calendar Year 2012. The report was issued on August 20, 2013. This publication updates FinCEN’s prior Mortgage Loan Fraud (MLF) assessments examines Suspicious Activity Report (SAR) filings from January through December 2012 (CY 2012).

The report provides new information on the volume of SAR filings, geographic locations of subjects, and other filing trends in CY 2012. Tables covering non-geographic aspects are compared with filings from corresponding periods in2011. A section provides updated statistics on foreclosure rescue-related SARs during 2012, and filers’ voluntary use of the new FinCEN SAR e-filing report for voluntary mortgage fraud reporting through March 31, 2013.

This article offers an outline of the FinCEN report. Please visit our Library to download it.

IN THIS ARTICLE

MLF SAR Filings by Year SAR Received, 2001-2012

Mortgage Loan Fraud (MLF) SARs
Time Elapsed from Activity Date to Reporting Date

Number of Mortgage Loan Fraud SAR Filings by Year
with and without the Term “Repurchase” in Narrative

Mortgage Loan Fraud SAR Subjects - Top 20 States and Territories

Foreclosure Rescue Scams

Number of Mortgage Loan Fraud SAR Filings by Year
with Term “Foreclosure Rescue” in Narrative, 2003-2012

__________________________________________________________________________

MLF SAR Filings by Year SAR Received, 2001-2012

FinCEN’s data on suspected mortgage fraud shows that reports declined 25% in 2012  (from 92,561 to 69,277) as compared to the previous year. The past three years of suspected mortgage fraud suspicious activity reports (MLF SARs), if counted by the date they were received by FinCEN, accounted for approximately 46% of the past decade’s mortgage fraud SARs.

We take this to mean that filing increases or decreases are not necessarily indicative of overall increases or decreases in MLF activities over a bracketed period, as the volume of SAR filings in any given period does not directly correlate to the number or timing of suspected fraudulent incidents in that period.

However, one of the inherent features of mortgage fraud is that the suspicious activity associated with it is often only recognized and reported years after loan origination, after a review of origination documents is prompted by a loan default, repurchase demand, or other factors. As a result, many mortgage fraud SARs are filed much later than the date that the suspicious activity actually began. Thus, in 2012, 57% of SARs reported mortgage loan fraud (MLF) activities that started more than 5 years before the SAR was filed.

The bulk of FinCEN’s MLF SARs, regardless of filing date, references suspicious activity that the filers believe began in calendar years 2006 and 2007.

Mortgage Loan Fraud (MLF) SARs
Time Elapsed from Activity Date to Reporting Date

This chart depicts the number of annual mortgage fraud SAR filings based on the year FinCEN received the SAR versus the year that the filer believed the suspicious activity actually began (which was usually at the time of the loan origination).

It should be noted that the chart shows there was an extraordinary concentration of suspicious mortgage origination activity beginning in 2006 and 2007, the years immediately preceding the financial crisis of 2008.

Anti-Money Laundering–Red Flags and the SAR Narrative

Even though AML compliance for nonbanks has been in effect since August 13, 2012, many Residential Mortgage Lenders and Originators (RMLO) still seem to have considerable difficulty in two specific areas: how to determine when a Suspicious Activity Report (SAR) should be filed, and which suspicious activity events or features may trigger the SAR filing requirement.

In one article, entitled Anti-Money Laundering Debuts for Nonbanks, I unpack the AML Program in a way that will provides some familiarity with the AML Compliance scope, while perhaps also making its implementation a bit less daunting than it might otherwise seem to be.

In another article, entitled Anti-Money Laundering Program: Preparation is Protection, I outlined many of the so-called Red Flags and other triggering events. In addition, I offered a way to construct a SAR narrative - the description to FinCEN about the alleged suspicious activity - that, based on years of experience auditing and implement AML compliance on behalf of our clients, best meets FinCEN's expectations of an informative statement. 

To give you an idea of the size and complexity of a well-constructed AML Program, my firm’s AML Program is well over fifty pages – which consists of a policy statement and numerous appendices for applicable procedures. This should give you some idea of the depth and detail needed for properly implementing AML compliance. The absence of or any inaccuracies in required program components may indicate a defective policy and procedures – the very tools needed to assist in detecting and preventing money laundering or other illegal activities conducted through mortgage banking conduits.

So, a word of caution is due: do not take the chance of buying an abbreviated or defective AML Program, in the hope of merely satisfying the “basic” FinCEN requirements. Obtaining a boilerplate document with your company’s name on it is regressive, and it is a tactic that Examiners are now regularly criticizing in adverse findings. 

These days, regulators are fully aware of this ‘short cut’ to compliance. An insufficient AML Program may cause adverse examination findings. Indeed, in some cases, template-driven policy and procedures may cause Examiners to escalate their regulatory review of an RMLO’s anti-money laundering implementation. 

AML compliance is a specialized area of mortgage compliance, necessitating genuine, practical, hands-on, regulatory compliance and experiential knowledge, and an AML Program must reflect precise policies and procedures that not only implement the SAR regulations but also conform to a company’s way of doing business. 

Therefore, an AML Program is one policy statement and set of procedures where the purchase price should not be an operative consideration. Caveat Emptor!

This is why I want to further outline the descriptive process of completing the SAR narrative, emphasizing a simple method I call The 5 W's and the How, and I will also provide details regarding both so-called Red Flags and triggering events. So, even if a company has a skimpy or defective AML policy and procedures, at least those who implement AML Compliance may be offered some rudimentary guidelines to consider in the practical experience of actually filing a SAR.

_________________________________________________________

IN THIS ARTICLE

The 5 W's and the How

Triggering Events

Documentation Red Flags

Applicant Red Flags

RMLO's Employee Red Flags

Library Resources

_________________________________________________________

The 5 W's and the How

If I were to choose the central feature of the SAR, I would select the SAR narrative. 

Each SAR requires a narrative to be provided by the SAR filer. 

Over time, my firm has compiled numerous examples of common patterns of suspicious activities from our audit and due diligence reviews. Based on our experience and FinCEN’s own stated guidance, we believe that there are five interrogative categories to be considered when writing a SAR narrative: who? what? when? where? and why?

FinCEN: SAR Narrative, PowerPoint, and Mortgage Loan Fraud

On September 18, 2012 FinCEN held an Informational Webinar regarding the new FinCEN Suspicious Activity Report (SAR).

The corresponding, full PowerPoint presentation of the recorded version of this Webinar is available HERE.

For those interested in actually viewing the Webinar, HERE is the link to the FinCEN webpage.

Recently, FinCEN issued two important reports (available in our Library): 

- SAR Activity Review – Trends, Tips & Issues (Issue 22)

- Mortgage Loan Fraud Update - Suspicious Activity Report Filings in 2nd Quarter 2012 

The first report offers significant insight and guidance in monitoring suspicious activity, and the second report provides important insights regarding SAR filings related to mortgage loan fraud. For years we have worked with our bank clients on auditing their SAR filings and AML compliance, and I can vouch for the practical advantages of reading these on-going FinCEN reports to enhance your risk management responsibilities.

_____________________________________________________

IN THIS ARTICLE

SAR Narrative: "5 W's and the How"

Mortgage Loan Fraud - Statistics and Charts

Foreclosure Rescue Scams on the Rise

California: Highest 2012-Q2 Foreclosure Rescue SARs

_____________________________________________________

SAR Narrative: "5 W's and the How"

In the recent SAR Activity Review, sections are provided that outline the basic aspects toward filing a SAR. In particular, the section  on writing an effective SAR Narrative is important to consider.

FinCEN rightly states that the narrative "is a critical part of the SAR because it is where the filer can summarize and provide a more  detailed description of the activity being reported." For that reason, it is essential that the narrative be clear, complete and thorough.

This section of the FinCEN report offers the "5 W's" that I have written about extensively as a way to develop the SAR narrative. (See, for instance, my article, Anti-Money Laundering Program - Preparation is Protection, August 2012.)

Our clients have learned  how to use this narrative method. The FinCEN report does not mention the "How" narrative that I have advocated - and which I will discuss below. In my view, the Anti-Money Laundering Program should have an appendix devoted exclusively to the SAR Narrative procedures, especially outlining  the "5 W's and the How" method of writing it.

The narrative must be clear, complete and thorough and the method I advocate is an effective means toward accomplishing these  goals.

FinCEN's outline is rather brief, so I will provide a much more extensive set of action steps for you to follow.

The following are the "5 W's" method provided by FinCEN, after which I will add some remarks about narrating the "How".

Who is conducting the suspicious activity?

While one section of the SAR form calls for specific suspect information, the narrative should be used to further describe the suspect or suspects, including occupation, position or title within the business, and the nature of the suspect’s business(es). If more than one individual or business is involved in the suspicious activity, identify all suspects and any known relationships amongst them in the Narrative Section.

While detailed suspect information may not always be available (i.e., in situations involving non-account holders), such information should be included to the maximum extent possible. Addresses for suspects are important: filing institutions should note not only the suspect’s primary street addresses, but also, other known addresses, including any post office box numbers and apartment numbers when applicable. Any identification numbers associated with the suspect(s) other than those provided earlier are also beneficial, such as passport, alien registration, and driver’s license numbers.