Recent questions from compliance teams have surfaced following the Senate Finance Committee report on delayed Suspicious Activity Report (SAR) filings. When Deutsche Bank and Bank of America delayed reporting over $420 million in suspicious transactions linked to Jeffrey Epstein, it highlighted significant compliance issues for financial institutions.
Here's what your team needs to know.
Understanding "Delayed" SAR Filings
The Bank Secrecy Act requires you to file a SAR within 30 calendar days from detecting suspicious activity. This isn't 30 business days, and the clock starts at detection, not after an investigation.
In the Senate Finance Committee's context, "delayed" means taking years to file, indicating systemic failures in monitoring and escalation processes. Your Money Laundering Reporting Officer should track detection-to-escalation and escalation-to-filing timelines. If these exceed internal thresholds, it's a process problem. The FATF Recommendations stress timely reporting as essential for effective anti-money laundering controls.
Consequences of Late Filing and Self-Reporting
Self-reporting a late SAR doesn't negate the violation, but it can alter discussions with regulators. FinCEN expects a corrected SAR with a clear explanation of the delay. Document what went wrong, the fixes, and how you're testing them.
The real issue isn't the late SAR itself but what it reveals about your compliance program. Examiners will question whether this is a one-off failure or if your system routinely misses high-risk activity. If late filings result from a backlog in your case management system, it indicates broader compliance weaknesses. The USA PATRIOT Act's Section 352 mandates maintaining an adequate AML program, meaning you must meet regulatory timeframes.
Demonstrating Monitoring System Effectiveness
While you can't prove a negative, you can show control effectiveness. Conduct a lookback analysis using public transaction patterns. If your rules would've flagged similar activity, document it. If not, identify the gaps.
Your transaction monitoring system should generate alerts based on defensible rules. Show threshold logic, typology coverage, and tuning history. When did you last update your rules? What new typologies have you added recently?
Consider a parallel test: sample closed SARs from the past year and verify your current rules would still catch them. If tuning has reduced both false and true positives, you've compromised compliance for efficiency, which examiners will notice.
Addressing a 90-Day Investigation Queue
A 90-day investigation queue is a red flag. The 30-day clock starts at detection, not case assignment. If alerts sit in a queue for weeks, you're risking late filings.
Track metrics like median time-to-assignment, investigation duration, and filing timeliness. Meeting the 30-day deadline by rushing investigations creates quality risk. Missing deadlines due to queues creates regulatory risk.
Your board and senior management should see these metrics monthly. The NYDFS Cybersecurity Regulation requires annual reporting on cybersecurity risks; apply similar rigor to AML compliance. If you need more analysts or better tools, it's a resource allocation decision for the boardroom.
Communicating with Senior Management
Communicate three key points:
The Senate Finance Committee report signals increased scrutiny on SAR timeliness industry-wide. Expect this focus in your next exam.
Delayed reporting isn't just a technical issue; it undermines the financial intelligence system. Late filings hinder law enforcement and increase reputational risk.
Validate your controls now. Conduct a lookback on SAR filings from the past 12 months. Calculate your median time-to-file from detection. Identify cases exceeding 30 days and document reasons. Address systemic issues and brief your examiner proactively.
Next Steps
Begin with your transaction monitoring system's alert disposition report. Assess the number of alerts per analyst per month and your true positive rate. If false positives overwhelm your team, real risks may be overlooked.
Review SAR narrative quality. A well-documented SAR should clearly outline who, what, when, where, why, and how. Generic narratives indicate poor filing quality.
Map your escalation paths. Ensure junior analysts can escalate complex cases efficiently and senior analysts can file SARs without excessive approvals. Even the best monitoring system can't compensate for organizational bottlenecks.
The $420 million in delayed reporting highlighted by Senator Ron Wyden's report didn't result from a single failure. It was a cascade of control failures. Ensure this doesn't describe your program.
