Final Rule Part 748, Filing Requirements for Suspicious Activity Reports

Dear Board of Directors:

This Regulatory Alert is to inform you about revisions to Part 748 of the NCUA Rules and Regulations. The revised rule describes in greater detail Suspicious Activity Report (SAR) reporting and filing requirements. The rule became effective November 27, 2006.

There are six changes to Part 748 which are summarized below.

1. Notification to board of directors

   Credit union management must promptly notify its board of directors (board), or a committee designated by the board of directors (committee), to receive notice of any SAR filed. Notification must be at least monthly. Notification at the monthly board meeting is adequate, unless the seriousness of an activity merits immediate reporting.
   
   Part 748 does not specify a notification format. Credit unions have the necessary flexibility to tailor the format to their particular needs and circumstances. Credit unions may use the formats included in the FFIEC Bank Secrecy Act/Anti-Money Laundering Examination Manual.
   
   If a SAR suspect is a director or committee member designated to receive SAR filing notices, the credit union may not notify the suspect. However, the credit union must notify the remaining directors, or designated committee members, who are not suspects.

2. Reportable Activity:

   Credit unions must report any known or suspected crimes, as well as any suspicious transactions related to money laundering or other illegal activity, or a violation of the Bank Secrecy Act (BSA) in the following circumstances:
   • Insider Abuse involving any amount;
   • Transactions aggregating $5,000 or more where a suspect can be identified;
   • Transactions aggregating $25,000 or more regardless of potential suspects; and/or
   • Transactions aggregating $5,000 or more that involve potential money laundering or violations of the BSA.

3. Filing Procedures

   Timing

   Credit unions must file a SAR with FinCEN within 30 calendar days from the date the suspicious activity is initially detected. If a suspect is not identified on the date of detection, an additional 30 calendar days is permitted to identify a suspect before filing a SAR. A credit union may not take more than 60 days from the initial detection date to file a SAR.

   Content

   Credit unions must fully and accurately complete SAR form TDF 90-22.47, Suspicious Activity Report (also known as NCUA Form 2362) in accordance with the form’s instructions.

   Compliance

   Failure to file a SAR as required by the form’s instructions and 31 C.F.R. Part 103.18 may subject the credit union, its officials, employees and agents to civil money penalties or other administrative actions.

4. Retention of Records

   A credit union must maintain copies of the SARs filed and supporting documentation for five years. Supporting documentation must be made available to appropriate law enforcement authorities and regulatory supervisory authorities upon request.

5. Confidentiality of reports

   SARs are confidential. A credit union may not disclose a SAR was prepared or filed. Any credit union subpoenaed or otherwise requested to disclose a SAR, or the information in a SAR, must decline. NCUA should be notified of any such requests.

6. Safe Harbor

   Credit unions are protected from liability for any disclosure in a SAR, or the failure to disclose the existence of a SAR, to the full extent provided by the Bank Secrecy Act.

The revised rule provides general statements of the filing requirements and other key provisions for SARs. Please refer to 31 C.F.R. Part 103.18 and the SAR form instructions for detailed information. The FFIEC Bank Secrecy Act/AntiMoney Laundering Examination Manual, and NCUA’s and FinCEN’s websites also provide additional guidance.

Should you have questions about revisions to Part 748, please contact your regional office or state supervisory authority.