Who You Gonna Call—and When? Telephoning Law Enforcement About Suspicious Activity

Stay up-to-date with the latest developments in securities law through access to both news and all statutes and regulations. Find relevant corporate filings through a searchable EDGAR database. And...

Robert M. Axelrod

By Robert M. Axelrod

Robert M. Axelrod is a Deloitte Risk and Financial Advisory Managing Director in Deloitte Transactions and Business Analytics LLP, an affiliate of Deloitte Financial Advisory Services LLP. He specializes in projects to help organizations address financial transactions in regulatory and compliance contexts, including anti-money laundering and antiterrorist financing, as well as anticorruption concerns in the financial services industry, specifically addressing banks, insurance companies, and broker dealers.

The traditional emphases in discussing the requirement for a Suspicious Activity Report (SAR) have been whether there have been reasonable grounds to suspect illegal or otherwise reportable activity, and whether the report has been in fact filed within 30 days of the time that the financial institution deemed the activity suspicious. However, the SAR regulations and their predecessors ( https://goo.gl/YH234T) have for more than twenty years ( https://goo.gl/KuLARY) imposed an additional requirement, namely that for “violations requiring immediate attention” there be immediate telephone notice to an “appropriate” law enforcement authority. This requirement appears in SEC guidance ( https://goo.gl/Y6IL5F at p. 8), the broker dealer SAR regulation (31 CFR section 1023.320(b)(3)), banking regulations, Money Services Businesses (MSBs) regulation (at 31 CFR Section 1022.32(b)(3)), in FinCEN’s 2015 proposed regulation for investment advisers and also in a FINRA notice, among other places( https://goo.gl/f6zAfz). Nonetheless, the requirements for when someone at an institution needs to pick up the phone, and, to a lesser degree, who the institution should call, remain somewhat opaque. Perhaps not surprisingly, compliance with this area is rarely the subject of an enforcement action and the judgment as to who to call and when a call must be made has little articulated standard and thus significant variance. Considering that these reporting events are, by definition, the most important and most urgent instances of suspicious activity (those that require “immediate attention”), more clarity would be productive. This article discusses what some of the pertinent determinants for the open questions may be.

In What Situations Are You Gonna Call?

Let us look at one of the regulations that addresses this issue. For the Federal Reserve, 12 CFR Section 208.62 provides, in pertinent part, the following, culminating in the telephone requirement in section (d):

  • (c)  SARs required. A member bank shall file a SAR with the appropriate Federal law enforcement agencies and the Department of the Treasury in accordance with the form's instructions by sending a completed SAR to FinCEN in the following circumstances:
  • (1) Insider abuse involving any amount. Whenever the member bank detects any known or suspected Federal criminal violation …
  • (2) Violations aggregating $5,000 or more where a suspect can be identified. Whenever the member bank detects any known or suspected Federal criminal violation …
  • (3) Violations aggregating $25,000 or more regardless of a potential suspect. Whenever the member bank detects any known or suspected Federal criminal violation …
  • (4) Transactions aggregating $5,000 or more that involve potential money laundering or violations of the Bank Secrecy Act. Any transaction … if the bank knows, suspects, or has reason to suspect that [various problematic, evasive or illegal transactions have occurred]
  • (d)  Time for reporting. A member bank is required to file a SAR no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing a SAR. … In situations involving violations requiring immediate attention, such as when a reportable violation is ongoing, the financial institution shall immediately notify, by telephone, an appropriate law enforcement authority and the Board in addition to filing a timely SAR. [ Emphasis added](explanation supplied)

Although all suspicious activity within thresholds is reportable, the regulation anticipates some of it will involve “known” as opposed to “suspected” violations. The seriousness of the violation implicating immediate reporting is suggested by the example (and it is only an example) of ongoing activity. The OCC’s regulation regarding SAR reporting for national banks, 12 CFR 21.11(d), follows suit:

... In situations involving violations requiring immediate attention, such as when a reportable violation is ongoing, the financial institution shall immediately notify, by telephone, an appropriate law enforcement authority and the OCC in addition to filing a timely SAR.

The FinCEN’s SAR rule for broker dealers is a little more explicit, giving as its examples violations “such as terrorist financing or ongoing money laundering schemes.” FinCEN uses the same formulation in the instructions for filing an electronic SAR.

Not surprisingly, there is a general consensus that suspected terrorist financing activity will be the subject of immediate notification to law enforcement.

Nonetheless, there is still considerable slack in this direction to make immediate telephone notification. Is the immediacy requirement limited to actual violations or does it extend to serious violations that are merely suspected? Is there a multiplier arrangement, along the lines of an immediacy trigger if the product of (1) “seriousness” (2) “degree of certainty” and (3) contingent harm if law enforcement does not get involved quickly, reaches a certain level? Since a telephone call anticipates a two way simultaneous conversation (something that a text or an email may not), the notion of impending harm is conveyed. On the other hand, if the law enforcement authority doesn’t answer the phone, is a voicemail enough to satisfy the requirement? That is not clear. In any event, under this framework, a terrorist financing SAR would be a strong candidate for an immediate telephone report, but perhaps the mere suspicion of a low dollar check kiting scheme might not. Taken literally, every supplemental SAR involves an “ongoing money laundering scheme,” it would seem, because, as FinCEN has noted ( https://goo.gl/co4zBF), such SARs are for “ongoing or supplemental information” as to activity reported in a prior SAR. That is, they involve suspicion of ongoing money laundering. However few would read the requirement as implying telephoning law enforcement on each occasion of every supplemental SAR, especially if they hadn’t already made a telephone call in the first place. Additionally, while there is nothing explicit in this regard, in the December, 2016 FATF (Financial Action Task Force) Mutual Evaluation Report ( https://goo.gl/Y6XEcj at p. 49) for the U.S., FATF stated that when the immediate telephone requirement is triggered, it occurs irrespective of the monetary threshold (generally $5,000 or greater) for a formal SAR filing, a conclusion about the U.S. framework that was presumably at least not opposed by the U.S. representatives meeting with FATF. If there were a communication without an associated SAR, the safe harbor for civil liability associated with SARs could arguably be impacted, though this is a matter for construction under 31 USC 5318(g). In any event, there is no simple standard for what situations require a telephone call that can be gleaned from the regulations.

In the present environment, the decision to call appears one of judgment, but government officials have not supplied clarity as to precisely which situations require a call. This is perhaps a tolerable situation unless the agencies decide to bring regular enforcement actions in this regard. If one looks at the enforcement actions around egregious failures to file SARs or to take an excessively long time in filing SARs, one can suppose that the telephone call requirement could have been an alternative basis for enforcement, and perhaps a pretty easy one to demonstrate. Moreover, the prospect of personal liability for failure to call and the lack of a clear governance process for making and documenting calls could be an attractive subject for enforcement because it would depend on relatively simple facts. At the same time, it should be noted that unlike the ubiquitous FinCEN analytics on SARs filed, such as through the thoroughly indexed ( https://goo.gl/Xv0aWf) SAR Activity Review series, there is no report of the trends and nature of the immediate telephonic reports, nor does there appear to be an associated infrastructure within FinCEN or banking regulators, for example, to compile and integrate this information, although the fact of law enforcement contact, for whatever reason (for immediacy or otherwise), is a choice on the FinCEN SAR forms.

If there were regular enforcement, a reasonably possible reaction could be a tripling or otherwise great multiple of the incidence of telephone calls to law enforcement, because, like the filing of a SAR itself, the dissymmetry between the consequences (high) of not acting when you were supposed to and the consequences (miniscule, if that) of acting when you weren’t really required to act creates a substantial amount of unproductive action. In the case of SAR filings, this equates to defensive SARs. In the case of telephone calls, this could present as a process to practically degrade the saliency to law enforcement of a given call, because it may more likely occur in a sea of non-urgent calls from financial institutions. Moreover, one of the apparent benefits of this requirement to begin with is to build credible informal relationships between financial institutions and particular law enforcement officials, and excessive telephone calls wouldn’t be helpful for that purpose. Maybe things are better off the way they are.

When Are You Gonna Call?

There is no defined period for “immediate.” Even if we assume that “immediate” means within one or at most a few days, the bigger question is the starting point. Is it the day the SAR is filed, or the day something is deemed suspicious (starting the 30 day clock) or is it before something is deemed suspicious? For example, we may likely assume that a terrorist financing scheme would merit an immediate notice when a SAR is to be filed, but we might expect that notice to occur even before the formal filing of a SAR; there is no direction in the regulations in that regard. And if you call before something is deemed suspicious, just to be safe, have you, in effect, started the 30 day clock, anyway? Given the proximity (in the same paragraph in each of the regulations cited in this article) in the regulations of the 30 day time period for filing and the requirement of “immediacy” for a telephone call, it appears arguable that the call should precede the filing of the SAR. In some instances, however, a financial intelligence unit or the person making the SAR filing decision may deem something suspicious and set the 30 day clock rolling, but may still be gathering information for the SAR filing. There will be some judgment about whether to wait a short time (presumably less than 30 days) to have facts compiled and organized before calling law enforcement. This is another area where guidance could be helpful.

Who You Gonna Call?

Although the regulations are perhaps remarkably flexible with the citation of the hypothetical “appropriate” law enforcement authority, here the agencies have been active in supplying answers. The SEC has nominated a hotline for this purpose. FinCEN has set up a hotline to expedite voluntary reports in this setting, especially for terrorist financing situations. The FFIEC BSA Examination Manual Suspicious Activity Reporting Overview ( https://goo.gl/aaD2bW at p. 8) advises that the appropriate authority is “usually” the FBI or the IRS, although, as set out in the regulation quoted above, a telephone call to the Federal Reserve Board, the Office of Comptroller of the Currency or the like may be required as well. FINRA ( https://goo.gl/ZdUULX at p 32)has cited the SEC’s examples of appropriate agencies. It would appear that so long as an employee of the institution has the ear of a law enforcement authority that has the particular crime or violation involved in the ambit of its work, things should sort themselves out “appropriately.” There is no indication that for any violation, there is one and only one appropriate agency, anyway.


The requirement of immediate telephone contact is a steady component of SAR regulations, though the actual timing, necessity and direction of a telephone call to law enforcement is not clear. Given the premium on the immediacy of an violation, as that term is used in the SAR regulations, the framework suggests that law enforcement be called when a financial institution has enough information to identify a serious wrong that could be investigated, particularly one where delay in the initiation of an investigation could visit harm on innocent persons. The lack of definitive guidance about what situations implicate a phone call and when it must be made have created a situation where the timing and fact of a telephone call are left to the bona fide judgment of the financial institution. Without more specific guidance or new defining regulations, this may be a reasonable place for this requirement to be. However, since these telephone calls represent an especially important segment of suspicious activity, the compiling of data around these calls and the provision of more specific guidance on why some things “require” attention, how the communication should take place and what an “appropriate” law enforcement authority would be, form a path worthy of consideration.

Copyright © 2017 The Bureau of National Affairs, Inc. All Rights Reserved.

Request Securities & Capital Markets on Bloomberg Law