The Suspicious Activity Report that is Not Suspicious – Marijuana Limited

As a former Bank Secrecy Act (BSA) Officer I understand that BSA requirements are intended to ensure the integrity of the banking system and detect and deter money laundering. My experience has also shown me that the most important output of a BSA program is its suspicious activity reports (SAR). A well prepared SAR will provide actionable intelligence for law enforcement to use in starting or bolstering investigations and prosecutions.

Banks, bank holding companies, and their subsidiaries (“Banks”) are required by federal regulations to file a SAR with respect to:

• Criminal violations involving insider abuse in any amount.
• Criminal violations aggregating $5,000 or more when a suspect can be identified.
• Criminal violations aggregating $25,000 or more regardless of a potential suspect.
• Transactions conducted or attempted by, at, or through the bank (or an affiliate) and aggregating $5,000 or more, if the bank or affiliate knows, suspects, or has reason to suspect that the transaction:
• May involve potential money laundering or other illegal activity (e.g., terrorism financing). 
• Is designed to evade the BSA or its implementing regulations. 
• Has no business or apparent lawful purpose or is not the type of transaction that the particular customer would normally be expected to engage in, and the bank knows of no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction.

This all makes sense other than the outdated thresholds, but I digress.

Money Service Businesses (MSB) have similar requirements at a lower threshold:

A report must be filed when a transaction that is conducted by, at or through the MSB is both:

Suspicious, and $2,000 or more. Suspicious:

• A transaction must be reported if the MSB knows, suspects or has reason to suspect that the transaction (or a pattern of transactions of which the transaction is a part):
• Involves funds derived from illegal activity or is intended or conducted in order to hide or disguise funds or assets derived from illegal activity, or is
• Designed to evade the requirements of the Bank Secrecy Act, whether through structuring or other means, or
• Serves no business or apparent lawful purpose, and the reporting business knows of no reasonable explanation for the transaction after examining all available facts.

Using these standards we make the next step to the requirements around “Marijuana Limited” SAR Filings for Banks and MSBs (“Financial Institution” or “FI”). None of the specific requirements indicate that there is suspicious activity as defined above (other than the Federal Law violation elephant in the room). In fact it appears to only be intended only for law enforcement awareness:

A financial institution providing financial services to a marijuana-related business that it reasonably believes, based on its customer due diligence, does not implicate one of the Cole Memo priorities or violate state law should file a “Marijuana Limited” SAR. The content of this SAR should be limited to the following information: (i) identifying information of the subject and related parties; (ii) addresses of the subject and related parties; (iii) the fact that the filing institution is filing the SAR solely because the subject is engaged in a marijuana-related business; and (iv) the fact that no additional suspicious activity has been identified. Financial institutions should use the term “MARIJUANA LIMITED” in the narrative section.

In case it wasn’t completely clear the requirements above state: the filing institution is filing the SAR solely because the subject is engaged in a marijuana-related business; and (iv) the fact that no additional suspicious activity has been identified. This is an explicit requirement to file a SAR without having to meet any of the SAR filing violation or dollar threshold requirements outlined in the general SAR filing regulation. Therefore the only reason that a Marijuana Limited SAR should be filed is if the FI has knowledge that they are banking or processing transactions for a state legal marijuana business. If there is any actual suspicious activity identified the FI should file a “Marijuana Priority” SAR.

We have established that a Marijuana Limited SAR is for awareness rather than to report suspicious activity but that does not alleviate the need to follow continuing activity requirements. Per the “BSA Expectations Regarding Marijuana Related Business”: financial institution should follow FinCEN’s existing guidance on the timing of filing continuing activity reports for the same activity initially reported on a “Marijuana Limited” SAR. The continuing activity report may contain the same limited content as the initial SAR, plus details about the amount of deposits, withdrawals, and transfers in the account since the last SAR. However, if, in the course of conducting customer due diligence (including ongoing monitoring for red flags), the financial institution detects changes in activity that potentially implicate one of the Cole Memo priorities or violate state law, the financial institution should file a “Marijuana Priority” SAR.

Following the guidance above the FI will continue to file Marijuana Limited SARs indefinitely even though they are not reporting any suspicious activity. Indefinitely.

It is still unclear to me what if any activity should be reported as the amount of suspicious activity (in field 26 of the SAR) for the reporting period. If the intent of the guidance is to report activity that is tainted by the fact that the business is federally illegal then it would likely be required to include all activity that passed through the account. Each subsequent continuing activity SAR would include the same for the following period.

This would create an indefinite string of SARs filed without any suspicious activity. The amount of unnecessary SARs filed each year is already too high. What I consider unnecessary is not the point of this article but suffice it to say that the current regulatory environment has FIs filing questionable or defensive SARs just because it is not worth defending a no-SAR investigation.

Pursuant to Section 6216 of the Anti-Money Laundering Act of 2020 (AMLA) FinCEN published a request for information (RFI) and comment on December 15, 2021.

The Financial Crimes Enforcement Network (FinCEN) is issuing this request for information (RFI) to solicit comment on ways to streamline, modernize, and update the anti-money laundering and countering the financing of terrorism (AML/CFT) regime of the United States. FinCEN seeks comment on ways to modernize risk-based AML/CFT regulations and guidance, issued pursuant to the Bank Secrecy Act (BSA), so that they, on a continuing basis, protect U.S. national security in a cost-effective and efficient manner.

The RFI breaks down the request via “Questions for Comment” many of which appear to apply to the Marijuana Limited SAR.

IV-B-3: Are there BSA reporting or recordkeeping requirements that you believe do not provide information that is highly useful in countering financial crimes? If so, what reports or records, and why?

As noted above the continuous filing of Marijuana Limited SARs with no material changes do not provide any useful information to law enforcement. One might argue that by continuously filing and aggregating the amount of deposits and withdrawals etc. that it might at some point reach a threshold that would interest law enforcement. However if a law enforcement officer read the SAR they would see there is no suspicious activity and it would be a waste of their time.

IV-C-I-9: Are there BSA regulations or guidance that do not promote risk-based safeguards or that no longer fulfill their original purpose? If so, which regulations or guidance, and what changes do you recommend?

I am speculating on the original purpose of the Marijuana Limited SAR but it appears to have been created so that FIs would report state legal marijuana business and create a database for FinCEN. Even this is redundant on some level as state legal marijuana businesses must be licensed and lists of licensees are published on state licensing websites. Noting above that there is no suspicious activity reported in these SARs the requirements do not seem risk based. Even if they were when initially implemented, the risk seems to have waned over time. If nothing else there is little if any risk based need to file a supplemental Marijuana Limited SAR every 120 days.

IV-C-III-16: Do any BSA regulations or guidance require or encourage resources be allocated inefficiently based on the level of risk that the regulations or guidance are intended to prevent or mitigate? If so, which regulations or guidance, and what changes would you recommend FinCEN make?

The filing of any type of SAR is difficult and time consuming. Even the most simple fact pattern such as structuring requires diligence in completing all the SAR fields correctly, properly aggregating, quality assurance etc., etc. The Marijuana Limited SAR only provides awareness and can get very cumbersome in regards to aggregating and reporting account activity. If we concede that an initial Marijuana Limited SAR is useful for law enforcement awareness, it is hard to make that same concession on a subsequent continuing activity filing. There is no new intelligence provided to law enforcement. This would appear to be an inefficient use of resources that could be repurposed to more risky endeavors.

In conclusion it is my assertion that the Marijuana Limited SAR has limited value and goes against the only reason to file a SAR; to report suspicious activity. If the initial filing of a Marijuana Limited SAR must be retained, then at least the need for a subsequent continuing activity SAR should be eliminated. If there is a material change that should be reported to law enforcement another Marijuana Limited SAR could be filed. A continuous string of Marijuana Limited SARs with no material changes is as noted above: not useful, not risk based, and inefficient. FinCEN, it’s time to make a change.