The Financial Crimes Enforcement Network (FinCEN) announced changes to the Suspicious Activity Reports Electronic Data Fields on February 2, 2017. On January 26, 2018 FinCEN issued an Important Notice to E-Filers that announces an update to the Suspicious Activity Report (SAR). The 2018 announcement states, ” the FinCEN Suspicious Activity Report (SAR) available on the BSA E-Filing System will be updated to adhere to the changes defined in Federal Register notice posted on February 2nd, 2017.
The changes include:
- A new file format for batch filers;
- A new text field to alert FinCEN that a FinCEN SAR is being filed in response to a current specific geographic targeting order (GTO), advisory, or other activity;
- A new “Cyber Event” suspicious activity type category;
- New/Modified subtype selections associated with the following categories of suspicious activities: Structuring, Fraud, Gaming activities (formally labeled “Casinos”), Money laundering, Identification/Documentation, Other suspicious activities, Securities/Futures/Options, and Mortgage fraud.
- New text fields to accompany the IP Address field in order to record the date and/or timestamp of the first instance of the reported IP address;
- New category of fields to record up to 99 cyber events associated with the suspicious activity. The following cyber event indicators are added along with the event value (and date and timestamp, if applicable): Command & Control IP address; Command & Control URL/Domain; Malware MD5, Malware SHA-1, or Malware SHA-256; Media Access Control (MAC) Address; Port; Suspicious e-mail address; Suspicious filename; Suspicious IP Address; Suspicious URL/Domain; Targeted system; and Other;
- New type selections associated with the product type(s) involved in the suspicious activity: Deposit accounts; Microcap securities; and
- New subtype selections associated with the type of securities and futures institution in Part III (Financial institution where activity occurred) and Part IV (Filing institution).
A copy of the January 26, 2018 notice is available at: https://bsaefiling.fincen.treas.gov/docs/SARXMLAnnouncement_Jan2018.pdf
A copy of the February 2, 2017 announcement is available at: https://www.gpo.gov/fdsys/pkg/FR-2017-02-02/pdf/2017-02235.pdf