Financial institutions’ ability to share suspicious activity reports (“SARs”) within the corporate organizational structure serves as an important tool for Bank Secrecy Act compliance and risk avoidance. FinCEN began 2017 by reminding casinos of their ability to share information under this rule.
Subject to certain limitations, casinos may share with domestic parents and affiliates suspicious activity reports and related information under the Bank Secrecy Act (“BSA”). FIN-2017-G001 (January 4, 2017). Under this guidance, such sharing assists casinos in discharging their responsibilities with respect to enterprise-wide risk management and compliance, and facilitates a casino’s ability to identify suspicious transactions. This guidance also reinforces FinCEN’s 2014 Advisory to financial institutions regarding promoting a culture of compliance, which is achieved in part by ensuring information is shared throughout the organization. FIN-2014-A007.
Permissible Sharing
Casinos are expressly permitted to disclose SARs to FinCEN, law enforcement agencies, and Federal and state regulators or tribal authorities that examine casinos for compliance with the BSA. 31 CFR § 1021.320(e). Casinos may also share facts and documents upon which a SAR is based with another financial institution for filing a joint SAR, § 1021.320(e)(1)(ii)(A)(2), and share a SAR or information revealing the existence of a SAR “within a casino’s corporate organizational structure for purposes consistent with Title II of the [BSA] as determined by regulations or in guidance.” § 320(e)(1)(ii)(B).
With this guidance, FinCEN defines the “corporate organizational structure.” A “parent” is as an entity that controls the casino filing the SAR; an “affiliate” is a financial institution required under BSA rules to report suspicious transactions that is controlled by, or under common control with, the casino filing the SAR.
Important Limitations on Sharing
Casinos and their agents are not authorized to disclose a SAR or any information that would reveal the existence of a SAR to anyone outside a limited set of exceptions, described above. Under no circumstances may this information be shared with a subject of a SAR. In addition, casinos may not share SARs or revealing information with:
- Parents or affiliates located outside the U.S.;
- Individuals or entities within the organization structure who perform functions unrelated to gaming, g. shops, restaurants, entertainment;
- A financial institution without its own independent SAR-filing obligation; or
- A money services business co-located with a casino but not an affiliate.
Further, a domestic parent or affiliate receiving SAR-related information from a casino may not forward that information to another affiliate, even if that affiliate is subject to SAR-reporting obligations.
Practical Impact
In formulating its overall compliance program, a casino should be mindful of its ability to share this SAR information to effectively identify risk and ensure operational information is understood by those in a position to mitigate identified risks. However, given the prohibitions on SAR information sharing—and potential attendant liability—casinos should be mindful to have policies, procedures and internal controls in place to ensure SAR confidentiality is preserved.