(a) Suspicious activity reports required. An FDIC-supervised institution shall file a suspicious activity report with the appropriate federal law enforcement agencies and the Department of the Treasury, in accordance with the form's instructions, by sending a completed suspicious activity report to FinCEN in the following circumstances:

(1) Insider abuse involving any amount. Whenever the FDIC-supervised institution detects any known or suspected federal criminal violation, or pattern of criminal violations, committed or attempted against the FDIC-supervised institution or involving a transaction or transactions conducted through the FDIC-supervised institution, where the FDIC-supervised institution believes it was either an actual or potential victim of a criminal violation, or series of criminal violations, or that the FDIC-supervised institution was used to facilitate a criminal transaction, and the FDIC-supervised institution has a substantial basis for identifying one of the FDIC-supervised institution's directors, officers, employees, agents, or other institution-affiliated parties as having committed or aided in the commission of the criminal violation, regardless of the amount involved in the violation;

(2) Transactions aggregating $5,000 or more where a suspect can be identified. Whenever the FDIC-supervised institution detects any known or suspected federal criminal violation, or pattern of criminal violations, committed or attempted against the FDIC-supervised institution or involving a transaction or transactions conducted through the FDIC-supervised institution, and involving or aggregating $5,000 or more in funds or other assets, where the FDIC-supervised institution believes it was either an actual or potential victim of a criminal violation, or series of criminal violations, or that the FDIC-supervised institution was used to facilitate a criminal transaction, and the FDIC-supervised institution has a substantial basis for identifying a possible suspect or group of suspects. If it is determined prior to filing this report that the identified suspect or group of suspects has used an “alias”, then information regarding the true identity of the suspect or group of suspects, as well as alias identifiers, such as driver's license or social security numbers, addresses and telephone numbers, must be reported;

(3) Transactions aggregating $25,000 or more regardless of potential suspects. Whenever the FDIC-supervised institution detects any known or suspected federal criminal violation, or pattern of criminal violations, committed or attempted against the FDIC-supervised institution or involving a transaction or transactions conducted through the FDIC-supervised institution, involving or aggregating $25,000 or more in funds or other assets, where the FDIC-supervised institution believes it was either an actual or potential victim of a criminal violation, or series of criminal violations, or that the FDIC-supervised institution was used to facilitate a criminal transaction, even though the FDIC-supervised institution has no substantial basis for identifying a possible suspect or group of suspects; or

(4) Transactions aggregating $5,000 or more that involve potential money laundering or violations of the Bank Secrecy Act. Any transaction (which for purposes of this paragraph (a)(4) means a deposit, withdrawal, transfer between accounts, exchange of currency, loan, extension of credit, purchase or sale of any stock, bond, certificate of deposit, or other monetary instrument or investment security, or any other payment, transfer, or delivery by, through, or to a financial institution, by whatever means effected) conducted or attempted by, at or through the FDIC-supervised institution and involving or aggregating $5,000 or more in funds or other assets, if the FDIC-supervised institution knows, suspects, or has reason to suspect that:

(i) The transaction involves funds derived from illegal activities or is intended or conducted in order to hide or disguise funds or assets derived from illegal activities (including, without limitation, the ownership, nature, source, location, or control of such funds or assets) as part of a plan to violate or evade any federal law or regulation or to avoid any transaction reporting requirement under federal law;

(ii) The transaction is designed to evade any regulations promulgated under the Bank Secrecy Act; or

(iii) The transaction has no business or apparent lawful purpose or is not the sort of transaction in which the particular customer would normally be expected to engage, and the FDIC-supervised institution knows of no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction.

(b) Time for reporting.

(1) An FDIC-supervised institution shall file the suspicious activity report no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing a suspicious activity report. If no suspect was identified on the date of detection of the incident requiring the filing, an FDIC-supervised institution may delay filing a suspicious activity report for an additional 30 calendar days to identify a suspect. In no case shall reporting be delayed more than 60 calendar days after the date of initial detection of a reportable transaction.

(2) In situations involving violations requiring immediate attention, such as when a reportable violation is ongoing, the FDIC-supervised institution shall immediately notify, by telephone, an appropriate law enforcement authority and the appropriate FDIC regional office (Division of Supervision and Consumer Protection (DSC)) in addition to filing a timely report.

(c) Reports to state and local authorities. An FDIC-supervised institution is encouraged to file a copy of the suspicious activity report with state and local law enforcement agencies where appropriate.

(d) Exemptions.

(1) An FDIC-supervised institution need not file a suspicious activity report for a robbery or burglary committed or attempted, that is reported to appropriate law enforcement authorities.

(2) An FDIC-supervised institution need not file a suspicious activity report for lost, missing, counterfeit, or stolen securities if it files a report pursuant to the reporting requirements of 17 CFR 240.17f-1.

(e) Retention of records. An FDIC-supervised institution shall maintain a copy of any suspicious activity report filed and the original or business record equivalent of any supporting documentation for a period of five years from the date of filing the suspicious activity report. Supporting documentation shall be identified and maintained by the FDIC-supervised institution as such, and shall be deemed to have been filed with the suspicious activity report. An FDIC-supervised institution must make all supporting documentation available to appropriate law enforcement authorities upon request.

(f) Notification to board of directors. The management of an FDIC-supervised institution shall promptly notify its board of directors, or a committee thereof, of any report filed pursuant to this section. The term “board of directors” includes the managing official of a foreign bank having an insured branch for purposes of this part.

(g) Confidentiality of suspicious activity reports. Suspicious activity reports are confidential. An FDIC-supervised institution subpoenaed or otherwise requested to disclose a suspicious activity report or the information contained in a suspicious activity report shall decline to produce the suspicious activity report or to provide any information that would disclose that a suspicious activity report has been prepared or filed citing this part, applicable law (e.g., 31 U.S.C. 5318(g)), or both, and notify the appropriate FDIC regional office (Division of Supervision and Consumer Protection (DSC)).

(h) Safe harbor. The safe harbor provisions of 31 U.S.C. 5318(g), which exempts an FDIC-supervised institution that makes a disclosure of any possible violation of law or regulation from liability under any law or regulation of the United States, or any constitution, law or regulation of any state or political subdivision, cover all reports of suspected or known criminal violations and suspicious activities to law enforcement and financial institution supervisory authorities, including supporting documentation, regardless of whether such reports are filed pursuant to this part or are filed on a voluntary basis.

[61 FR 6099, Feb. 16, 1996, as amended at 85 FR 3247, Jan. 21, 2020]