FR2230_20190531_omb

Supporting Statement for the
Suspicious Activity Report
(FR 2230; OMB No. 7100-0212)
Summary
The Board of Governors of the Federal Reserve System (Board), under authority
delegated by the Office of Management and Budget (OMB), has extended for three years, with
revision, the interagency Suspicious Activity Report (SAR) (FR 2230; OMB No. 7100-0212).
Certain institutions supervised by the Board are required, pursuant to the Bank Secrecy Act
(BSA) and the Board’s regulations, to file a SAR to report known or suspected violations of
federal law or a suspicious transaction related to a money laundering activity or a violation of the
BSA. Institutions file a SAR electronically through a secure network created and maintained by
the administrator of the BSA, the Department of the Treasury’s Financial Crimes Enforcement
Network (FinCEN).
The Board revised the FR 2230 to be consistent with changes implemented by FinCEN,
which had added, removed, or revised several data fields on the electronically filed SAR. In
addition, FinCEN had changed the file format for electronic submission of the SAR by batch
filers from ASCII based fixed-length delimited file to an XML based file. The Board has not
adopted any changes to the SAR regulatory reporting criteria. Institutions will continue to
follow Regulation H (12 CFR 208.62) and filing instructions in determining when to file a report
and what information should be included on the report. The Board does not anticipate any
change to the burden hours per response. The estimated total annual burden for all Board
supervised institutions is 439,520 hours.
Background and Justification
Since 1996, as mandated by the BSA, the federal banking agencies1 and FinCEN have
required certain types of financial institutions to report known or suspected violations of law and
suspicious transactions. To fulfill these requirements, supervised banking organizations file
SARs.2 Law enforcement agencies use the information submitted in the reports to initiate
investigations and the Board uses the information in the examination and oversight of supervised
institutions.
The Board’s suspicious activity reporting rules apply to state member banks, Edge and
agreement corporations, certain U.S. branches, agencies, and representative offices of foreign

1

The Board, Office of the Comptroller of the Currency, Federal Deposit Insurance Corporation, and National
Credit Union Administration.
2
In 1996, the Board together with the other federal banking agencies issued nearly identical regulations to
implement the SAR process for banking organizations.

banks operating in the United States3 and bank holding companies or any nonbank subsidiary
thereof, or a foreign bank that is subject to the BHC Act or any nonbank subsidiary of such
foreign bank operating in the United States. The Board is only responsible for the paperwork
burden imposed on these institutions. Other federal banking agencies account for the paperwork
burden for the institutions they supervise.
Since 1996, the reports have been revised several times. In 2012, FinCEN developed the
current SAR that combined all previous versions of paper SAR forms into one electronic
collection. Use of the electronic SAR became mandatory on April 1, 2013, and is available
through FinCEN’s BSA E-Filing System.
Description of Information Collection
State member banks, bank holding companies and their nonbank subsidiaries, Edge and
agreement corporations, and the U.S. branches and agencies, representative offices, and nonbank
subsidiaries of foreign banks supervised by the Board follow the SAR instructions to determine
when a SAR should be filed and what information should be included on the SAR. Banks
provide the following information when completing a SAR: the name of the financial institution
where the suspicious activity occurred; subject information such as name, date of birth, address,
or occupation; information on the type of suspicious activity such as amount involved, type(s) of
suspicious activity, or product types or mechanisms involved; and a narrative that provides a
sufficient description of the activity reported as well as the basis for filing.
Reporting Criteria
A banking institution must report certain known or suspected violations of federal law
and suspicious transactions. An institution is generally required to file a SAR with respect to:
 suspicious activity of any amount involving an insider
 violations aggregating $5,000 or more where a suspect can be identified
 violations aggregating $25,000 or more regardless of a potential suspect
 violations aggregating $5,000 or more that involve potential money laundering or
violations of the BSA
An institution need not file a SAR for an attempted or committed burglary or robbery
reported to the appropriate law enforcement agencies.

3

See 12 CFR 208.62 (state member banks); 12 CFR 211.5(k) (Edge and agreement corporations); 12 CFR
211.24(f) (a branch, agency, or representative office of a foreign bank operating in the United States, except for a
federal branch or a federal agency or a state branch that is insured by the Federal Deposit Insurance Corporation
(FDIC)); 12 CFR 225.4(f) (bank holding companies, nonbank subsidiaries of a bank holding company, foreign
banks subject to the Bank Holding Company Act, and nonbank subsidiaries of such a foreign bank). The Board’s
suspicious activity reporting rules do not apply to a branch or agency of a foreign bank operating in the United
States if it is a federal branch or a federal agency or a state branch that is insured by the FDIC.

2

Proposed Revisions
On July 27, 2018, FinCEN implemented the new version 1.2 of the SAR, which added,
removed, or revised several data fields.4 The FinCEN revisions added or modified types and
subtypes of suspicious activities, added new fields related to IP address information, and added
new cyber event indicators. These revisions were made to ensure the collection of appropriate
and current information in order to aid law enforcement in combating cyber-events and cyberenabled crime. The Board has adopted the revisions made by FinCEN. Please see the appendix
for a detailed listing of all revisions. With respect to the file format changes for electronic
submission, the BSA E-Filing System now only accepts the new SAR (v1.2) and the new XML
based batch format.
Time Schedule for Information Collection
The Board’s suspicious activity reporting rules require that a SAR be filed no later than
30 calendar days from the date of the initial detection of facts that may constitute a basis for
filing a SAR. If no suspect can be identified, the time period for filing a SAR is extended to
60 days. Respondents file online: https://bsaefiling.fincen.treas.gov/main.html.
Legal Status
The FR 2230 is authorized pursuant to the Federal Reserve Act (12 U.S.C. 248(a)(1),
602, and 625), Federal Deposit Insurance Act (12 U.S.C. 1818(s)), Bank Holding Company Act
of 1956 (12 U.S.C. 1844(c)), and International Banking Act of 1978 (12 U.S.C. 3105(c)(2) and
3106(a)). The FR 2230 is mandatory. SARs are confidential and exempt from Freedom of
Information Act (FOIA) disclosure by 31 U.S.C. 5319, which specifically provides that SARs
“are exempt from disclosure under section 552 of title 5” and FOIA exemption 3 (5 U.S.C.
552(b)(3)) (matters “specifically exempted from disclosure by statute”).
Consultation Outside the Agency
As set forth above, the SAR was originally developed in 1996 by an interagency group
that consisted of the federal banking agencies, U.S. Departments of Justice and Treasury, and
several law enforcement agencies. The general framework of the SAR report and any revisions
to the SAR data elements are discussed on an interagency basis. The current revisions to the
SAR data elements were discussed in the interagency Data Management Council led by FinCEN,
of which the Board is a member.
Public Comments
On February 5, 2019, the Board published an initial notice in the Federal Register
(84 FR 1732) requesting public comment for 60 days on the extension, with revision, of the
FR 2230. The comment period for this notice expired on April 8, 2019. The Board did not

4

The notice announcing the final submission to OMB was published in the Federal Register November 28, 2017
(82 FR 56325).

3

receive any comments. On May 15, 2019, the Board published a final notice in the Federal
Register (84 FR 21777).
Estimate of Respondent Burden
The burden per institution varies depending on the nature of the activity reported.
Between January 1, 2017, and December 31, 2017, 6,698 state member banks, bank and financial
holding companies, Edge and agreement corporations, and U.S. branches and agencies,
representative offices, and nonbank subsidiaries of foreign banks filed 293,013 SARs.5 Based on
this data the annual reporting burden hours for all Federal Reserve regulated entities is estimated
to be 439,520. Because there are no new regulatory requirements or changes to the requirements
related to suspicious activity reporting, the Board believes that no additional burden is associated
with these changes to the filing itself. These reporting requirements represent approximately
3.97 percent of the Board’s total paperwork burden.

FR 2230
All Respondents

Estimated
number of
respondents6
6,698

Estimated
Annual
average hours
frequency
per response
43.75

1.5

Estimated
annual burden
hours
439,520

The estimated total annual cost to the public for this information collection is $25,316,352.7
Sensitive Questions
This collection of information contains no questions of a sensitive nature, as defined by
OMB guidelines.
Estimate of Cost to the Federal Reserve System
The cost to the Federal Reserve System is negligible. The Board, as well as the other
federal supervisors of financial institutions, distributes the reporting form in electronic format.
The Federal Reserve System has minimal data collection costs associated with SAR filings, as
the filings go directly to FinCEN which acts as the data base manager for the federal banking
agencies and makes the information available to the Board electronically.
5

Number of SARs received by FinCEN between January 1, 2017, and December 31, 2017, by institutions that
listed the Federal Reserve as their regulator.
6
Of these respondents, 548 are considered small entities as defined by the Small Business Administration (i.e.,
entities with less than $550 million in total assets), www.sba.gov/document/support--table-size-standards. The
design of the FinCEN SAR is such that only the fields normally associated with the filing institution are displayed.
This design minimizes the time required to complete the report and thus the impact on small businesses.
7
Total cost to the public was estimated using the following formula: percent of staff time, multiplied by annual
burden hours, multiplied by hourly rates (30% Office & Administrative Support at $19, 45% Financial Managers at
$71, 15% Lawyers at $69, and 10% Chief Executives at $96). Hourly rates for each occupational group are the
(rounded) mean hourly wages from the Bureau of Labor and Statistics (BLS), Occupational Employment and Wages
May 2018, published March 29, 2019, www.bls.gov/news.release/ocwage.t01.htm. Occupations are defined using
the BLS Occupational Classification System, www.bls.gov/soc/.

4

Appendix
Detailed list of Revisions
Effective July 27, 2018, FinCEN has added, removed, or revised several electronic data
fields in the SAR filed by financial institutions required to file such reports under the BSA.
FinCEN did not propose any new regulatory requirements or changes to the requirements related
to suspicious activity reporting. The data fields reflect the filing requirement for all filers of
SARs. The changes to the SAR are described below by form Part.
Type of Filing



Item 1e remove the reference to “document control number.”
Add new item 2 “Filing Institution Note to FinCEN” followed by a text field with 100
character limit. This item allows the filer to identify reports filed in response to
geographical targeting orders and BSA advisories etc.

Part I – Subject Information


Item 24j, remove ‘‘no relationship to institution’’ option.

Part II – Suspicious Activity Information























Items 32a and b, add “or cancels” to the current item.
Item 32c, remove the current item.
Item 34b add “Advanced Fee’’ and remove “Business loan.”
Item 34i, remove “mass marketing” and replace with “Ponzi Scheme.”
Item 34l, add “Securities Fraud.”
Item 35, change the section title to “Gaming Activities.”
Item 35a, replace the current item with “Chip walking.”
Item 35b, replace the current item with “Minimal gaming with large transactions.”
Item 35d, add “Unknown source of chips.”
Item 36b, remove the current item and replace with “Funnel account.”
Item 37d, add “Provided questionable or false identification.”
Item 38g, insert “Human Trafficking/Smuggling.”
Item 38i, remove the current item.
Item 38p, add “Transaction(s) involving foreign high risk jurisdiction.”
Item 38q, remove the current item.
Item 40b, remove “wash trading” from current item and add as a new item e.
Item 41a, add new “Application Fraud.”
Item 41c, add “Foreclosure/Short sale fraud.”
Item 41e, add “origination fraud” and remove “reverse mortgage fraud.”
Item 42, add as new category “Cyber-event.”
Add new item 42a, “Against the Financial Institution(s).”
Add new item 42b, “Against the Financial Institution’s customer(s).”

5

































Add new item 42z, “Other” with the associated text field.
Item 43n, remove the term “Penny Stocks.”
Add item 48a, Date field (yyyy/mm/dd).
Add item 48b, Time field (hh:mm:ss in UTC).
Add new item 49, “Cyber-event Indicators” (Multiple entries up to 99).
Add new item 49a, “Command & Control IP Address.”
Add new item 49a1, event value text field.
Add new item 49a2, event value text field, date associated with the event.
Add new item 49a3, event value text field, timestamp associated with the event, UTC
time hh:mm:ss.
Add new item 49b, “Command & Control URL/Domain.”
Add new item 49b1, event value text field.
Add new item 49c, Malware MD5, Malware SHA–1, or Malware SHA–256.
Add new item 49c1, event value text field.
Add new item 49d, “Media Access Control (MAC) Address.”
Add new item 49d1, event value text field.
Add new item 49e, “Port.”
Add new item 49e1, event value text field.
Add new item 49f, “Suspicious Email Address.”
Add new item 49f1, event value text field.
Add new item 49g, “Suspicious Filename.”
Add new item 49g1, event value text field.
Add new item 49h, “Suspicious IP Address.”
Add new item 49h1, event value text field.
Add new item 49h2, event value Date associated with the event.
Add new item 49h3, event value timestamp (UTC time hh:mm:ss).
Add new item 49i, “Suspicious URL/Domain.”
Add new item 49i1, event value text field.
Add new item 49j, “Targeted System.”
Add new item 49j1, event value text field.
Add new item 49z, “Other” text field.
Add new item 49z1, event value text field.

Part IV – Filing Institution Contact Information


Increase the field length for Part IV, Item 93, “Designated contact office,” to 50
characters.

6