Investigating Unusual Activity and Filing the Suspicious Activity Report

Welcome to the STR Decision-Making Journey!

Hello! If you have ever wondered what happens after an AML investigator finds something "fishy," you are in the right place. This chapter covers one of the most critical parts of the CAMS exam: The Suspicious Transaction Report (STR) process. Think of the STR as the bridge between a financial institution and law enforcement. Don't worry if this seems like a lot of legal jargon at first—we are going to break it down step-by-step using simple logic and real-world scenarios. By the end of these notes, you will know exactly how a "red flag" turns into a report for the authorities!

1. Identifying the "Need to Know": What Triggers an STR?

The process doesn't start with a report; it starts with an alert. An alert is like a smoke detector going off. It doesn't always mean there is a fire, but it means you must go check the kitchen!

Common Triggers for STR Investigations:
• Automated Monitoring: Computer software flags a transaction that is "out of character" for a customer (e.g., a student suddenly receiving \( \$100,000 \)).
• Referrals from Staff: A teller or bank clerk notices a customer acting nervously or asking strange questions about reporting limits.
• External Tips: Law enforcement sends a subpoena or a "tip" about a specific individual.
• Media Reports: You read in the news that one of your big corporate clients is being investigated for fraud.

Quick Tip: Not every alert becomes an STR! Most alerts are cleared once the investigator looks at the facts. Only the truly "suspicious" ones move forward.

2. The Decision-Making Process: To File or Not to File?

This is where the investigator becomes a detective. You have to decide: Is this activity suspicious?

The Evaluation Stage

When investigating, you aren't trying to prove a crime happened. That is the job of the police. Your job is to identify suspicious activity. Suspicion is a "fluid" concept, but it generally means the activity has no apparent economic, business, or even lawful purpose.

The Three Pillars of Decision-Making:
1. Is it unusual? Does it deviate from the customer’s normal behavior?
2. Is there a logical explanation? Did the customer just sell their house? If yes, that \( \$500,000 \) deposit makes sense!
3. Is there a red flag? Does the behavior match known money laundering patterns (like structuring or round-tripping)?

Common Mistake to Avoid:

Don't wait for "Absolute Proof." Many students think they need a confession to file an STR. No! In the world of CAMS, if you have a "reasonable ground" to suspect, you must file. If you wait for 100% proof, the money will be gone before the police can act.

Key Takeaway: The decision to file should be documented thoroughly. Even if you decide not to file, you must write down why you felt the activity was okay. This protects the bank during audits!

3. Writing a High-Quality STR: The "5 Ws"

Once you decide to file, you have to write the report. The most important part of an STR is the Narrative. Law enforcement officers read hundreds of these, so your report must be clear and concise.

To write a perfect narrative, remember the 5 Ws:
• Who: Who is involved? (Names, addresses, occupations, and account numbers).
• What: What instruments were used? (Cash, wire transfers, money orders, or crypto).
• When: When did the activity happen? (Give specific dates and timeframes).
• Where: Where did the money go? (Include the branch location and the destination country).
• Why: Why is it suspicious? (Explain the "logic" of the suspicion—e.g., "The customer made 10 deposits of \( \$9,900 \) to avoid the \( \$10,000 \) reporting limit").

Analogy: The 5 Ws are like a Recipe

If you are writing a recipe for a cake, you can't just say "Put stuff in a bowl." You need to say Who (the baker), What (flour, eggs), When (bake for 30 mins), Where (in the oven), and Why (to make a birthday treat). An STR is a recipe for an investigation!

4. Filing Deadlines and Confidentiality

Once you find something suspicious, you can't sit on it forever. Most jurisdictions have strict deadlines (often 30 days from the date of discovery). If you miss the deadline, the bank can face huge fines.

Tipping Off: The Golden Rule

Never, ever tell the customer that you filed an STR. This is called Tipping Off, and in many countries, it is a criminal offense that can land you in jail.

Did you know? If a customer asks, "Are you reporting this to the government?", you should be trained on how to answer neutrally without confirming or denying. The goal is to keep the investigation a secret so the criminal doesn't run away.

5. Post-Filing Actions: What Happens Next?

Filing the report isn't the end of the story. The bank has to decide what to do with the customer.

1. Keep or Close? Does the bank keep the customer's account open? If the risk is too high, the bank may exit the relationship (close the account).
2. Cooperating with Authorities: If law enforcement calls, you must cooperate, but usually, you need a summons or subpoena before handing over actual documents.
3. Ongoing Monitoring: If you keep the account open, you must watch it even more closely. This is often called "High-Risk Monitoring."

6. Summary Quick Review

Check your knowledge:
• The Decision: Based on "reasonable suspicion," not "absolute proof."
• The Narrative: Must include the 5 Ws (Who, What, When, Where, Why).
• Confidentiality: Tipping off is a crime.
• Documentation: Always record the reason why you chose to file or NOT to file.

Memory Aid (The "AIR" Mnemonic):
A - Alert (Something looks weird)
I - Investigation (Check the facts and the 5 Ws)
R - Report (File the STR and don't tip them off!)

Don't worry if this feels like a lot to remember! Just keep focusing on the "Why." If you understand why the government needs this information, the "How" of filing the report becomes much easier to learn. You've got this!

Welcome to the Investigation!

Welcome to one of the most exciting parts of being an AML specialist! If the rest of the CAMS curriculum is about the rules of the game, this chapter is about the "detective work." We are going to learn how to follow the breadcrumbs left by potential money launderers. Don't worry if this seems like a lot to take in; we will break it down step-by-step. By the end of this, you’ll understand how an investigation starts, how to conduct it, and how to finish it properly.

Section 1: Why Do We Start an Investigation?

An investigation doesn't just happen out of nowhere. It usually begins with a trigger. Think of a trigger like a smoke alarm: it doesn't always mean there is a fire, but it means you must go and check the room.

Common Triggers include:
• Automated Alerts: Your bank’s software flags a transaction that looks unusual (like a huge cash deposit).
• Internal Referrals: A front-line teller notices a customer acting strangely or asking odd questions.
• External Inquiries: Law enforcement or regulators ask about a specific person or account.
• Negative News: You see a report in the media that one of your clients has been arrested for fraud.

Quick Review: An investigation is a search for the truth behind a "red flag." Our goal is to determine if the activity is suspicious or if there is a logical, legal explanation.

Section 2: The Investigation Process - Step by Step

When you start an investigation, you need a plan. You can't just jump in! Here is the standard flow:

1. Initial Review and Planning

Before diving into the data, look at what triggered the alert. Is it a repeat offender? Is this a high-risk customer? Determine the scope (how far back you will look) and the objective (what you are trying to prove).

2. Gathering Evidence

This is where you collect your "puzzle pieces." You should look at:
• Internal Records: Account opening documents (KYC), transaction history, and previous SARs (Suspicious Activity Reports).
• External Records: Public records, social media (for business context), and news articles.
• The "Paper Trail": Copies of checks, wire transfer instructions, and deposit slips.

3. Analyzing the Data

Now, you look for patterns. Are there "round-dollar" amounts? Is money moving in and out immediately (layering)?
Analogy: Imagine someone says they are a "student," but they are receiving $50,000 wire transfers every week from a foreign country. The profile doesn't match the activity.

4. Making a Decision

At the end, you must decide: Is this suspicious? If yes, you file a SAR/STR. If no, you close the case with a clear explanation of why it’s not suspicious.

Common Mistake to Avoid: Never close an investigation just because the customer is "nice" or "well-known." Base your decision on the data and facts, not on personal feelings!

Section 3: Interviewing Techniques

Sometimes, you need to talk to people to get the full story. This could be a bank employee or, in some cases, the customer (though you must be very careful not to "tip them off").

How to conduct a successful interview:

• Be Prepared: Know the facts before you walk in.
• Ask Open-Ended Questions: Instead of asking "Did you send this money?", ask "Can you explain the purpose of this transaction?" This encourages the person to talk more.
• Observe Non-Verbal Cues: Is the person sweating, avoiding eye contact, or acting overly defensive? (Though remember, some people are just naturally nervous around investigators!).
• The "Two-Person" Rule: It is often helpful to have two investigators present—one to ask questions and one to take detailed notes.

Memory Aid: The 5 W’s
Always ensure your interview covers: Who involved, What happened, Where it happened, When it happened, and Why it’s suspicious.

Section 4: Responding to Law Enforcement

Law enforcement might come knocking with a Search Warrant or a Subpoena. It is vital to handle these correctly to protect the institution.

What is a Subpoena? It is a legal demand for records. You must provide the documents requested, but you usually have some time to gather them.
What is a Search Warrant? This is more urgent. It allows officers to enter the premises and seize records immediately.

The Golden Rules for Law Enforcement Requests:
1. Verify Identity: Ask for the officer's credentials.
2. Notify Legal/Compliance: Immediately call your senior management or legal counsel.
3. Keep a Record: Keep a detailed list of every document the police take. Do not interfere with them, but do stay present and observe.

Did you know? If you receive a grand jury subpoena, you are often prohibited from telling the customer that their records have been requested. This is to prevent the customer from destroying evidence or fleeing.

Section 5: Filing a SAR/STR (The Final Step)

If your investigation confirms that the activity is suspicious, you must file a Suspicious Activity Report (SAR) or Suspicious Transaction Report (STR).

The Narrative is Key

The "Narrative" is the story part of the report. It needs to be clear and concise. A good narrative should explain:
• How the activity started.
• What specifically made it suspicious.
• The "flow of funds" (where the money came from and where it went).

Important Point: Do not use overly technical jargon in the SAR narrative. Write it so that a law enforcement officer—who might not be a banker—can easily understand what happened.

Section 6: Closing the Investigation

Whether you file a SAR or not, you must document everything. If a regulator visits two years from now and asks why you didn't file a SAR on "Customer X," you need to show your notes and evidence to prove you did a thorough job.

Key Takeaway for Closing: Documentation should be "self-standing." This means if a stranger reads your file, they should be able to understand your logic and the conclusion you reached without you being there to explain it.

Summary and Encouragement

Let's recap:
1. Investigations start with a trigger.
2. We follow a structured process: Plan, Gather, Analyze, and Decide.
3. Interviews help fill in the gaps using open-ended questions.
4. Law enforcement requests must be handled through legal/compliance channels.
5. SARs are the final output if we find true suspicion.

Investigations can be complex, but remember: you are the gatekeeper of the financial system. By being thorough and documenting your work, you are making it harder for criminals to succeed. You've got this! Keep reviewing these steps, and they will become second nature.