The MSB and the 30-Day Clock

File the suspicious activity report. The activity is consistent with the customer's business only at a high level; the combination of 60 individual senders, high-risk jurisdictions, 12 beneficiaries, and a prior report for similar conduct creates a reasonable suspicion that cannot be explained by 'corridor growth' alone. The missing agent network agreement also weakens the bank's ability to verify the source and purpose of the flows.

Timing: file as soon as the decision is made, and in any event within the regulatory deadline - generally 30 calendar days after initial detection, or 60 days if no subject can be identified. Do not use the internal nine-day target as permission to wait until the last moment, and do not delay for business-line objections.

Prior report: reference the earlier report and describe the continuing activity. A prior report does not excuse a new filing when the activity continues or changes.

Law enforcement request: the request not to tip off the customer reinforces the need for confidentiality. It does not suspend the filing obligation. Coordinate the timing and content with legal, but do not disclose the report to the customer or the agent network.

Business pressure: $90,000 in annual fees is not a legitimate factor in the filing decision. Document that the business line raised the concern and that the decision was made on risk grounds.

Include:

• Who: the customer, its ownership, licensing status, and the 22 agent locations.
• What: the dollar amounts, transaction types, and the pattern of 60 individual senders and 12 beneficiaries.
• When: the three-month period and key dates, including the prior report 14 months earlier.
• Where: the high-risk source and destination jurisdictions and the banks involved.
• Why it is suspicious: the mismatch between the stated remittance corridor growth and the unverified agent network, the high-risk geography, and the continuing activity after a prior report.
• How: the flow of funds, account numbers, and references to supporting exhibits.

Avoid:

• Conclusory statements that the customer is a criminal enterprise without factual support.
• Disclosure of the report's existence or any suggestion that the customer should be told.
• Privileged communications and unnecessary personal data.
• Speculation about law enforcement's investigation beyond a factual note that an inquiry exists, if legal approves.

Reasoning: the narrative should let a reader who has never seen the case understand the activity and why it was reported. It should be factual, specific, and complete enough to support follow-up, while respecting confidentiality.

Options:

• Enhanced due diligence and monitoring: obtain the agent network list, ownership and licensing documents, source-of-funds information for the largest senders, and purpose of payments; set transaction limits; require senior approval for new corridors; conduct site visits or independent verification.
• Restrict activity: block new agent locations or high-risk corridors until due diligence is complete.
• Exit: terminate or wind down the relationship if the bank cannot verify the agent network or mitigate the risk within a defined period.

Decision factors: the severity and persistence of the activity, the prior report, the high-risk jurisdictions, the missing agent agreement, the customer's willingness to cooperate, and the bank's ability to monitor the volumes. The $90,000 fee is irrelevant; reputational damage from retaining an unmonitored MSB is the greater risk.

Law enforcement coordination: if law enforcement asks the bank not to tip off the customer, an immediate exit could alert the customer. Legal should decide whether to continue with controls pending the inquiry or to exit in a controlled way.

Document: the risk assessment, the options considered, the decision, and the approver. If enhanced monitoring is chosen, set a review date and define what would trigger exit. If exit is chosen, record why the risk could not be managed.