The 380 Open Alerts and the Friday Cash Deposits
Harborline Bank ($800 million in assets, nine branches in a metro with a large cash-intensive business base) files roughly 60 SARs a year; its peer group median is over 100. The BSA team is one manager and four analysts. The automated monitoring system generated 1,140 alerts over the last twelve months; 380 remain open, 190 of those are aged beyond 90 days, and 41 were closed by a single analyst in one afternoon with the note no activity of concern and no supporting narrative. One customer, a check casher with $4.3 million in annual cash deposits, has made 27 deposits between $8,500 and $9,900 in the past four months, always on Fridays. Its file contains a beneficial ownership certification listing three holding LLCs, each with a different manager whose address matches a mail-drop storefront, and the branch manager says the person who opened the account is a consultant. A CTR exemption review is pending for two convenience stores. The board receives one BSA slide per quarter showing SAR count and training completion.
1. How should the CCO structure remediation of the alert backlog, and what must be true before an alert is closed?
Read the worked answer
Do not clear the backlog by attrition. Mass closure is the single most damaging outcome available here, and the 41 one-line closures have already created a documented weakness.
Sequence:
- Freeze and triage. Segment the 380 open alerts by customer risk rating, product, cash volume, and geography. High-risk customers and any alert touching cash-intensive businesses, MSBs, or prior SAR subjects go first. Low-risk alerts on long-tenured customers with documented expected activity can be batched, but each still requires a decision.
- Reopen and review the 41 closures with a second reviewer. If any involved reportable activity, the bank has missed filing deadlines and needs a lookback.
- Assess the SAR gap. Sixty filings against a peer median above 100 may reflect a lower-risk customer base, or it may reflect under-filing. The lookback answers that question; do not assume the benign explanation.
- Tune the system, then validate. Rules generating high false-positive rates should be tuned with documented testing before and after, not simply threshold-raised to shrink the queue.
- Add capacity deliberately. Temporary contract investigators can clear volume, but the manager must QA a sample before any closure stands.
Closure standard. A closure is valid only when the file shows what activity triggered the alert, what the analyst reviewed (statements, transaction detail, expected-activity baseline, prior alerts, negative news), why the activity is consistent with the customer's profile, and who approved it. The approval must be independent of the analyst for anything high-risk. No narrative, no closure.
2. Analyze the check casher relationship. What is reportable, and what customer due diligence actions are required?
Read the worked answer
Reportable activity. Twenty-seven deposits clustered between $8,500 and $9,900, on the same weekday, over four months, is a textbook structuring pattern. Currency transaction reporting is triggered on aggregate cash transactions exceeding $10,000 in a business day -- splitting deposits to stay below the threshold does not avoid the report, it creates a separate obligation. Structuring is reportable in its own right regardless of the dollar amount, and the SAR is due within 30 calendar days of detection (60 if no subject can be identified). Under the confidentiality provision at 31 U.S.C. 5318(g)(2), the bank may not disclose the filing to the customer.
CDD and beneficial ownership. The certification requires identifying each individual with 25% or more ownership plus one individual with managerial control. Three holding LLCs with different managers at a mail-drop address, plus an accountholder described as a consultant, are inconsistent with a straightforward ownership structure. The bank must resolve the inconsistency and cannot rely on the certification on file. Actions:
- Obtain ownership charts and identify the natural persons behind each LLC.
- Site visit to the check casher's stated business location; verify through state registration records.
- Document source of funds and expected cash volumes, and reconcile against actual activity.
- Evaluate whether the structure suggests shell entities or nominees.
- Escalate to enhanced due diligence and a relationship decision.
The relationship may continue while the investigation runs -- refusing the deposits is not required -- but continuing without documented EDD is the deficiency.
3. What should the board and senior management now receive, and what governance actions follow from the backlog?
Read the worked answer
The single SAR-count slide is inadequate and is itself evidence of weak oversight. The committee should receive, quarterly:
- Alert volumes, open and aged inventory, and closure quality results from QA sampling.
- SAR filings with a trend line, plus late or lookback filings and the reasons.
- High-risk customer counts, EDD status, and any exited relationships.
- CTR timeliness and exemption review status.
- Staffing against alert volume, with an explicit capacity statement.
- Independent testing results and issue aging.
Governance actions. The BSA officer's authority to escalate should be confirmed in the program document. The board should approve a written remediation plan with dates and owners for the backlog, the lookback, system tuning, and staffing. The board should also consider whether the pattern of missed filings constitutes a self-identified issue that warrants proactive communication with the bank's examiner -- a conversation that goes better when the bank arrives with a plan than when the examiner arrives with a finding. Independent testing under the BSA program rules must cover the monitoring and filing process, not just training completion, and should be scoped to test the lookback conclusions. The one-analyst, 41-closure episode should be addressed directly in the minutes: the committee should record what happened, what was found, and what changed.