The Post-Closing Discovery the CEO Wants to Bury

The broker should evaluate the conduct against its BSA/AML program and applicable SAR requirements. The facts involve suspected fraud-an employee altered a bank statement to induce a loan-and the loan was sold to an investor. If the broker is a covered financial institution and the activity meets the threshold and suspect criteria, a SAR should be filed. Timing is critical: generally a SAR must be filed within 30 calendar days after detection, with a possible extension to 60 days if no suspect is identified. The compliance officer discovered the issue 45 days ago, so the filing window may already be tight or overdue; the broker should document the detection date and file promptly if required.

Repurchasing the loan may address an investor contractual obligation, but it does not erase the suspected fraud, the altered document, or the reporting obligation. It also does not protect the broker from regulatory criticism for delayed reporting. The CEO's 'keep it quiet' request should be refused and documented; SAR confidentiality prohibits tipping off the subject or unauthorized disclosure. The broker should involve counsel and its SAR vendor, but the business line should not control the decision.

Preserve the original bank statement provided by the borrower, the altered version submitted to underwriting, the loan file, emails and messages between the loan officer and the borrower, the post-closing audit workpaper, the repurchase analysis, and all communications with the investor. Maintain a chain of custody for originals and preserve electronic metadata. Obtain a written statement from the borrower if possible, but do not coach her. Preserve the loan officer's personnel file and any prior complaints, subject to employment-law requirements.

Notify the investor as required by the purchase agreement and repurchase obligations, and notify the broker's errors-and-omissions or fidelity insurer if applicable. Consider whether state licensing authorities require notification of the loan officer's conduct or the broker's remediation. Law enforcement referral may be appropriate depending on the amount and evidence. Do not notify the former loan officer in a way that would compromise the investigation or violate SAR confidentiality. Coordinate with counsel on privilege and disclosure.

The CEO's request to 'keep it quiet' is not an acceptable compliance strategy. A repurchase may be a legitimate business decision to limit liability, but it cannot be used to suppress a SAR, mislead the investor, or avoid regulatory obligations. Compliance should report the request and the underlying facts to the board or audit committee, and counsel should advise on disclosure. Retaliation against the compliance officer would be a serious governance failure.

Control responses should include a review of how the altered statement passed through underwriting, why the post-closing audit caught it only after sale, and whether other files handled by the loan officer contain altered documents. Strengthen document-integrity checks, separation of duties, and escalation of audit findings. Document the remediation plan and retain records of the SAR decision, investor notification, and repurchase. If the broker concludes that no SAR is required, it should document the legal and factual basis for that conclusion rather than rely on the CEO's preference.