In a series of settlements announced this year, the U.S. Securities and Exchange Commission (SEC) and the Financial Industry Regulatory Authority (FINRA) penalized several broker-dealers for allegedly failing to file suspicious activity reports (SARs) and one registered representative allegedly for causing a firm's filing failure.¹ In this post, we provide a refresher of the relevant rules, examine recent SEC and FINRA settlements involving this particular strain of anti-money laundering (AML) compliance violation and, building off our prior points for broker-dealers on the subject, offer a lullaby of additional practical considerations.

Rules Refresher

The SEC and FINRA have dual authority to pursue claims against broker-dealers for SARs violations under the Bank Secrecy Act (BSA). In conjunction with the BSA, Section 17(a) and Rule 17a-8 of the Securities Exchange Act of 1934 (Exchange Act) require broker-dealers to comply with the reporting, recordkeeping and record retention requirements of rules promulgated by the Financial Crimes Enforcement Network (FinCEN). In addition, FINRA's authority flows from Rule 3310(a) (previously NASD Rule 3011(a)),² which requires broker-dealers to implement AML programs that include policies and procedures that can be reasonably expected to detect and cause the reporting of suspicious transactions.

Generally speaking, broker-dealers must file SARs for transactions that exceed $5,000 if they involve suspected criminal or suspicious activity.³ The threshold for national banks is different. For a national bank, a SAR should be filed when there is suspected criminal activity involving: 1) bank insiders involving any amount, 2) violations aggregating $5,000 or more where a suspect can be identified, or 3) violations aggregating $25,000 or more regardless of potential suspects.

How I Wonder What [the Thresholds] Are

On July 11, 2023, the SEC and FINRA separately fined one of the nation's largest broker-dealers and its parent company for failing to file nearly 1,500 SARs during a 10-year period from January 2009 until November 2019. The missing SARs all involved transactions that fell between $5,000 and $25,000. The broker-dealer's parent company, a national bank, had assumed responsibility for creating and implementing the firm's SAR policies and procedures and for filing its SARs. In doing so, the bank applied a $25,000 threshold, which, as discussed above, applies to banks. However, the SEC alleged that the bank should have applied the $5,000 threshold for broker-dealers. The transactions that went unreported included unauthorized debit card withdrawals, forged or altered checks, unauthorized account access, identity theft and internet scams.

In its settlement order, the SEC alleged that the broker-dealer violated Exchange Act Section 17(a) and Rule 17a-8 and that the bank caused those violations. FINRA, in its Letter of Acceptance, Waiver, and Consent (AWC), alleged that the broker-dealer violated NASD Rule 3011(a) and FINRA Rules 3310(a) and 2010. Although the broker-dealer self-reported the lapse to the SEC, FINRA and FinCEN upon discovery of the mistake, the SEC and FINRA each imposed civil monetary penalties of $6 million, for a total of $12 million. The broker-dealer and the bank, without admitting or denying the findings, each agreed to cease and desist, and the broker-dealer was censured.

In resolving the actions, the SEC and FINRA credited the broker-dealer's remedial measures, including:

• self-reporting
• updating its policies, procedures and automated surveillance systems to reflect the correct $5,000 threshold
• training its personnel responsible for filing SARs
• conducting an internal investigation and reporting the results to the SEC and FINRA
• reviewing and confirming all other thresholds were correct
• conducting a look-back to the earliest date for which the broker-dealer retained records and filing 865 additional SARs

Up Above the World So High: High-Risk Investments Require More Stringent Monitoring

On Aug. 29, 2023, the SEC announced settled charges with a Chicago-based broker-dealer, Archipelago Trading Services (ATSI), for allegedly failing to file hundreds of SARs over an eight-year period between August 2012 and September 2020.

According to the SEC's order, ATSI operated an over-the-counter (OTC) alternative trading system (ATS), known as Global OTC, which broker-dealers use to execute trades in OTC securities. Most of these transactions involved microcap or penny stock securities, which the SEC classifies as higher-risk than more traditional stocks listed on a national exchange. The SEC alleged that for several years, ATSI failed to establish an AML surveillance program for the thousands of transactions executed daily on Global OTC, which allegedly caused it to miss red flags regarding suspicious manipulative trading activity, including possible spoofing, layering, wash trading and prearranged trading. As a result, ATSI did not file 461 SARs, according to the SEC.

The SEC's order found that ATSI violated Exchange Act Section 17(a) and Rule 17a-8. Without admitting or denying the SEC's findings, ATSI agreed to a censure and cease-and-desist order and to a $1.5 million civil monetary penalty.

Like a [Red Flag] in the Sky

On Sept. 29, 2023, the SEC and FINRA announced settlements with a New York broker-dealer for failure to file required SARs and properly execute certain short sales.⁴ In the settlement order, the SEC alleged that the broker-dealer failed to investigate red flags sufficiently and that the firm's SARs filing failures were due to not adequately designing or implementing its AML policies and procedures so as to reasonably address the risks associated with it facilitation of order flow from other broker-dealers involving sales of large volumes of OTC microcap securities.

The SEC found that the broker-dealer willfully violated Exchange Act Section 17(a) and Rule 17a-8, along with Rule 203(b)(1) of Regulation SHO. Without admitting or denying the charges, the firm agreed to pay a civil monetary penalty of $800,000 and to be censured. The SEC recognized the firm's remedial measures, including increasing its staffing responsible for AML compliance, revising its policies and procedures, adding automated monitoring systems, implementing measures to minimize trading in microcap securities and retaining an independent consultant to review its Regulation SHO policies and procedures.

The same day, FINRA issued an AWC in which it alleged that from February 2019 to July 2022, there were weaknesses in the broker-dealer's AML program that hindered detecting or reasonably investigating red flags and that the broker-dealer failed to establish and maintain a supervisory system and written procedures reasonably designed to ensure certain securities sales complied with Securities Act Section 5. Without admitting or denying the findings, the firm agreed to pay a $500,000 fine and retain an independent consultant for violations of NASD Rule 3011(a) and FINRA Rules 3310(a) and 2010. FINRA also noted the firm's remedial measures.

Twinkle-Twinkle Little SAR: The SEC Targets a Registered Representative

On Sept. 18, 2023, the SEC announced a rare settlement with a registered representative for allegedly causing his broker-dealer employer to fail to file a SAR. In the order, the SEC alleged that Pierre Economacos, a registered representative of a registered broker-dealer, allegedly failed to report "suspicious and unusual transactions" from a customer's brokerage account to his firm's AML group, in violation of the firm's policies and procedures. According to the SEC, the representative's failure caused the firm to not file a SAR in violation of Exchange Act Section 17(a) and Rule 17a-8. Interestingly, the SEC did not charge the broker-dealer. In fact, the SEC cited the firm's strong AML policies, procedures and guidance.

According to the SEC, a longtime customer asked Economacos to wire $50,000 from the customer's account to the brokerage account of a relative as a "loan." A few days later, the company where the relative worked announced it would be acquired, causing the stock price to increase by 30 percent. Throughout the following week, in a series of four wire transfers, the relative wired a total of $280,000 back to the customer. Economacos, who had an unblemished disciplinary record for more than 30 years prior to this settlement, did not report any of the transactions to the firm's AML group.

In the order, the SEC identified several red flags that it alleged should have caused Economacos to contact the firm's AML group, including that the transactions: 1) were abnormal compared to the customer's transaction history, 2) constituted a sudden and unusual change based on the amount of the incoming wires, 3) took place in a short period of time in "multiple large, round dollar amounts" and 4) occurred right after the announcement of the acquisition of the company, which resulted in a sharp stock price increase, both of which Economacos knew about.       

Without admitting or denying the SEC's findings, Economacos agreed to cease and desist and pay a civil penalty of $20,000.

How I Wonder What You Are: Two SEC Commissioners Dissent

Notably, two of the five SEC Commissioners issued a statement dissenting from the SEC's order against Economacos, in which they disagreed that he acted unreasonably in not alerting the broker-dealer's AML group to the myriad red flags the SEC alleged he ignored. The dissenting Commissioners stated that they disagreed with the SEC that the alleged red flags required Economacos to cause a SAR to be filed but rather were "a list of factors to consider when assessing whether a particular transaction or set of transactions reaches the reporting threshold set out in the relevant Treasury regulations."

Furthermore, the Commissioners faulted the SEC's order for "fail[ing] to explain adequately how and why a loan, and subsequent repayment, between close family members amounts to suspicious activity under the Treasury rule," particularly given Economacos's long-standing and close relationship with the customer and his understanding of the history of loans between the customer and the relative. They cautioned that the SEC's order could encourage overreporting by representatives who may begin to see all flags in "various shades of red," which may result in broker-dealers over-filing SARs. The dissenters concluded the SEC's second-guessing broker-dealers would impose extra costs on firms and add "unhelpful clutter" to the reporting data.

Takeaways

• The Symptoms Are the Same. Each of these settlements involved similar conduct (ignoring red flags, lack of adequate policies and procedures), which led to a finding of similar violations (excepting the Regulation SHO violations in the second-discussed settlement) and the imposition of similar penalties. Although the $6 million penalty imposed in the first-discussed settlement is larger than the others, especially when combined with the $6 million penalty FINRA imposed, when viewed on a per SAR basis, the settlement amounts are roughly the same. For instance, the July 2023 $6 million settlement involved 1,500 unfiled SARs, which amounts to a $4,000 fine per SAR. The ATSI settlement involved 461 missing SARs leading to a $1.5 million penalty, or approximately $3,254 per SAR. And if each of the five allegedly suspicious wires in the $20,000 settlement with Economacos is considered to have required its own SAR, according to the SEC, that equates to $4,000 per SAR as well.⁵
• Policies and Procedures Plus Implementation Plus Training. Time and again when dealing with SARs, and many other SEC compliance issues, the agency has shown that having appropriate policies and procedures, which means they are reasonably designed to identify and detect potential suspicious activity based on the firm's particular risk profile, is crucial, but they mean nothing without proper implementation. Another important element of a successful AML compliance program is adequate and frequent training. These aspects, when applied properly and consistently, are likely to vaccinate a broker-dealer against a SARs enforcement action. In July 2023, the SEC's Divisions of Examinations (EXAMS) issued a risk alert, following up on its earlier March 2021 risk alert confirming the importance of independent testing of firms' AML programs, employee training, and identification and verification of customers and their beneficial owners. In the alert, EXAMS identified some observations that were common to deficient broker-dealers: 1) inadequate policies and procedures, 2) failure to implement procedures, 3) failure to respond to suspicious activity/red flags and 4) filing inaccurate or incomplete SARs.
• Guideposts for Effective Remediation. The settlements discussed throughout share some common actions that the SEC deemed remedial. The SEC has thus provided helpful guideposts for the types of activities it views favorably, including: 1) self-reporting, 2) reviewing and updating policies and procedures, 3) training, 4) reviewing and confirming correct thresholds are in place and correcting if not, 5) looking back at earlier records and filing any SARs that should have been filed, 6) increasing SAR compliance personnel, 7) adding automated monitoring systems and 8) possibly conducting an internal investigation.
• Registered Representatives Pay Attention. The SEC's settlement with Economacos is ringing alarm bells at this blog's HQ for several reasons. First, while it is not unprecedented for the SEC to charge an individual but not the entity, it is unusual in the SARs context. Registered representatives are not obligated to file SARs themselves; the broker-dealer is tasked with that responsibility. Yet, the SEC did not charge the firm and charged Economacos only for what could arguably (at least according to two of the five Commissioners) be considered compliant conduct. It is clear that the SEC views registered reps as playing a key role in SAR compliance even though they do not file SARs themselves.

Second, a reasonable response to the settlement could be for registered representatives to escalate any transaction that could be construed as potentially suspicious, even in instances where they know the customer or before they are able to gather all the facts. The dissenting Commissioners warned against exactly this type of overreporting as unhelpful and likely to cloak truly suspicious activity in a sea of benign information. Finally, the Economacos settlement signals more aggressive enforcement relating to AML compliance generally. This is the type of shot-across-the-bow action that should cause registered representatives and other industry participants to take notice.

Notes

¹ Timely and accurate filing of SARs has long been an SEC priority. The SEC's Division of Examinations included ensuring that broker-dealers "[m]eet[ ] their SAR filing obligations" as one of its exam priorities in 2024 and in 2023, 2022, 2021, 2020, etc.

² NASD Rule 3011(a) was superseded by FINRA Rule 3310(a) on Jan. 1, 2010. Rule 3310 sets forth the minimum requirements for a firm's AML compliance program. Additionally, FINRA Rule 2010 requires that all FINRA member firms, in conducting business, observe the "highest standards of commercial honor and just and equitable principles of trade."

³ Broker-dealers must timely file SARs with FinCEN to report any transaction (or a pattern of transactions of which a transaction is a part) involving or totaling at least $5,000 and for which the broker-dealer knows, suspects or has reason to suspect: 1) involves funds derived from illegal activity or is conducted to disguise funds derived from illegal activities, 2) is designed to evade any requirement of the BSA, 3) has no business or apparent lawful purpose and the broker-dealer knows of no reasonable explanation for the transaction after examining the available facts or 4) involves use of the broker-dealer to facilitate criminal activity. See 31 CFR § 1023.320(a)(2).

⁴ The SEC alleged in the settlement order that the broker-dealer engaged in short sales of low-priced securities without locating shares of stock to borrow prior to effecting the short sales, in violation of Regulation SHO.

⁵ The other settlement from September 2023 includes a violation of Regulation SHO, which makes it difficult to pinpoint how much of the $800,000 penalty was attributable to the SARs violations.