Follow the money: The U.S. Treasury Department’s Financial Crimes Enforcement Network keeps track of all suspicious-activity reports filed by banks. Here’s the geographic distribution of reports filed by banks in New York between 1996 and 2006.
Whether a deviation is flagged will depend in part on a customer’s risk exposure score, a rating assigned by the bank according to the customer’s occupation, geographical location, and other personal details. A retired schoolteacher who has lived in the suburbs of Minneapolis her entire life might have a lower risk score than a 42-year-old import-export businessman from Sicily, for example. So-called politically exposed persons–customers such as politicians, top executives, and judges–will automatically receive a higher level of scrutiny.
Every bank has a group of actual people who personally scrutinize transactions that have been flagged. The vast majority of alerts represent acceptable behavior, and nothing more is done. If the Minneapolis schoolteacher has sold her house, for example, the income will show as a clear deviation from her peer group’s norm. The human investigator will understand why and won’t pursue the matter any further.
“Banks do not want to be in the position of reporting on a customer without good reason,” says Ido Ophir, vice president of product management for Actimize, another large vendor of anti-money-laundering software. “They can’t just send in transactions that have no suspicious merits.”
However, if the human reviewers can’t explain away the activity, they will produce an official suspicious activity report (SAR), including a written narrative describing the transaction, and send it to the Internal Revenue Service and the Treasury Department’s Financial Crimes Enforcement Network (FinCen), the federal group responsible for administering the 1970 Bank Secrecy Act.
Most SARs are ultimately reviewed by regional teams of investigators, drawn from the IRS, the FBI, the DEA, and the U.S. Attorney’s office. But the reports also go into a Bank Secrecy Act database, which is made available to authorized federal law-enforcement agencies. Agents can search for specific names, account numbers, and details, such as telephone numbers, to see if the subjects of their own investigations have raised any financial flags.
FinCen spokesman Steve Hudek says that automated pattern-analysis software also runs on the Bank Security Act database, helping to spot patterns of activity or links between individuals that humans might miss. He declined to say which software or vendors FinCen uses, however.
As the software has gotten more sophisticated–and the government has applied more pressure to highlight suspicious activity–the number of SARs filed has gone up sharply. In 2000, banks (as distinguished from securities firms or casinos) filed 121,505 SARs. In 2006, they filed 567,080, and by the end of last June, the last month for which figures are available, 2007 was on track to set a new record.
Technologists say that future software will be even better at spotting anomalies, analyzing customers’ social networks, tapping into the vast databases of information held by companies such as LexisNexis and ChoicePoint, and using that outside information to help make judgments about customer transactions.
This might be a privacy advocate’s nightmare, but it helps keep banks safe from fraud and regulatory fines.
“We’re getting to the problem of how to digest larger and larger amounts of information,” says Fortent’s Recce. “There is fundamentally an enormous amount of information, and people are trying to hide in it.”
Gain the insight you need on security at EmTech Digital.