BSA/AML and SARs: Anti-Money Laundering on the SAFE Exam

Mortgage loans move large sums of money, which makes them attractive to people trying to clean dirty money. That is why the Bank Secrecy Act and anti-money laundering (BSA/AML) rules show up in Federal Mortgage-Related Laws, which is 24% of the national test. Expect questions on who has to run an AML program, when a Suspicious Activity Report (SAR) is required, how fast it must be filed, the $10,000 cash reporting rules, structuring, and the one rule people miss most: you can never tell the borrower a SAR was filed.

This guide covers what the SAFE exam tests, in plain English, with the numbers you need to memorize.

What the Bank Secrecy Act is

The Bank Secrecy Act became law in 1970. Despite the name, it is not about keeping bank information secret. It requires financial institutions to keep records and file reports that help the government detect money laundering, tax evasion, and terrorist financing. The USA PATRIOT Act of 2001 expanded it after the September 11 attacks.

The BSA is administered by the Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Department of the Treasury. Its rules are in 31 CFR Chapter X. A common distractor is to name the CFPB, HUD, or the FTC as the agency in charge of SARs. The answer is FinCEN.

The three stages of money laundering

The exam likes to ask which stage a fact pattern describes. Learn them in order:

Placement: getting illegal cash into the financial system, for example by depositing it or buying cashier's checks and money orders.
Layering: moving the money through a series of transactions to hide where it came from, such as wiring it between accounts or buying and quickly reselling property.
Integration: bringing the money back as what looks like legitimate wealth, such as owning a home free and clear or taking cash out through a refinance.

Real estate can be used at every stage, which is why mortgage companies are covered.

Who must have an AML program

Banks have had BSA duties for decades. In 2012, FinCEN extended AML program and SAR rules to non-bank residential mortgage lenders and originators (RMLOs), with a compliance date of August 13, 2012. These rules are in 31 CFR Part 1029, which covers "loan or finance companies."

The obligation sits with the company, including a sole proprietor acting as a lender or originator. An individual MLO who is an employee is not a separate "loan or finance company"; they work under their employer's program and receive its training.

The program must be written, based on the company's own assessment of its money laundering and terrorist financing risks, and approved by senior management. At a minimum it must have four parts, often called the four pillars:

Policies, procedures, and internal controls, including how the company brings its agents and brokers into the program and collects the customer information it needs.
A designated compliance officer who makes sure the program is carried out, updated, and that the right people are trained.
Ongoing training of appropriate persons, which can be done directly or by verifying that a competent third party trained them.
Independent testing of the program. A third party or an employee can do it, but not the compliance officer.

That last detail is a favorite trap. The person running the program cannot be the one who independently tests it.

Suspicious Activity Reports: when one is required

For an RMLO, a SAR is required when a transaction is conducted or attempted by, at, or through the company, involves or adds up to at least $5,000 in funds or other assets, and the company knows, suspects, or has reason to suspect that the transaction:

Involves funds from illegal activity, or is meant to hide or disguise funds from illegal activity.
Is designed to evade BSA requirements, including through structuring.
Has no business or apparent lawful purpose, or is not the kind of transaction the customer would normally be expected to make, and the company knows of no reasonable explanation after looking at the facts.
Uses the company to facilitate criminal activity.

Note the word "attempted." A loan that never closes because the borrower walked away when asked about the source of funds can still require a SAR. Proof is not required either. Reasonable suspicion is enough.

SAR deadlines and record keeping

Rule	Number
Dollar threshold for RMLOs	At least $5,000
Filing deadline	30 calendar days after initial detection
If no suspect is identified	May delay 30 more days, never more than 60 days total
Keep the SAR and supporting documents	5 years from the filing date
Where it is filed	With FinCEN, through the BSA E-Filing System

When a situation needs immediate attention, such as suspected terrorist financing or an ongoing money laundering scheme, the company must immediately call an appropriate law enforcement authority, in addition to filing the SAR on time. A phone call does not replace the SAR.

When more than one institution is involved in the same transaction, such as a broker and a lender, a single joint SAR can satisfy everyone, as long as it names each institution and each keeps a copy with its supporting documents.

SAR confidentiality: never tip off the borrower

A SAR, and any information that would reveal a SAR exists, is confidential. No company, officer, employee, or agent may disclose it to the person involved or to anyone else outside the allowed channels. If someone subpoenas a SAR, the company must decline to produce it and notify FinCEN.

The company may share the SAR with FinCEN, law enforcement, and the regulators that examine it for BSA compliance. It may also share the underlying facts and documents with another institution to prepare a joint SAR.

The law also gives a safe harbor: a company and its employees are protected from civil liability to the customer for filing a SAR or for disclosing the information to the government.

On the exam, any answer that has the MLO warn the borrower, explain that a report is being filed, or tell the borrower to fix the paperwork so the report goes away is wrong. That is also an ethics issue, which ties into the patterns covered in the MLO ethics question traps guide.

Cash reporting: CTRs and Form 8300

Do not mix up SARs with the cash reports. They have different triggers:

Currency Transaction Report (CTR): a bank or other financial institution files one for each deposit, withdrawal, exchange, or other transfer of currency of more than $10,000 in a business day. Multiple cash transactions by or for the same person on the same business day are added together. It is due within 15 days.
Form 8300: any trade or business that receives more than $10,000 in cash in one transaction or in related transactions files this report with the IRS and FinCEN, also within 15 days.

A CTR is automatic once the threshold is crossed. Nothing has to be suspicious. A SAR depends on suspicion, and its RMLO threshold is lower, at $5,000.

Structuring is a crime by itself

Structuring means breaking up cash transactions to stay under the $10,000 reporting threshold, for example depositing $9,500 on Monday, $9,000 on Tuesday, and $8,800 on Wednesday for a down payment. It is illegal under federal law even if the money came from a legal source. Helping a customer structure, or advising them how to avoid a report, is also a violation. When an MLO sees it, the right response is a SAR, not advice.

Mortgage red flags to know

FinCEN and the industry point to warning signs like these. The exam usually gives a short story and asks what the MLO should do.

A borrower pays a large part of the down payment or closing costs in cash, cashier's checks, or money orders, especially in amounts just under $10,000.
Funds come from an unrelated third party, or from a foreign account with no clear connection to the borrower.
The borrower is reluctant to give identification or source-of-funds documents, or gives information that cannot be verified.
The borrower's income or job does not match the size of the purchase or the assets.
A straw buyer appears to be buying for someone else, or the buyer has no interest in the property's condition, price, or location.
The property is bought and resold quickly at a large price change, or a new loan is paid off early with funds from an unknown source.
The borrower asks how to avoid reporting requirements or uses a shell company or trust to hide who really owns the property.

One red flag alone does not prove anything. The duty is to notice it, document it, and escalate it to the compliance officer under the company's procedures, who decides whether a SAR is filed.

OFAC: the other Treasury list

The Office of Foreign Assets Control (OFAC), also part of the Treasury, maintains the Specially Designated Nationals (SDN) list of people and entities U.S. persons generally may not do business with. OFAC sanctions are separate from the BSA, and they have no dollar threshold. Lenders screen borrowers and other parties against the SDN list, and a true match means the transaction must be stopped and reported to OFAC. If a question mentions a sanctions list, think OFAC, not FinCEN.

Common exam traps

Wrong agency: SARs and AML programs belong to FinCEN, not the CFPB or HUD.
Wrong threshold: the RMLO SAR threshold is $5,000. The CTR and Form 8300 thresholds are more than $10,000.
Wrong deadline: a SAR is due 30 calendar days after detection, with a 60-day maximum only when no suspect is identified. CTRs and Form 8300 are 15 days.
Telling the borrower: never allowed, and no answer that includes it is correct.
Legal money: structuring is still a crime when the cash is legitimate.
Who tests the program: anyone qualified except the compliance officer.

Three practice questions

1. A borrower brings four cashier's checks, each between $9,000 and $9,800, bought on different days at different banks, for a down payment. When the MLO asks about them, the borrower says a relative gave him cash and he did not want the bank "filing paperwork." What should the MLO do?

Answer: Escalate it so the company files a SAR, and do not tell the borrower. The pattern looks like structuring to avoid the $10,000 reporting threshold, and the amount is well over the $5,000 SAR threshold. Whether the gift money was legal does not matter.

2. A non-bank mortgage lender first detects facts that may require a SAR on March 1, but it has not identified a suspect. What is the latest it may file?

Answer: 60 calendar days after March 1. The normal deadline is 30 days, and the company may take up to 30 more days to identify a suspect, but never more than 60 days after initial detection.

3. A mortgage company wants its BSA compliance officer to perform the annual independent test of its AML program to save money. Is that allowed?

Answer: No. Independent testing can be done by a third party or by an officer or employee of the company, but not by the designated compliance officer.

Practice this on MLO Pass

BSA/AML questions come down to a few numbers, one agency, and the never-tip-off rule, which makes them easy points once you have drilled them. A one-time $99 unlock of MLO Pass gives you about 1,154 questions across all five domains: Mortgage Loan Origination Activities 27%, Federal Mortgage-Related Laws 24%, General Mortgage Knowledge 20%, Ethics 18%, and Uniform State Content 11%. Pay once and keep it for life, with no subscription. Sign up to pass your test

Related study guides

Studying with other people taking the SAFE exam? Join the NMLS Test Prep community.