FI monitoring technology and training / expertise . FIs benefit from information sharing by and through LE . Local SAR task forces and local chapters of AFC specialists like ACAMS represent unparalleled opportunities for FI representatives to network with local LE . It is these connections that may prove valuable to FIs during the SAR investigation and filing processes .
When LE contact is required
Certain financial and non-bank financial institutions ( NBFIs ) have suspicious activity reporting requirements under the Bank Secrecy Act ( BSA ). These institutions meet the suspicious activity reporting requirements by filing SARs with FinCEN . Entities with SAR filing responsibilities should check the BSA for specific requirements concerning notification to LE . For example , the BSA SAR filing requirements for banks include the following instruction under § 1020.320 ( b )( 3 ): “ In situations involving violations requiring immediate attention , such as when a reportable violation is [ ongoing ], the [ FI ] shall immediately notify , by telephone , an appropriate [ LE ] authority and the Board in addition to filing a timely SAR .” 2
In addition , there are certain instances where contacting federal or local LE is either recommended , advisable or both . SAR filers are advised to validate requirements for their specific industry , the SAR-reportable characteristic on which they are filing , and the regulatory body responsible for examining the industry . Examples of instances where contact is required include but are not limited to the activities listed below .
Terrorism ― Most advisories published by FinCEN on the topic of terrorism , such as the recent FIN-2024-A001 , 3 contain instructions for FIs to contact the FinCEN hotline at 866-556-3974 to expedite the reporting of terrorist activity . Further reading of the footnote contains specific instructions to FIs : “ The purpose of the hotline is to expedite the delivery of this information to [ LE ]…. [ FIs ] should immediately report any imminent threat to local-area [ LE ] officials .” 4 So , while the BSA does not require the reporting of potential terroristic activity to FinCEN , federal or local LE , for terrorist-related activity , direct and immediate LE contact is advised .
Ransomware ―
▪ FinCEN ’ s Advisory on Ransomware and the Use of the Financial System to Facilitate Ransom Payments from November 2021 5 contains the following : “[ FIs ] wanting to report suspicious transactions related to recent or ongoing ransomware attacks should contact FinCEN ’ s Financial Institution Hotline at 866-556-3974 .”
▪ Additional recommended LE contacts for ransomware incidents are listed in the Ransomware Guide 6 published by the Cybersecurity and Infrastructure Security Agency ( CISA ).
▪ The Office of Foreign Assets Control ( OFAC ) provides the following guidance on reporting ransomware incidents : “ To report an intrusion and request technical assistance , contact CISA at cisaservicedesk @ cisa . dhs . gov or 888-282-0870 , or the FBI through a local field office or the FBI ’ s Cyber Division at CyWatch @ fbi . gov or 855-292- 3937 , or any U . S . Secret Service local field office to report a crime . Contact OFAC at ofac _ feedback @ treasury . gov 7 if there is any reason to suspect the cyber actor demanding ransomware payment may be sanctioned or otherwise have a sanctions nexus .” 8
ACAMS Today | March – May 2025 39