Frequently Asked Questions Anti-Money Laundering Program and Suspicious Activity Reporting Requirements for Insurance Companies

Guidance

FIN-2008-G004

Issued: March 20, 2008

Subject: Frequently Asked Questions

Anti-Money Laundering Program and Suspicious Activity Reporting

Requirements for Insurance Companies

This guidance originally was issued on October 31, 2005. We have updated the guidance

provided in these frequently asked questions at question 7, further coordinating the

answer with guidance provided in the final anti-money laundering program rule for

insurance companies that was published in the Federal Register on November 3, 2005.

We additionally published frequently asked questions for insurance companies as FIN-

2006-G010 on May 31, 2006. Insurance companies may continue to rely on the guidance

contained in FIN-2006-G010, which has not been incorporated into this publication.

We are providing the following “Frequently Asked Questions” to assist insurance

companies in understanding the scope of the final rules.

1.

Why is the Financial Crimes Enforcement Network issuing a regulation

requiring insurance companies to establish anti-money laundering

programs?

As with all of our regulations requiring the establishment of an anti-money

laundering program, we are issuing this regulation to better protect a class of financial

institutions – in this case, the insurance industry – from potential abuse by criminals and

terrorists, thereby enhancing the protection of the U.S. financial system generally. The

characteristics of financial products, including certain insurance products, make them

potentially vulnerable to those seeking to launder money. This regulation is a key step in

ensuring that the Bank Secrecy Act is applied appropriately to these businesses

industry – from potential abuse by criminals and

terrorists, thereby enhancing the protection of the U.S. financial system generally. The

characteristics of financial products, including certain insurance products, make them

potentially vulnerable to those seeking to launder money. This regulation is a key step in

ensuring that the Bank Secrecy Act is applied appropriately to these businesses.

Recognizing the need for a more comprehensive anti-money laundering regime,

Congress passed and the President signed into law the USA PATRIOT Act, which,

among other things, requires that all entities defined as financial institutions for Bank

Secrecy Act purposes establish anti-money laundering programs. An insurance company

is defined as a “financial institution” under the Bank Secrecy. The USA PATRIOT Act

further directs the Secretary of the Treasury to prescribe through regulation minimum

standards for such programs.

2.

Does the final rule apply to all insurance companies?

No. The term “insurance company” or “insurer” is defined in the final rule to

describe any person engaged within the United States as a business in the issuing or

underwriting of “covered products.” Covered products, discussed further below, are those

insurance products that we have determined to present a higher degree of risk for money

laundering.

The phrase “as a business” in the definition of “insurance company” is intended

to exclude those persons that offer annuities or other covered products as an incidental

part of their business. For example, a tax-exempt organization that offers charitable gift

annuities, as defined in section 501(m)(5) of the Internal Revenue Code, that would not

otherwise fall within the definition of an insurance company, would not be considered an

insurance company for purposes of the final rule

e those persons that offer annuities or other covered products as an incidental

part of their business. For example, a tax-exempt organization that offers charitable gift

annuities, as defined in section 501(m)(5) of the Internal Revenue Code, that would not

otherwise fall within the definition of an insurance company, would not be considered an

insurance company for purposes of the final rule.

If an insurance company that is not presently issuing or underwriting a covered

product should do so in the future, the insurance company would then become subject to

the rule (but only to the extent of its business relating to covered products). Conversely, if

an insurance company ceases issuing or underwriting covered products, the insurance

company would no longer be subject to the rule.

An insurance company that is registered with the Securities and Exchange

Commission as a broker-dealer in securities would not be required to establish a duplicate

program under the final rule for insurance companies. Broker-dealers in securities

currently are subject to an independent anti-money laundering program obligation under

our regulations, 31 CFR 103.120; therefore, the insurance company would not be

required to establish a separate anti-money laundering program in order to comply with

the final rule, as long as it has established an anti-money laundering program pursuant to

that requirement and complies with the program.1

However, the company should evaluate

the extent (if any) to which its existing anti-money laundering program should be revised

to appropriately address the risks of doing business in covered insurance products.

3.

What are “covered products”?

For purposes of the final insurance company rule, the term “covered product” is

defined to mean:

• A permanent life insurance policy, other than a group life insurance policy;

• An annuity contract, other than a group annuity contract; and

• Any other insurance product with cash value or investment features

business in covered insurance products.

3.

What are “covered products”?

For purposes of the final insurance company rule, the term “covered product” is

defined to mean:

• A permanent life insurance policy, other than a group life insurance policy;

• An annuity contract, other than a group annuity contract; and

• Any other insurance product with cash value or investment features.

1 An insurance company that is registered or is required to register with the Securities and Exchange

Commission will be deemed to have satisfied the requirements of this rule for those activities regulated by

the Securities and Exchange Commission to the extent that the company complies with the anti-money

laundering program requirements applicable to such activities that are imposed by the Securities and

Exchange Commission or by a self-regulatory organization registered with the Securities and Exchange

Commission.

2

The definition incorporates a functional approach, and encompasses any insurance

product having the same kinds of features that make permanent life insurance and annuity

products more at risk of being used for money laundering, e.g., having a cash value or

investment feature. To the extent that term life insurance, property and casualty

insurance, health insurance, and other kinds of insurance do not exhibit these features,

they are not products covered by the rule.

4.

Which insurance products are not “covered products” pursuant to the rule?

Because they pose a lower risk for money laundering, the following products are

not defined as “covered products” in the final rule:

• group insurance products

• products offered by charitable organizations, e.g. charitable annuities

• term (including credit) life, property, casualty, health, or title insurance

• reinsurance and retrocession contracts

” pursuant to the rule?

Because they pose a lower risk for money laundering, the following products are

not defined as “covered products” in the final rule:

• group insurance products

• products offered by charitable organizations, e.g. charitable annuities

• term (including credit) life, property, casualty, health, or title insurance

• reinsurance and retrocession contracts.

Contracts of indemnity and structured settlements (including workers’ compensation

payments) are not within the definition of “covered products” for purposes of the final

rule.

5.

Does the final rule require insurance agents and brokers to establish anti-

money laundering programs?

No. Insurance agents and brokers are not required by the final rule to have

separate anti-money laundering programs. However, insurance agents and brokers are an

integral part of the insurance industry due to their contact with customers. Insurance

agents and brokers typically are involved in sales operations and are therefore in direct

contact with customers. As a result, the agent or broker will often be in a critical position

of knowledge as to the source of investment assets, the nature of the clients, and the

objectives for which the insurance products are being purchased. Agents and brokers

have an important role to play in assisting the insurance company to prevent money

laundering. Therefore, the final rule requires each insurance company to integrate its

agents and brokers into its anti-money laundering program and to monitor their

compliance with its program. The final rule also requires an insurance company’s anti-

money laundering program to include procedures for obtaining relevant customer-related

information necessary for an effective program, either from its agents and brokers or

otherwise

equires each insurance company to integrate its

agents and brokers into its anti-money laundering program and to monitor their

compliance with its program. The final rule also requires an insurance company’s anti-

money laundering program to include procedures for obtaining relevant customer-related

information necessary for an effective program, either from its agents and brokers or

otherwise.

The insurance company remains responsible for the conduct and effectiveness of

its anti-money laundering program, which includes the activities of the agents and

brokers that are involved with covered products. The insurance company must exercise

due diligence, not only in the development of its anti-money laundering program and in

the collection of appropriate customer and other information but also in monitoring the

operations of its program, its employees, and its agents.

3

6.

What are the requirements for an anti-money laundering program?

The final rule requires an insurance company that issues or underwrites covered

products to develop and implement a written anti-money laundering program applicable

to its covered products that is reasonably designed to prevent the insurance company

from being used to facilitate money laundering. The program must be approved by senior

management and made available to the Department of the Treasury (or its delegate) upon

request.

As is true of all of our anti-money laundering program rules, insurance companies

must develop a risk-based program. Under the Bank Secrecy Act, financial institutions

are required to identify, assess, and mitigate the risk that their business will be abused by

criminals. Risks can be jurisdictional, product-related, service-related, or client-related.

Regardless of where those risks arise, financial institutions covered by our regulations

must take reasonable steps to mitigate them

lop a risk-based program. Under the Bank Secrecy Act, financial institutions

are required to identify, assess, and mitigate the risk that their business will be abused by

criminals. Risks can be jurisdictional, product-related, service-related, or client-related.

Regardless of where those risks arise, financial institutions covered by our regulations

must take reasonable steps to mitigate them. Compliance is risk-based, meaning that a

financial institution must devote more compliance resources to the areas of its business

that pose the greatest risk. Moreover, as is true for all industries we regulate, we do not

expect businesses of different sizes and circumstances to have the same types of anti-

money laundering programs.

We believe effective implementation must be predicated upon your knowledge of

your business, a careful assessment of the vulnerabilities of your business to money

laundering, and adoption of controls appropriate to that risk.

At a minimum, insurance companies must establish an anti-money laundering

program that comprises the four elements set forth below. Our website (www.fincen.gov)

contains information and updates on money laundering and terrorist financing risks as

they apply to the insurance industry. We do not expect that this program can prevent all

potential money laundering. What is expected is that your business will take prudent

steps, with the same kind of thought and care that you take to guard against other crimes,

such as theft or fraud.

It should be noted that the required components are minimum requirements.

Insurance companies that offer a diversity of insurance products may decide to adopt

institution-wide anti-money laundering programs regardless of the types of products

offered. However, the final rule requirement applies only to covered products offered by

the company.

gainst other crimes,

such as theft or fraud.

It should be noted that the required components are minimum requirements.

Insurance companies that offer a diversity of insurance products may decide to adopt

institution-wide anti-money laundering programs regardless of the types of products

offered. However, the final rule requirement applies only to covered products offered by

the company.

(1) A compliance officer who is responsible for ensuring that the program is

implemented effectively.

The compliance officer is an employee or group of employees who will be

responsible for the day-to-day operation of your anti-money laundering program. In

particular, this person (or persons) will be responsible for ensuring that the steps within

your own program are fully implemented. As such, this person should be someone with

4

enough authority to achieve this important task. The amount of time devoted to these

duties will depend on the level of risk. An insurance company is not required to designate

a person to serve on a full-time basis as a compliance officer for purposes of the final rule

unless the level of risk or volume of transactions warrants. If your business faces a very

high level of risk for money laundering, then a great deal will be required of this person.

If your exposure to these risks is more moderate, then the level of effort will be

commensurate with that risk.

In all cases, however, the compliance officer should be thoroughly familiar with

the operations of the business itself and with all aspects of your anti-money laundering

program, as well as with the requirements of the Bank Secrecy Act and applicable

Financial Crimes Enforcement Network forms, and should have read carefully all

applicable documents we issue or post on our web page (www.fincen.gov).

cases, however, the compliance officer should be thoroughly familiar with

the operations of the business itself and with all aspects of your anti-money laundering

program, as well as with the requirements of the Bank Secrecy Act and applicable

Financial Crimes Enforcement Network forms, and should have read carefully all

applicable documents we issue or post on our web page (www.fincen.gov).

(2) Policies, procedures, and internal controls.

Policies, procedures, and internal controls must be developed, based on the

insurance company’s assessment of the money laundering risk associated with its

business, that are reasonably designed to enable the insurance company to comply with

the applicable requirements of the Bank Secrecy Act and to prevent the insurance

company from being used by money launderers.

As the preamble to the rule describes, you should assess the extent to which your

particular business is susceptible to money laundering. Those companies dealing with

covered products that pose a significantly higher risk require greater diligence for

detecting transactions that may involve money laundering. Using customer and other

information obtained through agents, brokers or otherwise, an insurance company can

assess the money laundering risks presented by its business based on such factors as the

particular types and locations of customers served, distribution channels, and products

offered.

igher risk require greater diligence for

detecting transactions that may involve money laundering. Using customer and other

information obtained through agents, brokers or otherwise, an insurance company can

assess the money laundering risks presented by its business based on such factors as the

particular types and locations of customers served, distribution channels, and products

offered.

(3) Ongoing training of appropriate persons concerning their responsibilities

under the program.

You should first consider what training is appropriate for each individual

employee. Some employees may require no training on the program, given their

particular duties. Others may require a great deal of training. The training should be

clearly understood by your employees, agents, brokers, and others doing business with

covered products. The compliance officer should be available to answer all questions

posed by employees. Remember that you should periodically retrain your employees on

your program to ensure that they understand and can fully implement your program.

(4) Independent testing to monitor and maintain an adequate program.

Some person or group of people who are not working specifically for the

compliance officer on the compliance program should be selected to determine whether

5

the program complies with the requirements of the rule and that the program functions as

designed. For example, if the program requires that a particular employee be trained once

every six months, then the independent testing should determine whether the training

occurred and whether the training was adequate. Independent testing does not mean that

an outside party must be hired, although outside parties may be utilized to conduct the

independent review

t the program functions as

designed. For example, if the program requires that a particular employee be trained once

every six months, then the independent testing should determine whether the training

occurred and whether the training was adequate. Independent testing does not mean that

an outside party must be hired, although outside parties may be utilized to conduct the

independent review. It does mean, though, that the testing should be a fair and unbiased

appraisal of the success in implementing the anti-money laundering program, and the

results of the independent testing should be put into writing, including any

recommendations to senior management.

Independent testers should carefully consider all of the decisions made by the

compliance officer, such as the determination of the level of risk faced by the insurance

company for money laundering, the frequency of training, etc. The independent testing is

intended to confirm that the program complies with the requirements of the rule and that

the program functions as designed.

7.

Is an insurance company required to train all of its employees in-house?

What about training of brokers and agents?

An insurance company may satisfy the training requirement under its anti-money

laundering program with respect to its employees, agents and brokers by directly training

such persons. An insurance company may also satisfy the training requirement by having

a competent third-party train those employees, agents and brokers. A competent third

party may include, among others, another financial institution that is subject to an anti-

money laundering program rule, such as another insurance company, a bank, or a broker-

dealer in securities.

An insurance company remains responsible for assuring compliance with the final

rule and monitoring the effectiveness of its training program

se employees, agents and brokers. A competent third

party may include, among others, another financial institution that is subject to an anti-

money laundering program rule, such as another insurance company, a bank, or a broker-

dealer in securities.

An insurance company remains responsible for assuring compliance with the final

rule and monitoring the effectiveness of its training program. The nature of the insurance

company’s review of a training program performed by a competent third party depends

upon the facts and circumstances of the particular situation. As a general rule, the

insurance company should carefully evaluate the substance of training to be provided by

a third-party for the insurance company’s own employees, its career agents, or

independent agents or brokers representing it.

When an agent is retained by or affiliated with another entity that is subject to an

anti-money laundering program rule, however, the insurance company may reasonably

rely on the compliance program of the other entity, including the requirement to train

appropriate persons.2 When reasonably relying upon the anti-money laundering

compliance program of another entity subject to an anti-money laundering program rule,

the insurance company’s anti-money laundering program should contain policies and

procedures to address circumstances where it may appear that an agent or agents

2 “[T]he insurance company could generally rely on the agent’s own program requirements to address

issues at the time of the sale if reasonable (i.e., the insurer knows of no defect in the agent’s program),

while the insurer’s program should focus on the ongoing administration of the covered product.” Anti-

Money Laundering Programs for Insurance Companies, 70 Fed. Reg. 66754, 66758 (Nov. 3, 2005).

6

nsurance company could generally rely on the agent’s own program requirements to address

issues at the time of the sale if reasonable (i.e., the insurer knows of no defect in the agent’s program),

while the insurer’s program should focus on the ongoing administration of the covered product.” Anti-

Money Laundering Programs for Insurance Companies, 70 Fed. Reg. 66754, 66758 (Nov. 3, 2005).

6

employed by the other entity are not receiving proper training from the other entity.

Indicators may include, for example, publicly available information about the other

entity’s failure to comply with anti-money laundering program requirements, or elevated

levels of suspicious activity coming from the other entity or certain agents or locations of

the other entity.

8.

What resources are available to help an insurance company to establish an

adequate program?

The preambles to the final rules and these Frequently Asked Questions provide

the foundation for the process of establishing an anti-money laundering program. Going

forward, we will be issuing additional guidance to the industry. All such guidance will be

posted on our website (www.fincen.gov). Additionally, we operate a Regulatory Helpline

(1-800-949-2732), to provide answers to specific regulatory or compliance questions.

9.

When must we implement our Anti-Money Laundering Program?

You will have 180 days from when the final rule is published in the Federal

Register to implement your anti-money laundering program.

10.

Should insurance companies continue to file Form 8300 – Report of Cash

Payments Over $10,000 Received in a Trade or Business?

Yes. Insurance companies should continue to file Form 8300 in appropriate

situations to report the receipt of cash over $10,000. There is no requirement at this time

for insurance companies to file Currency Transaction Reports.3

Also, Form 8300 includes Box 1b for reporting of suspicious transactions

to file Form 8300 – Report of Cash

Payments Over $10,000 Received in a Trade or Business?

Yes. Insurance companies should continue to file Form 8300 in appropriate

situations to report the receipt of cash over $10,000. There is no requirement at this time

for insurance companies to file Currency Transaction Reports.3

Also, Form 8300 includes Box 1b for reporting of suspicious transactions.

Because covered insurance companies will be required to file Suspicious Activity

Reports (see below) as part of their anti-money laundering program, the proposed

Suspicious Activity Report for Insurance Companies form will be the required medium

for reporting suspicious activity. An insurance company is not precluded from also

checking the “suspicious transaction” box, as appropriate, when filing a Form 8300;

however, checking the box on the Form 8300 is not required, and in any event will not

satisfy the insurance company’s obligation to file a Suspicious Activity Report in the

appropriate circumstances.

11.

Are insurance companies required to file Suspicious Activity Reports as a

part of their anti-money laundering programs?

Yes. Pursuant to a final rule adopted at the same time as the anti-money

laundering program final rule, insurance companies will now be required to file

3 Currency Transaction Reports are filed by certain financial institutions for deposit, withdrawal, exchange

of currency, or other payment or transfer by, through, or to the financial institution that involves a

transaction or transactions in currency of more than $10,000.

7

program final rule, insurance companies will now be required to file

3 Currency Transaction Reports are filed by certain financial institutions for deposit, withdrawal, exchange

of currency, or other payment or transfer by, through, or to the financial institution that involves a

transaction or transactions in currency of more than $10,000.

7

Suspicious Activity Reports. This requirement will take effect 180 days from when the

final rule is published in the Federal Register.

We have proposed a new suspicious activity reporting form for insurance

companies (FinCEN Form 108 – Suspicious Activity Report by Insurance Companies).

Until such time as that form has been adopted and is available for use, insurance

companies should use FinCEN Form 101 – Suspicious Activity Report by Securities and

Futures Industries to report suspicious transactions. Importantly, to assist law

enforcement in locating reports filed by insurance companies, the words “Insurance

SAR” should be entered on the first line of the Narrative.

Under the final rule requiring suspicious activity reporting by insurance

companies, covered insurance companies must file Suspicious Activity Reports to report

suspicious transactions, rather than checking the” suspicious transaction” box on Form

8300 (Box 1b) (see above). It may be appropriate for an insurance company to file a

Form 8300 for receipt of cash and other items over $10,000 as well as to file a Suspicious

Activity Report when the circumstances surrounding the receipt of cash and other items

are suspicious.

12

ivity Reports to report

suspicious transactions, rather than checking the” suspicious transaction” box on Form

8300 (Box 1b) (see above). It may be appropriate for an insurance company to file a

Form 8300 for receipt of cash and other items over $10,000 as well as to file a Suspicious

Activity Report when the circumstances surrounding the receipt of cash and other items

are suspicious.

12.

What are examples of suspicious activities with regard to insurance

products?

Some examples of "red flags" include, but are not limited to, the following: the

purchase of an insurance product inconsistent with the customer's needs; unusual

payment methods, such as cash, cash equivalents (when such a usage of cash or cash

equivalents is, in fact, unusual), or structured monetary instruments; early termination of

a product (including during the "free look" period), especially at a cost to the customer, or

where payment is made by, or the refund check is directed to, an apparently unrelated

third party; the transfer of the benefit of a product to an apparently unrelated third party; a

customer who shows little concern for the investment performance of a product, but a

great deal of concern about the early termination features of the product; a customer who

is reluctant to provide identifying information when purchasing a product, or who

provides minimal or seemingly fictitious information; and a customer who borrows the

maximum amount available soon after purchasing the product.

13.

How should suspicious activity involving variable insurance products funded

by separate accounts that meet definition of a “mutual fund” be reported?

Some insurance companies issue variable insurance products funded by separate

accounts, some of which meet the definition of a mutual fund.4

We are in the process of

finalizing a rule that would require mutual funds to themselves file suspicious activity

reports

activity involving variable insurance products funded

by separate accounts that meet definition of a “mutual fund” be reported?

Some insurance companies issue variable insurance products funded by separate

accounts, some of which meet the definition of a mutual fund.4

We are in the process of

finalizing a rule that would require mutual funds to themselves file suspicious activity

reports. When that final rule becomes effective, we will amend the insurance company

4 A mutual fund is an investment company (as defined in section 3 of the Investment Company Act of 1940

(15 U.S.C. 80a-3) that is an open-end company (as defined in section 5 of the Investment Company Act of

1940 (15 U.S.C. 80a-5)) that is registered, or required to register, with the Securities and Exchange

Commission under section 8 of the Investment Company Act of 1940.

8

suspicious activity reporting rule to ensure that such suspicious activity is reported under

the mutual fund rule.

Until such time as a final rule requiring suspicious activity reporting by mutual

funds is adopted, however, insurance companies that issue variable insurance products

funded by separate accounts that meet the definition of a mutual fund may report

suspicious activity on FinCEN Form 101 – Suspicious Activity Report by Securities and

Futures Industries.

14.

Are insurance brokers and agents required to file suspicious activity reports?

The obligation to identify and report suspicious transactions applies only to an

insurance company, and not to its agents or brokers

ate accounts that meet the definition of a mutual fund may report

suspicious activity on FinCEN Form 101 – Suspicious Activity Report by Securities and

Futures Industries.

14.

Are insurance brokers and agents required to file suspicious activity reports?

The obligation to identify and report suspicious transactions applies only to an

insurance company, and not to its agents or brokers. Nevertheless, because insurance

agents and brokers are an integral part of the insurance industry due to their direct contact

with customers, the final rule requires an insurance company to establish and implement

policies and procedures reasonably designed to obtain customer-related information

necessary to detect suspicious activity from all relevant sources, including from its agents

and brokers, and to report suspicious activity based on such information.

The final rule imposes a direct obligation only on insurance companies, and not

on their agents or brokers, for a number of reasons. First, whether an insurance company

sells its products directly or through agents, we believe that it is appropriate to place on

the insurance company, which develops and bears the risks of its products, the

responsibility for guarding against such products being used to launder illegally derived

funds. Second, insurance companies, due to their much larger size relative to that of their

numerous agents and brokers, are in a much better position to shoulder the costs of

compliance connected with the sale of their products. Finally, numerous insurers already

have in place compliance programs and best practices guidelines for their agents and

brokers to prevent and detect fraud. We believe that insurance companies largely will be

able to integrate their obligation to report suspicious transactions into their existing

compliance programs and best practices guidelines

iance connected with the sale of their products. Finally, numerous insurers already

have in place compliance programs and best practices guidelines for their agents and

brokers to prevent and detect fraud. We believe that insurance companies largely will be

able to integrate their obligation to report suspicious transactions into their existing

compliance programs and best practices guidelines.

Insurance agents and brokers will play an important role in the effective operation

of an insurance company’s obligation to report suspicious transactions. By not placing an

independent reporting obligation on agents and brokers, we do not intend to minimize

their role. We intend to assess the effectiveness of the rule on an ongoing basis. If it

appears that the effectiveness of the rule is being undermined by the failure of agents and

brokers to cooperate with their insurance company principals, we will consider proposing

appropriate amendments to the rule. We also expect that an insurance company, when

faced with a non-compliant agent or broker, will take necessary actions to secure such

compliance, including, when appropriate, terminating its business relationship with such

an agent or broker.

9

Certain insurance agents and insurance brokers may be broker-dealers in

securities with an independent obligation to report suspicious activity under another Bank

Secrecy Act regulation.5

15.

Are joint Suspicious Activity Report filings permissible?

Yes. In circumstances where two or more financial institutions subject to

suspicious activity reporting requirements under the Bank Secrecy Act are involved in a

common or related transaction, and each financial institution has information about the

transaction, a joint Suspicious Activity Report may be filed. Neither the Bank Secrecy

Act nor regulations promulgated by us prohibit financial institutions from sharing

information relating to suspicious activities as long as no persons involved in the

transaction are notified

ecrecy Act are involved in a

common or related transaction, and each financial institution has information about the

transaction, a joint Suspicious Activity Report may be filed. Neither the Bank Secrecy

Act nor regulations promulgated by us prohibit financial institutions from sharing

information relating to suspicious activities as long as no persons involved in the

transaction are notified.

An insurance company must keep a copy of the filed Suspicious Activity Report

form for its records. The Suspicious Activity Report and the original or business record

equivalent of any supporting documentation must be maintained in the insurance

company’s records for a period of five years from the date of filing. An insurance

company must also retain copies of reports (and supporting documentation) provided to it

by its agents that are required to make reports by another provision in 31 CFR Part 103

when the agents and the company file a joint report regarding a transaction involving

both companies.

A joint Suspicious Activity Report that is filed with us in the manner described

above will be deemed to have been filed by each financial institution involved in the

underlying transaction, thereby satisfying each financial institution’s obligation to report

suspicious activity. Financial institutions may share information pertaining to the

transaction, as long as no persons involved in the transaction are notified. Such

communications between financial institutions for the purpose of filing or determining

whether to file a joint Suspicious Activity Report are protected by a safe harbor from

civil liability pursuant to 31 U.S.C. 5318(g), as disclosures authorized under that

section’s implementing regulations and interpretative guidance

ction, as long as no persons involved in the transaction are notified. Such

communications between financial institutions for the purpose of filing or determining

whether to file a joint Suspicious Activity Report are protected by a safe harbor from

civil liability pursuant to 31 U.S.C. 5318(g), as disclosures authorized under that

section’s implementing regulations and interpretative guidance.

In all such joint filings, only one of the filing institutions should be identified as

the “filer” in the filer identification section of the form (unless the form accommodates

multiple filers, as the Suspicious Activity Report for Insurance Companies will do). The

Narrative section of the suspicious activity report must include the words “joint filing”

and must identify the other financial institution or institutions on whose behalf the report

is being filed (unless the form will accommodate multiple filers, in which case there is no

need to include that information in the Narrative section).

5 Variable insurance products that are deemed securities under the Securities Exchange Act of 1934 must be

sold by registered broker-dealers, which are themselves subject to a suspicious activity reporting obligation.

See 31 CFR 103.19. Banks, which sell fixed annuities as agent for insurance companies, are also subject to

suspicious activity reporting. See 31 CFR 103.18.

10

5 Variable insurance products that are deemed securities under the Securities Exchange Act of 1934 must be

sold by registered broker-dealers, which are themselves subject to a suspicious activity reporting obligation.

See 31 CFR 103.19. Banks, which sell fixed annuities as agent for insurance companies, are also subject to

suspicious activity reporting. See 31 CFR 103.18.

10

16.

If an insurance company files a Suspicious Activity Report voluntarily, will it

be protected from civil liability?

Yes. Pursuant to 31 U.S.C. 5318(g)(3): “Any financial institution that makes a

voluntary disclosure of any possible violation of law or regulation to a government

agency …shall not be liable to any person under any law or regulation of the United

States… or regulation of any State…for such disclosure or for any failure to provide

notice of such disclosure to the person who is the subject of such disclosure or any other

person identified in the disclosure.”

It is the intent of this provision of the Bank Secrecy Act to provide the greatest

possible protection to financial institutions, in the form of a “safe harbor,” to encourage

the filing of Suspicious Activity Reports if appropriate.

17.

May we disclose that a Suspicious Activity report was filed? What if we

receive a civil subpoena?

There are statutory and regulatory prohibitions against the disclosure of

information filed in, or the fact of filing, a Suspicious Activity Report whether the report

is required or is filed voluntarily. Thus, insurance companies filing the proposed

Suspicious Activity Report by Insurance Companies (or receiving a copy of filed joint

Suspicious Activity Reports from another financial institution involved in the same

transaction) are specifically prohibited from disclosing that a Suspicious Activity Report

has been filed or the information contained therein, except to appropriate law

enforcement and regulatory agencies

filing the proposed

Suspicious Activity Report by Insurance Companies (or receiving a copy of filed joint

Suspicious Activity Reports from another financial institution involved in the same

transaction) are specifically prohibited from disclosing that a Suspicious Activity Report

has been filed or the information contained therein, except to appropriate law

enforcement and regulatory agencies.

If you are served with any subpoena requiring disclosure of the fact that a

Suspicious Activity Report has been filed or of a copy of the Suspicious Activity Report

itself, except to the extent that the subpoena is submitted by an appropriate law

enforcement or supervisory agency, you should neither confirm nor deny the existence of

the Suspicious Activity Report. You also should immediately notify the Office of Chief

Counsel at the Financial Crimes Enforcement Network (703-905-3590).

18.

Certain financial institutions participate in information sharing pursuant to

section 314(b) of the USA PATRIOT Act and Financial Crimes Enforcement

Network regulations at 31 CFR 103.110. May insurance companies now

participate in that information sharing?

Yes. Pursuant to 31 CFR 103.110(a)(2), information sharing between financial

institutions concerning terrorist financing and/or money laundering is available to

financial institutions that have an obligation to establish anti-money laundering programs.

Once an insurance company subject to the insurance company anti-money laundering

program rule has established its anti-money laundering program it may file a certification

for purposes of section 314(b) of the USA PATRIOT Act and 31 CFR 103.110.

11