Implications of FinCEN Guidance on SAR Sharing for Casinos
On January 4, 2017, the Financial Crimes Enforcement Network (FinCEN) issued guidance1 to the gaming industry on the sharing of suspicious activity reports (SARs), confirming that casinos may share SARs, or any information that may reveal the existence of a SAR, within certain portions of its corporate organization. Specifically, subject to certain limitations, casinos may share SARs with each office or other place of business located within the US of either the casino itself or a parent or affiliate of the casino. Casinos and their parents and affiliates should thoughtfully incorporate this guidance into their Bank Secrecy Act (BSA) programs to ensure proper aggregation and analysis of information across the corporate enterprise.
The guidance clarifies the permissibility of SAR sharing within the casino's corporate organizational structure as prescribed under 31 C.F.R. § 1021.320(e)(ii)(B), but does not create or change any legal obligation for casinos. Section 1021.320(e)(ii)(B) states that, provided no person involved in any reported suspicious transaction is notified that the transaction has been reported, casinos are not prohibited from sharing "a SAR, or any information that would reveal the existence of a SAR, within the casino's corporate organizational structure for purposes consistent with Title II of the [BSA] as determined by regulation or in guidance."
FinCEN's guidance states that sharing SARs will facilitate a casino’s ability to identify suspicious transactions and may enhance a parent's or affiliate's respective BSA efforts by allowing those entities to review the casino's SARs and obtain a clearer and more comprehensive understanding of the activities the casino has identified as suspicious. As discussed below, this increase in access to information raises the compliance standards for casinos.
The guidance also specified limitations to sharing SAR information, including that SARs or SAR information may not be shared with:
- Parents, affiliates, offices, or other places of business located outside the US, including non-US offices of domestic parents or affiliates;
- Individuals or entities within a parent's or casino's organizational structure who perform functions unrelated to gaming;
- A financial institution without an independent SAR-filing obligation, such as a check casher; or
- A money services business that may be co-located with a casino, but is not an affiliate of the casino.
In addition, the authority to share SAR information is limited to the originating office or gaming property. Recipients of SARs or SAR information are prohibited from subsequently sharing that information with other affiliates or parents.
Consistent with the requirements for casinos to maintain compliance programs that use all available information for determination of reporting obligations under 31 C.F.R. § 1021.210(b)(2)(v)(B), this guidance suggests that casinos, and now their parents and affiliates, are subject to an enhanced BSA compliance standard where they must utilize all information available to them, including SARs and the underling facts and information, to meet their BSA obligations. This enhanced standard will require greater coordination across the corporate organization and enhanced internal controls and data management systems. Notably, FinCEN stated that gaming establishments that are licensed separately from each other, but under common ownership, are not considered affiliates for purposes of sharing SARs. Accordingly, casinos under common ownership will not be required to aggregate and utilize SAR data across gaming institutions.
Gaming establishments, and their parents and affiliates, should carefully evaluate how the guidance may impact their enterprise-wide compliance operations, identify which entities may share SAR information and which may not, and tailor their policies, procedures, and internal controls accordingly.
Sharing Suspicious Activity Reports with U.S. Parents and Affiliates of Casinos, FIN-2017-G001 (Jan. 4, 2017).