Skip to main content

Deficient Suspicious Activity Reporting - Rare Court decision on broker dealer defficient SAR process

Suspicious activity reporting forms the cornerstone of the Bank Secrecy Act reporting system.

It is critical to the United States’ ability to use financial information provided through the submission of Suspicious Activity Reports (“SARs”) to combat terrorism, terrorist financing, money laundering, and other financial crimes. The quality of the content of the SAR, therefore, is of significant importance to the adequacy and effectiveness of the suspicious activity reporting system and investigations conducted by law enforcement agencies.

In one of the few instances, the Securities and Exchange Commission (“SEC”) obtained a victory in its enforcement action against a broker dealer, Alpine Securities Corporation (“Alpine”), which clears transactions for microcap securities, finding the company liable for thousands of violations of its obligation to file SARS.

Most SAR-related enforcement actions are resolved without litigation, however, this decision provided a rare instance of judicial guidance on SAR filing requirements. Although the opinion has particular relevance in the microcap context, it provides all financial institutions subject to SAR requirements insight into SAR deficiencies including the adequacy of SAR narratives and the inclusion of “red flag” information.


The SEC alleged that from 2011 to 2015 Alpine filed SARs with deficient narratives, failed to file SARs, filed untimely SARs, and failed to maintain supporting documentation, violating Rule 17a-8 of the Securities Exchange Act of 1934, which requires broker-dealers to report potentially illegal trading activities under the Bank Secrecy Act of 1970. Notably, many of the underlying transactions involved Scottsdale Capital Advisors (which shares an owner with Alpine) as the introducing broker.

Judge Cote found Alpine liable for thousands of SAR-filing violations. The court stated that its analysis was based on:


  • Section on the language in 1023.320’s Reports by Brokers or Dealers in Securities of Suspicious Transactions;
  • SAR forms instructions, including the requirement that SAR narratives provide a “clear, complete and chronological description of what is unusual, irregular or suspicious about the transaction”; and,
  • FinCEN guidance documents, including SAR narrative guidance, such as Guidance on Preparing a Complete & Sufficient Suspicious Activity Report Narrative explain, among other things, that “certain fact patterns are typical of suspicious activity

Red Flag Information

As a preliminary matter, the court explained that based upon SAR investigations Alpine’s duty to file a SAR is triggered when a transaction involves:

  • A large deposit of Low-Priced Securities (“LPS”); and,
  • The presence of one of six red flags, in which the court discussed in relation to Alpine[1]:
  1. Related Litigation
  2. Unverified Issuers
  3. Shell Companies or Derogatory History of Stock
  4. Foreign Involvement
  5. Low Trading Volume
  6. Stock Promotion


Once the duty is triggered, the red flag information must be included in the SAR narrative to comply with the SAR Form’s instructions to provide a “clear, complete and chronological description [of] what is unusual, irregular or suspicious about the transaction.”


Also, SARs should be written for the benefit of the ultimate user (law enforcement) to allow them to deploy their resources to assist with that SAR. Specifically, the first sentence should understandably explain why this SAR is reporting suspicious activity related to jurisdiction and product and the narrative must detail pertinent information such as who, what, when and how pertaining to the subject(s) identified in the suspicious activity.


[1] United States Securities and Exchange Commission v. Alpine Securities Corporation

Related Litigation

The instructions to the 2002 Suspicious Activity Report by the Securities and Futures Industries (“2002 SAR Form”) directs a filer to “indicate whether there is any related litigation, and if so, specify the name of the litigation and the court where the action is pending” in the narrative portion of a SAR. The court found that 668 SARs filed by Alpine lacked such information that, in many cases, involved SEC enforcement actions against the issuer or the customer (or an affiliate).

The court ruled that there was no question of fact as to the (1) presence of information about the litigation in the SAR support file, and (2) a connection between the litigation and the reported transaction. That connection is established where the litigation at issue concerns either the issuer of the securities in the transaction or the customer engaged in the transaction. SARs should only include a boilerplate disclaimer at the end. 

Unverified Issuers

The court found that 36 SAR narratives were deficient for failing to disclose the problems with the issuers described in the Alpine support files for the SARs (even though millions of shares of that issuer’s LPS were deposited with Alpine). Specifically, Alpine improperly omitted that the issuer had an expired business license, a nonfunctioning website, or no current SEC filings.

The SAR Form requires filers to provide a “clear” and “complete” description of what is “unusual, irregular or suspicious about the transaction(s).” Further, in its Guidance on Preparing a Complete & Sufficient Suspicious Activity Report Narrative, FinCEN has explained that suspicious activity “common[ly]” includes transactions involving “parties and businesses that do not meet the standards of routinely initiated due diligence and anti-money laundering oversight programs (e.g., unregistered/unlicensed businesses).”

Shell Companies or Derogatory History of Stock

The court found that nearly 250 SARs were deficient for failing to disclose derogatory information regarding the history of a stock, including that the issuer was a shell company or formerly a shell company.

In FinCEN, FIN–2006–G014, Potential Money Laundering Risks Related to Shell Companies (Nov. 9, 2006), FinCEN warned that shell companies “are an attractive vehicle for those seeking to launder money or conduct illicit activity” with significant potential for “abuse” in the form of money laundering or pump and-dump schemes. The court held that being a suspected shell entity is one of several “common patterns of suspicious activity and that Alpine thus was required to note this in its SARs”.

In addition, the court accepted the SEC’s argument that various SARs were incorrectly filed omitting other derogatory or negative information—such as frequent name changes by an issuer, suspended trading of an issuer’s security and the delisting of an issuer.  The court said this information “may indicate that the issuer is engaging in unlawful distributions of securities” or is attempting to evade requirements of the securities laws.

Foreign Involvement

The court found that in 289 SARs filed Alpine did not disclose in the SAR narrative that a foreign entity or individual was involved in the transaction.

The 2002 SAR Form directs filers to “[i]ndicate” in the SAR narrative “whether U.S. or foreign currency and/or U.S. or foreign negotiable instrument(s) were involved. If foreign, provide the amount, name of currency, and country of origin,” and include in the narrative “foreign bank(s) account number(s),” and “passport(s), visa(s), and/or identification card(s)” belonging to an involved “foreign national.”

The 2012 SAR Instructions direct filers to include essentially the same information in the SAR narrative. Both sets of instructions also state that filers should “identify” in the narrative “the country, sources, and destinations of funds” if funds have been “transfer[red] to or from a foreign country.” 

In addition, in Guidance on Preparing a Complete & Sufficient Suspicious Activity Report Narrative FinCEN directs a filer to:

 “[s]pecify” in the SAR narrative if the suspected activity or transaction(s) involve a foreign jurisdiction. If so, provide the name of the foreign jurisdiction, financial institution, address and any account numbers involved in, or affiliated with the suspected activity or transaction(s).”

Low Trading Volume

The court found that 700 SARs were deficient for failing to disclose the comparatively low trading volume in the LPS in relation to the substantial number of deposited shares. The number of deposited shares often amounted to millions of shares which represented at least three times the securities average daily trading volume.

The SAR Form requires a filer to “[d]escribe conduct that raised suspicion,” and to do so with a “clear, complete and chronological” description of the suspicious activity. The SAR Activity Review Trends, Tips & Issues – Issue 15 - One type of transaction that may be suspicious is a “[s]ubstantial deposit, transfer or journal of very low-priced and thinly traded securities”.

Stock Promotion

The court found that Alpine failed to include in SAR narratives where stock promotion occurred within six months of a substantial deposit of LPS. This duty was triggered because the “promotion of an issuer’s stock is a classic indicator that a low-priced stock’s price is being manipulated as part of a pump-and-dump scheme”.  The court reasoned that the one month cut off was “clearly too short a period,” and noted that while a fact finder must “determine the outer limit,” promotion activity within six months of these deposits is a red flag requiring disclosure in the SAR.

In addition, the court found that Alpine maintained inadequate SAR supporting information. Section 1023.320 requires a broker-dealer to maintain all supporting documentation for five years from the date of filing a SAR. The court observed that no such records existed for 1000 SARs. Alpine was unable to locate any supporting material for these SARs.


Suspicious activity reporting continues to be a significant component in the fight against money laundering, terrorist financing and fraud as well as identifying financial crimes patterns and trends. Simply filing SARs will not mitigate risk related to an entity’s responsibility because SAR quality is also key. Therefore financial institutions must:

  • Implement a comprehensive BSA/AML program, incorporating FINCEN guidance in connection with SARs;
  • Perform significant due diligence to identify, investigate and document complete and chronological descriptions of the unusual activity;
  • Provide adequate SAR training to compliance staff and follow SAR Form instructions for accurate reporting; and,
  • Implement quality internal controls to facilitate the review and verification of the SAR filing process

It is important that Chief Compliance Officers and compliance teams periodically assess the quality of the SAR process confirming compliance with BSA/AML requirements. This is most important when SAR filings are numerous and especially when a particular entity is the subject of several SARs. Financial institutions’ high level of due diligence when reporting suspicious and fraudulent activity further support efforts to protect the financial system.