On January 4, 2017, the United States Department of Treasury's Financial Crimes Enforcement Network (FinCEN) issued an advisory to clarify when casinos may share a suspicious activity report (SAR) with their own offices, parent entities or affiliates.1 The advisory indicates that subject to certain limitations, the Bank Secrecy Act (BSA) permits a casino to share SARs, or information revealing the existence of SARs, with any office or place of business located in the United States of either the casino itself or its parent or affiliate.2
Permissible Sharing of SARs
FinCEN confirms that casinos may share SARs, or information revealing the existence of such SARs, with the casino's own domestic offices or other places of business. Similarly, a casino may share SARs with domestic offices for its parents or affiliates. For purposes of the advisory, an affiliate includes any financial institution "that is required under rules implementing the BSA to report suspicious transactions and that is controlled by, or is under common control with, the casino filing the SAR." Two or more licensed gaming establishments also may be considered affiliates for purposes of the advisory, so long as they are not organized as separate legal entities.
According to FinCEN, SAR sharing among domestic offices and affiliates is consistent with existing BSA regulations that already permit casinos to share SARs and related information with specific enumerated parties, including FinCEN itself, tribal regulatory authorities and federal, state, local law enforcement or regulatory agencies.3 FinCEN's view is that SAR sharing within domestic offices will enhance a casino's ability to form a clear and comprehensive understanding of the "red-flag" activities engaged in by customers, resulting in more uniform and consistent compliance with the BSA. The advisory concludes that SAR sharing in this context is "consistent with the purposes of Title II of the BSA" and, therefore, evidence that SAR sharing within a casino's domestic offices, parents and affiliates is permissible under the BSA.
Limitations on SAR Sharing
Although FinCEN endorses SAR sharing by casinos as noted, such sharing is subject to certain limitations, which are addressed in the advisory. First, as implied above, FinCEN prohibits casinos from sharing SARs or related information with parents, affiliates or offices located outside the United States, including non-US offices of domestic parents or affiliates. The advisory determines whether an office or place of business is "domestic" based on where it is physically located, so non-US offices conducting business within the United States (for example, online gaming operations) may share SARs with only those places of business physically located within the United States.
The advisory also emphasizes the express limitations on SAR disclosure in the BSA; namely, that no person involved in the suspicious transaction and/or the subject of a SAR may be notified that the transaction has been reported. FinCEN cautions that a casino or its parent or affiliate may "be liable for direct or indirect disclosure of a SAR, or any information that would reveal the existence of a SAR, to any person who is the subject of the SAR."4 Moreover, the advisory emphasizes that SAR sharing may not extend to entities within a parent's or casino's organizational structure that perform functions unrelated to gaming, such as retail shops, hotels and similar businesses within a gaming establishment not covered under the BSA.5
The BSA also explicitly prohibits SAR sharing with covered entities, such as a money services business co-located with the casino, if the business is not an affiliate of the casino. Likewise, a domestic affiliate that receives a SAR from the casino, or information that reveals the existence of a SAR, cannot forward the SAR or related information to its own affiliate -- even if its own affiliate is subject to the BSA's reporting obligations.
In implementing FinCEN's new guidance regarding interpretation of the BSA's regulations, casinos should clarify as needed the universe of legal entities that may fall within the scope of parties for which SAR sharing is permitted, and consider whether a review of existing compliance policies and procedures for SAR and information sharing generally is warranted. In addition, the advisory should be viewed in consideration of the "information sharing" repeatedly emphasized by FinCEN in other contexts, including a specific reference in its prior advisory on "Promoting a Culture of Compliance" dated August of 2014. Even though the BSA does not mandate SAR sharing with affiliates or related legal entities, failure to do so could result in missed "red flags," resulting in a failure to file a required SAR. In addition, SAR sharing has implications for risk monitoring and customer due diligence, to the extent that the receipt of a SAR by an affiliate or related entity could impact the risk ratings of players who are active at multiple locations for the same casino.