Hey, welcome to VoraPrep Audio. Alright, picture this. You're new on the job, and a client walks in. They want to open an account and deposit fifteen thousand dollars. In cash. They say it’s from an overseas source, but when you ask for details, they get... vague. They just want to put it all into a mutual fund, right now. That feeling in your gut? That little alarm bell? On exam day, and in your real career, that's the signal that you need to know exactly what to do next. This isn't just a test question; it’s about protecting the entire financial system.
So, let's talk about Anti-Money Laundering, or AML.
Think of it like this: criminals get money from illegal activities—drug trafficking, terrorism, you name it. That money is "dirty." They can't just deposit a million dollars in cash from a duffel bag without raising questions. So they try to "launder" it, or wash it, by running it through the legitimate financial system, making it look like it came from a clean source. Our job, at a broker-dealer, is to be the gatekeepers. We have to spot that dirty money before it gets into the wash.
The main law behind all of this is the Bank Secrecy Act, or the BSA. It's been around for a while, but it got a major upgrade after 9/11 with the USA Patriot Act. That's what really put the teeth into these rules, especially the requirement for every firm to have a Customer Identification Program. We'll get to that. For you, the most important rule to know is FINRA Rule 3310. It’s the one that tells every member firm, "You *must* have an AML program, and here's what it needs to look like."
So what does a good AML program actually involve? It’s not just one thing; it's a system with a few key parts.
First, every firm has to designate an Anti-Money Laundering Officer. The AMLO. This is your point person, the one who's in charge of making sure the whole program runs day-to-day. They're the expert you go to when you see something that doesn't feel right.
Next, and this is a big one, is the Customer Identification Program, or CIP. This is basically the bouncer at the club door. Before you let anyone in to open an account, you have to know who they are. The CIP says you must collect, at a minimum, their name, date of birth, a physical address, and their taxpayer ID number, like a Social Security number. And you can't just take their word for it; you have to have procedures to *verify* that identity. This usually happens before the account is opened, but the rule says within a "reasonable time."
And a critical part of that identity check is screening their name against a special list from the Office of Foreign Assets Control, or OFAC. It's called the Specially Designated Nationals and Blocked Persons list—the SDN list. This is essentially a list of known terrorists, narcotics traffickers, and other sanctioned individuals and entities. If your client's name pops up as a match, everything stops. You have to block the transaction, freeze the funds, and report it to OFAC immediately.
Now, let's talk about the two main reports you’ll hear about. They sound similar, but they're for very different things, and the exam loves to test the difference.
First is the Currency Transaction Report, or CTR. This one is pretty straightforward. It's all about cash. Big piles of cash. Anytime a single customer moves more than ten thousand dollars in cash in a single business day—whether it’s a deposit, a withdrawal, whatever—the firm has to file a CTR with FinCEN. That's the Financial Crimes Enforcement Network, a part of the Treasury Department. And you have 15 calendar days to file it. So, think CTR, think Cash, over $10,000.
The other report is the Suspicious Activity Report, or SAR. This one is based on suspicion, not just a simple cash amount. If a transaction involves at least five thousand dollars, and the firm knows, suspects, or just has a reason to suspect that something is off… you file a SAR. Maybe the money seems to be from an illegal source. Or maybe the client is trying to structure their deposits to fly under the radar. Or maybe the whole transaction just has no logical business purpose. If it smells fishy and it's over five grand, it’s SAR territory. You have 30 calendar days from when you spot the activity to file it.
And here is the most important thing you need to remember about a SAR: it is top secret. You cannot, under any circumstances, tell the customer or anyone else unauthorized that you've filed one. That's called "tipping off," and it's a serious violation.
Rounding out the program, firms have to provide ongoing AML training for all their people. It's not a one-and-done thing. And finally, the whole AML program has to be tested for effectiveness every year by an independent party. That could be someone from outside the firm, or even someone inside, as long as they're not involved in the day-to-day AML operations.
Okay, so let's walk through that opening scenario. The client with $15,000 cash from an unknown source. What's your mental checklist?
First, you identify the red flags. A large cash deposit is one. An unverified overseas source is another. And the client being evasive? That’s a huge red flag.
Second, you run your Customer Identification Program. You get their name, address, date of birth, tax ID, and you verify it. You also run their name against that OFAC SDN list to make sure they're not a blocked person.
Third, you have to decide on reporting. Let’s think through the flowchart. Is it a cash transaction over $10,000 in one day? Yes, it’s $15,000. So, a Currency Transaction Report, a CTR, is definitely required. You've got 15 days to file that. But wait. Is the activity also suspicious? The evasive answers, the weird source of funds... absolutely. And it's over the $5,000 threshold. So you *also* need to file a Suspicious Activity Report, a SAR. You have 30 days for that one. And remember, you tell no one about the SAR.
Let's try one more, this one trips people up. A client deposits $8,000 in cash on a Monday. On Tuesday, they come back and deposit another $3,000 in cash. They say they just don't like banks. You find it weird. What do you do?
Well, do you file a CTR? No. Because neither day's deposit was over the $10,000 single-day limit. But is it suspicious? It sure looks like they might be "structuring" their deposits to avoid triggering that $10,000 CTR. That structuring, by itself, is a classic money laundering red flag. Since the total amount involved is over $5,000 and the activity is suspicious, the right move is to file a SAR. Telling the customer you're reporting them would be tipping off, and just closing the account doesn't fulfill your legal duty to report. The answer is to file that SAR.
The exam really hits on a few key traps. The biggest one is mixing up the SAR and CTR thresholds. Just remember: CTR is for C-ash, over ten grand. SAR is for S-uspicious stuff, and the bar is lower, only five grand. For the timing, remember you get more time to report something suspicious—30 days for a SAR. A simple cash transaction is faster—15 days for a CTR.
And they will test you on confidentiality. If you see a question where one of the options is to tell the customer you're filing a SAR, you can cross that one out immediately. That's tipping off, and it's always wrong. Finally, remember this responsibility isn't just on the AML Officer. It’s on you. It’s on every single person at the firm to recognize and report suspicious activity up the chain.
You're building a great foundation here. And if you want to keep building on it, VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. You can get started over at Vora Prep dot com. It's free to try and can really help connect all these dots.
So, to recap the big ideas on AML. The Bank Secrecy Act is the law, and FINRA Rule 3310 puts it into practice for broker-dealers. Your firm needs a designated AML officer, a solid Customer Identification Program to check IDs and the OFAC list, and a system for training and independent testing. And for you, on the front lines, it's all about spotting those red flags and knowing when to trigger a report. Is it cash over $10,000 in a day? That's a CTR. Is it suspicious activity over $5,000? That's a confidential SAR.
You’ve got this. Keep up the great work, and I'll talk to you on the next one.