What if I have emails showing people discussed not filing SARs?

Internal emails discussing whether to file a Suspicious Activity Report (SAR) can be important evidence. They may show that staff identified suspicious activity, raised concerns and made a decision not to file. But an email is not, by itself, proof that a bank or money services business (MSB) committed a Bank Secrecy Act (BSA) violation. Its meaning depends on the transactions, the information available at the time, the organisation’s procedures, and what happened next.

If you are an employee or contractor who has seen emails like these, act carefully. Preserve information lawfully, avoid accessing or sharing records you are not authorised to handle, and get independent legal advice promptly. There may be time limits for reporting retaliation or pursuing other claims. Waiting for an internal investigation to finish may not pause those deadlines.

What might count as a BSA violation?

Financial institutions subject to the BSA must maintain anti-money-laundering programmes and comply with applicable reporting requirements. SAR rules vary according to the type of institution and activity. For example, banks and MSBs have rules addressing suspicious transactions, but the applicable trigger, threshold and filing deadline should be checked against the institution’s specific obligations and current regulations.

A failure to file may be significant where a report was required and the institution did not submit it, submitted it late, or had a broader failure in its systems for identifying and escalating suspicious activity. Regulators may also examine whether the institution’s AML programme was reasonably designed and implemented, including whether staff had training, clear escalation routes and adequate resources.

However, not every suspicious transaction requires a SAR, and not every unfiled SAR reflects a legal violation. A review may find that the activity did not meet the applicable filing standard, that relevant facts were not known at the time, or that a filing decision was made under a reasonable process. A disagreement over judgement is not automatically evidence of misconduct.

Mistake, poor process or willful conduct?

The distinction between human error and willful conduct matters. An isolated missed alert, misunderstanding of a procedure or clerical mistake may point to a training or control failure. It does not automatically show that an individual intended to break the law. By contrast, repeated decisions to suppress escalation, alter records or disregard a known reporting obligation may raise more serious questions.

“Willful” is a legal https://dlf-ne.org/what-if-i-have-emails-showing-people-discussed-not-filing-sars/ concept whose meaning depends on the claim and the facts. It should not be treated as a synonym for “someone made a bad decision”. Evidence that decision-makers knew about a specific risk, understood the relevant obligation and deliberately chose not to act may be relevant, but context remains essential. For example, an email saying “do not file” could reflect an improper instruction—or it could be shorthand for a documented decision that the activity did not meet the filing criteria.

Regulators and courts may look beyond a single message. They can consider the transaction record, internal procedures, alert history, escalation notes, filing decisions, audit findings, training and the organisation’s response when concerns were raised. The issue is often not simply what someone wrote, but what the organisation knew and did over time.

Why internal emails can be knowledge evidence

Internal emails may help establish who knew what, and when. crypto AML enforcement They can be especially relevant if they identify particular customers, transactions, alerts or prior warnings. An email chain dated before a filing deadline may carry different weight from a later message written after an investigation began. Messages discussing repeated activity or a known control gap may also be more informative than a vague statement that something “looks odd”.

But emails have limits. They may be incomplete, written informally, or taken out of context. A message may refer to an earlier review, an attachment or a decision recorded elsewhere. A person may have raised a concern without having authority to decide whether a SAR should be filed. Conversely, a polished process document does not necessarily show that the process worked in practice.

Preserve the surrounding context, not just the sentence that appears most troubling. Relevant context could include the date, recipients, attachments, transaction or alert reference, follow-up messages and the final decision. Do not edit, forward broadly or remove information from company systems to create a personal evidence file. If you are unsure how to preserve records lawfully, ask a solicitor before acting.

What evidence is likely to be useful?

Strong evidence is usually specific, dated and tied to conduct. Rather than making a general allegation that “management ignored AML”, identify the issue you observed: the transaction or alert, the date it was escalated, the person or team notified, and the response. A dated note made close to events may help you recall what happened later, but it should distinguish what you personally saw from what someone else told you.

Internal emails: Keep the full thread and available metadata where you are authorised to do so. Note whether the message identifies a transaction, customer, alert, filing deadline or decision-maker. SAR logs and case-management records: Record the relevant case or alert reference, status, review dates and escalation history. Do not obtain or disclose confidential SAR information unlawfully. Policies and training: Identify the version in force at the time, who was responsible for escalation, and whether staff received relevant training. Personal notes: Make a dated, factual record of meetings or conversations. Separate direct quotations from your recollection and avoid speculation about motives. Follow-up and response: Note when concerns were raised, to whom, what response was given, and whether there was any change to the relevant process or records.

What to write down

The date and time of the event or communication. The transaction, alert or case reference, if known. What you personally observed, and what you learned from someone else. Who was notified, how they were notified, and their response. Any relevant filing deadline or internal escalation step you know about. Where supporting records are held, without copying or removing records improperly. Any later changes, pressure, threats or other treatment that may relate to raising the concern.

Keep notes factual. “On 12 March, I emailed the AML manager about alert 123; on 14 March, they replied that the case was closed” is more useful than “management knowingly enabled money laundering” unless you can substantiate that conclusion. Avoid accessing customer records outside your role or sending customer information to a personal account. SAR confidentiality requirements can restrict disclosure, including disclosure to the subject of a SAR; seek legal advice before sharing any material outside authorised channels.

Timing: do not assume you can wait

Several different clocks may matter: the institution’s SAR filing deadline, a regulator’s investigation timeline, a limitation period for a civil or criminal matter, and the deadline for a whistleblower or retaliation complaint. They are not interchangeable. The applicable period can depend on the legal claim, the date of the conduct, when a claim accrued, and the forum.

Some BSA civil enforcement provisions contain a six-year limitations period, while many federal criminal offences have a general five-year limitation period, subject to exceptions and case-specific rules. Those figures are not a personal filing deadline for every whistleblower, and they should not be used to decide that there is plenty of time. Retaliation procedures can have much shorter deadlines. Certain AML whistleblower protections involve an administrative process and time limits that may be measured in months, not years; the precise route and current requirements should be verified with a lawyer promptly.

Do not wait for an internal review, a regulator’s response or a news story before getting advice about deadlines. Keep a dated record of when you raised concerns and any workplace action that followed. If you face discipline, demotion, dismissal, threats or other adverse treatment, record the dates and preserve relevant communications. Retaliation concerns may require a separate, timely response even while the underlying AML issue is being assessed.

Anonymous or identified submission?

Whether you can submit anonymously depends on the channel and the legal process. A regulator may accept information from a person whose identity is not initially disclosed, but anonymity can make follow-up questions, corroboration and assessment of credibility more difficult. It may also be impossible to obtain an award or use a particular statutory protection without meeting that programme’s identity and procedural requirements.

An identified report can make it easier for investigators to ask questions and assess the source’s knowledge. It can also increase concerns about workplace exposure or retaliation. In some circumstances, a lawyer can discuss making a submission on a confidential basis or act as an intermediary. That does not guarantee that identity will remain protected in every later proceeding, so ask about the limits before providing details.

Do not assume that sending an anonymous email to a regulator automatically protects you from retaliation or preserves a legal claim. Nor should you assume that an internal hotline is confidential in the same way as a lawyer-client conversation. Review the reporting channel’s terms, avoid using workplace devices if that could expose your communications, and obtain independent advice about safe and lawful options.

Where the FFIEC and legal commentary fit

The Federal Financial Institutions Examination Council (FFIEC) website is a useful starting point for supervisory materials and examination resources relevant to financial institutions. It can help you understand how examiners approach BSA/AML controls, but it is not a substitute for the specific statutes, regulations, agency guidance or legal advice that apply to your situation.

The National Law Review has published commentary on filing an AML/BSA whistleblower lawsuit. Use such commentary as a prompt to understand possible legal routes, not as a guarantee that a claim is available or that a particular deadline applies. The facts, employer, role, type of report and timing can all affect the options.

Practical next steps

Do not alter, delete, take or widely circulate company records. Preserve information only through lawful, authorised means. Write a dated chronology that separates what you observed from what you infer. Record the specific transactions or alerts involved, the people notified, and the response—without making unsupported allegations. Get independent advice promptly about reporting channels, confidentiality, retaliation risk and limitation periods. If you report, use a channel suited to the issue and ask how your identity and any customer information will be handled.

Conclusion

Internal emails can be important knowledge evidence, particularly when they are specific, contemporaneous and supported by transaction records or SAR logs. They do not automatically prove a BSA violation or willful conduct. The key is to establish what was known, when it was known, what the applicable obligation required, and how the institution responded—while distinguishing an honest mistake from deliberate disregard.

Protect the integrity of the evidence, document facts rather than conclusions, and take timing seriously. A lawyer experienced in whistleblower and financial-regulatory matters can help assess both the underlying concern and the safest way to raise it.