A non-bank residential mortgage lender or originator has to file a suspicious activity report (SAR) when a transaction conducted or attempted at or through it involves or aggregates funds or other assets of at least $5,000 and the company knows, suspects or has reason to suspect one of four things about it. The report goes to the Financial Crimes Enforcement Network (FinCEN) no later than 30 calendar days after the initial detection of facts that may form the basis for filing. Where no suspect is identified on the date of that initial detection, the company may take a further 30 calendar days to identify one, but in no case more than 60 calendar days from initial detection. The rule is 31 CFR s. 1029.320, and the company also has to run a written anti-money laundering (AML) program under s. 1029.210.
The rule that brought non-banks in
Non-bank residential mortgage lenders and originators were not Bank Secrecy Act (BSA) filers until FinCEN defined them as loan or finance companies in a final rule at 77 FR 8148, published February 14, 2012. That rule took effect on April 16, 2012, and the compliance date for the AML program in s. 1029.210 was August 13, 2012. Section 1029.320(g) then switched the SAR duty on for transactions initiated after the program was required.
The authority sits in the Bank Secrecy Act at 31 USC s. 5318(g), which lets the Secretary of the Treasury require a financial institution, and its directors, officers, employees and agents, to report any suspicious transaction relevant to a possible violation of law. Subsection (g)(2) carries the notification bar and (g)(3) the safe harbor from liability for reporting.
The four parts of the AML program
Section 1029.210(a) wants a written program, reasonably designed to stop the company being used to launder money or finance terrorism, approved by senior management, and produced to FinCEN on request. Paragraph (b) sets four minimum parts.
- Policies, procedures and internal controls based on the company’s own assessment of its money laundering and terrorist financing risk, covering BSA compliance, integrating its agents and brokers, and obtaining the customer information the program needs.
- A designated compliance officer, responsible for effective implementation (including monitoring agents and brokers), for keeping the program current, and for seeing that the right people are trained.
- Ongoing training of appropriate persons, which the company may deliver itself or verify that a competent third party delivered for the products and services it offers.
- Independent testing whose scope and frequency match the risk of the products and services, conducted by a third party or by any officer or employee other than the designated compliance officer.
Paragraph (b)(4) excludes the designated compliance officer from conducting that testing.
What makes a transaction reportable
Section 1029.320(a)(2) sets the $5,000 floor and then four grounds, any one of which is enough. The transaction, or a pattern it belongs to, involves funds from illegal activity or is meant to hide or disguise such funds; or it is designed, through structuring or otherwise, to evade a BSA requirement; or it has no business or apparent lawful purpose, or is not the sort the customer would normally engage in, with no reasonable explanation after the available facts are examined; or it involves using the company to facilitate criminal activity.
A company may also file voluntarily on a transaction the section does not require it to report. Where more than one institution has a duty on the same transaction, one report will do, provided it carries all the relevant facts including every institution’s name, follows the joint filing instructions, and each institution keeps a copy with the supporting documentation.
Deadlines, records and the 90 day clock
The 30 and 60 calendar day rule in s. 1029.320(b)(3) runs from initial detection, not from the date of the transaction. Where the violation needs immediate attention, such as suspected terrorist financing or an ongoing laundering scheme, paragraph (b)(4) requires an immediate telephone call to an appropriate law enforcement authority on top of the timely SAR.
The company keeps a copy of every SAR it files, and the original or business record equivalent of the supporting documentation, for five years from the date of filing, under paragraph (c). Supporting documentation is identified as such and is treated as having been filed with the SAR.
For activity that carries on, FinCEN’s filing instructions set out a 90 day rhythm at pp. 9 and 10 of the April 2026 version: detection on day 0, the initial SAR by day 30, the 90 day review period ending on day 120, and a continuing report by day 150 if the activity has continued. Page 9 says an institution is not required to follow that pattern and may instead file on the ordinary timelines. A continuing report is completed in full and its narrative covers the 90 day period, without reproducing the earlier narratives.
SAR confidentiality
A SAR, and any information that would reveal one exists, is confidential under s. 1029.320(d). A company served with a subpoena for one declines to produce it, citing the section and 31 USC s. 5318(g)(2)(A)(i), and tells FinCEN about the request and the response. Three disclosures are outside the bar as long as no person involved in the reported transaction is told: to FinCEN, law enforcement or a BSA supervisor; the underlying facts, transactions and documents on which the SAR rests, including to another institution preparing a joint SAR; and sharing within the company’s own corporate structure.
On September 2, 2026, FinCEN, the Federal Reserve, the Federal Deposit Insurance Corporation, the National Credit Union Administration and the Office of the Comptroller of the Currency issued a joint statement clarifying that SAR confidentiality does not stop a bank talking to its customers about potentially fraudulent transactions, other suspicious activity, or account closures. The release says in terms that the statement alters no existing BSA legal or regulatory requirement and sets no new supervisory expectation, so s. 1029.320(d) stands as written.
The schemes the white paper names
The Federal Financial Institutions Examination Council (FFIEC) white paper of February 2010 splits mortgage fraud two ways at p. 6, following the FBI’s classification: fraud for housing, where the borrower lies to get a house, and fraud for profit, where the object is money out of the transaction. Its summaries run from p. 10 to p. 12.
- Buy and bail. A borrower who is current but underwater takes out a purchase money loan on a similar, cheaper house, then walks away from the first loan.
- Chunking. A third party persuades an uninformed borrower to invest with no money down, then files applications with several institutions on various properties and keeps the proceeds.
- Double selling. An originator copies a genuine loan file and sends the package to separate warehouse lenders, each of which funds it.
- Equity skimming. A fraudulent appraisal overvalues the property, creating phantom equity that is then stripped out.
- Fictitious loan. Loan documents are fabricated, or a real person’s information is used, for a loan nobody intends to repay.
- Phantom sale. Title is falsely transferred and funds are obtained through mortgage loans or sales to third parties.
- Property flip fraud. A property is bought and resold at an inflated price, often the same day and often to a straw buyer, with a complicit appraiser supplying the inflated value, per p. 40.
- Builder bailout. A builder with unsold units uses hidden down payment assistance or excessive seller concessions to lift the recorded sales price, leaving the lender with collateral whose real loan-to-value exceeds 100 percent, per p. 17.
The paper treats a straw or nominee borrower, identity theft, a fake down payment, a fraudulent appraisal and fraudulent documentation as mechanisms rather than schemes, because each can appear inside several schemes. Its glossary at p. 87 defines a straw buyer as a person used to buy or borrow against property to conceal the actual owner, who does not intend to occupy or pay and is usually compensated for the use of their identity.
Fannie Mae publishes its own list, Potential Red Flags for Mortgage Fraud and Other Suspicious Activity (2026). It is not reproduced here, and a lender may hand out its own copy.
Sources
- 31 CFR Part 1029.
- 31 USC s. 5318, United States Code release point 119-102.
- 77 FR 8148, 14 February 2012, p. 1.
- FFIEC, The Detection and Deterrence of Mortgage Fraud Against Financial Institutions, February 2010, pp. 6, 10 to 12, 17, 40 and 87.
- FinCEN, SAR filing instructions, April 2026 version 1.0, pp. 9 and 10.
- FinCEN news release, September 2, 2026.