Treasury’s Financial Crimes Unit Releases Cyber Guidance

The Treasury Department’s Financial Crimes Enforcement Network (FinCEN) recently issued an advisory to financial institutions on cyber-events and cyber-enabled crime, as well as Frequently-Asked-Questions guidance regarding the reporting of cyber-events, cyber-enabled crime and cyber-related information through Suspicious Activity Reports.

FinCEN said the late October guidance is designed to assist financial institutions in understanding their Bank Secrecy Act obligations regarding cyber-events and cyber-enabled crime, and also highlights how BSA reporting helps U.S. authorities combat cyber-events and cyber-enabled crime.

The alert is designed to help financial institutions with the following:

• Reporting cyber-enabled crime and cyber-events through Suspicious Activity Reports (SARs);

• Including relevant and available cyber-related information (e.g., Internet Protocol (IP) addresses with timestamps, virtual-wallet information, device identifiers) in SARs;

• Collaborating between BSA/Anti-Money Laundering (AML) units and in-house cybersecurity units to identify suspicious activity; and

• Sharing information, including cyber-related information, among financial institutions to guard against and report money laundering, terrorism financing, and cyber-enabled crime.

The alert also defines three types of cyber-related incidents:

• Cyber-Event: An attempt to compromise or gain unauthorized electronic access to electronic systems, services, resources, or information.

• Cyber-Enabled Crime: Illegal activities (e.g., fraud, money laundering, identity theft) carried out or facilitated by electronic systems and devices, such as networks and computers.

• Cyber-Related Information: Information that describes technical details of electronic activity and behavior, such as IP addresses, timestamps, and Indicators of Compromise (IOCs). Cyber-related information also includes, but is not limited to, data regarding the digital footprint of individuals and their behavior.

FinCEN and law enforcement regularly use information financial institutions report under the BSA to initiate investigations, identify criminals, and disrupt and dismantle criminal networks, the alert states.

FinCEN also points out that the advisory “does not change existing BSA requirements or other regulatory obligations for financial institutions,” and that financial institutions “should continue to follow federal and state requirements and guidance on cyber-related reporting and compliance obligations.”