casemark/sar-filing
skills/legal/sar-filing/SKILL.md
Drafts FinCEN Suspicious Activity Reports (Form 111) for BSA/AML regulatory filing. Compiles subject identification, transaction timelines, red-flag analysis, and activity classifications. Use when a financial institution detects suspicious transactions requiring mandatory SAR filing, continuing activity reports, or BSA compliance documentation.
$ install --global
skillsauthnpx skillsauth add casemark/skills sar-filingInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 17, 2026, 2:17 PM10.5s1 file scanned
SKILL.md
- name:
- sar-filing
- description:
- Drafts FinCEN Suspicious Activity Reports (Form 111) for BSA/AML regulatory filing. Compiles subject identification, transaction timelines, red-flag analysis, and activity classifications. Use when a financial institution detects suspicious transactions requiring mandatory SAR filing, continuing activity reports, or BSA compliance documentation.
SAR Filing
Drafts a FinCEN-ready SAR (Form 111) from transaction records, investigation files, and institutional data.
Prerequisites
Gather before drafting:
- Transaction records — amounts, dates, account numbers, instrument types
- CIP/KYC documentation — government IDs, SSN/TIN, beneficial ownership
- Investigation file — alerts, internal notes, employee observations
- Filer details — institution legal name, EIN, LEI, regulator, SAR contact
- Prior SAR history (continuing filings) — BSA IDs, filing dates
Quick Start
- Determine filing type: Initial / Continuing / Corrective
- Verify thresholds: ≥$5,000 (subject identified) or ≥$25,000 (no subject)
- Confirm deadline: 30 days from detection (60 if no subject identified)
- Draft sections in order below
- Run compliance checklist before submission
SAR Sections
1. Filing Header
| Field | Detail | |---|---| | Filing type | Initial / Continuing / Corrective | | Institution | Legal name, EIN/LEI | | Regulator | OCC / Fed / FDIC / NCUA / State | | SAR contact | Name, title, phone, secure email | | Detection date | When activity first identified | | Filing deadline | 30 days (60 if no subject) | | Prior BSA ID | If continuing: reference number + new trigger |
2. Subject Identification
Classify each party: Subject, Purchaser/Sender, Payee/Receiver, Other.
Individuals: Legal name, aliases, DOB, SSN/ITIN, address, government ID (type/number/jurisdiction/expiration). Foreign nationals: passport, citizenship, visa, high-risk jurisdiction nexus.
Entities: Legal name, DBAs, EIN, formation state/date, business nature, beneficial owners (≥25% ownership or substantial control).
Relationships: Document familial, business, signatory, nominee, or intermediary connections between parties.
3. Account Detail
For each account: number, type, open date, status (active/closed/restricted/frozen), holders/signers, stated purpose, baseline activity profile, and deviations triggering concern.
Include: branch contacts, prior compliance concerns, correspondent/MSB/processor relationships with fund-flow tracing, CIP/CDD/EDD procedures performed, closure details if applicable.
4. Activity Classification
Select FinCEN categories:
| Category | Examples | |---|---| | Structuring | Below CTR thresholds | | Money laundering | Layering, integration, funnel accounts | | Terrorist financing | OFAC/SDN nexus | | Fraud | Check kiting, wire fraud, elder exploitation | | Identity crimes | Synthetic ID, stolen credentials | | Cyber | Account takeover, intrusion-related transfers | | Sanctions evasion | Sanctioned jurisdictions/persons | | Other | Unlicensed MSB, trade-based ML, human trafficking |
Thresholds: ≥$5,000 (subject identified) / ≥$25,000 (no subject). For blocked/attempted transactions, explain why filing is warranted. Confirm no exemption applies and filing is not duplicative.
State total dollar amount, currency, and complete time period.
5. Narrative
Address Who/What/When/Where/Why/How chronologically:
- Detection — How identified (alert, referral, LE inquiry, audit); specific trigger; why not false positive
- Timeline — Each significant transaction: date, type, amount, source→destination, stated purpose, unusual characteristics
- Red flags — Map facts to indicators: reluctance to provide info, no economic purpose, rapid in/out movement, structuring, shell companies, high-risk jurisdictions, profile inconsistencies. Cite FFIEC BSA/AML Manual or FinCEN advisories where applicable.
- Investigation — Customer contact attempts and responses, why insufficient, public records research, prior SARs (BSA IDs and dates)
- Conclusion — Factual basis for filing. Objective tone only — no conclusions about criminal intent.
6. Supporting Documentation
Index attachments by category: transaction records, customer ID docs, correspondence, monitoring system output, investigation memos, inter-institution communications. Label each with title and narrative relevance.
Compliance Checklist
- [ ] Filed within 30-day deadline (60-day if no subject)
- [ ] All mandatory Form 111 fields completed
- [ ] Narrative addresses Who/What/When/Where/Why/How
- [ ] Dollar amounts accurate and aggregated
- [ ] All dates, account numbers, IDs verified
- [ ] Senior management/board notified per policy
- [ ] Legal counsel consulted if civil liability or non-BSA issues
- [ ] Reviewing/approving officers documented
- [ ] Filed via BSA E-Filing; confirmation + BSA ID retained
- [ ] File stored separately, access restricted to need-to-know
- [ ] 5-year retention initiated from filing date
- [ ] No disclosure to any subject (31 U.S.C. § 5318(g)(2))
- [ ] No inadvertent tipping via closure letters or communications
- [ ] Immediate LE notification assessed
Critical Rules
- Confidentiality is absolute. SAR disclosure prohibition (31 U.S.C. § 5318(g)(2)) carries criminal penalties. Never reference SAR existence in customer-facing communications.
- Objectivity only. State facts and observations. Never conclude criminal guilt or legal violations.
- Over-include. FinCEN prefers detailed narratives.
- Standalone. Must be comprehensible without access to underlying bank records.
- Continuing filings must reference prior BSA IDs and identify what is new.
- Safe harbor (31 U.S.C. § 5318(g)(3)) applies to good-faith filings — document investigative process thoroughly.
Related Skills
casemark/medical-records-gap-analysis
tools
VerifiedTrustedCommunity
Audits the complete in-scope medical-record universe in a litigation matter and produces an attorney-facing, Bates-cited analysis of treatment gaps, missing records or providers, baseline coverage, material billing or production mismatches, and complaint evolution. Use when asked to find missing medical records, analyze treatment gaps or first-care timing, identify absent providers, assess whether a production is complete, or prepare a records-request target list. Use medical-record-chronology instead when the primary request is a chronological clinical narrative.
40SKILL.mdUpdated Sep 3, 2026
casemark/private-placement-memo
development
VerifiedTrustedCommunity
Drafts a legally compliant Private Placement Memorandum for Regulation D offerings (Rule 506(b)/506(c)), covering full disclosure framework including risk factors, capitalization, securities terms, use of proceeds, and investor qualification requirements. Enforces SEC anti-fraud compliance under Section 10(b)/Rule 10b-5, blue sky law considerations, and accredited investor verification under Rule 501. Use this skill when drafting PPMs, offering memorandums, Reg D disclosure documents, or private offering circulars for issuers raising capital from sophisticated investors. Also trigger when the user mentions private placement disclosure, offering memorandum, Reg D fundraising, or accredited investor verification. Even if the user just says "PPM" or "draft our offering memo," use this skill.
40SKILL.mdUpdated Apr 17, 2026
casemark/privacy-law-updates
data-ai
VerifiedTrustedCommunity
Generates structured privacy and data protection law briefings across US, EU, UK, and other jurisdictions. Organizes by jurisdiction with compliance deadlines, enforcement actions, and legislative changes. Use when preparing privacy law briefings, compliance updates, regulatory change summaries, or data protection landscape reviews.
40SKILL.mdUpdated Apr 17, 2026
casemark/prior-art-summary
testing
VerifiedTrustedCommunity
Generates structured summaries of prior art references for patent prosecution, validity analysis, and freedom-to-operate assessments. Maps disclosures to claim elements with precise citations. Use when summarizing prior art, analyzing patent landscapes, mapping references to claims, or preparing office action responses.
40SKILL.mdUpdated Apr 17, 2026