Consolidated COVID-19 Suspicious Activity Report Key Terms and Filing Instructions

1 FIN-2021-NTC1 February 24, 2021 Consolidated COVID-19 Suspicious Activity Report Key Terms and Filing Instructions The Financial Crimes Enforcement Network (FinCEN) is issuing this Notice to consolidate filing instructions and key terms for fraudulent activities, crimes, and cyber and ransomware attacks related to Coronavirus Disease 2019 (COVID-19), and to remind financial institutions of recent updates to FinCEN guidance concerning Section 314(b). FinCEN has published a series of advisories and notices on COVID-19-related threats to assist financial institutions with the filing of suspicious activity reports (SARs) involving such threats. In this Notice, FinCEN further requests that financial institutions consult the tables below when filing SARs for COVID-19-related activity. Table 1 contains key terms and instructions related to government programs. Table 2 contains a summary of the key terms and instructions for COVID-19-related activities that are not tied to specific government programs. Table 3 provides a list of additional FinCEN’s COVID-19-related publications. Financial institutions that follow the instructions set forth below will assist FinCEN, law enforcement, financial regulators, and other relevant government agencies in identifying and utilizing the information submitted in COVID-19-related SARs. Financial institutions should consult previously published advisories and notices for additional SAR filing instructions related to the advisories and notices included below. If financial institutions wish to cite more than one advisory, then they should use only the FinCEN identification numbers (FINs) listed in the tables below in Field 2, and provide the full references in the SAR narrative. FinCEN requests that filers be as specific as possible in their SAR filings. For instance, if the SAR addresses a government program, FinCEN requests that filers use program-specific keywords, as detailed in the keyword columns in Table 1 below, and avoid relying on generalized key terms, such as “stimulus,” “CARES Act,” or “benefit.” Doing so will expedite identification of relevant SARs for appropriate investigative, analytical, supervisory, and other authorized purposes.

FINCEN NOTICE 2 Table 1: COVID-19 Government Programs Government Program Keyword(s) for Suspicious Activity and narrative Field 2 (Note to FinCEN) Suspicious Activity Field(s) 32-42 Economic Injury Disaster Loan (EIDL) Program1 Economic injury disaster COVID19 EIDL FUNDS FRAUD2 34(z) (Fraud - other) Economic Impact Payments (EIP)3 Economic impact payment FIN-2021-A002 34(z) (Fraud - other) Paycheck Protection Program (PPP)4 Paycheck protection FIN-2021-NTC1 34(z) (Fraud - other) State Unemployment Insurance5 Unemployment COVID19 UNEMPLOYMENT INSURANCE FRAUD FIN-2020-A0076 34(z) (Fraud - other) Pandemic Unemployment Assistance Unemployment COVID19 UNEMPLOYMENT INSURANCE FRAUD FIN-2020-A0077 34(z) (Fraud - other) Main Street Lending8 FED MSL FIN-2021-NTC1 34(z) (Fraud - other)

1. For more information regarding this loan program, please visit U.S. Small Business Administration (SBA), Economic Injury Disaster Loans.
2. FinCEN News, “Prepared Remarks of FinCEN Director Kenneth A. Blanco, delivered virtually at the ACAMS AML Conference,” (September 29, 2020).
3. For more information about EIPs, please visit Internal Revenue Service (IRS), Economic Impact Payment Information Center.
4. For more information regarding the PPP, please visit SBA, Paycheck Protection Program.
5. For more information about COVID-19-related unemployment insurance programs and relief, please visit the U.S. Department of Labor, Unemployment Insurance Relief During COVID-19 Outbreak.
6. FinCEN Advisory, FIN-2020-A007, “Advisory on Unemployment Insurance Fraud During the Coronavirus Disease 2019 (COVID-19) Pandemic,” (October 13, 2020).
7. Id.
8. For more information regarding the Main Street Lending Program, please visit Board of Governors of the Federal Reserve System, Main Street Lending Program.

FINCEN NOTICE 3 Table 2: Other COVID-19-related Crimes and Frauds Potential Fraud or Crime Keyword(s) for Suspicious Activity and narrative Field 2 (Note to FinCEN) Suspicious Activity Field(s) 32-42 Cyber crime BEC fraud, EAC fraud, and others as warranted COVID19-CYBER FIN-2020-A0059 34 (z) (Fraud –other) for BEC, EAC; 38 (a) account takeover; 42 (a), (b), and/or (z), as appropriate (noting the (z) “other” box the COVID-19 cyber event); 44 (a) through (j) cyber event indicators, as relevant and available Health insurance and health care Kickbacks, services not provided, billing schemes, and others as warranted FIN-2021-A00110 34(g) (Health care – public or private health insurance) Medical products Fraudulent products, non-delivery scam, price gouging, hoarding COVID19 FIN-2020- A00211 34(z) (Fraud - other) Vaccine-related scams and cyber crimes Vaccine scam or vaccine ransomware FIN-2020-NTC412 34(z) (Fraud - other) Money mule and imposter scams Imposter, money mule scams COVID19 MM FIN￾2020-A00313 34(z) (Fraud - other) 9. FinCEN Advisory, FIN-2020-A005, “Advisory on Cybercrime and Cyber-Enabled Crime Exploiting the Coronavirus Disease 2019 (COVID-19) Pandemic,” (July 30, 2020). 10. FinCEN Advisory, FIN-2021-A001, “Advisory on COVID-19 Health Insurance- and Health Care-Related Fraud,” (February 2, 2021). 11. FinCEN Advisory, FIN-2020-A002, “Advisory on Medical Scams Related to the Coronavirus Disease 2019 (COVID-19),” (May 18, 2020). 12. FinCEN Notice, FIN-2020-NTC4, “FinCEN Asks Financial Institutions to Stay Alert to COVID-19 Vaccine-Related Scams and Cyberattacks,” (December 28, 2020). 13. FinCEN Advisory, FIN-2020-A003, “Advisory on Imposter Scams and Money Mule Schemes Related to Coronavirus Disease 2019 (COVID-19),” (July 7, 2020).

FINCEN NOTICE 4 Table 3: Additional FinCEN COVID-19-related Publications Field 2 (Note to FinCEN) Title February 1, 2021 FAQs Paycheck Protection Program Frequently Asked Questions (FAQs) FIN-2020-NTC3 Notice Related to the Coronavirus Disease 2019 (COVID-19) FIN-2020-NTC2 The Financial Crimes Enforcement Network Provides Further Information to Financial Institutions in Response to the Coronavirus Disease 2019 (COVID-19) Pandemic FIN-2020-NTC1 The Financial Crimes Enforcement Network (FinCEN) Encourages Financial Institutions to Communicate Concerns Related to the Coronavirus Disease 2019 (COVID-19) and to Remain Alert to Related Illicit Financial Activity Updates to Section 314(b) Fact Sheet and Information Sharing Documents FinCEN updated its USA PATRIOT Act Section 314(b) Fact Sheet in December 2020. The Fact Sheet, which addresses safe harbor protections in connection with certain private-sector information sharing, supersedes the material concerning information sharing provided in FinCEN’s May 2020 Notice Related to the Coronavirus Disease 2019 (COVID-19). For Further Information Additional COVID-19-related information, including COVID-19-related advisories and notices, is located on FinCEN’s website at https://www.fincen.gov/coronavirus, which also contains information on how to register for FinCEN Updates. Questions or comments regarding the contents of this notice should be addressed to the FinCEN Regulatory Support Section at frc@fincen.gov. The mission of the Financial Crimes Enforcement Network is to safeguard the financial system from illicit use, combat money laundering and its related crimes including terrorism, and promote national security through the strategic use of financial authorities and the collection, analysis, and dissemination of financial intelligence.