Keeping Accounts Open for Law Enforcement

Overview
Within the CAMS domain of AFC Program Governance and Risk Management, the topic of keeping accounts open at the request of law enforcement sits at the intersection of suspicious activity reporting, customer exit decisions, cooperation with authorities, and institutional risk management. The normal instinct of a compliance officer who has identified suspicious activity is to file a report and consider exiting the relationship. However, closing the account may destroy the very evidence trail that investigators need. This guide explains why the topic matters, what the concept is, how the process works in practice, and how to answer exam questions on it confidently.

1. Why It Is Important

Preserving the investigative trail. When a financial institution detects suspicious activity and files a Suspicious Activity Report (SAR) or Suspicious Transaction Report (STR), law enforcement may already be investigating the customer, or the report may trigger an investigation. If the institution abruptly closes the account, the subject may be alerted, funds may be dispersed to other institutions or jurisdictions, and the ability to identify counterparties, co-conspirators, and the ultimate destination of criminal proceeds may be lost. An open, monitored account is often the best window investigators have into a criminal network.

Avoiding inadvertent tipping off. Account closure soon after a SAR filing or subpoena can signal to a sophisticated criminal that they have been detected. Keeping the account open, when requested, helps protect the confidentiality of the investigation and the SAR itself.

Managing institutional risk. Continuing to process transactions that the institution believes may be illicit exposes it to legal, regulatory, and reputational risk. Governance around keep-open requests ensures that the decision is made deliberately, documented, time-limited, and approved at the appropriate level, rather than left to an individual analyst or relationship manager.

Demonstrating public-private cooperation. Regulators and FIUs expect institutions to be constructive partners in the fight against financial crime. A documented, well-governed process for handling law enforcement requests is a hallmark of an effective AFC program and a point examiners will look for.

2. What It Is

A keep-open request (sometimes called a keep-open letter or request to maintain an account) is a formal communication from a law enforcement agency asking a financial institution not to close a specific account or customer relationship, even though the institution may have identified suspicious activity and would ordinarily consider exiting the customer. The purpose is to allow investigators to continue observing transactional activity, trace funds, and gather evidence.

In the United States, FinCEN has issued guidance on this subject. The key principles, which are broadly consistent with good practice in other jurisdictions, are:

• The request should be made in writing, on official agency letterhead, and signed by an appropriately senior official (for example, a supervisory agent or an attorney within a prosecutor's office).
• The request should state the purpose in general terms and specify a duration. FinCEN suggests that keep-open requests should generally not exceed six months, after which they may be renewed in writing if the investigation requires.
• The ultimate decision to keep the account open or to close it rests with the financial institution, in accordance with its own risk appetite, policies, and legal obligations. A law enforcement request is a request, not an order.
• Complying with a keep-open request does not relieve the institution of its ongoing obligations: it must continue to monitor the account, file SARs on continuing suspicious activity, maintain records, and comply with all other AML requirements.
• The institution should retain documentation of the request and its own decision-making so it can demonstrate to regulators why the account remained open.
• Regulators have indicated that they will take a documented keep-open request into account when evaluating an institution's decision to maintain the account; however, the letter is not an unconditional legal shield, and the institution must still exercise sound judgment.

Outside the United States, analogous mechanisms exist. In jurisdictions with a consent or moratorium regime (for example, the UK's Defence Against Money Laundering process), the FIU may refuse consent to a transaction or ask the institution to delay exiting a customer. The underlying logic is the same: cooperation with authorities must be balanced against the institution's own duty not to facilitate crime.

3. How It Works in Practice

Step 1 – Detection and reporting. Transaction monitoring, an employee referral, a 314(a) match, a subpoena, or a negative news alert identifies activity that is suspicious. The institution investigates and files a SAR/STR where required. Under FinCEN rules, if the activity continues, a continuing-activity SAR is filed on a periodic basis (generally every 120 days, covering the preceding period of activity).

Step 2 – Account disposition review. Many institutions have a committee or escalation path (often involving the BSA/AML officer, legal counsel, and business line management) that decides whether to retain, restrict, or exit a customer following a SAR. This is where a keep-open request becomes relevant.

Step 3 – Receipt of the law enforcement request. Law enforcement may approach the institution directly, often after reviewing a SAR. The request may initially be verbal. Good practice is to insist on a written request before acting on it and to verify the identity and authority of the requesting agent.

Step 4 – Internal evaluation and approval. Compliance and legal should assess the request against the institution's risk appetite. Considerations include: the nature and severity of the suspected activity; whether continued activity could cause harm to third parties (for example, fraud victims or human trafficking victims); the institution's ability to monitor the account closely; and the reputational consequences if the account is later publicized. The decision should be approved at an appropriate senior level and documented.

Step 5 – Enhanced monitoring and continued reporting. If the institution agrees to keep the account open, it typically places the account under enhanced monitoring, may apply restrictions where appropriate, and continues to file SARs on the ongoing activity. It should not assume that law enforcement's awareness eliminates its reporting duty.

Step 6 – Confidentiality. Staff must not disclose the SAR, the investigation, or the keep-open request to the customer or to unauthorized persons. Front-line employees who interact with the customer should be managed carefully to avoid inadvertent tipping off. Information about the request should be restricted on a need-to-know basis.

Step 7 – Duration, renewal, and closure. The institution tracks the expiration date of the request. If law enforcement wishes to extend it, a new written request should be obtained. When the request lapses and is not renewed, the institution revisits its exit decision according to its normal policy.

Step 8 – Documentation and audit trail. The written request, internal approvals, monitoring records, SAR filings, and the eventual disposition should all be retained in a manner that allows the institution to demonstrate a defensible, risk-based process to examiners and auditors.

Related Governance Points
• A keep-open request is distinct from a subpoena or a 314(a) request. Receiving a subpoena does not by itself mean the institution should close the account; in fact, abrupt closure could tip off the subject. The institution should review the account, consider whether a SAR is warranted, and respond to the legal process.
• The decision framework should be written into the institution's policies and procedures, with clear roles and escalation paths.
• Senior management and the board should be aware, at least in aggregate, of high-risk accounts maintained at law enforcement's request, as part of their oversight of the AFC program.

4. How to Answer Exam Questions on This Topic

CAMS questions on this subject are usually scenario-based. A typical stem describes an institution that has filed a SAR and is preparing to close an account, when a law enforcement agent calls and asks that the account remain open. You are asked what the compliance officer should do next, or which answer best reflects appropriate practice. Apply the following reasoning:

Identify the core principles the question is testing:
1. The request should be in writing, from the agency, with a specified duration.
2. The institution retains the decision; it weighs its own risk.
3. SAR filing and monitoring continue.
4. No tipping off the customer.
5. Document everything.
6. Escalate to the appropriate senior level (BSA/AML officer, legal, management).

The best answer will typically contain several of these elements, or the one element most directly responsive to the scenario.

Exam Tips: Answering Questions on Keeping Accounts Open for Law Enforcement

Tip 1 – Favor the written request. If an answer choice says the institution should act on a verbal request alone, it is almost certainly wrong. The correct choice will ask for a written request on agency letterhead, signed by an authorized official, with a stated duration.

Tip 2 – Remember who decides. Any option implying the institution must keep the account open because law enforcement asked is incorrect. The decision belongs to the institution, made on a risk basis. Conversely, an option saying the institution should ignore law enforcement and close the account immediately is also generally wrong, because it fails to consider cooperation and tipping-off risk.

Tip 3 – SAR obligations never pause. Eliminate any option that suggests the institution can stop filing SARs because law enforcement already knows about the activity. Continuing-activity SARs must still be filed.

Tip 4 – Watch for tipping-off traps. Options that involve informing the customer that the account is under investigation, explaining why the account is not being closed, or sharing the keep-open letter with the relationship manager without need-to-know controls are wrong.

Tip 5 – Time limits matter. If a question references duration, recall that FinCEN guidance suggests requests generally should not exceed six months and should be renewed in writing. An option proposing an indefinite or open-ended arrangement is a distractor.

Tip 6 – Escalation and documentation are usually part of the best answer. CAMS favors answers that involve escalating to the AML/compliance officer and legal counsel, obtaining senior approval, and maintaining a documented record. An answer where a single analyst or branch manager makes the call unilaterally is weaker.

Tip 7 – Distinguish related requests. Do not confuse a keep-open request with a 314(a) information request, a 314(b) information-sharing exchange between institutions, a subpoena, or a National Security Letter. Each has its own rules. A keep-open request is specifically about maintaining an account for investigative purposes.

Tip 8 – Consider harm to third parties. In scenarios involving fraud victims, human trafficking, or terrorist financing, the best answer may acknowledge that the institution must weigh the risk of ongoing harm and may legitimately decline or limit the request, while still cooperating with authorities and documenting the rationale.

Tip 9 – Use the elimination method. Strike out any option containing: verbal-only compliance, indefinite duration, ceasing SARs, notifying the customer, or treating the request as a binding order. What remains is usually the correct answer.

Tip 10 – Think like a risk manager, not a rule-follower. The exam rewards the balanced answer: cooperate with law enforcement, protect the institution through written requests and documentation, maintain all reporting and monitoring obligations, protect confidentiality, and reserve the institution's right to decide.

Sample Question Walk-Through
A compliance officer has filed a SAR on a customer whose account shows patterns consistent with structuring. The officer is about to recommend account closure when a federal agent calls and asks that the account remain open. What should the compliance officer do FIRST?

A. Close the account immediately to avoid liability.
B. Agree verbally and suspend further SAR filings since law enforcement is aware.
C. Request that the agency provide a written request on letterhead specifying the duration, and escalate internally for a documented decision.
D. Inform the customer that the account is being kept open at the request of authorities.

Correct answer: C. Option A ignores cooperation and tipping-off risk; B violates the written-request principle and the continuing SAR obligation; D is tipping off. Option C reflects the written request, escalation, and documentation expected by CAMS.

Key Takeaways
• Keep-open requests preserve investigative evidence and help avoid tipping off.
• Obtain the request in writing, with purpose and duration (generally up to six months, renewable).
• The institution, not law enforcement, makes the final decision based on its risk appetite.
• Continue monitoring and filing SARs; the request does not suspend any AML duty.
• Protect confidentiality and restrict knowledge of the request internally.
• Document the request, approvals, monitoring, and eventual disposition.
• On the exam, choose the answer that balances cooperation, written documentation, continued compliance, and confidentiality.