File a FinCEN SAR when your institution knows, suspects, or has reason to suspect reportable activity, and treat the narrative as the single most important deliverable in the filing. The standard clock runs 30 days from detection, or 60 days when no suspect has been identified. FinCEN and the FFIEC set the governing expectations, and a growing number of institutions now lean on platforms like RiskInMind to keep that narrative consistent under pressure.
TL;DR:
- SARs must be filed within 30 days of detection when a suspect is identified, or within 60 days if no suspect has been confirmed.
- The initial filing should include a detailed narrative following the who, what, when, where, and why, supported by spreadsheets for high-volume cases.
- Institutions can file SARs voluntarily below thresholds or when suspicion exists, even if amounts are under the standard reporting limits.
- Confidentiality laws prohibit revealing SAR filings to customers, but institutions may discuss transaction facts without confirming a SAR exists.
- Supporting documentation must be retained for five years and be organized to demonstrate compliance during examinations.
Automate Regulatory Model Risk Governance
Examine models against 32 qualitative criteria and resolve risk Tiers with pre-deployment checklists per OCC 2011-12 guidelines.
Table of Contents
- Quick SAR filing checklist for the first hours after detection
- Who must file and what thresholds trigger a SAR
- Deadlines, date of detection, and continuing-activity timing
- Writing a SAR narrative that investigators can actually use
- Continuing activity, joint filings, and amending prior SARs
- Confidentiality rules and what you can tell a customer
- Recordkeeping and evidence retention examiners expect to see
- How to e-file: BSA E-Filing basics and batch XML pitfalls
- Operational workflow and where automation earns its keep
- Escalation, governance, and preparing for examiner questions
- What actually matters when resources are limited
- How RiskInMind supports the filing process end to end
- FAQ
- Sources
Quick SAR filing checklist for the first hours after detection
Before anything else, confirm your institution's filer status and the dollar threshold that governs the activity you've flagged. Acting fast and documenting each step protects your institution if an examiner later asks why a decision took the time it did.
- Confirm your institution is a designated filer and identify the threshold that applies to this transaction type.
- Record the date of detection, the source of the alert, and the name of the initial reviewer.
- Select the correct filing type (initial, continuing, joint, or correction) before drafting the narrative.
- Prepare a spreadsheet for voluminous transaction data and note where supporting records will be retained.
Who must file and what thresholds trigger a SAR
Banks, credit unions, money services businesses, broker-dealers, casinos, insurers, and mortgage lenders all fall under SAR filing obligations, each governed by its own regulator but sharing the same underlying BSA framework. For depository institutions, the general reporting threshold is $5,000 when a suspect can be identified, and institutions must file regardless of amount once transactions reach $25,000 and suspicious activity is apparent, per 31 C.F.R. § 1020.320. Certain money services businesses use a lower $2,000 threshold.
None of these numbers are ceilings on judgment. Interagency guidance makes clear that structuring near $10,000 does not automatically require a SAR absent actual suspicion of evasion, and conversely, institutions retain discretion to file voluntarily below any stated threshold when the facts warrant it. That discretion matters most in borderline cases, where documenting the reasoning behind a voluntary filing, or a decision not to file, does more to protect the institution than chasing a bright-line rule ever will.
Deadlines, date of detection, and continuing-activity timing
The 30-day filing clock starts on the date of detection, defined operationally as the date your institution knows or has reason to suspect the activity, which can be the alert review date rather than the transaction date itself. When no suspect has been identified, the window extends to 60 days. Exigent circumstances, such as ongoing fraud that threatens customer funds, call for immediate notification to law enforcement ahead of the formal filing.
For continuing suspicious activity, examiners historically referenced a 90/120-day review cadence, but FinCEN's FAQs now clarify that cadence as guidance rather than a fixed rule. Institutions have flexibility to set continuing-activity review timing based on their own risk assessment, provided the rationale is documented. That shift puts more weight on your internal policy: write down how you decided a 60-day versus 90-day review cycle fits the risk profile of a given account, because an examiner will ask.
Writing a SAR narrative that investigators can actually use
The narrative is the part of the SAR that law enforcement actually reads, and FFIEC Appendix L treats it as the critical component of the entire report. A strong narrative answers who, what, when, where, and why in chronological order, then describes the method of operation in plain language: how funds moved, through which accounts, to which beneficiaries, and toward what ultimate destination.
Specificity carries weight. Include exact dates, dollar amounts, account numbers, counterparties, and, where relevant, cross-border jurisdictions involved in the flow of funds. Avoid vague phrasing like "customer behaved suspiciously" in favor of concrete observations such as the sequence of deposits, the timing relative to withdrawals, and any pattern that deviated from the account's established profile.
When the activity involves a high volume of transactions, FFIEC guidance recommends attaching a single Excel spreadsheet rather than cramming the detail into the narrative text itself. That keeps the narrative readable while preserving the full transactional record for anyone who needs to dig deeper. A narrative that reads like a timeline, with clear cause and effect, consistently proves more useful to investigators than one that lists observations without connecting them.
Continuing activity, joint filings, and amending prior SARs
When suspicious activity persists past an initial filing, you generally file a continuing activity report referencing the prior filing's Document Control Number or BSA ID rather than starting from scratch, which preserves the investigative thread for law enforcement. Decide case by case whether new facts warrant a fresh initial filing instead, typically when the activity represents a materially different pattern.
Joint filings require coordination: Part III should list each institution's relevant details, and Part V should clearly identify which institutions are joint filers on the same suspicious activity. When a prior SAR contains an error, whether a wrong account number or an incomplete narrative, file a correction referencing the original submission rather than letting the mistake stand uncorrected in the system.
Confidentiality rules and what you can tell a customer
SAR confidentiality is a statutory requirement, not a courtesy: disclosing that a SAR has been filed, or any statement that would reveal its existence, is prohibited by law. A 2026 interagency statement clarifies that banks may still discuss the underlying facts of a transaction, such as why an account was frozen or why a payment was declined, without ever confirming that a SAR exists.
That distinction gives frontline staff room to communicate honestly with customers while staying compliant. A teller can explain that a transaction triggered a review under the bank's policies; no one should ever say the word "SAR" to a customer. Build scripts for common scenarios, train staff on the line between permitted and prohibited disclosure, and route any ambiguous customer question through compliance before a frontline employee answers it.
Recordkeeping and evidence retention examiners expect to see
31 C.F.R. § 1020.320 requires institutions to retain SARs and all supporting documentation for five years from the date of filing. Supporting documentation includes transaction records, account statements, internal memos, and any spreadsheet attachments referenced in Part V of the filing.
Keep a single, indexed business-record equivalent of that documentation rather than scattering files across departments, and log every investigatory step, including reviewer notes and the rationale behind any decision not to file. That log often matters more to an examiner than the SAR itself.
How to e-file: BSA E-Filing basics and batch XML pitfalls
Register at FinCEN's BSA E-Filing system before your first submission, then choose between single-report filing or batch XML submission depending on your institution's volume. The FinCEN SAR Electronic Filing Instructions walk through schema requirements, required Party elements (transmitter, filing institution, subject, and the institution where the activity occurred), and limits on branches and parties per report.
Test batch files before live submission; schema validation failures are the most common cause of rejected filings. Avoid placeholder text in required fields, since excessive use of generic entries triggers rejections and delays the filing clock.
Operational workflow and where automation earns its keep
A defensible SAR process runs on a clear pipeline: detection, review, escalation, and filing, with the date of detection and every reviewer action captured at each step. Standardizing narrative templates and enforcing chronological structure through mandatory fields removes much of the inconsistency that shows up when different analysts draft narratives their own way.
This is where automation changes the economics of the work rather than just the speed. AI-powered risk management platforms help BSA teams prepare spreadsheet attachments for voluminous transactions, preserve a full audit trail of who changed what and when, and cut the time between detection and filing, all while keeping confidentiality controls intact. We built this around SOC 2 aligned security controls, because audit trails only help if the underlying system is itself defensible.
Pro Tip: Build your narrative template around the FFIEC's who/what/when/where/why structure from day one, so every analyst produces a narrative an examiner can follow without asking follow-up questions.
Escalation, governance, and preparing for examiner questions
Board or committee notification should cover filing volume and trends without naming specific SAR subjects, keeping governance informed while preserving confidentiality. Document the rationale behind every non-filing decision and link that documentation to the underlying investigation log, since examiners routinely sample these decisions during exams.
Prepare a standing exhibit package: narrative checklists, a timeline of the review process, supporting spreadsheets, and redacted samples that demonstrate your confidentiality controls without exposing subject details. Our step-by-step risk assessment framework offers a useful structure for documenting these judgment calls consistently.
What actually matters when resources are limited
In practice, the narrative quality on your highest-risk cases matters more than perfect execution on every filing. We'd rather see a team spend extra time on the cases where the method of operation is genuinely complex and automate the repeatable, low-judgment steps, like pulling account history or formatting spreadsheet attachments, that don't require an analyst's judgment at all.
Examiners respond to consistency. A documented process with templates and audit trails earns goodwill even when individual cases are imperfect, because it shows the institution's risk management is systematic rather than reactive.
— Raj
How RiskInMind supports the filing process end to end
The platform is built so compliance teams spend less time assembling a SAR and more time investigating the activity that deserves attention. It generates narrative drafts aligned to FFIEC structure, prepares transaction attachments automatically, and keeps a secure audit trail of every edit and approval.
- Automated narrative drafting that follows who/what/when/where/why structure examiners expect.
- Attachment preparation for voluminous transaction data, formatted and ready for Part V.
- Full audit trails showing who reviewed, edited, and approved each filing.
If your team is evaluating ways to standardize SAR documentation, our Document Generator and pricing plans show how Starter, Professional, and Enterprise tiers fit institutions of different sizes. Request a demo to see the workflow on your own case types.
This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.
FAQ
What triggers a mandatory SAR filing?
A SAR is required when your institution knows, suspects, or has reason to suspect that a transaction involves funds from illegal activity, is designed to evade BSA reporting requirements, or has no apparent lawful business purpose. The $5,000 general threshold applies when a suspect can be identified, while transactions of $25,000 or more require filing regardless of suspect identification under 31 C.F.R. § 1020.320.
How long do I have to file a SAR after detection?
Institutions have 30 days from the date of detection to file, or 60 days if no suspect has been identified by that point. Exigent circumstances involving ongoing harm call for immediate notification to law enforcement before the formal SAR is submitted.
Can I tell a customer that we filed a SAR on their account?
No. Disclosing that a SAR exists is prohibited by statute, though a 2026 interagency statement confirms that banks may discuss the underlying factual transaction details, such as why an account action occurred, without revealing the SAR itself.
How long must we retain SAR records?
SARs and all supporting documentation must be retained for five years from the date of filing under 31 C.F.R. § 1020.320. Supporting documentation includes transaction records, internal review notes, and any spreadsheet attachments referenced in the filing.
Does RiskInMind file SARs on our behalf?
Our platform helps teams draft narratives, prepare attachments, and maintain audit trails throughout the filing process, but your institution's BSA officer remains responsible for the final filing decision and submission. Pricing details for Starter, Professional, and Enterprise plans are available on our pricing page.
Sources
- Frequently Asked Questions Regarding FinCEN Suspicious Activity Report (SAR)
- FFIEC BSA/AML Examination Manual — Appendix L: SAR quality guidance
- Joint Statement on Suspicious Activity Report Confidentiality Considerations Regarding Communications with Customers
- eCFR — § 1020.320 Reports by banks of suspicious transactions