An elder financial exploitation SAR is a suspicious activity report on the illegal or improper use of an older adult's money, filed with FinCEN under the same rules as any SAR, with two additions FinCEN has asked for since 2022: the elder financial exploitation checkbox, field 38(d), and the key term "EFE FIN-2022-A002" in field 2 and in the narrative. A bank files within 30 calendar days of first detecting the facts, keeps the SAR and its supporting documents for five years, and may never reveal that it filed. The narrative and the file behind it decide whether the report helps anyone: they should show what was seen and by whom, what the institution did, whether adult protective services or the police were told, and what was lost or saved. Botminds' Elder Financial Exploitation Detection is software for fraud and BSA teams that builds that file as the case happens and drafts a confidential SAR referral; the BSA team decides whether and what to file.
The examples on this page come from the solution's fictional sample case at Norrell Federal Credit Union. The rules are linked to their sources.
What a defensible elder exploitation SAR file contains, and why
- The date and time of initial detection
The 30-day clock runs from it. In the sample: Thursday 22 October, 9:56 a.m., file by Saturday 21 November.
- Each red flag, with where it came from
Behavioural flags with the names of the staff who saw them; financial flags with the transaction or change that shows them.
- The customer’s own explanation
Her stated purpose, in her words, and why it did not hold. The interagency statement names the account holder’s explanation as a factor.
- What the institution did
Conversation, trusted-contact call, delay and its dates, payees paused. FinCEN asks for “details about the reporting entity’s response”.
- Who else was told
Adult protective services and law enforcement, with the contact name and phone, for the law enforcement contact field.
- Amounts paid out, attempted and refunded
In the sample: $5,500 paid out, $42,000 attempted and delayed.
- Every place the SAR must not appear
The notice, the call guide, the APS report, branch notes and anything a joint owner can see.
- Who decided each step, under which rule
Supporting documentation is deemed filed with the SAR and must be produced on request for five years.
When should a bank file a SAR for elder exploitation?
When the bank knows, suspects or has reason to suspect that a transaction conducted or attempted through it involves exploitation of an older customer and meets a filing threshold; below the threshold it may still file. FinCEN's 2022 advisory restates the general duty: a financial institution must file if a transaction "involves the use of the financial institution to facilitate criminal activity, including EFE", among the other standard grounds.
For national banks the OCC's rule sets the fraud thresholds: "Insider abuse involving any amount"; "Violations aggregating $5,000 or more where a suspect can be identified"; and "Violations aggregating $25,000 or more regardless of potential suspects." The Federal Reserve, FDIC and NCUA have parallel rules. Elder theft by a family member usually has an identifiable suspect, so the $5,000 line is the one that matters most often.
Small cases are the ones that slip. FinCEN's trend analysis notes that suspicious amounts in elder theft "may be below BSA filing thresholds", and the interagency statement reminds institutions that they "can voluntarily file SARs for suspicious activities related to elder financial exploitation that do not meet the requirements for mandatory filing, such as those involving dollar amounts lower than the regulatory threshold." A voluntary SAR carries the same safe harbor as a required one.
What is the FinCEN key term for elder exploitation?
"EFE FIN-2022-A002", entered in SAR field 2 ("Filing Institution Note to FinCEN") and in the narrative, together with the elder financial exploitation checkbox in field 38(d). FinCEN first added the checkbox to the SAR form in 2012; the key term arrived with its June 2022 advisory. Both exist so that law enforcement and analysts can find elder cases in the BSA database.
They are used. FinCEN built its April 2024 trend analysis by selecting reports that "used the June 2022 EFE Advisory key term" or checked the box, and found 155,415 of them between June 2022 and June 2023, associated with more than $27 billion of reported suspicious activity, actual and attempted. FinCEN warns the amount may be overstated, because it can include unpaid and attempted payments, duplicates and both sides of transfers. Depository institutions alone filed 46,888 such reports between March and May 2023, and FinCEN received an average of 15,993 a month from mid-June 2023 to mid-January 2024. A report without the key term or box is missing from every one of those counts.
The clocks: 30 days to file, five years to keep
A bank has 30 calendar days from initial detection to file, 60 if no suspect has been identified, and five years to keep the SAR and its supporting documents. The regulation is precise about both: a SAR is due "no later than 30 calendar days after the date of initial detection by the bank of facts that may constitute a basis for filing a SAR", and supporting documentation "shall be identified, and maintained by the bank as such, and shall be deemed to have been filed with the SAR."
The dates an elder exploitation SAR file has to carry
| Clock | The rule | In the sample case |
|---|---|---|
| Initial detection | The date the bank first detected facts that may be a basis for filing | Thursday 22 October, 9:56 a.m.: the specialist is paged |
| Filing deadline | 30 calendar days; up to 30 more if no suspect was identified | Saturday 21 November |
| Report to the state | Where state law requires it; in Washington, whenever a disbursement is refused | Approved by the BSA officer at 11:02 a.m. the same day |
| Retention | SAR and supporting documents, five years from filing | Five years, with legal hold; other members redacted in exports |
| Production on request | To FinCEN, law enforcement and BSA examiners | An export pack with the timeline, sign-offs and training records |
The five-year rule is why the file matters more than the form. Everything that "assisted" the decision to file, in the interagency statement's words, is supporting documentation: the teller's report, the conversation notes, the call log, the delay and its approvals. If those live in email and personal notes, the bank cannot produce them as one file when FinCEN or an examiner asks.
A decision not to file is different. FinCEN's October 2025 answers to frequently asked questions say that nothing in the BSA or its regulations requires, or even expects, an institution to document a decision not to file. A fraud or elder protection team will usually still keep its reasons, because the same facts drive a hold, a report to the state and the customer's next visit.
What should an elder exploitation SAR narrative include?
A clear account of what was unusual and why, with the older adult's age and location, the red flags and who saw them, what the institution did, what was lost or recovered, and who else was told. FinCEN's instructions require the narrative to give "a clear, complete, and concise description of the activity, including what was unusual or irregular that caused suspicion." The advisory then lists best practices that are "not regulatory obligations", and an elder file should meet them anyway.
Those practices are specific. FinCEN asks filers to give "the age and location (county/city) of the target or victim"; to describe "the reporting entity's response, e.g., whether accounts were closed"; to give "details about the amounts involved and whether any amounts were refunded"; to "Reference supporting documentation, including any photos or video footage"; to use "the law enforcement contact field" to show a report to the police or adult protective services; and to name a point of contact who can answer investigators. It adds a line about the people at the window: "behavioral red flags of EFE and the names of staff who witnessed them should be included in the SAR narrative".
One drafted narrative, read against FinCEN's tips
An 81-year-old member
The age of the older adult, from FinCEN’s first best-practice tip. The same tip asks for her county or city, which this draft still lacks.
added a joint owner, Curtis Vane, on October 3, 2026.
The subject, by name, with the date he appeared.
Within 10 days the phone of record changed, digital banking was enrolled from a new device, a new payee received $2,400 and $3,100 in gift cards were bought.
Financial red flags, in order, each tied to a cited source in the file.
On October 22 the member asked to close a $42,000 certificate by check payable to Mr. Vane, while he answered questions for her.
The behavioural red flag the teller saw. FinCEN asks for the name of the staff who witnessed it.
Her trusted contact knows no Curtis and says the stated purpose, a roof, was completed in 2022.
Why the explanation did not hold: what a reader needs to see the activity is suspicious.
EFE FIN-2022-A002.
The key term, in the narrative as well as in field 2.
Read against FinCEN's tips, the draft is short on two things: her county or city, and the name of the teller who saw Mr. Vane answer for her. Both are in the file, the second in the teller's report at 9:52 a.m. That is the point of a referral rather than a finished filing: the person who files reads the whole case and completes the narrative, and the agent's job is to make sure nothing in the case is missing from what they read.
A confidential SAR referral in Elder Financial Exploitation Detection, with FinCEN's key term and the 30-day clock
Can a bank tell APS about a SAR?
No. Adult protective services may receive the facts, but not the SAR or anything that would reveal it. The rule is categorical: no bank, and no one working for it, may disclose a SAR or anything that would show one exists. The exceptions are narrow: FinCEN, law enforcement agencies, and the regulators that examine the bank for BSA compliance. Adult protective services is a social services agency and is not on that list.
What the rule does allow is the substance. It does not prohibit disclosing "the underlying facts, transactions, and documents upon which a SAR is based", provided no one involved in the transaction is told it was reported. So the report to the state can carry every fact in the SAR narrative. It must not say "SAR", "BSA team", or that anything was reported to FinCEN.
Who may learn what in an elder exploitation case
| Reader | The facts | That a SAR exists | Why |
|---|---|---|---|
| FinCEN, law enforcement, BSA examiners | Yes | Yes | Named in the exceptions to SAR confidentiality |
| Adult protective services | Yes | No | Facts may be reported; the SAR may not be revealed |
| The older customer | What was delayed and why, in plain words | No | Disclosure rules and the notice requirement of the state hold law |
| A trusted contact | Only what the customer’s consent allows | No | Privacy law and the consent on file |
| A joint owner suspected of the exploitation | Not the concern; statements still show account activity | Never | Tipping off is prohibited by 31 U.S.C. 5318(g)(2) |
| Branch staff outside the case | That a concern is open, if they own a step | No | Need to know |
The adult protective services report: every fact, no SAR
Tipping off: the places a SAR must never reach
The prohibition reaches anything the person involved could see. The interagency statement restates the federal rule that no institution, director, officer, employee or agent "may notify any person involved in the transaction that the transaction has been reported". In elder cases the person involved is often on the account: a joint owner who receives the statements, an agent under a power of attorney who uses online banking, a relative who comes to the branch with the customer.
The leaks are rarely deliberate. A referral typed into a comment field on the teller platform appears the next time any teller opens the account. A delay letter addressed to every owner reaches the suspect. A call to a trusted contact mentions "a report". In the sample, the agents listed six places the referral must never appear, from the branch view to anything Curtis Vane can see as joint owner, and found 0 mentions in each before the referral went to the BSA team.
How long must elder exploitation records be kept?
Five years for a filed SAR and its supporting documents, counted from the date of filing. Other records in an elder case have their own rules. The Senior Safe Act requires an institution to keep a record of each covered employee's training and show it to its examiner on request, without fixing a period. State hold laws can add more: Florida requires a written record of each delayed disbursement, including the reporting employee's name and the facts behind the report, kept "for at least 5 years". A single five-year retention rule with a legal hold covers all three, which is how the sample policy is set.
Is a SAR required for elder scams under $5,000?
Not usually, for a bank, but it is allowed and often worth filing. Below $5,000 with an identified suspect, or $25,000 without one, the banking agencies' rules do not require a SAR unless an insider is involved. FinCEN's advisory says institutions "may file a SAR regardless of the amount involved (if any) or if the transaction is only attempted." A run of small gift-card purchases or cash withdrawals is often the start of a larger loss, and the key term and checkbox put it on the map.
The data shows why early filing matters. In the CFPB's study of elder exploitation SARs, the suspicious activity "took place, on average, over a four-month period"; "In nearly 30 percent of EFE SARs, activities span 10 days or fewer, and in 27 percent, activities span 100 days or more." A file that starts at the first small sign records the whole pattern. The day-by-day version of that pattern is told in one member's three weeks.
What Elder Financial Exploitation Detection prepares, and what the BSA team decides
Elder Financial Exploitation Detection builds the file while the case runs and leaves the filing to people. Each action, by a person or an agent, goes on a read-only trail with who, what, when, why and the evidence. The referral carries the key term, the checkbox, the subjects, the amounts, the initial detection time and the filing date, and a narrative in which every sentence cites its source. The Safeguards agent checks every draft written for someone outside the BSA team against SAR confidentiality, and that check cannot be overridden.
An export pack that answers the examiner's request in one file
What the solution does not do matters as much. It does not file with FinCEN, does not decide whether a SAR is required, and does not replace the BSA team's own case and filing system. It also does not know your institution's internal rules on continuing-activity reviews or joint filing until you load them. Those decisions belong to the BSA officer, who in the sample approves the adult protective services report and accepts the referral as the second person. How the whole case divides between agents and people is in banks' elder fraud prevention, and what a policy must contain before any of this runs is in the elder financial exploitation policy guide. The case itself is on the Elder Financial Exploitation Detection page.
Questions people ask
What is SAR field 38(d)?
It is the "Elder Financial Exploitation" checkbox among the suspicious activity types on the FinCEN SAR form. FinCEN added it in 2012 and, in advisory FIN-2022-A002, asks filers to mark it whenever they suspect elder exploitation, alongside the key term in field 2 and the narrative.
Does reporting elder exploitation to the police replace a SAR?
No. The interagency statement reminds institutions that "reporting suspicious activity to law enforcement does not relieve the financial institution of the requirement to file a SAR with FinCEN." FinCEN's advisory also notes that a SAR is not a substitute for any state requirement to report to law enforcement or adult protective services.
Should an elder exploitation SAR be filed jointly with another bank?
Where the activity is shared, FinCEN suggests institutions "should consider filing a SAR jointly". Facts underlying a SAR may be shared with another financial institution to prepare a joint filing, and section 314(b) of the USA PATRIOT Act gives institutions a safe harbor to share information about activity they suspect may involve money laundering.
Can a SAR narrative name the employees who saw the red flags?
FinCEN asks for exactly that: behavioural red flags "and the names of staff who witnessed them" belong in the narrative to help later investigations. It is also why the teller's report should be specific about what was said, by whom and when.
How much elder exploitation do SARs capture?
A fraction. The CFPB estimated that the 63,500 elder exploitation SARs filed in 2017 may have accounted for less than 2 percent of incidents that year, based on prevalence studies. FinCEN's later count, 155,415 reports in one year to June 2023, reflects more filing, not necessarily more exploitation.