The SAR filing process: who waits on whom between alert and e-file

The SAR filing process at a bank has five parts: someone spots unusual activity, an investigator works the alert, a decision maker decides whether it is suspicious, a writer completes the suspicious activity report, and the BSA officer signs and e-files it with FinCEN, within 30 calendar days of the determination that the activity is suspicious, or 60 when no suspect has been identified. The rule fixes the deadline, not the hand-offs, and that is where the calendar leaks: the investigator waits on documents, the writer waits on a decision, the reviewer waits on a draft, the officer waits on a review. Botminds' SAR Narrative & Filing is built for the second half of that chain. Its agents draft the narrative and the FinCEN fields from the case, check every number against the bank's records and keep the clock in view, while people decide, review and sign.

This guide follows one fictional case through the process: Tessaly Community Bank, a sample bank, and its structuring case against Northgate Resale Supply LLC, 24 cash deposits below $10,000 at four branches and six wires out to an auto dealer. Rules and regulator figures are linked where they appear.

What is the SAR filing process? Five components, one clock

The SAR filing process is the chain from unusual activity to a filed report, and the examination manual names its links. Effective systems, it says, include five key components: identification or alert of unusual activity, managing alerts, SAR decision making, SAR completion and filing, and monitoring and SAR filing on continuing activity (FFIEC BSA/AML Examination Manual). GAO describes the same chain in four steps when it interviews filers: identifying unusual activity, reviewing and investigating alerts, deciding whether to file, and completing and filing (GAO-24-106301).

What the manual asks of a bank is not a particular org chart but a written one: the policies and procedures should set out the steps for each component and name the people or departments who own it. A large bank may run each component as its own department; a community bank may have one analyst who reviews the monitoring report, researches the activity and completes the SAR. Both are acceptable. A procedure that names nobody for the hand-off between deciding and writing is not.

The legal clock sits across the middle of that chain. Under 31 CFR 1020.320(b)(3) a bank files "no later than 30 calendar days after the date of initial detection by the bank of facts that may constitute a basis for filing a SAR", may take 30 more days to identify a suspect if none was identified, and in no case may delay more than 60 days. Everything before the determination is the bank's own pace, held to a reasonable period. Everything after it is the regulation's.

When does the 30-day clock start? At the determination, not the alert

The 30-day clock starts when the bank determines that the activity is suspicious, not when a system flags it. The manual is explicit: an automated system or a system-generated report "may flag the transaction; however, this should not be considered initial detection of potential suspicious activity. The 30-day (or 60-day) period does not begin until an appropriate review is conducted and a determination is made that the transaction under review is 'suspicious'" (FFIEC manual, Timing of a SAR Filing).

That does not make the time before the determination free. The same section says the review "should be completed in a reasonable period of time", that what is reasonable depends on the facts and on how well the bank's process works, and that what matters most is whether the bank has adequate procedures for reviewing potentially suspicious activity, written down and actually followed (the guide to AML investigation steps walks through them). An alert queue that ages for months before anyone looks has not stopped the clock; it has created a finding of its own.

The sample case shows the line. A Harlan Street teller wrote a note on September 18 that the customer had asked what amount gets reported to the government and then split $14,600 between two branches. The note went to the bank's unusual-activity log the same afternoon. It was reviewed with the monitoring alert on October 1, and that review is day 0: the case was due October 31. Thirteen days between the note and the review is the bank's reasonable-period question; the 30 days after it are the rule's.

Every open SAR on its own clock, counted from the determination

The panel on the right states the rule the clock follows: day 0 is the determination, here October 1, when the review of the alert found the teller's note.

Who files a SAR in a bank? Five roles, one signature

In most banks the BSA officer signs and files, but five roles touch every SAR. The investigator, often a BSA analyst, works the alert and documents a recommendation; the manual expects investigators to write down their conclusions, including whether they recommend filing. The decision maker, an individual or a committee, must hold the authority for the final call, and a committee needs a set way to settle disagreements among its members (FFIEC manual, SAR Decision Making).

The writer turns the case into the narrative and the FinCEN SAR fields, and in many community banks the writer is the investigator. A quality reviewer checks the draft against the case and the bank's checklist. The BSA officer, or whoever the bank designates, attests and files through BSA E-Filing. Two more parties sit outside the chain but are owed something by it: the board, which must be told SARs were filed, and the customer, who must never learn of one.

Where the days go: the waits between hand-offs

The days are lost between people, not inside their work. Each hand-off is a queue: the investigator waits on the core banking system, document imaging and the payments hub, and sometimes on the customer; the decision maker waits for a write-up; the writer waits for the decision; the reviewer waits for the draft; the signer waits for the review. Each queue is small. Five of them on a 30-day clock are not.

FinCEN's 2023 order against Shinhan Bank America shows what happens when the hand-offs become the schedule. The bank "generally adhered to a 90-day timeline to file SARs": 30 days to open a case and assign an analyst, 30 days to investigate and recommend, and, once filing was decided, 30 days for a supervisor "to prepare and file the SAR". The order adds that "the lack of formalized procedures often caused significant delays, sometimes over 100 days, between an analyst recommending that a SAR be filed and a supervisor approving and filing the SAR" (FinCEN Consent Order 2023-03). The penalty was $15 million.

Sometimes over 100 days between an analyst recommending that a SAR be filed and a supervisor approving and filing it.

FinCEN, Consent Order No. 2023-03, Shinhan Bank America

A schedule that spends the whole 30 days on writing and approval leaves no slack for the weeks a case actually needs: a letter to the customer, a wait for documents, a committee meeting that moves. The figure compares that fixed schedule with the sample case.

Staffing makes the queues longer. In its spring 2025 risk report the OCC noted that elevated fraud "may result in increased volumes of suspicious activity alerts and increased SAR filing obligations", and that some banks were lending BSA staff to other risk work such as fraud investigations, at a cost to the continuity of BSA operations (OCC Semiannual Risk Perspective, Spring 2025). Every analyst moved to fraud is a queue in the SAR process that gets longer.

How many days to file a SAR, and what happens when it is urgent

A bank has 30 calendar days from the determination, and up to 60 when no suspect was identified on that date; the extra 30 days exist only to identify a suspect, and reporting may never be delayed beyond 60. Calendar days include weekends: the sample case, determined on a Thursday, was due on a Saturday. A bank that plans to file on the last business day before a weekend due date has a 28-day clock in practice.

Some activity cannot wait for the form. For violations that require immediate attention, "such as terrorist financing or ongoing money laundering schemes", the filing instructions say the institution "shall immediately notify by telephone an appropriate law enforcement authority in addition to filing timely a FinCEN SAR" (FinCEN SAR Filing Instructions, April 2026). The phone call is in addition to the SAR, never instead of it. Which threshold applies, and how the unknown-suspect clock works covers the 60-day case in detail.

What happens after e-filing: the acknowledgment, the board and five years

Filing is a sequence of its own. For a single report, FinCEN's e-filing FAQ lists the steps: complete the report in its entirety, "Validate", "Sign with PIN", "Save", then "Submit" (FinCEN SAR FAQs, item 12). The system is not a records system, so the copy the bank saves before submitting is the copy it keeps. FinCEN then acknowledges the report and assigns a BSA ID, which is what the bank will need if it ever has to correct or amend the filing.

The record runs five years. The bank keeps a copy of every SAR it files, with the original or business-record copy of the supporting documents, for five years from the filing date; it must mark those documents as supporting documentation, and the rule treats them as filed with the SAR (31 CFR 1020.320(d); the guide to BSA record retention sets the SAR rule beside the others). The documents an analyst gathered in week one are part of the filing in year five.

The board is told, in a format the bank chooses. The manual says banks must notify the board or a board committee that SARs have been filed, but "the regulations do not mandate a particular notification format": copies, summaries or tables by violation type all qualify. One exception is written into the footnotes: where the subject is an insider, such as a director, the usual notification "should not be followed", the deviation should be documented, and uninvolved senior personnel advised (FFIEC manual, Notifying Board of Directors).

Can a bank tell a customer it is filing a SAR?

No. Neither the bank nor any of its directors, officers, employees or agents may disclose a SAR, or anything that would show one exists (31 CFR 1020.320(e)). A bank subpoenaed for a SAR must decline, cite the rule and notify FinCEN. The manual extends the point to silence: the bank keeps confidential whether a SAR exists at all, not only what it says (FFIEC manual, Prohibition of SAR Disclosure).

The risk in the process is rarely a person saying it aloud. It is a hold reason on a teller screen, a note on a branch call log, a status in a partner program's portal or a file name. FinCEN's e-filing FAQ "strongly recommends" that SAR file names not include subjects' names, "as this may lead to the inappropriate disclosure of the SAR" (FinCEN SAR FAQs, item 5). Every system the case touched is a place the SAR can leak.

What the teller, the customer and the partner see: nothing that reveals a SAR

Running the SAR filing process in SAR Narrative & Filing

The solution takes the hand-offs after the decision and the clock around all of them. Overnight, a case reader agent reads the case file, the alerts, the account history, deposit tickets, teller notes, wires, letters and the currency transaction reports already filed, and cites every value to its page; in the sample case that was 47 documents from six systems. A narrative drafter writes the introduction, body and conclusion; a field mapper fills the FinCEN SAR parts and builds the transaction attachment; a consistency checker compares every amount, count, date and name across the narrative, the fields and the systems of record.

People keep the steps the rule gives them. The analyst corrects a disagreement from the system of record or overrides it with a reason code; in the Northgate case one $1,500 deposit sat in two overlapping alerts and the draft had counted it twice. The quality reviewer passes or returns; the BSA officer signs; only then does the e-filing agent submit, record the BSA ID and seal the record for five years. Escalation days are settings, and the 30- and 60-day limits are fixed. How the drafter and checker are kept apart is the subject of why a SAR narrative generator should never check its own work.

SAR reporting for the board: counts only

The point of the clock view is the hand-off it exposes. In the sample bank, a case passing day 20 without a decision goes to the BSA officer, and day 25 to the Chief Risk Officer. Those are the bank's settings; what matters is that the wait is visible to someone with authority while there are still days to use. For the cost side of the same process, what a SAR costs to write, three ways splits a SAR's hours by stage.

Questions people ask

What are the SAR filing steps?

Identify unusual activity, investigate the alert, decide whether it is suspicious, complete and file the SAR, and handle continuing activity. The FFIEC manual calls these the five key components and expects written procedures to name who is responsible for each one.

Does the 30-day SAR deadline start when the alert fires?

No. The manual says a system flag "should not be considered initial detection"; the clock starts when a review determines the activity is suspicious. The review itself must still happen within a reasonable period, under procedures the bank has documented and follows.

Who signs a SAR?

The rule does not name a title, but banks usually have the BSA officer or a designated officer attest and submit through BSA E-Filing, signing with the user's PIN. The decision to file belongs to whoever the procedure gives final authority, which may be a committee.

Does the board have to be told about SARs?

Yes. The banking agencies' SAR rules require notice to the board or a board committee that SARs have been filed, in a format the bank chooses. When the subject is a director or another insider, the normal notice is skipped, the deviation documented and uninvolved senior personnel told.

Can a customer find out about a SAR?

Not lawfully from the bank. 31 CFR 1020.320(e) bars disclosure of a SAR or anything that would reveal one, and a bank asked for one by subpoena must decline and notify FinCEN. Banks control the risk by keeping SAR status off customer-facing screens, notes and file names.

How long must SAR records be kept?

Five years from the date of filing, for the SAR and the original or business-record copy of its supporting documents. Those documents are deemed filed with the SAR, and must be provided to FinCEN, law enforcement or the bank's regulator on request without legal process.