BSA E-Filing: Submitting CTRs and SARs to FinCEN

10/14/2026

Every currency transaction report and suspicious activity report a bank files ends up in the same place: FinCEN's BSA E-Filing System. The forms get most of the training attention, but the filing system is where a surprising number of real compliance failures happen. A SAR that was saved but never submitted, a batch file rejected for a schema error that nobody noticed, an acknowledgment that never arrived because the filer had no Secure Messenger access, a corrected CTR filed as a new report instead of an amendment. None of these are judgment errors. All of them can leave the bank with a late or missing report.

This guide is for the bank staff who actually operate the system: BSA officers, analysts, deposit operations and CTR teams. It covers access and roles, the two ways to file, what happens after submission, how to correct a report, and the recordkeeping the system does not do for you.

If you are an individual looking to file a Report of Foreign Bank and Financial Accounts (FBAR, FinCEN Form 114), you are in the right system but the wrong article. FBARs are also filed through BSA E-Filing, but individual filers use a separate path on the BSA E-Filing site, and FinCEN's FBAR pages explain it. Everything below is about institutional filing by banks.

What the system is, and what has to go through it

BSA E-Filing is FinCEN's web-based system for submitting Bank Secrecy Act reports. FinCEN made electronic filing mandatory, with limited exceptions, effective July 1, 2012. FinCEN's mandatory e-filing FAQ lists the reports banks must e-file, including:

FinCEN Form 112, the Currency Transaction Report (CTR)
FinCEN Form 111, the Suspicious Activity Report (SAR)
FinCEN Form 110, the Designation of Exempt Person (DOEP)

The underlying deadlines are not set by the system; they come from the regulations. A CTR is due within 15 days after the transaction (31 CFR 1010.306). A SAR is due within 30 calendar days of initial detection of facts that may constitute a basis for filing, extendable by 30 days to identify a suspect, but never more than 60 days after detection (31 CFR 1020.320(b)(3)). A DOEP is due by the close of the 30-calendar-day period beginning after the first reportable transaction with the customer being exempted (31 CFR 1020.315(c)). The system only records when you actually submitted.

Getting access: organization enrollment and user roles

The Supervisory User

Each filing organization has at least one Supervisory User, who enrolls the organization and controls who can do what. According to FinCEN's enrollment materials, the initial Supervisory User registers the organization with its name, address and EIN, and can then create additional Supervisory User accounts. Other staff enroll under the organization using its enrollment code and are assigned roles by a Supervisory User.

Choose Supervisory Users deliberately. They are typically the BSA officer and a backup. They should not be the only people who can file, and their own departures need to be part of the offboarding checklist, because an organization whose only Supervisory User has left cannot easily add or remove filers.

Filing roles

Roles are assigned by report type and filing method. FinCEN's SAR FAQ lists roles such as FinCEN SAR Filer, FinCEN SAR Batch Filer, FinCEN CTR Filer, FinCEN CTR Batch Filer, FinCEN DOEP Filer and FinCEN DOEP Batch Filer. General users can see only the reports their Supervisory User has given them permission to see.

Every filer also needs the Secure Messenger role. Acknowledgments and the official BSA IDs are delivered through Secure Messaging, so a filer without it cannot confirm a report was accepted.

Login.gov

Since April 30, 2024, BSA E-Filing has used Login.gov for multi-factor authentication. Users sign in through a Login.gov account, and the email address on the Login.gov account must match the email address on the BSA E-Filing account. If a user changes email addresses, or the bank changes domains after a merger, fix the match before the next filing deadline, not on it.

Access hygiene

SAR access is a confidentiality issue as much as an operational one. Under 31 CFR 1020.320(e), a SAR and any information that would reveal its existence are confidential. A practical access standard:

SAR filing roles limited to the BSA team; CTR and DOEP roles to the staff who prepare those reports
A quarterly review of active users and roles, signed by the BSA officer
Removal of access the same day someone leaves or changes jobs
No shared logins. Each filing must be traceable to a person.

Discrete filing versus batch filing

There are two ways to submit reports, and the choice usually depends on volume and on whether the bank's core or BSA software can generate files.

Discrete filing

Discrete filing means completing one report at a time in FinCEN's online form. It suits SARs at most community banks, low CTR volumes and banks without CTR software.

How it works in practice:

Open the form in the system and complete it. The form validates fields as you go, flagging missing or badly formatted entries.
Save a copy before you submit. FinCEN's CTR FAQ is explicit: the BSA E-Filing System is not a recordkeeping program, filers cannot go back and view previously filed reports, and FinCEN does not provide copies of filed reports to filers. The Save button must be used before Submit becomes available.
A confirmation page shows a Tracking ID, a unique number the system assigns to the submission.
Watch for the acknowledgment. FinCEN's SAR FAQ says that within 48 hours the report will be formally acknowledged and a secure message containing the official BSA ID will be sent to the filer's Secure Mailbox.

Status is visible in the system's Track Status function in the meantime.

Batch filing

Batch filing means submitting a file containing many reports, generated by the bank's own software or a vendor's, in FinCEN's XML format. Banks with high CTR volume almost always batch file, and many BSA software platforms batch file SARs as well. The current SAR batch format is XML Schema 2.0, documented in FinCEN's XML user guides, which FinCEN updates periodically.

What makes batch filing different:

FinCEN expects new or changed batch software and procedures to be tested in its user test environment before production submissions. Vendor upgrades are the moment this gets forgotten.
Schema validation errors are fatal: the entire batch file is rejected and none of its reports are processed. FinCEN says filers should immediately correct and resubmit a file rejected for fatal errors.
An acknowledgment file is returned to the filer through the system's inbox within two business days of the submission being accepted. It assigns a BSA ID to each accepted report and lists any data errors.
Primary and secondary errors. In the acknowledgment, reports with primary errors must be re-filed as corrected reports. Reports with only secondary errors do not need to be corrected, though recurring secondary errors are worth fixing at the source.

The biggest batch risk is silent failure. A file that never uploaded, or uploaded and was rejected, looks the same as a successful file to anyone who is not checking the acknowledgments. Someone must reconcile every submission against its acknowledgment, every time.

Choosing between them

Factor	Discrete	Batch
Typical use	SARs, low-volume CTRs, DOEPs	High-volume CTRs, SARs from case management software
Setup	Enrollment and roles only	Software generating valid XML, plus testing
Main failure mode	Typing errors, unsaved copies, unsubmitted drafts	Rejected files, unreviewed acknowledgment errors
Key control	Save a copy, confirm the BSA ID	Reconcile every file to its acknowledgment

After submission: tracking IDs, BSA IDs and the acknowledgment log

The two identifiers do different jobs. The Tracking ID proves you submitted. The BSA ID proves FinCEN accepted the report, and it is the number you will need later to correct, amend or reference the report, including in a continuing activity SAR.

A simple acknowledgment log prevents most filing failures:

Report type, subject or customer, and the internal case or CTR reference
Date the obligation arose (transaction date for a CTR, detection date for a SAR)
Due date
Date submitted and Tracking ID
Date acknowledged and BSA ID
Any errors returned and how they were resolved

Review the log weekly for anything submitted without a BSA ID. A report that was submitted but never acknowledged, or acknowledged with errors that were never fixed, has to be treated as a problem until proven otherwise. This log is also what an examiner will want to reconcile against your case files; our guide to BSA/AML examination procedures explains how that testing usually runs.

Correcting and amending reports

The forms build in a correction mechanism, and using it properly matters because a duplicate filing is not the same as a correction.

SARs

Item 1 on the FinCEN SAR asks the filer to identify the filing type:

Initial report
Correct/amend prior report
Continuing activity report
Joint report

For a correction or amendment, or for a continuing activity report, the filer enters the prior report's BSA ID. FinCEN's filing instructions say to enter all zeros if the prior BSA ID is unknown, which is another reason to keep the acknowledgment log. A corrected or amended SAR must be completed in its entirety, not just the changed fields, and the correction should be described at the start of the narrative.

Continuing activity has its own timing considerations. In FAQs issued jointly with the federal banking agencies on October 9, 2025, FinCEN said banks are not required to run a separate post-filing review to see whether suspicious activity has continued, and may instead rely on their risk-based monitoring. For banks that choose to follow FinCEN's continuing activity guidance, the FAQs give the timeline: a 90-day review period after the initial SAR, with the continuing activity SAR filed within 30 days after that period ends, or 120 days after the prior filing. The step-by-step guide on how to file a SAR covers the investigation and narrative side of the process.

CTRs

To correct a CTR, the filer checks "Correct/amend prior report" and enters the prior report's BSA ID or document control number. FinCEN's CTR FAQ notes that the corrected report receives its own new BSA ID. Do not file a fresh CTR for the same transaction without the correction indicator, which creates a duplicate rather than fixing the original.

Common reasons CTRs need correction:

Conductor and beneficiary recorded in the wrong roles
Missing or incorrect identification details
Amounts that do not reconcile to the source records
Multiple transactions aggregated incorrectly
An exempt customer reported, or a non-exempt customer missed

The underlying CTR rules, including aggregation, are covered in our guide to currency transaction reports.

Recordkeeping the system does not do

Because BSA E-Filing is not a recordkeeping system, the bank is responsible for its own copies:

CTRs and DOEPs. Keep a copy of each report for five years from the date of the report (31 CFR 1010.306(a)(2)).
Keep a copy of each SAR and the original or business record equivalent of supporting documentation for five years from the date of filing. Supporting documentation is deemed to have been filed with the SAR and must be made available to FinCEN, law enforcement and the bank's BSA examiners on request (31 CFR 1020.320(d)).

Store SAR copies and supporting files with restricted access, separate from customer files. Saved PDF copies of SARs on a shared drive that every operations user can open is a confidentiality problem, not just a filing one.

When things go wrong

The system is down near a deadline. Document the attempts, keep screenshots, and contact the BSA E-Filing Help Desk, which FinCEN lists at 1-866-346-9478. Submit as soon as the system is available.
A batch file was rejected. Correct and resubmit immediately, then check whether any report in it is now late.
You find an unfiled report. Escalate to the BSA officer. Late filing is a reporting failure that needs to be documented, corrected and evaluated for root cause, and the bank may need to consider whether a back-filing review of similar transactions is required.
Login trouble. Most access problems trace to Login.gov email mismatches or missing roles. Keep at least two people able to file each report type.

For questions about BSA rules themselves rather than the system, FinCEN maintains a separate regulatory helpline. Keep both numbers in the procedures.

Building it into procedures and training

Written procedures for e-filing should name the Supervisory Users and backups, assign roles by report type, require saving copies before submission, set the acknowledgment reconciliation routine, explain how to correct reports, and cover system outages. Training should cover the same ground for everyone who touches the system, plus the confidentiality rules for SAR filers.

The SARs and Information Sharing course is the natural fit for analysts and BSA staff who prepare and file SARs, and the suspicious activity reporting training page lists related options. For the program around the filings, our guide to BSA officer responsibilities explains where e-filing oversight sits.

Get the filing team trained

A filed report is only as good as the process that produced it and the person who submitted it. If your SAR filers are learning the system by inheriting someone else's password and notes, fix that before the next exam. The SARs and Information Sharing course gives the people who prepare and file SARs a structured grounding in suspicious activity reporting.

Frequently Asked Questions

What is the BSA E-Filing System?

BSA E-Filing is FinCEN's web-based system for submitting Bank Secrecy Act reports, including currency transaction reports (FinCEN Form 112), suspicious activity reports (FinCEN Form 111) and designations of exempt person (FinCEN Form 110). FinCEN made electronic filing mandatory, with limited exceptions, effective July 1, 2012. Banks enroll as filing organizations, with Supervisory Users who assign filing roles to staff. Reports can be filed one at a time through online forms or in batches of XML files generated by bank software.

How do I know FinCEN accepted my SAR or CTR?

After a discrete filing, the system shows a confirmation page with a Tracking ID, which proves submission. FinCEN's SAR FAQ says the report is formally acknowledged within 48 hours, with the official BSA ID sent to the filer's Secure Mailbox. Batch filers receive an acknowledgment file within two business days of the submission being accepted, with a BSA ID for each accepted report and any errors. Keep a log of Tracking IDs and BSA IDs and follow up on anything without a BSA ID.

Can I view a previously filed report in BSA E-Filing?

No. FinCEN states that BSA E-Filing is not a recordkeeping program, that filers cannot access or view previously filed reports, and that FinCEN does not provide copies of filed reports. You must save a copy before submitting; on discrete forms, saving is required before the Submit button becomes available. Banks must keep copies of CTRs for five years from the report date and copies of SARs, with supporting documentation, for five years from the filing date.

How do I correct a CTR or SAR that was already filed?

File the report again with the "Correct/amend prior report" box checked and the prior report's BSA ID entered. On a SAR, this is Item 1, and the corrected report must be completed in full, with the correction described at the start of the narrative. On a CTR, the corrected report receives a new BSA ID. Do not file a new report without the correction indicator, because that creates a duplicate rather than fixing the original filing.

What is the difference between discrete and batch filing?

Discrete filing means completing one report at a time in FinCEN's online form, which is typical for SARs and low CTR volumes. Batch filing means submitting XML files containing many reports, usually generated by core or BSA software. Batch filers must test new or changed software in FinCEN's test environment, and must watch for fatal schema errors, which reject the entire file. Both methods produce BSA IDs for accepted reports; batch filers receive them in acknowledgment files.

Is FBAR filing the same as bank BSA e-filing?

FBARs (FinCEN Form 114) are filed through the same BSA E-Filing website, but they are a different obligation. An FBAR is filed by a U.S. person with a financial interest in, or signature authority over, foreign financial accounts above a threshold, and individuals use a separate filing path on the site. Bank CTR, SAR and DOEP filing is done by enrolled filing organizations with assigned roles. FinCEN's FBAR pages are the right resource for individual filers.