How to File a Suspicious Activity Report (SAR): Step-by-Step Guide

5/3/2026

Most SAR training explains when a report is required. Far less of it explains how to actually produce one — how the clock is counted, who decides, what the narrative must contain, and what happens after filing.

This guide walks the process end to end, in the order it happens.

Step 1: Detection

Everything starts with initial detection, and that phrase carries legal weight because it starts the filing clock.

Detection arrives through several channels:

Automated monitoring alerts from the transaction monitoring system
Employee referrals from tellers, lenders, or operations staff who observed something
Law enforcement contact, including a 314(a) match or a subpoena
Negative news or adverse media identified during periodic review
Customer due diligence review finding activity inconsistent with the expected profile

The critical distinction: initial detection is not the date the alert fired. It is the date the institution has facts that may constitute a basis for filing — generally the date an appropriately trained person reviews the alert and identifies potentially suspicious activity. An alert sitting unreviewed in a queue for three weeks has not started the clock, but it has consumed three weeks of the institution's practical capacity to investigate, and a persistent backlog is its own examination finding.

Document the detection date deliberately. It is the first thing an examiner reconciles against the filing date.

Step 2: Investigation

The investigation determines whether the standard for filing is met. Scope it to answer three questions: what happened, does it have an apparent lawful purpose, and who is involved.

Practical steps:

Pull the full transaction history, not just the alerting transactions. A single $9,500 deposit means nothing; eleven of them across three branches in two weeks means something.

Review the customer profile. What did the institution expect from this relationship at onboarding, and does the activity match? A landscaping business depositing $40,000 a week in cash is a different question from a consulting firm doing the same.

Look across related accounts. Signers, beneficial owners, common addresses and phone numbers, and accounts that transact with each other frequently.

Ask the front line. The teller who handled the transactions often has context no system captured — who accompanied the customer, what explanation was volunteered, whether the customer seemed coached.

Consider asking the customer — carefully. Ordinary account servicing questions are permissible. What is prohibited is disclosing that a SAR is being considered or filed. Many institutions restrict customer contact during an investigation for exactly this reason, and the safe default is to route it through the BSA officer.

Document what you reviewed, including what turned out to be innocuous. An investigation file showing the alternatives considered and eliminated is what makes a decision defensible either way.

Step 3: The Decision

The standard is knowing, suspecting, or having reason to suspect that a transaction:

Involves funds derived from illegal activity, or is intended to hide such funds
Is designed to evade BSA requirements, whether through structuring or otherwise
Has no business or apparent lawful purpose, and the institution knows of no reasonable explanation after examining the available facts
Involves use of the institution to facilitate criminal activity

Dollar thresholds are generally $5,000 when a suspect can be identified and $25,000 regardless of whether one can be.

Note what the standard does not require. It does not require proof of a crime, identification of the predicate offense, or certainty. Suspicion is the standard, and the safe harbor exists precisely so institutions are not penalized for filing on suspicion that proves unfounded.

Deciding not to file is legitimate and common — most alerts do not become SARs. What is not acceptable is deciding not to file without documenting why. An undocumented no-file decision is indistinguishable, at examination, from nobody having looked.

Whoever holds decision authority should be named in the procedures, and the decision should be dated and recorded with its rationale.

Step 4: Meeting the Deadline

Filing is due within 30 calendar days of initial detection. Where no suspect has been identified at detection, the institution may take an additional 30 days to identify one, up to a maximum of 60 days.

The extension is available only for suspect identification. It does not extend the deadline because the investigation is complex, because the analyst was on leave, or because the committee meets monthly.

Continuing activity is handled differently. Where suspicious activity continues, institutions should report it at least every 90 days, filing a continuing activity report that summarizes the period. This keeps law enforcement current without requiring a new filing for each transaction.

Step 5: Writing the Narrative

The narrative is the part of the SAR that has value to an investigator, and it is the part most often written badly. FinCEN's own guidance is the best template: describe who, what, when, where, why, and how.

A usable narrative covers:

Who — the subject or subjects, their relationship to the institution, account numbers, and roles
What — the specific activity, with amounts, dates, and instruments
When — the period, and whether activity is ongoing
Where — branches, locations, channels, and any relevant geography
Why — what makes it suspicious, stated explicitly rather than implied
How — the mechanics, including how funds entered and left

Writing rules that materially improve quality:

Make it standalone. The reader has no access to your systems. A narrative referring to "the activity described in the attached" or "the customer's usual pattern" without stating it is unusable.

Be specific and quantified. "Numerous large cash deposits" is weak. "Fourteen cash deposits between $8,200 and $9,700, totaling $126,400, made at four branches between March 3 and March 28, 2026" is evidence.

Explain the deviation. State what the expected activity was and how the observed activity differs. This is what converts a list of transactions into suspicion.

State what you did not conclude. If a plausible legitimate explanation exists but was not verifiable, say so. Investigators value calibration.

Avoid jargon and abbreviations internal to your institution, and spell out system names.

Never state that a SAR was filed in any customer-facing document, and do not include the SAR itself in the customer's file.

Step 6: Filing

SARs are filed electronically with FinCEN through the BSA E-Filing System on FinCEN Form 111. Complete every field for which information is available — incomplete filings reduce searchability, which is the entire point of the report.

Retain a copy of the SAR and all supporting documentation for five years from the filing date. Supporting documentation is deemed to be part of the SAR, which matters for the confidentiality rules discussed below. Store it separately from the customer's regular file, with access restricted.

Confirm the filing was accepted. The E-Filing System returns an acknowledgment, and a filing that errored and was never resubmitted is functionally an unfiled SAR.

Step 7: After Filing

Confidentiality is absolute

No person may disclose the existence of a SAR, or any information that would reveal its existence, to the subject or to any unauthorized person. This prohibition is statutory, and it extends to supporting documentation.

Practical consequences that catch institutions out:

Do not tell the customer, and do not hint. "We are reviewing your account for compliance reasons" is acceptable; anything that reveals a filing is not.
Do not produce a SAR in response to a subpoena from a private party. Notify FinCEN and your primary regulator of the request and decline to produce.
Do not include SARs in files reviewed by outside parties in due diligence or litigation discovery.
Restrict internal access to those with a need to know.

Filing is not a decision to exit

A SAR does not require closing the account, and law enforcement often prefers the relationship continue so activity remains visible. Exit decisions should be made deliberately, documented, and based on risk — not triggered automatically by a filing.

Law enforcement may follow up

They may, or may not, and silence means nothing about the value of the filing. If contacted, verify the identity of the requester and route the response through the BSA officer and counsel.

Common Filing Errors

Clock started at the wrong date, usually the date the committee met rather than the date of initial detection
Narrative that lists transactions without explaining suspicion
Missing continuing activity reports where activity persisted past 90 days
No-file decisions with no documented rationale
Supporting documentation stored in the customer file, breaching confidentiality controls
Filings never confirmed as accepted by the E-Filing System
Blank fields where the institution held the information

Building the Skill

SAR writing is a craft, and it improves with structured practice and feedback rather than with volume alone. Institutions that review a sample of filed narratives internally each quarter — reading them as an investigator would, with no system access — improve quality faster than those that only measure timeliness. Our courses on suspicious activity reporting and SARs and information sharing cover both the mechanics and the narrative discipline.

Structuring the Investigation File

The SAR itself is one page of a much larger record, and the investigation file is what actually gets reviewed — by independent testing, by examiners, and by counsel if the relationship later becomes litigation. Institutions with clean examination results tend to build every file the same way, regardless of outcome.

A complete file contains six things. The trigger — the alert, referral, or event, with the date it was generated and the date it was reviewed. The transaction data examined, including the full period pulled rather than only the alerting items. The customer context — the profile as recorded at onboarding, the expected activity, and the risk rating in effect. The analysis — what was considered, what alternative explanations were tested, and what was ruled out and why. The decision — file or no-file, who made it, on what date, with the reasoning stated in complete sentences. The output — a copy of the filed SAR and confirmation of acceptance, or, for a no-file, the documented rationale.

The section most often missing is the fourth. Files routinely show the data and the conclusion with nothing in between, which leaves a reviewer unable to tell whether analysis occurred or the analyst simply had a view. Writing two or three sentences explaining what was considered costs a few minutes per case and is the difference between a defensible file and an unexplained one.

Two file-management practices are worth adopting deliberately. First, store investigation files separately from customer account records, with restricted access — supporting documentation is deemed part of the SAR for confidentiality purposes, and a file that lives in the customer folder will eventually be produced to someone who should not see it. Second, index by subject and by account, not only by case number, so that when the same customer surfaces again in eight months the prior investigation is findable. Repeat activity on a previously reviewed customer is common, and an institution that cannot retrieve its own prior work re-investigates from zero and misses the pattern that only appears across cases.

Frequently Asked Questions

How long do I have to file a SAR?

Thirty calendar days from initial detection of facts that may constitute a basis for filing. If no suspect has been identified at the point of detection, the institution may take up to an additional 30 days to identify one, for a maximum of 60 days. The extension applies only to suspect identification, not to investigative complexity.

What dollar amount triggers a SAR?

Generally $5,000 or more where a suspect can be identified, and $25,000 or more regardless of whether a suspect can be identified. There is no threshold at all for certain circumstances, and institutions may file voluntarily below the thresholds when the activity warrants it.

Can I tell a customer that I filed a SAR?

No. Disclosing the existence of a SAR, or information that would reveal it, to the subject or any unauthorized person is prohibited by statute and carries penalties. This includes declining to confirm or deny in response to a subpoena from a private party — notify FinCEN and your regulator instead of producing the document.

Do I have to close the account after filing a SAR?

No. A SAR is a report, not an exit decision. Continuing the relationship is often preferred by law enforcement because it preserves visibility. Any decision to exit should be made separately, documented, and based on the institution's risk tolerance.

What if I am not sure whether activity is suspicious?

File if you have reason to suspect after examining the available facts; the standard is suspicion, not proof, and the statutory safe harbor protects institutions from civil liability for filing. If you decide not to file, document the analysis and the rationale — an undocumented decision not to file is the weakest position of all.

How long must SAR records be kept?

Five years from the date of filing, including the SAR itself and all supporting documentation. Supporting documentation is treated as part of the SAR for confidentiality purposes, so it must be stored with restricted access and separately from the customer's ordinary account file.