SAR Filing Requirements: Thresholds, Deadlines and Continuing Activity

10/9/2026

SAR reporting requirements for banks come from two sets of rules that overlap: FinCEN's bank rule at 31 CFR 1020.320 and the SAR rule of each federal banking agency. Read together, they answer four questions every BSA officer has to get right: when a suspicious activity report should be filed, how much activity it takes, how long the bank has, and what happens when the activity keeps going.

This guide sets out the requirements as they stand, including the October 2025 FAQs from FinCEN and the federal banking agencies that changed how many banks handle continuing activity and no-file decisions. It does not cover the mechanics of completing the form; for that, see our guide on how to file a SAR.

Where the requirements come from

A bank's SAR obligation sits in two layers:

FinCEN's rule for banks, 31 CFR 1020.320. This is the Bank Secrecy Act requirement. It sets the money laundering and BSA-evasion triggers, the filing deadline, the retention rule, confidentiality and the safe harbor.
The federal banking agency rules. 12 CFR 21.11 (OCC), 12 CFR part 353 (FDIC), 12 CFR 208.62 (Federal Reserve) and, for credit unions, 12 CFR 748.1(d) (NCUA). These add crime-based triggers, including insider abuse, and the board-notification rule.

The two layers are aligned on the core deadline and the money laundering trigger, and the agency rules repeat much of the FinCEN rule. Where this article quotes an agency rule, it uses the OCC's as the example; check your own regulator's text for small wording differences.

When a suspicious activity report should be filed: the triggers

The BSA triggers (FinCEN rule)

A transaction requires a SAR under 31 CFR 1020.320(a)(2) if it is conducted or attempted by, at, or through the bank, it involves or aggregates at least $5,000 in funds or other assets, and the bank knows, suspects, or has reason to suspect that:

Illegal funds. The transaction involves funds derived from illegal activities, or is intended or conducted to hide or disguise such funds (including their ownership, nature, source, location or control) as part of a plan to violate or evade federal law or to avoid a transaction reporting requirement.
BSA evasion. The transaction is designed to evade any requirement of the BSA regulations. Structuring to avoid a currency transaction report is the classic example.
No apparent lawful purpose. The transaction has no business or apparent lawful purpose, or is not the sort in which the particular customer would normally be expected to engage, and the bank knows of no reasonable explanation after examining the available facts, including the background and possible purpose of the transaction.

The third trigger is the one that generates most investigative work, because it requires comparing activity against what the bank knows about the customer. Weak customer due diligence makes it impossible to apply. Our article on KYC and customer due diligence covers the profile that this comparison depends on.

The crime-based triggers (agency rules)

The agency rules require a SAR when the bank detects a known or suspected federal criminal violation, or pattern of violations, committed or attempted against the bank or involving transactions conducted through it, where the bank believes it was an actual or potential victim or was used to facilitate a criminal transaction, in these situations:

Insider abuse involving any amount, where the bank has a substantial basis for identifying a director, officer, employee, agent or other institution-affiliated party as having committed or aided the act.
Violations aggregating $5,000 or more where a suspect can be identified.
Violations aggregating $25,000 or more regardless of potential suspects.
Transactions aggregating $5,000 or more that involve potential money laundering or BSA violations, which mirrors the FinCEN triggers above.

Thresholds at a glance

Activity	Mandatory SAR threshold	Source
Insider abuse	Any amount	Agency rules (e.g., 12 CFR 21.11(c)(1))
Federal crime, suspect identifiable	$5,000 or more	Agency rules (e.g., 12 CFR 21.11(c)(2))
Federal crime, no suspect identifiable	$25,000 or more	Agency rules (e.g., 12 CFR 21.11(c)(3))
Money laundering, BSA evasion, no apparent lawful purpose	At least $5,000	31 CFR 1020.320(a)(2)

How to read the thresholds

Aggregation applies. "Involves or aggregates" means related transactions are added together. Ten $600 transfers that form one scheme are a $6,000 activity.

Attempts count. The FinCEN trigger covers transactions "conducted or attempted." A customer who abandons a deposit after learning a report will be filed, or a fraudster whose wire was stopped, can still be the subject of a required SAR.

The thresholds are floors, not limits. Below them, filing is voluntary. The FinCEN rule expressly allows a bank to file a SAR on any suspicious transaction it believes is relevant to a possible violation of law, even if reporting is not required. The safe harbor covers voluntary filings as well.

Near the CTR threshold is not, by itself, suspicious. FinCEN and the federal banking agencies said in their October 9, 2025 FAQs that the mere presence of a transaction or series of transactions at or near the $10,000 CTR threshold is not information sufficient to require a SAR. The bank must know, suspect, or have reason to suspect the activity was designed to evade reporting.

Exceptions

The FinCEN rule and the agency rules say a bank need not file a SAR for:

A robbery or burglary, committed or attempted, that is reported to appropriate law enforcement authorities
Lost, missing, counterfeit or stolen securities for which the bank files a report under the SEC's rule at 17 CFR 240.17f-1

Anything else that meets a trigger needs a SAR, even if the bank has also called the police, closed the account, or recovered the money.

The detection clock

30 days, extendable to 60

Under 31 CFR 1020.320(b)(3), a bank must file no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing a SAR. If no suspect was identified on the date of detection, the bank may delay filing for an additional 30 calendar days to identify a suspect. In no case may reporting be delayed more than 60 calendar days after the date of initial detection.

The extension exists for one purpose: identifying a suspect. It is not available because the investigation is complex, a reviewer was out, or the SAR committee meets monthly. If the bank identified the suspect on the day of detection, the deadline is 30 days.

What "initial detection" means

The clock does not start when a monitoring system generates an alert, and it does not wait for the investigation to finish. It starts when the bank has facts that may constitute a basis for filing. In practice, banks typically mark it at the point an appropriately trained reviewer looks at the alert or referral and identifies potentially suspicious activity, and many build their procedures around that point.

Two consequences follow:

Alert backlogs do not stop the clock from mattering. An unreviewed alert may not have started the 30 days, but a bank that lets alerts age for weeks has its own problem, and examiners look at alert aging as a control in its own right.
The detection date must be recorded. It is the first date an examiner will reconcile against the filing date. If the file does not show when detection happened, the bank cannot show it filed on time.

Immediate notification

When a violation requires immediate attention, such as an ongoing money laundering scheme, the bank must immediately notify an appropriate law enforcement authority by telephone, in addition to filing a timely SAR. The OCC's rule adds a call to the OCC. A phone call is not a substitute for the SAR; it comes in addition to it.

A worked timeline

Event	Day
Reviewer identifies potentially suspicious activity (initial detection)	0
SAR due if a suspect was identified at detection	30
Latest SAR date if no suspect was identified at detection	60

Continuing activity

What happens when the suspicious activity continues after the bank files? This is where practice changed most recently.

The old practice

In October 2000, FinCEN suggested as a "rule of thumb" that institutions report continuing suspicious activity with a SAR at least every 90 days. Later guidance, including FinCEN's electronic filing instructions, described filing continuing activity SARs after a 90-day review, with the filing deadline 120 days after the previous related SAR. Over the years many banks, and many examiners, treated that as a requirement: a mandatory 90-day review of every account on which a SAR had been filed, followed by a continuing SAR if the activity persisted.

What the October 2025 FAQs say

FinCEN, the Federal Reserve, the FDIC, the NCUA and the OCC jointly answered two questions on this:

No required post-filing review. A financial institution is not required to conduct a separate review, manual or otherwise, of a customer or account following a SAR to determine whether suspicious activity has continued. It may instead rely on risk-based policies, procedures and controls reasonably designed to identify and report suspicious activity.
The 90/120-day cadence is optional. Institutions are not required to file on the 90-day cycle and may instead file SARs as appropriate in line with the applicable timelines, meaning the ordinary 30-day (or 60-day) clock from detection of new facts.

For banks that elect to keep the continuing activity approach, the FAQs give this timeline for a case with an identified subject:

Step	Day
Detection of facts that may be a basis for filing	0
Initial SAR filed	30
End of the 90-day continuing activity period	120
Continuing activity SAR filed	150

If the initial SAR used the 60-day extension because no subject was identified, every later date moves by 30 days: initial SAR on day 60, end of the 90-day period on day 150, continuing SAR on day 180. The FAQs say the date range of activity on a continuing SAR (Item 30 on the form) should cover the entire 90-day period, starting the day after the initial SAR was filed or the day after the previous 90-day period ended.

What a continuing SAR contains

FinCEN's filing instructions say a continuing report should be completed in its entirety, including all subjects and all institutions where the activity occurred. The narrative should describe the activity for the period the report covers, include only as much from prior reports as is needed to understand the activity, and never reproduce prior narratives in full. The form also asks for the amount for the current period and the cumulative amount across all related reports.

Choosing an approach

Banks now have a genuine policy choice. A bank that keeps the 90-day cycle gets a predictable workload and a clean trail, at the cost of reviewing accounts where nothing new happened. A bank that drops it relies on monitoring to surface new activity and files on the normal clock when it does. Either is defensible if it is written into procedures, applied consistently and reasonably designed to catch continuing activity. What is not defensible is a policy that says one thing and a practice that does another.

Whichever approach a bank chooses, the decision about whether to keep the customer remains separate. Filing a SAR, or a series of them, does not require closing an account. Repeated filings on the same relationship should, however, prompt a deliberate, documented risk decision about whether the bank wants the relationship at all.

Documenting decisions not to file

The October 2025 FAQs also addressed the "no-SAR decision." FinCEN and the agencies stated there is no requirement or expectation under the BSA or its implementing regulations to document a decision not to file a SAR. FinCEN had previously encouraged, but not required, such documentation.

For banks that choose to document, the FAQs say the documentation need not exceed what the bank's own risk-based policies require, and that in most cases a short, concise statement of the SAR decision will likely suffice, with more detail reasonable in complex investigations.

In practice, many banks will keep some record anyway, for three reasons: it lets independent testing and quality control see that alerts were actually reviewed; it helps the next analyst who sees the same customer; and it shows the bank's monitoring is working as designed. The change is that the record can be short, and its absence is not itself a regulatory violation.

Retention, supporting documentation and the board

Five-year retention

A bank must keep a copy of each SAR and the original or business record equivalent of any supporting documentation for five years from the date of filing. Supporting documentation must be identified as such and is deemed to have been filed with the SAR, which brings it inside the confidentiality rule.

Supporting documentation on request

The bank must make supporting documentation available on request to FinCEN, federal, state and local law enforcement, the federal regulator that examines the bank for BSA compliance, and state regulators with BSA authority. It does not send supporting documentation with the SAR. FinCEN's instructions allow one attachment, an Excel-compatible CSV file of no more than 1 megabyte, which is useful for transaction lists too long for the narrative; everything else is described in the narrative and kept on file.

Board notification

The agency rules require management to promptly notify the board of directors, or a committee of directors or executive officers the board designates, whenever the bank files a SAR. If the suspect is a director or executive officer, that person may not be notified, but all directors who are not suspects must be. Many banks report SAR activity to a board or committee monthly or quarterly in summary form; the board's role is oversight, not case review. The BSA officer responsibilities post covers how this reporting line usually works.

Confidentiality and the safe harbor

Two more rules govern every SAR:

A SAR, and any information that would reveal its existence, is confidential. No bank, director, officer, employee or agent may disclose it except as the rule permits. A bank subpoenaed or otherwise asked to disclose a SAR must decline, cite the rule, and notify FinCEN of the request and the response. The bank may share with FinCEN, law enforcement and its BSA examiners, and within its corporate organizational structure as permitted by regulation and guidance.
Safe harbor. A bank and its directors, officers, employees and agents are protected from liability to any person for making a SAR or other disclosure under the rule, or for not notifying the person named in it, to the full extent of 31 U.S.C. 5318(g)(3).

Correcting, amending and joint filing

FinCEN's filing instructions distinguish three special filings:

Corrected reports when errors are found in a filed SAR
Amended reports when new information about reported activity emerges and a continuing report is not appropriate
Joint reports when two or more distinct institutions file a single SAR on activity involving all of them. Joint filing is not allowed when a subject is an insider of any of the filing institutions; each must file separately. A bank may not name another institution as a joint filer without that institution's agreement to the filing.

Corrected and amended reports are completed in full, with the corrections or amendments described at the beginning of the narrative.

What is changing, and what is not

The regulatory requirements above are current as of this writing. Three things are in motion around them:

The October 2025 FAQs are interpretive. They state that they do not alter existing legal or regulatory requirements; they clarify them.
FinCEN's April 2026 proposed rule to reform AML/CFT program requirements, with a parallel proposal from the OCC, FDIC and NCUA, is still a proposal. It focuses on program design and supervision rather than the SAR thresholds and deadlines.
Bills in Congress would raise SAR and CTR thresholds. Until one is enacted and implemented, the $5,000, $25,000 and $10,000 figures remain the law.

Our BSA/AML examination procedures article covers what examiners test around SAR timeliness and decisioning.

A requirements checklist

Triggers, thresholds and exceptions written into procedures, citing both the FinCEN rule and your regulator's rule
A defined point of initial detection, recorded on every case
Deadline tracking from detection, with the 60-day extension used only when no suspect was identified at detection
A procedure for immediate telephone notification to law enforcement in urgent cases
A written continuing activity approach: either the elected 90/120-day cycle or risk-based monitoring with filing on the normal clock
A stated position on documenting no-file decisions, consistent with the 2025 FAQs
Five-year retention of SARs and supporting documentation, stored separately with restricted access
Board or committee notification of filings
Confidentiality procedures for subpoenas and requests

Training on the requirements

The people who apply these rules every day are BSA analysts, investigators and officers, and the rules have moved recently. Our SARs and Information Sharing course focuses on suspicious activity reporting and BSA information sharing, and the suspicious activity reporting topic page lists related training. For program owners who need the whole framework, see the Certificate in BSA and AML Compliance.

Next step

Compare your written SAR procedures against the October 2025 FAQs, decide deliberately how you will handle continuing activity and no-file decisions, and train your BSA team on the result with SARs and Information Sharing.

Frequently Asked Questions

What are the SAR reporting requirements for banks?

Banks must file a SAR when a transaction involving or aggregating at least $5,000 is suspected of involving illegal funds, evading BSA requirements, or having no apparent lawful purpose. The banking agencies also require SARs for suspected crimes: any amount for insider abuse, $5,000 or more with an identifiable suspect, and $25,000 or more regardless of a suspect. Filing is due within 30 days of initial detection, records are kept five years, and the report is confidential.

When should a suspicious activity report be filed?

No later than 30 calendar days after the bank's initial detection of facts that may constitute a basis for filing. If no suspect was identified at detection, the bank may take another 30 days to identify one, but never more than 60 days in total. Where a violation needs immediate attention, such as ongoing money laundering, the bank must also notify law enforcement by telephone immediately.

Is a continuing activity SAR required every 90 days?

No. FinCEN's long-standing suggestion to report continuing activity at least every 90 days, with a 120-day filing deadline, is guidance, not a requirement. The October 2025 FAQs confirmed that banks need not run a separate post-filing review and may instead file SARs as appropriate on the normal timelines. Banks that choose the 90-day approach can follow it, using the timeline the FAQs describe.

Do banks have to document a decision not to file a SAR?

Not as a regulatory requirement. FinCEN and the federal banking agencies stated in October 2025 that there is no requirement or expectation under the BSA or its regulations to document a no-file decision. Banks may still choose to, and if they do, a short, concise statement will usually suffice. Many banks keep a brief record because it supports quality control and independent testing.

What is the SAR threshold when no suspect is identified?

Under the federal banking agencies' rules, a known or suspected federal crime against or through the bank requires a SAR at $25,000 or more when there is no substantial basis for identifying a suspect. When a suspect can be identified, the threshold is $5,000. Separately, if no suspect is identified at detection, the filing deadline can extend from 30 to a maximum of 60 days.

How long must a bank keep SAR records?

Five years from the date the SAR was filed. The bank must keep a copy of the SAR and the original or business record equivalent of all supporting documentation, which is deemed filed with the SAR. Supporting documentation must be made available on request to FinCEN, law enforcement and BSA examiners, and should be stored separately from the customer file with restricted access.