Module 4: SAR Filing — Compliance Training

When to file, what to write, and how to use FinCEN's BSA E-Filing system — for compliance officers and senior analysts.

Lesson 4.1 — When to File a SAR

A Suspicious Activity Report is mandatory when all three conditions are met:

The transaction involves a covered financial institution
The transaction involves at least $5,000 (where a suspect can be identified) or $25,000 (regardless of suspect identification)
The transaction is known, suspected, or there is reason to suspect it involves funds from illegal activity; is designed to evade BSA requirements; lacks a lawful purpose with no reasonable explanation; or involves use of the financial institution to facilitate criminal activity

Filing is also voluntary for suspicious activity below the mandatory thresholds. FinCEN and law enforcement agencies value below-threshold SARs, particularly in structuring and fraud patterns where individual transactions are small.

30-Day Filing Rule

SARs must be filed within 30 calendar days from the date the institution initially detects a basis for filing. If no suspect is identified, the deadline extends to 60 calendar days. When a filing delay would be material to a criminal investigation, FinCEN should be contacted for guidance.

Lesson 4.2 — SAR Narrative Writing Standards

The SAR narrative is the most important part of a SAR filing. FinCEN and law enforcement use it to decide whether to investigate. A well-written narrative is specific, factual, and answers the "5 Ws": Who, What, When, Where, and Why suspicious.

Required elements of the SAR narrative:

Who is involved (describe subjects — do not use names in the narrative text field other than the formal subject fields)
What activity occurred — specific transaction amounts, dates, types
When the activity occurred — specific dates and time periods
Where transactions occurred — accounts, locations, wire routing
Why the activity is suspicious — what made this activity inconsistent with known customer information
How the institution became aware — alert, manual review, law enforcement contact
What the institution did — account restricted, relationship terminated, etc.

Sample SAR Narrative (Redacted)

Example of a well-formed AML SAR narrative excerpt:

"Between [DATE] and [DATE], Subject A (hereinafter "Subject"), a [BUSINESS TYPE] opened [DATE], received 12 ACH credit transactions totaling $94,500 from 6 separate originators, none of which had prior transaction history with Subject's account. Within 24-48 hours of each credit, Subject transmitted wire transfers in equivalent amounts less routine transaction fees to two foreign beneficiary accounts at [BANK] in [JURISDICTION]. The account balance at no point exceeded $2,500 prior to this activity period. This pattern is consistent with a funnel account scheme in which Subject's account is being used to aggregate and move illicit proceeds of unknown origin. Subject's stated business purpose of [BUSINESS TYPE] does not provide explanation for international wire activity of this volume. The institution has restricted the account pending this filing."

SAR Do's and Don'ts

✓ DO

Be specific with dates, amounts, and account numbers
Explain why the activity is unusual for this customer
Reference prior SARs or EDD if applicable
Use plain, professional language
Have legal review narrative before filing

✗ DO NOT

Tip off the customer that a SAR has been or may be filed
Use conclusory language ("this is money laundering")
Include unverified gossip or speculation
File a SAR without management authorization
Delay filing past the 30/60-day deadline

Lesson 4.3 — FinCEN BSA E-Filing System

SARs are filed electronically using FinCEN's BSA E-Filing System at bsaefiling.fincen.treas.gov. Access requires an EIN-registered account approved by your institution's primary Supervisory User.

SAR Form Fields (key):

Part I — Filing institution information
Part II — Suspect information (name, DOB, address, ID)
Part III — Suspicious activity information (dates, dollar amounts, activity type checkboxes)
Part IV — Narrative (free-text, no character limit — write a complete, specific description)

After filing, FinCEN issues a BSA Identification Number (BSA ID) which becomes the permanent reference for that SAR. This number should be recorded in your case management system for the 5-year mandatory retention period.

90-Day Continuing Activity SAR

If the suspicious activity continues after an initial SAR is filed, a continuing activity SAR must be filed every 90 days while the activity continues. Reference the original SAR's BSA ID in the continuation filing to link the cases.

All 4 modules complete. Take the final knowledge check to earn your certification.

Take Final Knowledge Check →