Compliance reporting.

Each guide takes one part of the work in depth, with the rules, the deadlines and the primary sources.

• SAR filing Deadlines, the narrative, continuing activity and confidentiality for suspicious activity reports.
• Compliance operations What compliance costs a community bank or credit union, and where the hours go.
• HMDA reporting Who must report, the data fields, the March 1 deadline, edits and resubmission.

Each report runs on its own clock, and each clock starts from its own trigger: a cash transaction, the day suspicion is detected, the end of a quarter or a year, the last exam, the date of filing. These six span days to years, so the scale below is logarithmic.

Currency transaction report (CTR)15 days from the transaction

A CTR is filed for each deposit, withdrawal, exchange or other transfer of currency of more than $10,000. Cash transactions the bank knows are by or for the same person count as one when the cash in, or the cash out, totals more than $10,000 in a business day, across all domestic branches. Exemptions are in BSA compliance.

31 CFR 1010.311, 1010.313, 1010.306(a)(1)⁠[2]

Suspicious activity report (SAR)30 calendar days from initial detection

A SAR is due no later than 30 calendar days after the bank first detects facts that may constitute a basis for filing. If no suspect has been identified, it may take another 30 days to identify one, but never more than 60 days from detection. The 90/120-day continuing-activity cadence has been optional since October 9, 2025. Thresholds and the narrative are in SAR filing.

31 CFR 1020.320(b)(3) · 12 CFR 21.11(d), 208.62(d), 353.3(b)(1), 748.1(d)(2)(i)⁠[3]⁠[4]⁠[5]⁠[6]⁠[7]⁠[8]

Quarterly HMDA filing for large reporters60 calendar days after Q1, Q2 and Q3

An institution that reported at least 60,000 covered loans and applications for the preceding year, excluding purchased loans, also files its data for each of the first three quarters. Every reporter records each application on its register within 30 calendar days after the end of the quarter in which it took final action.

12 CFR 1003.5(a)(1)(ii), 1003.4(f)⁠[9]

Annual HMDA filingMarch 1 of the following year

File the loan/application register on the HMDA Platform, correct or confirm every edit, and have an authorized representative with knowledge of the data certify that it is accurate and complete. Keep a copy of the register for at least three years. Who must report is in HMDA reporting.

12 CFR 1003.5(a)(1)(i), (iii), (a)(3)⁠[9]⁠[10]

Full-scope exam, for banks12 or 18 months between exams

For banks, the law generally requires a full-scope, on-site exam every 12 months. Since September 14, 2026, qualifying banks under $6 billion can be examined every 18 months; the threshold was $3 billion, and the agencies estimate 4,016 institutions may now qualify. They can still examine any bank more often. The rule comes from the OCC, the Federal Reserve and the FDIC, so it doesn't cover credit unions.

12 CFR 4.6(b), 208.64(b), 337.12(b)⁠[11]

SAR and CTR recordsFive years from filing

Keep each SAR with its supporting documentation, and each CTR, for five years, stored so it can be retrieved within a reasonable time. SAR supporting documentation is deemed filed with the SAR and must be made available to FinCEN, law enforcement and examiners on request.

31 CFR 1020.320(d), 1010.306(a)(2), 1010.430(d)⁠[3]⁠[2]

There is no single official figure, and FinCEN says public data on compliance costs are scarce.⁠[12] The best estimates come from FinCEN and from the Conference of State Bank Supervisors (CSBS), which surveys community banks every year.

• About $598,700 a year is FinCEN's estimate of what a bank or credit union spends on its anti-money laundering program alone, as a size-weighted average. The median is $414,300.⁠[12]
• Over $6 billion a year is FinCEN's estimate of the reporting and recordkeeping part of BSA compliance alone, in aggregate.⁠[12]
• Roughly 11% to 15.5% of payroll went to compliance at the smallest community banks across ten years of CSBS surveys, 2015–2024, against 6% to 10% at the largest.⁠[13]
• 25.0% of community banks' compliance cost went to money laundering rules in CSBS's 2026 survey, second to safety and soundness at 25.9%.⁠[14]
• About three-fifths of community banks' compliance spending was salaries and benefits in CSBS's 2025 survey.⁠[15]

These figures measure different things in different years and samples, so compare them with care. Where the hours go is in Compliance operations.

Socratix AI coworkers can take on the gathering. For every LAR row, they pull the evidence from each system, check it against your policies and the source documents, and hand your team a recommendation with the reasoning laid out; for every SAR case, cash report or examiner request, they can do the same. Your team still makes every call — it just stops spending the day assembling the picture.

The clocks above don't stretch when the queue grows. With the gathering done on every item, the same team can work from the full record instead of a sample. Regulators have opened the door: FinCEN's 2026 proposal says institutions that responsibly experiment with innovative technologies won't face added enforcement risk solely for using them.⁠[12]

1. GatherCan pull the evidence for each SAR case, CTR, LAR row or exam request — transactions, account history, due diligence, prior filings, loan documents — from the systems that hold it, into one case.
2. AssessCan check the reported data against the source documents and your policies, flag each mismatch with the document it came from, and watch the clocks: CTR and SAR deadlines, HMDA filing dates.
3. RecommendCan propose the next step with the evidence and a plain-language reason: a draft SAR narrative when one is warranted, or a correction to a LAR field. Your team decides.
4. LearnCan learn from each decision — your policies, your risk appetite, your team's judgment — and log every step for the examiner.