SAR filing.

SAR filing is how a bank or credit union reports suspicious activity to the Financial Crimes Enforcement Network (FinCEN): it completes the FinCEN SAR and submits it electronically through the BSA E-Filing System.⁠[2] A bank files when it knows, suspects or has reason to suspect that activity meets a reporting test; it doesn't need to show a crime occurred.⁠[3]

Who has to file a SAR?

Banks, savings associations and credit unions, which FinCEN's rules all treat as banks, plus casinos, money services businesses, securities and futures firms, mutual funds, insurers, mortgage lenders and housing GSEs.⁠[2]⁠[4] Banks also follow their regulator's SAR rule: 12 CFR 21.11 (OCC; 163.180(d) for federal savings associations), 208.62 (Federal Reserve), 353.3 (FDIC) or 748.1(d) (NCUA).⁠[5]⁠[6]⁠[7]⁠[8]⁠[9]

Is a SAR the same as a CTR?

No. A currency transaction report is required for cash over $10,000, suspicious or not. A SAR is a judgment about suspicion, for any kind of payment. If a cash transaction over $10,000 is also suspicious, the bank files both.⁠[2] The full set of reports is in BSA compliance.

Banks and credit unions file more SARs than any other kind of institution.

• 2,037,214 SARs were filed by banks, thrifts and credit unions in calendar 2024, about 2.4 times as many as in 2014.⁠[10]
• About 45% of all SARs in fiscal 2024 came from the 10 largest filers. In 2022, 11,458 financial institutions filed at least one.⁠[11]⁠[12]
• 8.6 million hours and $326.8 million a year is FinCEN's estimate of the SAR burden, from 4,367,197 SARs filed in 2022. It leaves out monitoring, alert review and building the case.⁠[12]⁠[13]
• 89.3% of the IRS Criminal Investigation cases that began from a BSA filing in fiscal 2025 began with a SAR.⁠[1]

A SAR counts a report, not a loss. FinCEN's Year in Review (fiscal years, ending September 30) and its SAR Stats tables (calendar years) count filings differently, so their totals don't line up.

A bank must file when it detects activity that meets any one of four tests. Amounts count when the activity involves or aggregates to the threshold, attempts included.⁠[3]⁠[5]

The fourth test also covers a transaction that isn't the sort the customer would normally be expected to engage in, with no reasonable explanation after examining the facts. These are floors: a bank may file voluntarily below them, with the same liability protection.⁠[3]

Are there exceptions?

Two, generally. A bank doesn't need to file for a robbery or burglary reported to law enforcement, or for lost, missing, counterfeit or stolen securities reported under 17 CFR 240.17f-1.⁠[3]

A bank must file no later than 30 calendar days after it first detects facts that may constitute a basis for filing. If no suspect has been identified, it may take another 30 days to identify one, but never more than 60 days from detection.⁠[3] Four other duties run on their own clocks.

Ongoing violationsImmediately, by phone when a violation needs immediate attention

For violations such as terrorist financing or an ongoing money laundering scheme, call an appropriate law enforcement authority right away, and your regulator under the banking agencies' rules, then file the SAR on time. FinCEN's Financial Institutions Hotline, 1-866-556-3974, takes calls on suspected terrorist activity.

31 CFR 1020.320(b)(3) · 12 CFR 21.11(d), 208.62(d), 353.3(b)(2), 748.1(d)(2)(i)⁠[3]⁠[2]

The SAR deadline30 calendar days from initial detection

Calendar days, so weekends and holidays count. When detection happens during an investigation is covered in SAR investigations.

31 CFR 1020.320(b)(3) · 12 CFR 21.11(d), 208.62(d), 353.3(b)(1), 748.1(d)(2)(i)⁠[3]⁠[5]⁠[6]⁠[7]⁠[8]

Continuing activityOptional cadence since Oct 9, 2025

FinCEN's earlier guidance suggested a continuing SAR after each 90-day period, due 120 days after the prior one. Its October 2025 FAQs say neither the separate review nor that schedule is required; a bank may rely on risk-based monitoring.

SAR FAQs, Oct 9, 2025, Q2–Q3 · FinCEN SAR Filing Instructions § 6.1.4⁠[14]⁠[2]

RecordsFive years from filing

Keep each SAR and the original or business record equivalent of its supporting documentation for five years. That documentation is deemed filed with the SAR: identify it when you file, and produce it when FinCEN, law enforcement or your regulator asks, no subpoena needed.

31 CFR 1020.320(d) · 12 CFR 21.11(g), 208.62(g), 353.3(e), 748.1(d)(3)⁠[3]⁠[15]

Board notificationPromptly after filing

Management must promptly tell the board, or a committee it designates, about SARs filed. Under the OCC's and NCUA's rules, if a director is the suspect, notify the other directors but not that one.

12 CFR 21.11(h), 208.62(h), 353.3(f), 748.1(d)(4)⁠[5]⁠[6]⁠[7]⁠[8]

Once your team decides to file, every SAR moves through the same four steps.

1. 1Fix the detection date. The 30-day clock runs from the date your bank first detected facts that may support a filing.
2. 2Complete the FinCEN SAR. Five parts: the subjects, the suspicious activity, the institution where it occurred, your filing contact, and the narrative. Items marked with an asterisk must be completed even when the data are unknown; entries such as “NONE” or “XX” are prohibited.⁠[2]
3. 3Write the narrative. Part V, in English: a clear, complete and concise account of what happened and why it's suspicious.
4. 4File through BSA E-Filing. You may attach one CSV file of up to 1 MB for transaction detail; describe any other supporting documentation in the narrative instead. Keep the BSA ID E-Filing returns: corrections and continuing SARs ask for it.⁠[2]

A SAR narrative should answer who, what, when, where and why, and explain how the activity was carried out, in a concise, chronological account.⁠[16] It's the report's only free-text space for describing the activity, and FinCEN's instructions call it critical: the care taken with it may decide whether investigators clearly understand the activity.⁠[16]⁠[2]

How should a SAR narrative be organized?

FinCEN suggests three parts: an introduction with the suspected violation, any earlier SARs and your case number; a body with the parties and transactions in date order; and a conclusion with follow-up, such as closing the account.⁠[16]

Common narrative mistakes

• Writing “see attached” or pasting a table. Tabular data goes in the CSV attachment; the narrative has to stand on its own.⁠[16]⁠[2]
• Reporting only the total, without the dates and amounts behind it.⁠[16]
• Pasting the prior narrative into a continuing SAR, instead of covering the new period.⁠[2]
• Adding legal disclaimers, which the instructions say to leave out.⁠[2]

Where do FinCEN key terms go?

When a FinCEN alert or advisory asks for one, put its key term in Item 2, the 50-character “Filing Institution Note to FinCEN”, and in the narrative.⁠[2]⁠[17] Examples include FIN-2023-MAILTHEFT for mail theft-related check fraud and FIN-2026-SCAMCENTERS for digital asset investment scam centers.⁠[18] If the SAR uses information shared under section 314(b), the narrative should say “This SAR contains 314(b) data.”⁠[2]

No. A bank and its directors, officers, employees and agents may not disclose a SAR, or any information that would reveal one exists (31 U.S.C. 5318(g)(2); 31 CFR 1020.320(e)). Asked for a SAR by subpoena or otherwise, the bank must decline and notify FinCEN.⁠[19]⁠[3] Each federal regulator's SAR rule also requires notice to that regulator, such as 12 CFR 21.11(k) for the OCC.⁠[5]

Confidentiality doesn't cover the underlying facts, transactions and documents. A September 2, 2026 joint statement from FinCEN, the Federal Reserve, the FDIC, the NCUA and the OCC lists communications that typically don't reveal a SAR, including:⁠[4]

• Asking a customer about the purpose of a transaction or the source of funds
• Telling a customer that a delay, restriction or closure may relate to suspected fraud or other suspicious activity
• Telling a customer a deposit was rejected for suspected fraud, such as an altered or counterfeit check
• Warning a customer about fraud schemes, including money mule schemes

A bank may share a SAR itself with FinCEN, law enforcement, its examiners, and its head office or parent company.⁠[3]⁠[2]

What is the SAR safe harbor?

Federal law protects a bank and its directors, officers, employees and agents from liability to any person, under any federal or state law or contract, for reporting a possible violation to a government agency, or for not telling the person involved. It covers voluntary reports too, but not government enforcement actions (31 U.S.C. 5318(g)(3)).⁠[19]⁠[3]

• Record the detection date in every case. Make it a field in the case, not a date reconstructed later.
• Set your continuing-activity approach in policy. Keep the optional 90-day review and 120-day filing cadence or rely on monitoring, but write the choice down and follow it.⁠[14]
• Train front-line staff on what they can say. Customers ask why an account was restricted. The 2026 joint statement asks banks to weigh each case.⁠[4]

Why SAR narratives take so long

Writing is the last step, and often the slowest. One narrative needs the subject's identifiers, every transaction with its date and amount, earlier SARs and the analyst's findings, told in order, and those facts can sit in seven systems. When each case takes that long, the queue grows while the 30-day clock runs.

Socratix AI coworkers can take on the gathering and the first draft. For each case, they can pull the evidence from every system into one file, set it against the SAR triggers and your policies, and hand your BSA officer a recommendation and a draft narrative with the reasoning laid out. Your team still makes every call and files every report.

Depository SAR filings more than doubled between 2014 and 2024, and the 30-day deadline didn't move.⁠[10]⁠[3] Your team can't add analysts that fast, but it can hand off the gathering and keep the judgment. Regulators are open to it: FinCEN's April 2026 proposed rule says institutions that responsibly experiment with innovative technologies “will not incur any additional risk” of a significant supervisory or enforcement action solely for using them.⁠[20] Financial crime keeps changing; with the gathering handled, the same team can write every narrative from the full record.

1. GatherCan pull the alert, the subject's KYC profile, accounts and transactions, earlier SARs and case notes from the systems that hold them, into one case.
2. AssessCan test the facts against the SAR triggers and your policies, total the activity, and watch the 30- and 60-day clocks.
3. RecommendCan recommend file or don't file, with the reasoning, and a draft SAR narrative for your BSA officer to edit and file. Your team decides.
4. LearnCan learn from each decision — your policies, your risk appetite, your officers' judgment — and log every step for the examiner.

Related guides

• SAR investigations From alert to case to decision: how a suspicious activity investigation runs.
• AML transaction monitoring How monitoring works, why most alerts are false positives, and what examiners expect.
• BSA compliance The Bank Secrecy Act program: pillars, reports, records and the 2026 rule changes.
• Compliance operations What compliance costs a community bank or credit union, and where the hours go.