BSA/AML investigations.

Three guides go deeper on monitoring, the Bank Secrecy Act program and investigations; a fourth, from the compliance series, covers filing the SAR.

• AML transaction monitoring How monitoring works, why most alerts are false positives, and what examiners expect.
• BSA compliance The Bank Secrecy Act program: pillars, reports, records and the 2026 rule changes.
• SAR investigations From alert to case to decision: how a suspicious activity investigation runs.
• SAR filing Deadlines, the narrative, continuing activity and confidentiality for suspicious activity reports.

A BSA/AML investigation moves from an alert or referral, through triage and a case, to a decision to file a SAR or close, with a record kept along the way. The FFIEC manual's framework for this work applies at banks of every size; at a small bank one person may review the alert, research it and complete the SAR.⁠[2]

1. 1Alert or referral. A monitoring rule fires, an employee refers something unusual, or a subpoena or 314(a) request names a customer.⁠[2] Rules, thresholds and tuning are covered in AML transaction monitoring.
2. 2Triage. An analyst decides whether the alert points to a real potential risk or is a false positive, and closes or escalates it.⁠[3]
3. 3Open a case and gather. For alerts that hold up, the investigator pulls the customer's due diligence profile and expected activity, transactions and counterparties over a lookback period, related accounts and prior cases: the facts that answer who, what, when, where, why and how.⁠[4]
4. 4Recommend and decide. The investigator writes up the findings with a recommendation to file or not, and the decision maker, an individual or a committee, makes the call.⁠[2]
5. 5File or close. A SAR is due within 30 calendar days of initial detection, or up to 60 if no suspect has been identified.⁠[5] The filing itself is covered in SAR filing.
6. 6Keep the record. A filed SAR and its supporting documentation are kept for five years (31 CFR 1020.320(d)).⁠[5] Since October 9, 2025, there is no requirement to document a decision not to file, though a short record still helps quality review and shows the timeline.⁠[6]

Deciding is rarely the slow part. Gathering is: the facts for one alert can sit in several systems, and the same small team that gathers them also decides and files. What to gather, and what happens when the queue backs up, is in SAR investigations.

Transaction monitoring looks for typologies: known patterns of laundering and other financial crime. Your risk assessment decides which ones your scenarios cover.

Most of what's known about this work comes from FinCEN's own counts and estimates.

• 2,037,214 SARs were filed by banks, thrifts and credit unions in calendar 2024, about 2.4 times as many as in 2014.⁠[12]
• About 5.6 million cases: FinCEN's estimate of how many cases filers reviewed to produce 2.3 million original SARs in 2019. It assumed, from a Bank Policy Institute study of large banks, that 42% of cases end in a SAR.⁠[3]
• 90–95% of alerts from rule-based monitoring are false positives, by a widely repeated industry estimate that the Bank for International Settlements cites from an Oracle white paper. It isn't a regulator's measurement.⁠[13]
• 1.98 hours per SAR is FinCEN's estimate for case review, documenting decisions not to file and filing. It leaves out monitoring, alert review and case assembly, which FinCEN said it lacked the data to estimate.⁠[14]⁠[3]
• 89.3% of the IRS Criminal Investigation cases opened from a BSA filing in fiscal 2025 began with a SAR.⁠[1]

A SAR counts a report, not a loss. FinCEN's Year in Review (fiscal years, ending September 30) and its SAR Stats tables (calendar years) count filings differently, so their totals don't line up.

Socratix AI coworkers can take on the gathering. For every alert, they can pull the evidence from each system into one case, compare the activity with the customer's profile and the typologies you monitor for, and hand your analysts a recommendation with the reasoning laid out. Your team still makes every call. It just stops spending the day assembling the picture.

Depository SAR filings have more than doubled in a decade, and the 30-day deadline hasn't moved.⁠[12]⁠[5] Your team can't add analysts that fast. AI coworkers can do the gathering, every alert, around the clock, so the people you have spend their time on the decision. Regulators are open to it: FinCEN's April 2026 proposed program rule says institutions that responsibly experiment won't face added risk of a significant supervisory or enforcement action “solely based on the use of innovative technologies.”⁠[15]

1. GatherCan pull the alert, the customer's due diligence profile and expected activity, transactions and counterparties, related accounts, prior alerts and SARs, and screening results into one case.
2. AssessCan compare the activity with the customer's profile, peer groups and the typologies you monitor for, lay out the five Ws and the how, and watch the SAR clock.
3. RecommendCan recommend closing with a written rationale, opening a case or filing a SAR, with the evidence, a plain-language reason and a draft SAR narrative when one is warranted. Your analyst decides.
4. LearnCan learn from each decision — your policies, your risk appetite, your team's judgment — and log every step for the examiner.