SAR investigations.

A SAR investigation is the review a bank or credit union runs to decide whether activity it has spotted must be reported to FinCEN on a suspicious activity report. It can start with a monitoring alert, a referral from a teller or the fraud team, a subpoena, or a 314(a) or 314(b) request.⁠[3]

The rule frames the question. A transaction of $5,000 or more is reportable if, among other things, it has no business or apparent lawful purpose or isn't the sort the customer would normally be expected to engage in, and the bank “knows of no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction” (31 CFR 1020.320(a)(2)(iii)).⁠[4] Examining those facts is the investigation.

Does the bank have to prove a crime?

No. Banks report suspicious activity; they aren't obligated to investigate or confirm the underlying crime, which the FFIEC BSA/AML manual calls the responsibility of law enforcement. The bank describes the activity and why it's suspicious, as well as it can.⁠[3]

Who decides whether to file?

A final decision maker, an individual or a committee, with the authority to make the call. The FFIEC manual calls the decision “an inherently subjective judgment” and tells examiners to focus on whether the bank has an effective decision-making process, not on individual decisions. A bank that followed its process and decided not to file generally shouldn't be criticized unless the failure is significant or shows bad faith.⁠[3]

SAR filings have climbed over the past decade, and each one is the end of an investigation.

• 4.8 million SARs were filed by all types of financial institutions in fiscal 2025, up from 4.3 million in fiscal 2022.⁠[5]
• About 5.6 million cases: FinCEN's estimate of how many cases filers reviewed to produce 2.3 million original SARs in 2019. It assumed, from a Bank Policy Institute study of large banks, that 42% of cases end in a SAR.⁠[2]
• About 16 million alerts were reviewed, and over 640,000 SARs filed, by 19 banks with $50 billion to over $500 billion in assets in 2017, in the Bank Policy Institute's study of its members.⁠[6]
• 89.3% of the IRS Criminal Investigation cases opened from a BSA filing in fiscal 2025 began with a SAR.⁠[5]

Calendar-year counts (the chart) and fiscal-year counts differ. A SAR counts a filing, not a crime or a loss.

A SAR investigation moves from an alert or referral, through triage and a case, to a decision to file or close. The FFIEC manual's framework for this work applies at banks of every size; at a small bank one person may review the alert, research it and complete the SAR.⁠[3]

1. 1Alert or referral. A monitoring rule fires, an employee refers something unusual, or a subpoena or 314(a) request names a customer.
2. 2Triage. An analyst decides whether the alert points to a real potential risk or is a false positive, and closes or escalates it.⁠[2]
3. 3Open a case and gather. For alerts that hold up, the investigator pulls the customer's due diligence profile and expected activity, transactions and counterparties over a lookback period, related accounts and prior cases.
4. 4Recommend and decide. The investigator writes up the findings with a recommendation to file or not, and the decision maker makes the call.⁠[3]
5. 5File or close. A SAR is due within 30 calendar days of initial detection, or up to 60 if no suspect has been identified.⁠[4] The filing itself is covered in SAR filing.

When does the 30-day SAR clock start?

Not when the alert fires. The clock runs from the “initial detection by the bank of facts that may constitute a basis for filing a SAR” (31 CFR 1020.320(b)(3)).⁠[4] The FFIEC manual says a system flag isn't initial detection: the 30-day period begins once an appropriate review finds the activity suspicious. That review should still be completed in a reasonable period of time, which depends on the facts and on whether the bank's review procedures are documented and followed.⁠[3]

So a backlog doesn't start the clock early, but it can make the review unreasonably slow.

The facts that answer who, what, when, where, why and how. The FFIEC manual calls the first five the essential elements of a SAR narrative and adds the method.⁠[7] A case gathered this way is most of the way to a filing; writing the narrative is covered in SAR filing.

Two sources outside your own systems can fill a gap: 314(b) information sharing with the other institution in the transaction, and the customer, who can be asked about the purpose of a transaction without being told whether a SAR exists.

No rule sets a number, only the reasonable period the FFIEC manual expects for the review.⁠[3] What can be measured is the effort, and the two published estimates differ more than tenfold.

FinCEN estimates about 1.98 hours per SAR.⁠[8] That covers case review, documenting decisions not to file and filing, but not monitoring, alert review or case assembly, which FinCEN said it lacked the data to estimate.⁠[2] When the Bank Policy Institute counted the whole AML SAR workforce at 15 member banks with $100 billion or more in assets, from alert review through quality assurance, it came to 21.41 hours per SAR.⁠[9]

Neither figure describes a community bank. FinCEN's is an average across every type of filer; BPI, a trade group, surveyed only its largest members.

What happens when the alert queue backs up?

Reviews fall behind the institution's own timelines. New York's Department of Financial Services showed it in an April 2025 consent order with Block, Inc., the Cash App operator and a licensed money transmitter rather than a bank: Block's alert backlog grew from about 18,000 in 2018 to over 169,000 by 2020.⁠[10]

Block's own procedures called for a recommendation to file or not within 60 days of an alert; in the regulator's review of SARs filed from February 2021 to September 2022, the average time from alert to case was 70 days and from alert to SAR 129 days. The order, which also covered other failures, carried a $40 million penalty.⁠[10]

No. On October 9, 2025, FinCEN and the federal banking agencies said there is “no requirement or expectation under the BSA or its implementing regulations” to document a decision not to file. A bank that chooses to can usually rely on “a short, concise statement”, with more detail for complex investigations.⁠[11]

A decision to file is documented by the SAR and its supporting documentation, which the bank must identify, keep for five years and make available to FinCEN, law enforcement and its examiners on request (31 CFR 1020.320(d)).⁠[4]

The FAQ changes long practice. The FFIEC manual still says banks should document the reason for not filing, and notes its SAR section is due to be updated for the FAQs.⁠[3]

FinCEN's 2020 burden estimate assumed 25 minutes to document each decision not to file, longer than the 20 minutes it assumed for deciding.⁠[2] Treasury's Under Secretary for Terrorism and Financial Intelligence said in September 2025: “Every hour spent documenting a non-SAR is an hour not spent protecting Americans.”⁠[12]

Your team may still want a short record: it helps quality review and shows the timeline. A useful one fits in a few lines:

• The alert, and the dates the case opened and closed
• What was reviewed, and over what lookback period
• The explanation found for the activity, or why none was
• Who decided, and on what date

Are continuing activity reviews still required?

No. A bank doesn't have to run a separate review, “manual or otherwise”, of a customer after filing a SAR; it may rely on risk-based monitoring that is reasonably designed to identify and report continued suspicious activity. The 90-day review and 120-day filing cadence from earlier FinCEN guidance is optional.⁠[11] The timeline for banks that keep it is in SAR filing.

Investigations move faster when the path from alert to decision is written down, staffed for the volume and measured by the age of the queue.

• Write down the escalation path. The FFIEC manual expects a clear, defined path from initial detection to disposition.⁠[3]
• Staff and equip to the volume. The FFIEC manual expects enough experienced, trained staff for the bank's risk profile and transaction volume, with the internal and external tools to research activity properly.⁠[3]
• Track the age of the queue, not just its size. Dates for alert, case, decision and filing show whether reviews finish in a reasonable time, and show it before an examiner asks.
• Work related alerts together. Several negative news alerts about the same event don't each need their own investigation; review whether one adds anything new.⁠[13]
• Keep fraud and BSA talking. Where the fraud team and the BSA team research different activity, the manual says the lines of communication between them must stay open.⁠[3]
• Fix the rules that feed the queue. Alerts that never lead anywhere still take review time. Tuning belongs to AML transaction monitoring.

Why SAR investigations take so long

Deciding is rarely the slow part. Gathering is: the facts for one alert can sit in seven systems, and the same small team that gathers them also decides and files. When every case takes that long, the queue grows and reviews stop finishing in a reasonable time.

Socratix AI coworkers can take on the gathering. For every alert, they can pull the evidence from each system into one case and hand your analysts a recommendation with the reasoning laid out. Your analysts and your SAR decision maker still make every call; they just stop spending the day assembling the picture.

Depository SAR filings have more than doubled in a decade.⁠[1] Your team can't add analysts that fast. AI coworkers can do the gathering — every alert, around the clock — so the people you have can spend their time on the decision. Regulators are open to it: FinCEN's April 2026 proposed program rule says institutions that responsibly experiment won't face added risk of a significant supervisory or enforcement action “solely based on the use of innovative technologies.”⁠[14]

1. GatherCan pull the alert, the customer's due diligence profile and expected activity, transactions and counterparties, related accounts, prior cases and negative news into one case.
2. AssessCan compare the activity with the customer's profile and peers, your policies and the typologies that fit, lay out the five Ws and the how, and watch the dates.
3. RecommendCan recommend closing with a short rationale, opening a case or filing: with the evidence, a plain-language reason, and a draft SAR narrative when one is warranted. Your analyst decides.
4. LearnCan learn from each decision — your policies, your risk appetite, your team's judgment — and log every step for the examiner.

Related guides

• SAR filing Deadlines, the narrative, continuing activity and confidentiality for suspicious activity reports.
• AML transaction monitoring How monitoring works, why most alerts are false positives, and what examiners expect.
• BSA compliance The Bank Secrecy Act program: pillars, reports, records and the 2026 rule changes.
• Compliance operations What compliance costs a community bank or credit union, and where the hours go.