TL;DR: A bank's SAR duty has two layers: a $5,000 suspicion test under 31 CFR 1020.320, and banking-agency grounds that include insider abuse at any amount and criminal violations at $5,000 or $25,000 depending on whether a suspect can be identified. The filing is due 30 calendar days after initial detection, with one 30-day extension when no suspect was identified that day, and never later than day 60. FinCEN received approximately 4.7 million SARs in fiscal year 2024.
The amount and the suspicion have to meet
A required SAR for a bank starts as a transaction test. Under 31 CFR 1020.320, the bank files when a transaction is conducted or attempted by, at, or through the bank, involves or aggregates at least $5,000 in funds or other assets, and the bank knows, suspects, or has reason to suspect one of three things. The funds come from illegal activity, or the transaction is meant to hide or disguise those funds. The transaction is designed to evade the BSA or its regulations. Or the transaction has no business or apparent lawful purpose, is not the sort the customer would normally engage in, and the bank knows of no reasonable explanation after examining the available facts, including the background and possible purpose.
An attempt counts the same as a completed transaction, and a pattern is measured in the aggregate when it is one course of conduct. The third prong is met only after the bank examines the available facts and still has no reasonable explanation. A documented, plausible purpose leaves that prong unmet. The other two prongs can still be met on the same activity.
Federal banking agency rules add criminal-violation grounds beside that suspicion test. 12 CFR 21.11 is the national-bank version. The FFIEC BSA/AML Manual states the same four-part list for banks under the Federal Reserve, FDIC, NCUA, and OCC rules. On each criminal-violation ground the bank believes it was an actual or potential victim, or that it was used to facilitate the crime.
The $25,000 line is a dollar test for a criminal violation with no identified suspect. The extra 30 days below are time, after detection, to try to name a suspect. Both can apply to the same case. Each has its own rule.
A bank may also file when a report is not required. 31 CFR 1020.320(a)(1) permits a SAR the bank believes is relevant to a possible violation, including activity under $5,000. A robbery or burglary already reported to law enforcement is carved out, as are lost, missing, counterfeit, or stolen securities reported under 17 CFR 240.17f-1. A money services business follows a different section, 31 CFR 1022.320: $2,000 in the ordinary case, $5,000 for an issuer reviewing money-order or traveler's-check clearance records, and 30 calendar days with no extra 30 for an unidentified suspect.
Detection starts the clock
The SAR is due no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing. Calendar days include weekends and holidays. The transaction date belongs in the activity range on the form. The detection date is the date that starts the clock.
The FFIEC BSA/AML Manual places that moment when, during a review or because of other factors, the bank knows or has reason to suspect that the activity meets a definition of suspicious activity. Opening a review does not itself require a SAR, and it does not start the 30 days. The manual cites the October 2000 SAR Activity Review for that reading. The October 9, 2025 FAQs do not move detection back to the posting date.
If no suspect was identified on the date of detection, the bank may take an additional 30 calendar days to identify a suspect. Reporting may not be delayed more than 60 calendar days after initial detection. The extension is for that identification problem. A suspect already known on day one leaves the SAR due on day 30. Using the extension on a known suspect is a late filing.
When a violation needs immediate attention, 31 CFR 1020.320(b)(3) gives an ongoing money laundering scheme as the example: the bank immediately notifies an appropriate law enforcement authority by telephone and still files a timely SAR. A national bank also notifies the OCC under 12 CFR 21.11(d). The call does not reset day 30 or day 60.
The bank keeps the SAR and supporting documentation for five years from the filing date. The records are deemed filed with the SAR and must be available to FinCEN, law enforcement, and BSA examiners. The form goes to FinCEN through the BSA E-Filing System. FinCEN's fiscal year 2024 Year in Review reports approximately 4.7 million SARs, an average of 12,870 a day, which is why the detection date belongs in the case file. The narrative comes after the decision. A separate guide covers how to write a SAR narrative once the activity is reportable.
Continuing activity is a filing choice
A SAR on day 30 does not create a second mandatory review of that customer. FinCEN's October 9, 2025 FAQs, issued with the Federal Reserve, the FDIC, the NCUA, and the OCC, state that an institution is not required to conduct a separate review, manual or otherwise, to see whether the activity continued. Risk-based monitoring is enough when it is reasonably designed to identify and report suspicious activity. The FAQs leave the underlying duty in place: newly detected activity that meets a reporting ground is still filed on its own clock.
The same FAQs state that a continuing SAR every 90 days is not required. FinCEN suggested that cadence in October 2000. Later guidance described a deadline of 120 calendar days after the previously related SAR. Institutions may follow that schedule or file under the ordinary detection timelines.
An institution that elects the schedule, with a subject identified, follows the timeline in those FAQs. Detection is day 0, the initial SAR is day 30, the 90-day period ends on day 120, and the continuing SAR is due on day 150. Day 150 is 120 calendar days after the initial SAR. The activity dates on the form cover that 90-day period, starting the day after the initial filing. If the first SAR used the full 60 days because no suspect was identified, each later date moves by 30 and the continuing SAR is due on day 180.
Cash over $10,000 is a different form
A currency transaction report records currency of more than $10,000, by or for one person, during one business day. The October 2025 FAQs describe that line by reference to 31 CFR 1010.310 through 1010.315, including cash that aggregates across transactions in the day. Suspicion is not an element of the form.
A transaction or series of transactions at or near $10,000 does not, by itself, require a SAR. The October 2025 FAQs are direct: the institution files when it knows, suspects, or has reason to suspect that the activity is designed to evade CTR reporting. Absent that, proximity to the line does not trigger a SAR.
Evasion of a reporting requirement is its own SAR ground once the $5,000 test is met, and structuring is unlawful under 31 USC 5324. A companion article covers what structuring is. Reason to suspect evasion starts the same detection clock as any other reportable activity. A filed CTR leaves the SAR question standing. A filed SAR leaves the CTR question standing.
The safe harbor covers the report. The subject is not told.
Federal law, 31 USC 5318(g)(3), protects a bank and its directors, officers, employees, and agents from civil liability for disclosing a possible violation of law to a government agency, including a disclosure made while preparing a SAR. The protection covers the report and the failure to tell the subject, or anyone else named in it. The FFIEC BSA/AML Manual states that the safe harbor applies to filings inside the required thresholds and to voluntary filings below them, including a joint SAR under 12 CFR 21.11(l) and the FinCEN rule.
31 CFR 1020.320(e) and 31 USC 5318(g)(2) prohibit the bank and its directors, officers, employees, and agents from disclosing a SAR or any information that would reveal one. The subject is inside that prohibition. A subpoena for the SAR is declined, citing those provisions, and FinCEN is notified of the request and the response. Underlying facts may be shared where the regulation allows, including a joint SAR, provided no person involved in the activity is told a report was filed. A national bank promptly notifies its board, or a committee the board designates. A director or executive officer who is the suspect is not notified. The other directors are.
A decision that the activity is not reportable carries no BSA documentation requirement. The October 2025 FAQs state that there is no requirement and no expectation to document a decision not to file. An institution that writes the decision down can keep it to a short statement, with a longer note reserved for a complex investigation. The duty to file, when a threshold and a reporting ground are both met, is unchanged.
Where Sphinx fits
Sphinx's agents work the case that leads up to this decision. The filing call stays with the institution: the $5,000 suspicion test, the insider and $25,000 criminal-violation grounds, and the 30-day clock are legal duties. Once the institution decides a SAR is required, Auto-SAR prepares the report from the case file already under review. Sphinx reports an 80% reduction in case review time on that work. Comparing SAR filing software is a separate evaluation from the decision this article describes.
Frequently Asked Questions
When does the 30-day SAR clock start?
The clock starts on the date of initial detection of facts that may constitute a basis for filing, under 31 CFR 1020.320(b)(3). The FFIEC BSA/AML Manual reads that date as the point when the bank knows or has reason to suspect the activity is suspicious. The transaction date, and the date a review is opened, are not by themselves day zero.
When can a bank take 60 days to file a SAR?
Only when no suspect was identified on the date of detection, and only so the bank can try to identify one. Reporting cannot pass 60 calendar days after initial detection. A suspect known on the detection date leaves the SAR due in 30 calendar days.
Does a transaction near $10,000 require a SAR?
FinCEN's October 9, 2025 FAQs state that activity at or near the CTR threshold requires a SAR only when the institution knows, suspects, or has reason to suspect it is designed to evade CTR reporting. A currency transaction report is still required when one person moves more than $10,000 in currency in a business day, and that form has no suspicion element.
Must a bank file a continuing SAR every 90 days?
The October 2025 FAQs state that a 90-day continuing SAR is not required, and neither is a separate review of the customer after a filing. An institution that elects the old schedule, with a subject identified, files the first SAR by day 30 and the continuing SAR by day 150.
Does the SAR safe harbor cover a voluntary filing under $5,000?
31 USC 5318(g)(3) protects the bank and its directors, officers, employees, and agents from civil liability for reporting a possible violation, including a report that was not required. The FFIEC BSA/AML Manual applies that protection below the threshold as well as inside it.
.png)
