Last updated: October 2026

SAR filing requirements come down to one test: a US financial institution must file a suspicious activity report (SAR) with FinCEN when a transaction conducted or attempted by, at or through it meets its dollar threshold and it knows, suspects or has reason to suspect illicit funds, evasion of the Bank Secrecy Act, no apparent lawful purpose, or use of the institution to facilitate crime. A bank has 30 calendar days from initial detection to file, up to 60 when no suspect is identified, and keeps the SAR and its supporting documentation for five years. FinCEN's October 9, 2025 FAQs confirmed that a post-SAR 90-day review and a record of a decision not to file are not required, which is where many programs' habits now differ from the rules.

TL;DR

• Banks file at $5,000 under FinCEN's rule, and their federal regulator adds insider abuse in any amount. Money services businesses file at $2,000; most other covered institutions at $5,000.

• File within 30 calendar days of initial detection; banks get up to 60 with no suspect, money services businesses no extension.

• A SAR has five parts, is filed electronically with FinCEN, is confidential, carries a safe harbor and is kept for five years.

• Since October 2025, the 90-day continuing-activity review is optional and a no-SAR memo is not required.

• Two bills would raise the thresholds; as of October 28, 2026, neither is law.

What triggers a suspicious activity report

A SAR is required when a transaction conducted or attempted by, at or through the institution involves or aggregates at least its threshold, $5,000 for banks under 31 CFR 1020.320, and the institution knows, suspects or has reason to suspect one of three conditions. These SAR reporting requirements decide when to file a SAR, and the rules on this page are cited as in force on October 28, 2026.

1. The funds come from illegal activity, or the transaction is meant to hide such funds or avoid a reporting requirement.

2. The transaction is designed to evade Bank Secrecy Act requirements, which covers structuring.

3. The transaction has no business or apparent lawful purpose, and the institution knows of no reasonable explanation after examining the facts.

FinCEN's SAR Filing Instructions (April 2026) and the non-bank SAR rules add a fourth: use of the institution to facilitate criminal activity. Activity at or near the $10,000 currency transaction report (CTR) threshold is not enough on its own; a SAR is required only where the institution knows, suspects or has reason to suspect evasion of CTR reporting (FAQ 1, October 9, 2025).

NCUA's rule, 12 CFR 748.1(d), opens more broadly, covering any known or suspected crime or suspicious transaction related to money laundering activity or a Bank Secrecy Act violation.

A match against a sanctions list follows OFAC's rules rather than the SAR rule; our guide to OFAC sanctions screening and list management covers it.

Who must file a SAR, and the dollar thresholds by institution type

Every institution under a FinCEN SAR rule files, at a threshold set by its type.

Each amount is what the transaction or pattern involves or aggregates.

A fintech that offers accounts through a bank partner is usually not the filer; the bank partner is. "No, we're not filing any SARs," a compliance officer at a payments fintech (sponsor-bank program) said; "if we had to, it would probably be our sponsor bank." A fraud and BSA operations leader at a bank described the bank's side: it owns SAR filing for its fintech partners, so it checks that monitoring changes do not drop reportable activity. A fintech that is itself a money services business files its own SARs at $2,000.

How long you have to file: the 30-day clock

A bank must file a SAR no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing; if no suspect was identified on that date, it may take another 30 calendar days to identify one, but never more than 60 days after initial detection (31 CFR 1020.320(b)(3)). The non-bank rules use the same structure, except the money services business rule: 31 CFR 1022.320(b)(3) gives an MSB 30 calendar days with no extension.

A violation that needs immediate attention, such as an ongoing money laundering scheme, also calls for an immediate phone call to law enforcement (and to the OCC under 12 CFR 21.11(d)), with the SAR still filed on time.

When the clock starts

The SAR filing deadline runs from the determination, made after reviewing the alert, that the activity is suspicious. The FFIEC BSA/AML Examination Manual's SAR section (2014 text) says the period "does not begin until an appropriate review is conducted and a determination is made that the transaction under review is 'suspicious' within the meaning of the SAR regulation." The same section expects that review to be completed in a reasonable period of time.

That makes the determination date the control: it starts a deadline an examiner can test, so it has to be recorded where the deadline is tracked. A BSA officer at a credit union described the gap: the system tracked the deadline only once a SAR was created, so a case marked suspicious with no SAR yet could sit untracked and risk a late filing.

Sources: 31 CFR 1020.320(b)(3) and 1022.320(b)(3); FAQ 3 (October 9, 2025) for the optional rows.

Who decides whether to file

The institution decides, through a process it can show an examiner. The FFIEC manual's SAR section (2014 text) calls the decision an inherently subjective judgment and tells examiners to assess whether the SAR decision-making process is effective, not each individual decision. It lists five interdependent components: identifying unusual activity, managing alerts, SAR decision making, SAR completion and filing, and monitoring and SAR filing on continuing activity.

Many banks route each case to a SAR committee, where, as a BSA/AML compliance team member at a bank put it, the "officer determines to file a SAR or not." A BSA team member at a bank described the check before submission: "when we're ready to queue it to file it, we have someone doing a second review of it."

A case management team lead at a bank said each completed case ends as SAR or no SAR, with its supporting information. The upstream work of reviewing alerts before a case reaches this decision is covered in our guide to automating L1 alert review.

Continuing activity and decisions not to file, after the October 2025 FAQs

Since October 9, 2025, FinCEN and the federal banking agencies have said a financial institution is not required to run a separate review after filing a SAR to see whether activity continued, and is not required to follow the 90-day review and 120-day continuing-activity SAR schedule; institutions that elect the schedule may keep it. The FAQs say they change no BSA legal requirement and set no new supervisory expectation.

Where the 90-day review came from

The 90 days began as a FinCEN suggestion in October 2000, and FAQ 2 says it came to be read over time as a requirement or expectation of a separate post-SAR review. A head of fraud at a bank described it in just those terms on a recorded call.

If you follow the schedule

Institutions that elect FinCEN's optional schedule follow the FAQ 3 timeline in the table above, and FinCEN's SAR Filing Instructions (April 2026) say the continuing report's activity dates should then cover the whole 90-day period. An AML compliance team member at a credit union described still running that review by hand at the 90-day mark after each SAR.

Decisions not to file

There is no requirement or expectation under the BSA or its implementing regulations to document a decision not to file a SAR (FAQ 4, October 9, 2025); FinCEN had previously encouraged it without requiring it. Where policy calls for a record, a short, concise statement will likely suffice in most cases. The FFIEC manual has not caught up: its 2014 SAR text still says banks should document SAR decisions, under a banner pointing examiners to the January 19, 2021 and October 9, 2025 FAQs as the most current guidance.

Write the choice into policy

Either approach is defensible if it is written into policy and followed: keep the 90-day cadence, or rely on risk-based monitoring and file as appropriate within the normal deadlines. No-SAR records work the same way; none is required, but examiners still assess how decisions are made.

What a SAR contains and how it is filed

A FinCEN SAR opens with the type of filing (initial, correct or amend, continuing activity, or joint) and has five parts, per FinCEN's SAR Filing Instructions (April 2026):

1. Part I: subject information, one section for each known subject.

2. Part II: suspicious activity information.

3. Part III: the financial institution where the activity occurred.

4. Part IV: filing institution contact information.

5. Part V: the narrative.

Part V is the critical one: a clear, complete and concise description of the activity, including what was unusual or irregular that caused suspicion. How to write the narrative, and how to review one a tool has drafted, is covered in our guide to SAR narrative automation.

SAR filing is electronic, through FinCEN's BSA E-Filing System, as a discrete form or by XML batch or system-to-system filing. Only one attachment is allowed, a CSV file of tabular data; other supporting documentation is described in the narrative and kept by the institution, not attached.

Distinct institutions may file one joint SAR on activity that involves all of them, provided each approves the whole filing. Joint filing is not allowed when a subject is a director, officer, employee or owner of a filer; each then files its own SAR.

"The filing of the SAR once it's prepared and written is not really that difficult," an AML compliance leader at a bank said. A risk and compliance manager at a mortgage lender (non-bank) described filing by hand: download the form, fill it in, save it and upload it with a PIN. A chief compliance officer at a prepaid card program manager (money services business) said examiners line up each item on the blank form against the institution's records and expect every mismatch explained.

Confidentiality, safe harbor and board notice

A SAR, and any information that would reveal that one exists, is confidential (31 CFR 1020.320(e)), and no one at the institution may tell any person involved in the transaction that it was reported (31 U.S.C. 5318(g)(2)). Disclosure to FinCEN, law enforcement and examiners is allowed, as is sharing within the corporate structure or with an institution preparing a joint SAR. The FFIEC manual's SAR section adds that even the existence or non-existence of a SAR must be kept confidential.

Safe harbor

Under 31 U.S.C. 5318(g)(3), an institution and its people are not liable to any person under any law or contract, including an arbitration agreement, for the report or for not telling the subject. FinCEN's bank rule restates the protection at 31 CFR 1020.320(f). It does not shield an institution from an enforcement action brought by a government agency.

Board notice

Management must promptly notify the board, or a committee the board designates, whenever the bank files a SAR (12 CFR 21.11(h) for national banks, with parallel rules for other banks and credit unions). If the suspect is a director or executive officer, the bank notifies the directors who are not suspects and never the suspect.

A risk and compliance manager at a mortgage lender (non-bank) said only a handful of people there may see SAR information, so third-party access weighed on tool choices. What institutions can share with each other under section 314(b) without revealing a SAR is covered in our post on FinCEN's 314(b) update.

Keeping SAR records for five years

Keep a copy of each SAR and the original or business-record equivalent of its supporting documentation for five years from the filing date (31 CFR 1020.320(d)). Supporting documentation is deemed filed with the SAR and must be made available on request to FinCEN, law enforcement and the regulators that examine the institution for Bank Secrecy Act compliance, with no subpoena needed. The FFIEC manual defines it as all documents or records that helped the institution determine that the activity required a SAR.

What examiners look for in a SAR program

The FFIEC manual accepts that no bank can catch every illicit transaction and points examiners at policies, procedures and processes, tested through individual decisions. A program ready for review shows:

• SARs filed within 30 days of a recorded determination date, or 60 with no suspect.

• SARs that are complete, thorough and timely.

• A written decision process that is followed, from alert to SAR or no SAR.

• Continuing activity handled the way policy says.

• Access controls, five years of records and board notice for each SAR.

Common gaps

• Starting the clock when the SAR form is created instead of at the determination.

• Giving a money services business the 30-day extension that only the other rules allow.

• Dropping the 90-day review without writing its replacement into policy.

• Attaching supporting documents to the SAR instead of keeping them on file.

"The last thing that I want to see is a whole bunch of AI generated SARs with no human in the loop feedback within it," a manager of quality assurance at a prepaid card program manager (money services business) said. A compliance leader at an online gaming operator (casino/sportsbook) said the team judges its SAR program by what follows a filing: subpoenas and requests from law enforcement and regulators.

Are SAR thresholds changing?

Not yet: as of October 28, 2026, the SAR thresholds are unchanged. H.R. 1799, the Financial Reporting Threshold Modernization Act, would raise each $5,000 SAR threshold to $10,000 and each $2,000 threshold to $3,000; it was reported in the House on March 19, 2026, with no floor vote on the record as of October 28, 2026. S. 3017, the STREAMLINE Act, would make the same changes and was introduced and referred to committee on October 20, 2025. Neither bill is law.

FinCEN's April 10, 2026 proposal to reform AML/CFT program rules was still a proposal on October 28, 2026, and proposes no change to SAR thresholds or deadlines. In testimony on July 21, 2026, FinCEN's director pointed to the October 2025 FAQs as the step taken on SAR burden and announced no new threshold.

How Oscilar fits

Oscilar is the agentic risk platform for fraud, credit, onboarding, and compliance, for banks, credit unions and fintechs. It is a unified platform: real-time data fabric, device and behavior intelligence, rules, and case management in one stack, with agents native to it.

For a SAR program, the part that matters is the record. Oscilar keeps a full audit trail per decision with stored reasoning, human-in-the-loop by design, so the determination date, the evidence and who decided sit on the case when an examiner asks. The decision to file, and the SAR itself, stay with your team. See how Oscilar supports AML compliance for banks.

Frequently asked questions

What is a SAR in banking?

A SAR, or suspicious activity report, is what a bank files with FinCEN when it knows, suspects or has reason to suspect that a transaction of $5,000 or more involves illicit funds, evasion of the Bank Secrecy Act or no apparent lawful purpose (31 CFR 1020.320). It is filed electronically within 30 calendar days of initial detection and kept confidential.

Which of the following may require filing a SAR?

Any of these, once the threshold is met: funds from illegal activity, structuring or other evasion of the Bank Secrecy Act, a transaction with no apparent lawful purpose, or use of the institution to facilitate crime. For banks, insider abuse requires a SAR in any amount.

Can a bank take longer than 30 days if it cannot identify a suspect?

Yes. A bank may take 30 more calendar days to identify a suspect, but no more than 60 days in all from initial detection (31 CFR 1020.320(b)(3)); money services businesses get no extension.

Is a continuing-activity SAR required every 90 days?

No. Since FinCEN's October 9, 2025 FAQs, a separate post-SAR review and the 90-day review and 120-day filing schedule are not required; an institution may still elect the schedule.

Do banks have to document a decision not to file a SAR?

No. FAQ 4 of the October 9, 2025 FAQs says there is no requirement or expectation to document it; where policy calls for a record, a short statement will likely suffice.

Are banks required to freeze or close an account when they file a SAR?

No. The January 19, 2021 interagency FAQs say there is no BSA requirement to end a customer relationship after any number of SARs; the decision is the institution's. A bank may honor a written law enforcement request to keep an account open but is not obligated to, and must still file SARs on it (FinCEN FIN-2007-G002, June 13, 2007; 31 U.S.C. 5333).

Can you tell a customer that a SAR was filed about them?

No. 31 U.S.C. 5318(g)(2) bars telling anyone involved in a reported transaction that it was reported, and 31 CFR 1020.320(e) keeps any information that would reveal a SAR confidential.

Who files the SAR when a fintech offers accounts through a bank?

Usually the bank partner, since the bank SAR rule covers transactions by, at or through the bank. A fintech that is itself a money services business files its own SARs at $2,000 (31 CFR 1022.320).