SAR Filing Process Step-by-Step

Understanding the SAR Filing Obligation

A Suspicious Activity Report (SAR) is filed with FinCEN when a financial institution detects a transaction or pattern of transactions that it knows, suspects, or has reason to suspect involves funds derived from illegal activity, is designed to evade BSA requirements, or has no apparent lawful purpose. Under 31 CFR 1020.320 (for banks) and related regulations, you must file a SAR within 30 calendar days of initial detection of suspicious activity. If no suspect is identified, you get an additional 30 days (60 total), but no longer.

Critical rule: You cannot tip off the subject of a SAR. Under 31 U.S.C. § 5318(g)(2), disclosing the existence of a SAR — or even that one is being considered — to the subject is a federal crime. Do not tell the customer, and restrict internal knowledge to those with a need to know.

Step 1: Detection and Initial Review

An alert fires from your transaction monitoring system. Your Level 1 analyst conducts an initial review within 24-48 hours:

• Pull the customer's full transaction history for the relevant period
• Review KYC documentation — does the activity match their profile?
• Check for any prior SARs on this customer
• Determine if the alert is a true positive or false positive
• Document the decision with specific reasoning. "Looks fine" is not acceptable documentation

Step 2: Escalation and Investigation

If the Level 1 analyst determines the activity is potentially suspicious, it escalates to a senior BSA analyst or the BSA Officer for a full investigation:

• Conduct enhanced due diligence on the customer and counterparties
• Screen against OFAC lists, adverse media, and law enforcement databases
• Map the flow of funds — where did the money come from and where did it go?
• Interview the relationship manager or account representative if applicable
• Make the SAR/No-SAR determination and document your reasoning thoroughly

Step 3: Filing via FinCEN's BSA E-Filing System

SARs are filed electronically through FinCEN's BSA E-Filing System at bsaefiling.fincen.treas.gov. You'll need a BSA E-Filing account with appropriate user roles (typically a Supervisory User and one or more General Users).

The SAR form (FinCEN Form 111) has five parts:

Part I: Subject Information

• Full legal name, address, date of birth, SSN/EIN/ITIN of the subject
• If the subject is unknown, check "Unknown" — but you still need to file
• Include all known aliases and identifying information
• Relationship to the financial institution (account holder, non-account holder, etc.)

Part II: Suspicious Activity Information

• Date range of the suspicious activity
• Total dollar amount involved (cumulative across all related transactions)
• Type of suspicious activity — select from predefined categories (structuring, money laundering, fraud, etc.)
• Check all applicable characterizations: "Structuring/Smurfing," "Terrorist Financing," "Identity Theft," etc.

Part III: Information About the Financial Institution

• Your institution's name, EIN, address
• The branch or business unit involved
• Your primary federal regulator

Part IV: Contact Information

• Name and phone number of the person to contact about the SAR (typically the BSA Officer)

Part V: The Narrative (Most Important Section)

The narrative is where you tell the story of what happened. This is what law enforcement actually reads. A well-written narrative includes:

SAR Narrative Writing Tips

• Follow the "5 W's": Who is conducting the suspicious activity? What instruments or methods are being used? When did it occur? Where did it occur? Why is it suspicious?
• Be specific with numbers. Don't write "the customer made several large deposits." Write "Between January 15 and February 28, 2026, the customer made 14 cash deposits totaling $127,500, with individual amounts ranging from $8,900 to $9,800."
• Explain why the activity is suspicious. Connect the dots: "These deposits are inconsistent with the customer's stated occupation as a freelance graphic designer with reported annual income of $45,000."
• Don't include your personal opinion or speculation. State facts and observable patterns. Let law enforcement draw conclusions.
• Include account numbers, transaction IDs, dates, and amounts. Make it easy for investigators to pull records.
• Reference prior SARs. If you've filed before on this customer, reference the prior SAR's BSA ID number and explain what's new.

Example SAR Narrative Structure

"[Institution Name] is filing this SAR to report [type of activity] involving [subject name/description], account number [XXXX], during the period [date range]. [2-3 sentences describing the specific transactions]. This activity is suspicious because [explain why it's inconsistent with the customer's profile or has no apparent lawful purpose]. [Subject name] was [any relevant KYC details]. Total suspicious amount: $[amount]. [Reference any prior SARs or related filings]."

Timing Requirements

• 30 calendar days from detection to filing (if a suspect is identified)
• 60 calendar days if no suspect can be identified
• Immediately (within 24 hours by phone to law enforcement and FinCEN) if the activity involves an imminent threat, such as suspected terrorist financing — then follow up with the written SAR within 30 days
• Continuing activity: File follow-up SARs every 90 days if the suspicious activity continues

Practical Tip: Create SAR narrative templates for your most common alert types (structuring, rapid movement, fraud). This ensures consistency and speeds up the filing process. But always customize the narrative to the specific facts — examiners can spot copy-paste narratives, and they signal a weak compliance program.