New FinCEN FAQs Clarify Certain SAR Filing Requirements
By: John ReVeal and Linda Odom
On 9 October 2025, FinCEN issued Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements (FAQs). They address four specific issues that have needed clarification with respect to suspicious activity report (SAR) filings.
First, the FAQs clarify the timeline for the filing of SARs for continuing suspicious activities. There was some uncertainty as to whether a SAR for continuing activity needed to be filed within 90 days of the prior SAR or if the deadline is 120 days after the prior SAR filing. It is the latter: file a SAR, review continuing activity for 90 days, then file the continuing SAR within 30 days after the 90-day review period if the suspicious activity has continued.
FinCEN explained that institutions are not required to follow this 120-day timeline, but may instead file a SAR “as appropriate in line with applicable deadlines.” This would ordinarily mean filing a SAR within 30 days after identifying the continuing suspicious activity, rather than waiting until the 120-day deadline after the most recent SAR was filed. If the suspicious activity continues after this second SAR is filed, then another SAR filing would be needed, with the deadline being either the 120-day period or within 30 days after identifying the continuing activity, as the bank chooses.
The FAQs also address three other questions.
For continuing suspicious activity, FinCEN clarified that an institution is not required to conduct a “separate review—manual or otherwise—of a customer or account following the filing of a SAR to determine whether suspicious activity has continued.” Each institution may instead rely on its “risk-based internal policies, procedures, and controls to monitor and report suspicious activity as appropriate, provided those internal policies, procedures, and controls are reasonably designed to identity and report such activity.” We interpret this as meaning that an institution need not perform a targeted review of each customer or account related to a SAR filing, but may instead rely on its standard systems to detect a suspicious activity, assuming that system is reasonably designed to detect suspicious activity.
FinCEN also advised that a SAR for structuring-related activity is not triggered merely because a transaction or series of related transactions are at or below the US$10,000 currency transaction report (CTR) threshold: a SAR is required only if the institution knows, suspects or has reason to believe that the transaction or series of transactions are designed to evade the CTR reporting requirement.
Finally, FinCEN made clear that an institution is not required to document the decision not to file a SAR, stating that there “is no requirement or expectation under the Bank Secrecy Act (BSA) or its implementing regulations for” such documentation. The FAQ noted, however, that FinCEN has encouraged institutions to document decisions not to file a SAR. We believe that to be a prudent practice because, among other things, it will demonstrate to any examiner that the institution carefully considered the facts and circumstances in making its decision.