Suspicious Activity Report Requirements for Banks

A bank's SAR duties in order: the dollar lines, the 60-day limit on delay, the safe harbor, the confidentiality rule and the five-year copy.

Published	14 October 2026

What a suspicious activity report is and who must file one

The FFIEC manual says suspicious activity reporting forms the cornerstone of the BSA reporting system. The suspicious activity report requirements for banks sit in § 1020.320. It requires every bank to report any suspicious transaction tied to a possible violation of law or regulation.

The word "bank" matters here. This section covers banks, as does the page on suspicious activity reports at banks.

The FFIEC manual says banks are required to file SARs that are complete, thorough, and timely. Those three words set the standard for everything below.

The dollar thresholds that trigger a SAR

§ 1020.320 says a transaction requires reporting if it involves or aggregates at least $5,000 in funds or other assets.

The FFIEC manual adds a second line. It says banks must file a SAR for criminal violations aggregating $5,000 or more when a suspect can be identified.

Note the word "aggregates". Small transactions that add up count.

A bank can also file under the threshold. FinCEN's advisory on elder financial exploitation says institutions may file a SAR no matter the amount involved. It may file even if someone only tried the transaction and did not finish it.

One thing is left out on purpose. § 1020.320 says a bank is not required to file a SAR for a robbery or burglary reported to appropriate law enforcement authorities.

The filing deadline: 60 days at most

The clock starts at initial detection.

The period is longer when no suspect can be identified. The FFIEC manual says if no suspect can be identified, the time period for filing a SAR is extended to 60 days.

The rule itself sets a hard ceiling. § 1020.320 says reporting may not be delayed more than 60 calendar days after the date of initial detection of a reportable transaction. No file waits past that day.

What counts as a transaction and what counts as initial detection

The rule takes a wide view of what a transaction is. The FFIEC manual says a transaction includes a deposit, a withdrawal, a transfer between accounts, an exchange of currency, and an extension of credit. A loan can be suspicious just as a deposit can.

The start of the clock is narrower than people assume. The FFIEC manual says the phrase initial detection should not be interpreted as meaning the moment a transaction is highlighted for review. An alert in the monitoring system is not the trigger.

The safe harbor: protection from civil liability

Banks worry about being sued by a customer they report. The law answers that. The FFIEC manual says federal law provides protection from civil liability for all reports of suspicious transactions made to appropriate authorities.

The protection is broad. The FFIEC manual says the safe harbor applies to SARs filed within the required reporting thresholds and to SARs filed voluntarily below the threshold.

Confidentiality: what a bank may and may not say about a SAR

The rule is strict. The FFIEC manual says a SAR and any information that would reveal its existence are confidential, except as necessary to fulfill BSA obligations.

That reaches further than the form itself. The FFIEC manual says the fact that a SAR exists, or that none does, is confidential too. So the customer never hears from the bank that a SAR went out. It also cannot tell the customer that no report was filed.

There are set channels where sharing is allowed. The FFIEC manual says a SAR's underlying facts and supporting documents may be shared with another financial institution to prepare a joint SAR. It also says a U.S. bank may share a SAR with its controlling companies. Those companies may be in the U.S. or abroad. And § 1020.320 allows a bank to share a SAR within its own corporate structure for purposes consistent with the Bank Secrecy Act.

Recordkeeping: how long a SAR and its supporting documents are kept

A filed SAR is not done once it leaves the building. FinCEN's advisory on elder financial exploitation says a financial institution must keep a copy of a SAR and its supporting documentation. It keeps them for five years from the filing date.

The copy has to be reachable. The same advisory says a bank must hand over a requested SAR and its supporting documents. It gives them to FinCEN, a law enforcement agency, or a supervisory agency. A copy no one can find does not meet that demand.

What a bank does not have to do: investigate the underlying crime

A bank does not have to prove anything before it files. The FFIEC manual says banks are not required to investigate or confirm the underlying crime, because investigation is the responsibility of law enforcement.

Suspicion is enough. The bank reports what it saw and why it looked wrong. What happens after a suspicious activity report is filed is for law enforcement to investigate.

Calling the police does not replace the form. The FFIEC manual says notifying law enforcement of a suspicious activity does not relieve a bank of its obligation to file a SAR. The FFIEC manual says an appropriate law enforcement authority would generally be the local office of the IRS Criminal Investigation Division or the FBI. A phone call to either one is not a filing.

§ 1020.320 says FinCEN or its delegatees examine banks for compliance with that section, and failure may violate the Bank Secrecy Act. The report is the bank's duty, and the duty stands on its own.

The steps to file a suspicious activity report are on their own page.