Four stages that should not be collapsed
An alert is a signal generated by a monitoring process. An investigation is the institution’s examination of that signal and related information. A suspicious activity report, or SAR, is a regulated information channel to government authorities. A proven crime is a legal conclusion reached through a different process. These stages can connect, but none is simply another name for the next.
The distinction is central to interpreting financial-crime statistics. A higher alert count can reflect new monitoring thresholds or changing payment volume rather than more crime. A higher SAR count can reflect better detection, defensive filing or a changing customer mix. Conversely, fewer reports could reflect improved precision or weaker detection. Counts alone do not identify which explanation is correct. The quality and context of the information matter alongside its quantity.
FinCEN’s reporting resources identify institution-specific SAR regimes and filing requirements. This article does not offer one dollar threshold for every institution. Banks, money services businesses, securities firms and other covered entities operate under different provisions, and banking-agency criminal-violation rules can add distinctions. [1]
Suspicion needs a factual foundation
A report can be warranted without certainty that a crime occurred. That does not make a vague impression an adequate substitute for facts. The analytical task is to identify what happened, what makes it unusual or potentially reportable, and what remains unknown. A business model unfamiliar to an analyst and a pattern inconsistent with the available explanation are different observations.
In October 2025, FinCEN and the banking agencies clarified that transactions near the currency-reporting threshold do not, by their amount alone, require a structuring SAR. The institution needs knowledge, suspicion or reason to suspect evasion of reporting requirements. [2] This does not create permission to evade reporting or remove risk-based monitoring obligations. It prevents a numerical coincidence from being treated automatically as evidence of purpose.
Consider a hypothetical seasonal retailer whose cash deposits rise during a local festival. A monitoring alert may be entirely appropriate, while sales records and the customer’s history may explain the pattern. In a different case, inconsistent explanations and documented attempts to avoid reporting could change the assessment. The amount alone does not resolve either scenario. These examples illustrate reasoning, rather than prescribe a filing decision or establish a safe transaction size.
A useful narrative separates evidence from inference
FinCEN’s SAR filing materials emphasize relevant available information and accurate completion. A narrative connects the parties, dates, transactions and basis for suspicion in a way that structured fields cannot always capture. [3] A list of transfers may describe movement without explaining why the movement matters. A conclusion such as suspicious behavior may announce a judgment without disclosing its basis.
Analysis: an effective evidentiary chain could distinguish a directly observed payment, a statement attributed to a customer, an inconsistency found in records and an unresolved hypothesis. For example, the record may establish that funds arrived and departed rapidly. It may not establish who ultimately controlled an overseas recipient. Describing that gap is more informative than silently converting it into certainty about ownership or intent.
The same discipline applies to totals. A sum of account inflows, a sum of outflows and the value of unique suspected transactions can differ substantially. Counting a dollar as it enters and again as it leaves may be appropriate for one analytical purpose but misleading for another. A clear explanation of the calculation prevents a large number from acquiring a meaning that the underlying records do not support.
The underlying records remain important
FinCEN describes supporting documentation as the records that assisted the institution’s decision, potentially including transaction records, account-opening information and communications. Supporting material can qualify even when it is not named in the narrative. Institutions retain it and provide it to appropriate authorities on request; FinCEN’s guidance explains that separate legal process is not required for qualifying requests. [4]
Analysis: the report is therefore a compact account of an investigation, not the entire evidentiary file. A payment identifier that allows a later investigator to find the original transaction can be more valuable than another paragraph of speculative description. Conversely, an elegant narrative cannot repair records that confuse two customers or combine transactions from different periods.
Authenticating the requester matters because the existence of a reporting channel does not authorize disclosure to anyone claiming to work for government. FinCEN’s supporting-documentation guidance specifically addresses verification. [4] The operational problem is two-sided: information must remain available to legitimate investigators while being protected from impersonation and inappropriate access.
Continuing activity is not an automatic separate-review mandate
The October 2025 FAQs clarify that a SAR filing does not create a requirement for a separate manual or other review to determine whether suspicious activity continued. Institutions may rely on reasonably designed risk-based controls. They also distinguish the optional continuing-activity guidance from applicable reporting timelines, and state that the BSA does not require or expect documentation of every decision not to file. [2]
Analysis: this changes the interpretation of workload, not the obligation to recognize reportable activity. A bank can continue monitoring an account through its ordinary risk-based system without maintaining a parallel review merely because it previously filed a SAR. A newly detected pattern still needs assessment. The absence of a special diary review and the absence of monitoring are not equivalent.
FinCEN’s updated general FAQ illustrates the continuing-activity method with an initial report on day 30 and a further report on day 150 after a subsequent 90-day activity period. It expressly describes that approach as elective rather than universally mandatory. [3] An operational calendar is meaningful only when its starting event and governing requirement are understood; a date copied from an example is not a complete compliance analysis.
Confidentiality protects the report, not all discussion of an account
SAR confidentiality generally protects the report and information revealing its existence. It does not turn every underlying payment or customer communication into an undisclosable SAR. FinCEN’s guidance draws a distinction between the report and underlying facts, transactions and documents, while preserving restrictions on revealing that a report was filed. [5]
A September 2, 2026 joint statement makes the customer-communication point especially explicit. Banks may discuss potentially fraudulent or suspicious transactions, or an intention to close an account for such activity, provided the communication does not reveal a SAR’s existence. The agencies describe this as clarification of existing requirements, not a new legal regime. [6]
Analysis: a customer who may be a fraud victim can need timely information about a questioned payment. Treating confidentiality as a reason for complete silence can interfere with resolving the facts. At the same time, attaching an internal SAR, quoting its filing status or describing an account as reported would implicate a different issue. Other privacy, security and legal constraints still matter; the clarification is not unrestricted permission to share a customer’s information.
Reporting and account decisions have different purposes
A SAR supplies information to authorities. Account access, payment restrictions and relationship termination involve separate facts, risks and legal obligations. FinCEN’s BSA FAQs explain that a decision to close an account should depend on the institution’s assessment of the facts and circumstances rather than simply on having filed a SAR. [7] Reporting alone neither proves misconduct nor functions as a blanket instruction to exit the customer.
Analysis: an institution can have enough concern to report a pattern while remaining uncertain about its explanation. That uncertainty makes precise language important both inside the institution and in public discussion. Describing all reported funds as criminal proceeds would claim more than the reporting decision establishes. Describing every report as meaningless would ignore the value of connecting observations across institutions and investigations.
The framework as checked October 4, 2026 is therefore one of useful, bounded intelligence: accurate observations, clearly attributed explanations, a specific basis for suspicion and protected transmission. The report’s value lies in what another investigator can reliably learn from it, not in how strongly its wording implies a verdict.
Sources
- FinCEN SAR resources and institution-specific reporting frameworkOfficial sourceBack to text: ↑
- FinCEN and banking agencies, October 9, 2025 SAR FAQsOfficial source · PDFBack to text: ↑1↑2
- FinCEN SAR FAQs, including updated continuing-activity timelineOfficial sourceBack to text: ↑1↑2↑3
- FinCEN, SAR Supporting DocumentationOfficial sourceBack to text: ↑1↑2
- FinCEN, Cross-Border Information Sharing and SAR Confidentiality, September 2025Official source · PDFBack to text: ↑
- Federal Reserve SR 26-5, September 2, 2026 joint confidentiality statementOfficial sourceBack to text: ↑
- FinCEN, Answers to Frequently Asked BSA QuestionsOfficial sourceBack to text: ↑