Category: Suspicious Activity Reporting

SAR Filing Deadline

Also known as: SAR, Suspicious Activity Report Filing Deadline, SAR Filing Timeframe

Simply put

A SAR filing deadline is the timeframe within which a financial institution must submit a Suspicious Activity Report to the authorities after it identifies activity that may be suspicious. Under U.S. rules, the report generally must be filed within a set number of days after the institution first detects the relevant facts. Filing a SAR is a compliance step and does not, by itself, establish that any wrongdoing has occurred.

Formal definition

In the U.S. regime administered by FinCEN under the Bank Secrecy Act, SAR filing deadlines specify the maximum time an obliged financial institution has to electronically file a Suspicious Activity Report through the BSA E-Filing System following the initial detection of facts that may constitute a basis for filing. Guidance and rules generally require filing no later than 30 calendar days from the date of initial detection of the relevant facts. For continuing suspicious activity, FinCEN guidance indicates institutions may review the activity over a 90-day period and file a continuing SAR within 30 days after that review period concludes (commonly summarized as a 120-calendar-day cycle). These deadlines are specific to the U.S. framework and apply to institutions subject to SAR obligations; other jurisdictions may use different instruments, terminology (for example, suspicious transaction reports or STRs), and timing requirements. Exact deadlines, triggers, and any extensions should be confirmed against the applicable regulation and current FinCEN guidance.

Why it matters

SAR filing deadlines are central to the operational discipline of a U.S. AML program because they convert the abstract obligation to report suspicion into a fixed, auditable timeline. Under the Bank Secrecy Act framework administered by FinCEN, an institution that detects facts that may constitute a basis for filing generally has no later than 30 calendar days from the date of initial detection to submit its report through the BSA E-Filing System. Missing that window can expose an institution to supervisory criticism and enforcement scrutiny from FinCEN and functional regulators such as the OCC, regardless of the ultimate merits of the underlying activity.

The deadline also shapes how compliance teams structure their investigative workflows. Because the clock starts at initial detection rather than at the point an investigation concludes, institutions must be able to demonstrate when detection occurred and how promptly they moved from alert to decision. For continuing activity, FinCEN guidance indicates institutions may review the conduct over a 90-day period and then file a continuing SAR within 30 days after that review concludes, a cycle commonly summarized as 120 calendar days. This distinction matters because treating every ongoing pattern as a fresh 30-day obligation, or conversely delaying beyond the permitted review period, can each create compliance exposure.

It is important to keep the compliance and criminal-law meanings separate. Filing a SAR, or filing it on time, is a reporting step and does not by itself establish that any wrongdoing has occurred. The deadline governs the timeliness of a report about potentially suspicious activity; it is not a determination of guilt. These timing rules are specific to the U.S. framework, and other jurisdictions may use different instruments, terminology such as suspicious transaction reports (STRs), and different timing requirements, so exact deadlines should be confirmed against the applicable regulation and current guidance.

Who it's relevant to

BSA/AML Compliance Officers

Compliance officers at U.S. obliged institutions are responsible for ensuring SARs are filed within the applicable timeframe, generally no later than 30 calendar days from initial detection, and for applying the continuing-activity cycle correctly. They must be able to evidence detection dates and demonstrate that investigative workflows move from alert to filing decision within the permitted window.

Financial Intelligence and Investigations Analysts

Analysts who investigate alerts and draft SAR narratives operate directly against the deadline clock. Because the 30-day period generally runs from initial detection rather than investigation completion, analysts need to manage case timelines and, for ongoing conduct, apply the 90-day review followed by filing within 30 days as reflected in FinCEN guidance.

Regulatory Examiners and Supervisors

Examiners from functional regulators such as the OCC assess whether institutions file SARs within the required timeframes. Timeliness against the 30-calendar-day standard, and appropriate handling of continuing activity, are typical points of supervisory review under the BSA framework.

Legal and Risk Professionals

Counsel and risk advisers help institutions interpret filing triggers, the initial detection date, and the continuing-activity cycle, and confirm that internal procedures align with current FinCEN guidance. They also help maintain the distinction that a SAR filing is a compliance step and does not by itself establish wrongdoing.

Inside SAR

Triggering Event

In many jurisdictions, the SAR filing clock begins on the date the obliged entity detects facts that form the basis for a suspicion, such as identifying a suspicious transaction or activity during monitoring or investigation. Under the US Bank Secrecy Act and FinCEN rules, the deadline generally runs from the date of initial detection of facts that may constitute a basis for filing. Exact triggering criteria should be confirmed against the applicable regulation.

Standard Filing Window

Regimes typically prescribe a defined number of calendar days from the triggering event within which the report must be filed. The precise period varies by jurisdiction and by the type of report (for example, a SAR under US rules versus an STR in other regimes), so the exact number of days should be verified against the governing instrument rather than assumed to be uniform globally.

Extension for Identifying a Suspect

Some regimes, including US FinCEN rules, allow additional time where no suspect has been identified at the point of initial detection, permitting continued review before the deadline runs. The availability and length of any such extension differ across regimes and should be confirmed against the applicable regulation.

SAR vs. STR Terminology

The report is termed a Suspicious Activity Report (SAR) in some regimes, notably the US, while other jurisdictions use Suspicious Transaction Report (STR) terminology. Because the naming, scope, and associated deadlines diverge by regime, the applicable deadline depends on which report and which jurisdiction is engaged.

Receiving Authority

The deadline attaches to filing with the designated Financial Intelligence Unit or competent authority for the jurisdiction (for example, FinCEN in the US or the relevant national FIU elsewhere). The correct recipient and filing channel are set by the governing instrument.

Ongoing and Continuing Activity

Where suspicious activity is ongoing, regimes may require periodic or supplemental reporting on a recurring basis in addition to the initial filing. The treatment of continuing activity and any associated recurring deadlines varies by regime and should be confirmed against the applicable rules.

Common questions

Answers to the questions practitioners most commonly ask about SAR.

Is there a single global deadline for filing a SAR?

No. There is no universal SAR filing deadline, and terminology and timeframes differ by jurisdiction. In the United States, a Suspicious Activity Report (SAR) is filed with FinCEN under the Bank Secrecy Act and its implementing rules, which set a defined period running from the date of initial detection of facts that may constitute a basis for filing, with a further limited extension where no suspect has been identified. Other regimes use different terminology, such as a Suspicious Transaction Report (STR) in many FATF-aligned jurisdictions, and may frame the obligation as filing 'promptly' or 'without delay' rather than within a fixed number of days. Exact timeframes should always be confirmed against the applicable regulation and the receiving Financial Intelligence Unit's guidance.

Does the filing deadline start when suspicious activity first occurs?

Not typically. In many regimes the clock is generally tied to the point at which the obliged entity detects or forms a knowledge, suspicion, or reasonable grounds for suspicion, rather than the date the underlying transaction or conduct actually occurred. This distinction matters operationally because activity may only become suspicious after review, aggregation, or investigation. Because the triggering event and the precise counting method vary by jurisdiction, firms should map their internal detection-to-decision process against the specific requirement in the applicable regulation.

How should a firm document when the filing clock started?

As an operational practice, firms generally maintain a clear, contemporaneous record of when facts giving rise to a filing decision were identified, who reviewed them, and when the decision to file was made. This supports the ability to demonstrate that any applicable timeframe was met and helps evidence a reasoned, risk-based decision process. The specific documentation expectations depend on the applicable regime and any supervisory guidance, which should be confirmed against the relevant regulation.

What happens if internal investigation takes longer than the filing window?

Where a required timeframe applies, extended internal review does not by itself pause or reset the obligation in many jurisdictions, so firms generally need internal escalation and decision procedures designed to reach a filing determination within the applicable period. Some regimes provide a limited additional window in defined circumstances, such as where no suspect has yet been identified. Firms should confirm whether any extension is available under the applicable regulation and calibrate investigation timelines accordingly, treating timely filing as a measure to meet the obligation rather than a substitute for adequate analysis.

Who within an obliged entity is typically responsible for meeting the deadline?

Responsibility is generally assigned to a designated compliance function, often a nominated officer or equivalent role, who reviews internal referrals and decides whether a report is warranted. Front-line staff typically raise internal alerts or referrals, while the decision to file and the associated timeline are managed centrally. Titles and precise accountability differ by jurisdiction and by the type of obliged entity, so responsibilities should be defined in the firm's policies consistent with the applicable regime.

Does filing within the deadline mean the reported conduct is confirmed as criminal?

No. Meeting a filing deadline relates only to a compliance obligation to report knowledge or suspicion to the relevant authority; it does not establish that any wrongdoing occurred. A report reflects a suspicion-based threshold, not a finding of guilt, and the assessment of whether conduct is criminal rests with authorities through separate legal processes. Firms should keep this distinction clear in their internal records and communications.

Common misconceptions

There is a single, globally uniform SAR filing deadline that applies everywhere.

Filing deadlines are set by each regime's own instruments and diverge across jurisdictions. The US Bank Secrecy Act and FinCEN rules, the UK framework, EU-based regimes, and others may prescribe different periods, different triggering events, and even different report names (SAR versus STR). Exact deadlines must be confirmed against the applicable regulation.

Filing a SAR by the deadline is an accusation that establishes the customer committed a crime.

A SAR is a compliance report of suspicion filed with the relevant authority; it does not establish wrongdoing or constitute a criminal finding. The filing reflects that facts giving rise to suspicion were detected within the reporting period, not that money laundering or another offense has been proven.

The deadline always runs from the date the transaction occurred.

In many regimes the clock generally runs from the date the obliged entity detects the facts forming the basis for suspicion, not from the transaction date itself. Where a suspect has not yet been identified, some regimes may permit additional time. The precise triggering point should be verified against the governing rules.

Best practices

Identify and document the exact triggering event and detection date for each potential report, since the filing window in many regimes runs from detection rather than from the underlying transaction.

Confirm the applicable deadline, report type (SAR or STR), and receiving authority against the specific governing instrument for the relevant jurisdiction rather than assuming a single global standard.

Maintain a tracking mechanism that logs detection dates, internal review timelines, and filing deadlines to demonstrate timely handling and to manage the risk of late filing.

Clarify internally whether any extension for identifying a suspect applies in the relevant regime, and set internal review milestones that do not rely on the maximum permitted time.

Establish a process for periodic or supplemental filings where suspicious activity is ongoing, in line with any recurring reporting expectations under the applicable rules.

Ensure staff understand that filing within the deadline reflects detected suspicion and is not a determination of criminal wrongdoing, and preserve the supporting rationale and records for each decision.