The Filing Trigger and the Decision to File

Before you ever write a narrative, two separate questions have to be answered, and people routinely blur them. The first question is whether you are required to file at all. The second is, assuming you are, how you write the report.

Most of this workshop is about the second question, the craft. But the second question is meaningless until you've answered the first. In this lecture we focus entirely on the trigger and the filing decision, because a beautifully written narrative on activity that shouldn't have been filed, or worse, a missing filing on activity that should have been reported, is a failure no amount of polish can fix.

So let's get the decision right first.

Start with the dollar threshold, and know which rule applies to you. Under the bank rule, thirty-one C-F-R ten-twenty point three-twenty, a bank must file when a suspicious transaction or pattern of transactions aggregates to five thousand dollars or more and the bank can identify a suspect. Where the activity is suspicious but no suspect can be identified, the threshold is twenty-five thousand dollars.

The word aggregate matters: you don't look at each transaction in isolation, you add up related activity, which is how structuring just under reporting limits still trips the threshold. And the threshold differs by institution type. A money services business files under thirty-one C-F-R ten-twenty-two point three-twenty at a lower threshold, two thousand dollars for many transactions.

Casinos, broker-dealers, mutual funds, and insurers each have their own parallel rule. We teach the bank numbers as the example, but always confirm the threshold for your own institution type.

Now the harder part, the suspicion standard, because the dollar amount only tells you when to evaluate, not whether to file. You file when you know, suspect, or have reason to suspect that funds come from illegal activity, that a transaction is structured to evade Bank Secrecy Act requirements, that it has no apparent lawful or business purpose, or that the institution is being used to facilitate criminal activity. The standard is genuinely a suspicion standard.

You do not have to prove a crime, name the predicate offense, or be certain. The exam-room version of the classic mistake, and the real-world version too, is the analyst who keeps an alert open for weeks waiting to be sure, when the rule never asked for sure. If reasonable suspicion is present and the threshold is met, the obligation has arisen.

Reasonable, documented suspicion is the bar, not proof beyond doubt.

Here's something many writers miss: the filing decision runs in both directions, and both directions have to be defensible. When you decide to file, your job becomes the narrative, which is the rest of this workshop. But when you decide not to file, you are making an equally important decision, and it needs a documented rationale just as much.

Examiners and quality reviewers look hard at the no-file population, the alerts and investigations that were closed without a SAR, because that is exactly where under-filing hides. A no-file decision that says nothing more than reviewed, no SAR is not a decision, it's a shrug. A good one explains what the activity was, why it looked suspicious at first, and the specific reason it turned out to have a lawful explanation.

Write your no-file rationales as if someone skeptical will read them a year later, because someone might.

Once you've decided to file, resist the urge to start typing the narrative immediately. The strongest narratives come from gathering the facts first. Pull the actual transactions with their dates and amounts, identify every party and account involved, line up the supporting documentation, and figure out who the suspect or suspects are.

A narrative is only as good as the facts behind it, and scrambling for a date or a dollar figure halfway through writing is how gaps and errors creep in. Think of it as building the case file in your head before you tell its story. With the decision made and the facts assembled, you're ready for the part of this workshop that does the heavy lifting: the five essential elements that every sufficient narrative contains, plus the sixth that makes it actionable.

That's next.

Quick recap. The filing trigger has two parts: a dollar threshold that depends on your institution type, five thousand dollars in aggregate for banks where there's a suspect, and a suspicion standard, you know, suspect, or have reason to suspect. The standard is suspicion, not proof, so don't wait for certainty that the rule never demanded.

And remember that decisioning runs both ways: a no-file decision deserves a documented rationale every bit as defensible as a filing, because that's where under-filing hides. With the decision made and the facts gathered, the next lecture starts the craft itself, the five essential elements of a narrative, who, what, when, where, and why, plus the practical sixth, how. That's where good SAR writing really begins.