Lesson 06 of 8
Timing, Deadlines, and Confidentiality (No Tipping Off)
5 min read · SAR
Get the bright-line rules right: the 30-day deadline (60 if no suspect), continuing-activity reviews, the absolute no-tipping-off prohibition under 31 USC 5318(g)(2), and how the FinCEN SAR is filed via BSA E-Filing.
The rules you cannot get wrong
- A perfect narrative filed late is still a violation
- Telling the subject a SAR was filed is a crime
- This lecture: deadlines, continuing activity, confidentiality, filing mechanics
- These are bright-line rules, not judgment calls
Up to now we've focused on craft, where good judgment and clear writing carry the day. This lecture is different, because it covers bright-line rules where there's no room for interpretation. A beautifully written narrative filed two weeks late is still a late filing.
Disclosing to a customer that a SAR was filed on them isn't a quality issue, it's a separate prohibition with serious consequences. So we'll cover four things you have to get exactly right: the filing deadline, continuing-activity reviews, the confidentiality and no-tipping-off rule, and the basics of how a SAR is actually filed. Treat these as non-negotiables that sit around the writing skill, the guardrails inside which all that good narrative work has to happen.
The filing deadline
- Banks: file within 30 calendar days of initial detection
- 60 days if no suspect can be identified at detection
- The clock starts at detection, not at final write-up
- Document the detection date — it defines timeliness
Start with the deadline, which is precise and testable. Under the bank rule, thirty-one C-F-R ten-twenty point three-twenty, a SAR generally must be filed within thirty calendar days of the date the institution initially detects facts that may form a basis for filing. If no suspect can be identified on the detection date, the institution gets an extra thirty days to identify one, but in no case more than sixty days.
The detail people miss is when the clock starts: at initial detection, not when you finally finish writing. A thorough investigation is good, but it doesn't pause the deadline, so manage the calendar from the day the activity is flagged. Because timeliness is measured from a date, document your detection date clearly; it's the anchor a reviewer or examiner uses to judge whether you filed on time.
Continuing activity
- Suspicious activity often doesn't stop after the first SAR
- Review ongoing activity and file continuing-activity SARs
- FinCEN guidance points to ~90-day review intervals
- Don't let a subject vanish from scrutiny after one filing
Next, continuing activity, because filing once is rarely the end of the story. When suspicious behavior persists after you've filed, the expectation is that the institution keeps reviewing the ongoing activity and files continuing-activity SARs as warranted. FinCEN's guidance points institutions toward reviewing such activity at regular intervals, commonly described as around ninety days, so that a subject doesn't get one report and then quietly drop off the radar while the behavior continues.
Practically, that means your process should flag accounts with an existing SAR for periodic re-review rather than treating the first filing as closure. The narrative skills don't change, but the discipline does: a subject who was worth a SAR in March may be worth another in June, and the gap between those filings is something examiners look at.
Confidentiality and no tipping off
- 31 USC 5318(g)(2): never disclose that a SAR was filed
- Not to the subject, not to anyone unauthorized — directly or indirectly
- No hints, no 'we had to file something', no account-closure tells
- SAR confidentiality is protected by law; breaches carry penalties
Now the rule with the sharpest edge: confidentiality, often called the no-tipping-off prohibition, set out at thirty-one U-S-C fifty-three eighteen, paragraph g, sub-two. The law prohibits an institution and its people from disclosing that a SAR has been filed or even that one is being considered, to the subject of the report or to anyone not authorized to know. This is absolute and it includes indirect tipping off: no hints, no we were required to report this, no suggestion in the way you close an account or decline a transaction that a filing is the reason.
Tell a customer their SAR exists and you may have committed a separate violation carrying real penalties. The flip side is a protection: the same law shields good-faith filers from liability. Keep the existence of a SAR strictly inside the authorized circle, full stop.
How it's filed — and where the documents live
- File the FinCEN SAR electronically via the BSA E-Filing System
- Structured fields plus the free-text narrative you've been crafting
- Supporting documents stay in the institution's file, produced on request
- Retain the SAR and supporting records (generally five years)
Finally, the mechanics of filing, briefly, so the narrative has a home. SARs are filed electronically as the FinCEN SAR through the BSA E-Filing System. The form has the structured fields, the subjects, accounts, amounts, dates, and activity types you select, plus the free-text narrative we've spent this workshop learning to write.
A key point we raised earlier and restate here as a rule: supporting documentation does not go into the narrative. The narrative is self-contained text; the underlying statements, transaction records, and internal notes stay in the institution's file and are produced to law enforcement or examiners on request. And retain it all, generally for five years from the filing date, along with the records that support it, so the institution can produce the complete picture if asked.
The narrative is the public face of the filing; the evidence behind it lives, safely retained, in the file.
Recap and next
- 30 days from detection (60 if no suspect) — clock starts at detection
- Keep reviewing continuing activity (~90-day intervals)
- Never tip off — confidentiality is the law (31 USC 5318(g)(2))
- File the FinCEN SAR via BSA E-Filing; keep docs in the file
Recapping the rules you cannot get wrong. File within thirty days of initial detection, sixty if no suspect can be identified, and remember the clock starts at detection, not at write-up, so document that date. Keep reviewing continuing activity and file follow-on SARs as warranted, around every ninety days per FinCEN guidance, so a subject doesn't vanish after one report.
Never tip off, the confidentiality prohibition at thirty-one U-S-C fifty-three eighteen g-two is absolute and includes indirect disclosure. And file the FinCEN SAR electronically through BSA E-Filing, keeping supporting documents in the institution's file and retaining everything for the required period. Those guardrails protect all the craft we've built.
In the next lecture we turn that craft inward and learn to review your own draft the way a quality reviewer or an examiner would, before you ever hit submit.
Sources
- 31 CFR 1020.320 — Reports by banks of suspicious transactions (30-day filing deadline
- 60 days if no suspect identified)
- 31 USC 5318(g)(2) — SAR confidentiality / prohibition on disclosure (no tipping off)
- FinCEN SAR (FinCEN Report 111) via the BSA E-Filing System
- FinCEN guidance on continuing-activity SAR reviews
- FFIEC BSA/AML Examination Manual — Suspicious Activity Reporting
Test your knowledge
A few SAR questions on this material — pick an answer to see the explanation.
Q1. A SAR was filed and the narrative contained an error — the wrong account number was used. The suspicious activity has since stopped. What is the correct approach?
Q2. When completing the 'subject information' section of Form 111 for an individual, which data element is most important to include if known?
Q3. What is the single strongest opening sentence for a SAR narrative?
Q4. The narrative character limit in the FinCEN BSA E-Filing system is finite. When space is tight, what is the correct trade-off priority?