Filing a Suspicious Activity Report for insider abuse is mandatory at any dollar amount, must be submitted electronically through FinCEN’s BSA E-Filing System within 30 calendar days of detection (60 days if a suspect is still being identified), and comes with strict board-notification, confidentiality, and five-year retention rules. That zero-dollar trigger is what sets insider cases apart from every other SAR category.
The Zero-Dollar Threshold
Ordinary SAR triggers depend on how much money is at stake. Insider cases don’t. When a bank has a substantial basis to identify a director, officer, employee, agent, or other institution-affiliated party as having committed or aided a criminal violation, the SAR is required regardless of the amount involved.1eCFR. 12 CFR 21.11 – Suspicious Activity Report
For context, the other categories work like this:
- Criminal violations with an identified suspect and no insider involvement: file at $5,000 or more in aggregate.2Federal Financial Institutions Examination Council. FFIEC BSA/AML Manual – Suspicious Activity Reporting
- Criminal violations with no identified suspect: file at $25,000 or more.2Federal Financial Institutions Examination Council. FFIEC BSA/AML Manual – Suspicious Activity Reporting
- Money laundering or BSA evasion: file at $5,000 or more when the bank knows or suspects illegal source funds, evasion, or no apparent lawful purpose after review.3eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
A $200 embezzlement by a teller carries the same filing obligation as a multimillion-dollar fraud by a senior officer. There is no materiality judgment to make.
Who Is an Insider and What Counts as Abuse
The definition sweeps broadly. An insider is any director, officer, employee, agent, or other institution-affiliated party. Seniority is irrelevant: a teller, a loan processor, a contract IT worker with system access, and a board member all qualify. What matters is the relationship to the institution and access to its operations, accounts, or customer information.
Reportable insider abuse includes diverting bank assets for personal use, approving questionable loans or transactions for friends and relatives, abusing expense accounts, accepting bribes, and failing to disclose personal financial interests in deals the bank is handling.4Federal Deposit Insurance Corporation. Bank Fraud and Insider Abuse (Section 9.1) Embezzlement, check kiting, and loan fraud are squarely in scope.
Deadlines
The clock starts when the bank first detects facts that may constitute a basis for filing. From that date, the institution has 30 calendar days to file. If no suspect has been identified at initial detection, the institution gets an additional 30 days to try to identify one, but filing cannot be delayed beyond 60 calendar days from initial detection under any circumstance.5eCFR. 12 CFR 208.62 – Suspicious Activity Reports
When the violation is ongoing, filing on the normal timeline is not enough. The bank must immediately notify appropriate law enforcement by telephone and contact its primary federal regulator, in addition to filing the SAR.5eCFR. 12 CFR 208.62 – Suspicious Activity Reports The phone call is not optional here.
If the suspicious activity continues after the initial report, FinCEN advises filing follow-up SARs at least every 90 days, with the deadline set at 120 calendar days after the previous related SAR.6Financial Crimes Enforcement Network. Frequently Asked Questions Regarding the FinCEN Suspicious Activity Report (SAR) That cycle repeats for as long as the conduct persists. Filing once and moving on invites examiner criticism.
Completing the FinCEN SAR
Institutions file the FinCEN SAR (sometimes called FinCEN Form 111) electronically through the BSA E-Filing System. Paper filings are not accepted.7Financial Crimes Enforcement Network (FinCEN). Bank Secrecy Act Filing Information The structured fields capture information about the filer, the subject (name, title, taxpayer identification number if known), affected accounts, dates, instruments, and total amounts.
The narrative is what law enforcement actually reads. FinCEN guidance calls for it to explain who conducted the activity, what instruments were involved, when it occurred, where it took place, why the filer considers it suspicious, and how the scheme operated.8Federal Financial Institutions Examination Council. BSA/AML Manual – Appendix L – SAR Quality Guidance Describe the insider’s role, trace the flow of funds, list individual transaction dates and amounts rather than a single aggregate, and note any foreign jurisdiction involved. Stay concrete. A sentence saying activity “appeared suspicious” without explaining why weakens the report.
Filers can attach one Microsoft Excel file up to one megabyte to document transactions too numerous for the narrative. No other supporting documents should be attached to the SAR. Describe additional documentation in the narrative and keep it in the institution’s own files.8Federal Financial Institutions Examination Council. BSA/AML Manual – Appendix L – SAR Quality Guidance
Notifying the Board
Every SAR filing triggers a duty to notify the board of directors or a board-designated committee promptly. Insider cases add a complication. When the suspect is a director or executive officer, the institution cannot notify that person (confidentiality rules forbid it), but must notify all other directors who are not suspects.1eCFR. 12 CFR 21.11 – Suspicious Activity Report The purpose is to let the board act — cutting off system access, placing the individual on leave, engaging outside counsel — without tipping off the subject.
Confidentiality and Safe Harbor
Federal law forbids a financial institution from disclosing to any person involved in a reported transaction that a SAR has been filed. The prohibition is absolute: you cannot tell the insider subject, you cannot tell employees who have no need to know, and you cannot confirm or deny a SAR’s existence if asked.9FinCEN. Federal Court Reaffirms Protections For Financial Institutions Filing Suspicious Activity Reports
In return, the institution and its people get broad protection. Under 31 U.S.C. 5318(g)(3), any financial institution that discloses a possible violation to a government agency, along with any director, officer, employee, or agent who makes or requires such a disclosure, is shielded from liability under federal or state law, including contract claims and arbitration agreements.10Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority The institution has no obligation to notify the subject that a disclosure occurred. Congress built this safe harbor to remove any hesitation about reporting.
Record Retention
Keep a copy of every SAR and the original or business-record equivalent of all supporting documentation for five years from the date of filing.11Federal Financial Institutions Examination Council. BSA/AML Manual – Appendix P – BSA Record Retention Requirements Supporting documentation includes transaction records, internal investigation notes, and emails that informed the filing decision. Examiners ask for these files, and gaps draw attention.
Penalties for Failing to File
Missing a required SAR, filing late, filing incompletely, or ignoring continuing-activity obligations carries real exposure. FinCEN has authority to bring enforcement actions for BSA reporting and recordkeeping violations, with remedies that include civil money penalties.12FinCEN.gov. Enforcement Actions
Criminal penalties reach individuals as well as institutions. A willful BSA violation carries up to $250,000 in fines and five years in prison. When the violation is part of a pattern of illegal activity involving more than $100,000 in a 12-month period, the maximums double to $500,000 and ten years. An individual convicted of a BSA violation who was a partner, director, officer, or employee of the institution at the time must also repay any bonus received during the calendar year of the violation or the following year.13GovInfo. 31 USC 5322 – Criminal Penalties
The primary federal regulator — OCC, FDIC, or Federal Reserve — can layer on its own enforcement, including cease-and-desist orders, removal of officers, and additional civil penalties. Those actions are public.