A bank or other covered financial institution must file a Suspicious Activity Report within 30 calendar days of first detecting facts that may point to a legal violation. If no suspect has been identified by then, the SAR filing deadline extends by another 30 days, for an absolute maximum of 60 calendar days from initial detection.1eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions The count is in calendar days, so weekends and holidays are included. The rule applies to every institution covered by the Bank Secrecy Act, including banks, credit unions, broker-dealers, money services businesses, and casinos.
When the 30-Day Clock Starts
The countdown does not begin on the date of the suspicious transaction. It begins on the date the institution first detects facts that may justify a SAR.2eCFR. 12 CFR 208.62 – Suspicious Activity Reports A wire from six months ago can trigger the clock today if that is when a monitoring alert or account review surfaces it.
Detection in this context is not a teller’s hunch at the counter. It is the moment the facts reach someone in the BSA compliance function who can evaluate whether the activity looks suspicious. The regulation ties the deadline to the institution’s awareness because many patterns only become visible during later reviews or automated screening.
A frequent misreading treats an internal investigation as a way to hold off the clock. It is not. The rule says 30 days from “initial detection of facts that may constitute a basis for filing,” not 30 days from the conclusion of an investigation.1eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions If the initial facts were suspicious enough to open a review, those same facts likely started the clock. Institutions that wait for the investigation to close before counting often blow past day 30.
The 60-Day Extension When No Suspect Is Identified
If the institution cannot identify the person behind the activity by day 30, it gets an additional 30 calendar days to keep looking. That produces a hard outer limit of 60 calendar days from initial detection.3Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions The extension is meant to give compliance staff time to trace transactions across accounts or coordinate with other institutions when identification takes real work.
The 60-day cap is absolute. If the suspect is still unknown on day 60, the SAR still has to be filed with whatever information the institution has. A report naming an unidentified subject is far preferable to no report at all.1eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
When the Deadline Is Not Enough: Immediate Notification
Some activity cannot wait 30 days. When a reportable violation requires immediate attention, such as an ongoing money laundering scheme, the institution must telephone the appropriate law enforcement authority right away, and, depending on charter, its primary federal regulator.1eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions The phone call is on top of the SAR, not instead of it. The SAR still has to be filed on the regular 30- or 60-day timeline.
The regulation does not spell out every scenario that qualifies. It calls out ongoing schemes as its example. In practice, anything involving active terrorist financing, an in-progress fraud, or a fast-moving money laundering operation calls for the phone.
Deadlines for Continuing Activity
Suspicious activity does not always stop with the first SAR. When the pattern continues, the institution has to file follow-up reports. FinCEN guidance recommends reviewing continuing activity over a 90-day period after the previous filing, with the follow-up SAR due no later than 120 calendar days after the date of the prior report.3Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions
The math works out like this. Suppose the initial SAR is filed on day 30 after detection. The institution monitors for another 90 days, reaching day 120. It then has 30 days to prepare and file the continuation SAR, landing on day 150 from the original detection.4Financial Crimes Enforcement Network. Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements Each subsequent continuation SAR follows the same 90-day review cycle with a 120-day filing deadline measured from the previous filing.
Institutions may file continuation SARs earlier than the 120-day deadline if faster review by law enforcement seems warranted.3Financial Crimes Enforcement Network. FinCEN Suspicious Activity Report Electronic Filing Instructions Each continuation report must be complete on its own, and the narrative should cover only the 90-day period under review rather than reproduce prior narratives.
What Happens If You Miss the Deadline
A late or missed SAR is not a paperwork nuisance. The Bank Secrecy Act carries both civil and criminal penalties, and regulators use them.
- Negligent violations. A single negligent failure to comply with BSA requirements can bring a civil penalty of up to $500. A pattern of negligent violations can add another penalty of up to $50,000.5Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
- Willful violations. A willful failure to file carries a civil penalty of up to $25,000, or the amount of the transaction (capped at $100,000), whichever is greater.5Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
- Criminal penalties. A willful violation can also bring a fine of up to $250,000 and up to five years in prison. When the violation is part of a pattern of illegal activity involving more than $100,000 in a 12-month period, the maximum rises to a $500,000 fine and 10 years.6Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties
Statutory fines are only part of the exposure. Regulators can take supervisory action against the institution and its personnel, including consent orders, removal of officers, and restrictions on business activities. For compliance officers personally, a pattern of missed SAR deadlines can end a banking career; regulators have barred individuals from the industry for repeated failures.2eCFR. 12 CFR 208.62 – Suspicious Activity Reports
One Deadline Rule the Filing Deadline Does Not Override
Meeting the 30-day deadline does not close the compliance loop. Federal law separately prohibits the institution and any of its directors, officers, employees, or agents from telling the subject, or anyone else, that a SAR has been filed.7Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority The confidentiality obligation continues indefinitely after filing. Civil penalties for disclosure can reach $100,000 per violation, and criminal penalties can include fines up to $250,000 and up to five years in prison.8Financial Crimes Enforcement Network. FinCEN Advisory FIN-2012-A002 Filing on time is the first duty. Staying silent about the filing is the second, and it does not have an end date.