What FinCEN's October 2025 SAR FAQs change for alert reviews
Four answers from FinCEN and the four federal banking regulators. None of them changes the law. Three of them change how much effort an L1 queue should spend on alerts that were never going to become SARs.
The short version
- Activity at or near the $10,000 CTR threshold is not, by itself, enough to require a structuring SAR. The trigger is reason to suspect the activity was designed to evade reporting.
- Banks do not have to run a separate review of continuing activity after a SAR. The 90-day cadence was a rule of thumb that hardened into practice.
- There is no BSA requirement to document a decision not to file. When you do document, a short statement usually suffices. The FFIEC manual still says banks should, and that section is being updated.
- For alert review: ask about evasion, not amounts. Keep no-SAR notes proportionate. Leave the SAR clock where the regulation puts it.
On October 9, 2025, FinCEN published answers to four questions that financial institutions keep asking about suspicious activity reports. The Federal Reserve, FDIC, NCUA and OCC issued them jointly (FinCEN release). The banking agencies were careful to say the FAQs do not change existing requirements or create new supervisory expectations (Federal Reserve SR 25-4, FDIC FIL-48-2025). The stated aim is narrower: help institutions spend their effort on the reporting that is most useful to law enforcement.
That makes the FAQs easy to file and forget. They should not be. Each answer removes a piece of work that many teams do out of habit, and most of that work happens in the alert queue, before anyone at L2 has seen the case.
1. A deposit near $10,000 is not, by itself, a structuring SAR
Two rules meet here. Banks file a currency transaction report for cash transactions of more than $10,000, and several transactions count as one when the bank knows they were made by or on behalf of the same person in one business day (31 CFR 1010.311, 1010.313). Separately, a bank must file a SAR on a transaction of $5,000 or more when it knows, suspects or has reason to suspect the transaction was designed to evade BSA requirements (31 CFR 1020.320).
The first FAQ answers the question that sits between those two rules. The mere presence of a transaction or a series of transactions at or near the CTR threshold is “not information sufficient to require the filing of a SAR” (FAQ, question 1). The obligation turns on knowing, suspecting or having reason to suspect that the activity was meant to evade reporting.
The same answer restates how wide structuring is. Under 31 U.S.C. 5324 it covers currency transactions of any amount, at one or more institutions, on one or more days, in any manner, when the purpose is to evade the CTR. So the FAQ narrows the trigger for a SAR. It does not narrow the offense, and a program still has to monitor for structuring at a level that fits its products, customers and locations.
For a reviewer, that turns a structuring alert into a specific question. Not “are these deposits under $10,000?” The rule that fired already answered that. The question is whether anything in the record points to an intent to evade.
2. You do not need a separate continuing activity review
In 2000, FinCEN's SAR Activity Review suggested reporting continuing suspicious activity at least every 90 days. The FAQ says that rule of thumb came to be treated as a requirement. It is not. Institutions are not required to run a separate review, manual or automated, after a SAR to find out whether the activity continued. They can rely on risk-based policies and controls reasonably designed to identify and report it (FAQ, question 2).
Many teams run a 90-day calendar for every SAR subject: pull the account, re-review the activity, write it up, decide again. That review can now be kept or retired on risk grounds, instead of being run because everyone assumed it was mandatory.
3. If you do file continuing activity SARs, here is the clock
For institutions that keep following the continuing activity guidance, the third answer lays out the dates (FAQ, question 3). When no suspect is identified, the initial filing can take 60 days and the later dates shift with it.
| Day | Event |
|---|---|
| 0 | Facts are detected that may require a SAR |
| 30 | Initial SAR due |
| 120 | The 90-day continuing activity period ends |
| 150 | Continuing activity SAR due, with a date range covering the full 90 days |
4. No BSA requirement to document a decision not to file
The fourth answer is the one compliance teams talk about most. Nothing in the BSA or its regulations requires an institution to document a decision not to file a SAR. FinCEN has encouraged it but never required it. Where an institution chooses to document, the level of detail can follow its own risk-based policy, and in most cases a short, concise statement is enough. Complex investigations may call for more (FAQ, question 4).
The examination manual has not caught up yet. Its SAR section still reads:
Banks should document SAR decisions, including the specific reason for filing or not filing a SAR.
The same page tells examiners to refer to the recent interagency FAQs while the section is revised (FFIEC manual). Until that revision lands, many BSA officers will keep documenting no-SAR decisions in full. That is a defensible choice. What changed is that the depth of that record is now a policy decision rather than an assumption.
What did not change
- The deadline. A SAR is due no later than 30 calendar days after initial detection of facts that may warrant it, extendable by up to 30 more days when no suspect has been identified, and never past 60 (31 CFR 1020.320(b)(3)).
- What “initial detection” means. The FFIEC manual says it is not the moment a transaction is highlighted for review. The period starts once an appropriate review has been done (FFIEC manual).
- Retention. A copy of each SAR and its supporting documentation stays on file for five years from the filing date (31 CFR 1020.320(d)).
- Staffing and timeliness. Examiners still expect adequate staff for identifying, evaluating and reporting suspicious activity, and reviews completed in a reasonable period of time (FFIEC manual).
What this means for alert triage
Most of the effort the FAQs remove sits at L1, which is why they matter to anyone running a queue. Here is how they map onto the way Assay works.
Structuring alerts get an evasion question
Assay computes structuring findings in code before a model sees the alert: the cash deposits between $8,000 and $10,000 in the last 30 days, the locations used, the days with deposits at more than one location, and whether a staff note records the customer asking about the $10,000 threshold. The system prompt states the FAQ's position and tells the model to look for evasion indicators, not amounts alone. Every claim it makes has to cite the transaction or note behind it, and a claim that cites nothing sends the alert to a human. The indicators themselves are in Structuring that rules miss.
No-SAR depth is a setting, and the cost is storage
The agent writes a cited rationale for every alert it triages, so keeping a full no-SAR record costs storage, not analyst time. Policy settings let the BSA officer pick full or standard depth. The default is full, which matches the FFIEC manual as it reads today.
Continuing activity stays a human call
Prior SARs on the customer appear as cited evidence on the next alert, so the reviewer sees the history without a separate lookup. Whether to file a continuing activity SAR, or any SAR, is one of four decisions Assay has no code path to make.
The SAR clock starts where the regulation says
The queue shows your internal review deadline, which is your policy. The SAR clock starts only when an investigator records a suspicion determination in the L2 view, and then counts 30 days, or 60 when no suspect is identified. You can see both clocks on the synthetic alerts in the live demo.