Banking and Finance Law Daily Wrap Up, BANK SECRECY ACT—FinCEN issues FAQ to clarify Suspicious Activity Reporting requirements, (Oct 9, 2025)

By George M. Gullo, J.D.

“SARs should deliver better outcomes by providing law enforcement the most useful information — not by overwhelming the system with noise.”

The Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) has issued answers to four frequently asked questions (FAQs) to clarify certain requirements related to suspicious activity reports (SARs). By issuing these FAQs, which were based on feedback from financial institutions, FinCEN seeks to ensure those institutions do not needlessly expend resources on efforts that fail to provide law enforcement and national security agencies with the critical information needed to detect, combat, and deter criminal activity.

Prioritization. In an October 9 press release, John K. Hurley, Under Secretary for Terrorism and Financial Intelligence, stressed that: “Compliance requires real resources, and that’s why prioritization is crucial. At Treasury, we will continue to reform our Anti-Money Laundering and Countering the Financing of Terrorism framework to de-prioritize low-value activity and direct compliance resources towards the most significant threats to our country.” According to Mr. Hurley, “SARs should deliver better outcomes by providing law enforcement the most useful information—not by overwhelming the system with noise.”

Focus resources. The answers to these FAQs are intended to assist financial institutions with their compliance obligations while enabling institutions to focus resources on activities that produce the greatest value to law enforcement agencies and other authorized government users of Bank Secrecy Act (BSA) reporting. In particular, the FAQs clarify regulatory requirements relating to structuring SARs, continuing activity reviews, and a financial institution’s decision not to file a SAR.

Question 1. The first question addresses whether financial institutions must file a SAR for transactions at or near the $10,000 currency transaction reporting (CTR) threshold. The guidance confirms that such transactions alone do not trigger a SAR filing requirement. A SAR is only required if the institution knows, suspects, or has reason to suspect that the transaction is structured to evade CTR requirements. Structuring, defined as “breaking down” large currency transactions (i.e., exceeding $10,000) into smaller amounts to avoid reporting, is unlawful and must be detected and reported through a financial institution’s anti-money laundering/countering the financing of terrorism program, which should be tailored to the institution’s risk profile.

Question 2. The second question clarifies that financial institutions are not required to conduct a separate review of a customer or account following the filing of a SAR to determine whether suspicious activity has continued. Although FinCEN previously suggested filing SARs for ongoing suspicious activity every 90 days, this has been misinterpreted as a regulatory requirement. Instead, institutions may rely on risk-based internal policies, procedures, and controls that are reasonably designed to identify and report suspicious activity without mandating a distinct follow-up review.

Question 3. The third question elaborates on the timeline for institutions that choose to follow FinCEN’s continuing suspicious activity guidance. While not mandatory, the suggested timeline includes filing an initial SAR within 30 days of detecting suspicious activity, followed by a continuing activity SAR 120 days later (i.e., 150 days from initial detection). If a suspicious subject is not identified within the first 30 days, the initial filing timeline may be extended by an additional 30 days. When filing a SAR for continuing activity, institutions should include the full 90-day period of suspicious activity in the SAR form.

Question 4. The fourth question confirms that financial institutions are not required to document decisions not to file a SAR. Although FinCEN has encouraged such documentation in the past, it remains optional. If an institution chooses to document its decision, the level of detail should align with its internal risk-based policies and need not exceed what is necessary for internal compliance. A brief statement is generally sufficient, though more extensive documentation may be appropriate in complex cases.

Existing requirements. The answers to these FAQs do not alter existing BSA legal or regulatory requirements or establish new supervisory expectations. FinCEN issued the FAQs jointly with the Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency.

RegulatoryActivity: BankingOperations BankSecrecyAct CrimesOffenses FederalReserveSystem GCNNews