I seem to recall some guidance, most likely from FinCEN, regarding the timeliness for filing a SAR, which I can't locate. The instructions for a SAR states: "A financial institution is required to file a suspicous activity report no later than 30 calender days after the date of initial detection of facts that may constitute a basis for filing a SAR."
The key here are the words "initial detection". I am trying to clarify/understand what constitutes initial detection. Is it the identification of an account for review by your BSA monitoring software or does this occur when you have begun the review process and determined there is suspicious activity?

See Page 44 of http://www.ffiec.gov/bsa_aml_infobase/documents/new_6_2006/SAR_Act_Rev_10.pdf


From the FFIEC Manual:

The need for a review of customer activity or transactions does not necessarily indicate a need to file a SAR. The time period for filing a SAR starts when the organization, during its review or because of other factors, knows or has reason to suspect that the activity or transactions under review meet one or more of the definitions of suspicious activity.64

The phrase "initial detection" should not be interpreted as meaning the moment a transaction is highlighted for review. There are a variety of legitimate transactions that could raise a red flag simply because they are inconsistent with an accountholder’s normal account activity. For example, a real estate investment (purchase or sale), the receipt of an inheritance, or a gift, may cause an account to have a significant credit or debit that would be inconsistent with typical account activity. The bank’s automated account monitoring system or initial discovery of information, such as system-generated reports, may flag the transaction; however, this should not be considered initial detection of potential suspicious activity.

In order to clarify this at our financial instution we complete an internal Suspicious Activity Investigation form once we have determined a SAR may be required. The date on that form begins our 30 day clock. However we may review the customer's activity prior to that for any amount of time determined necessary to determine the activity is suspicious.

This form is also used to document if a filing was determined to not be filed with the reason why.

We use a SIR, (Suspicious Incident Report) procedure. Any one in the organization may centrally report a suspicious incident by completing a SIR and sending it to me. (Hit the "submit" button on the bank's intranet.) I gather documentation, research the incident and then present the case, (SIRs become case files), to our Risk Management Committee. The committee meets once a month. The committee discusses the case and decides whether or not to file, continue to monitor, etc. My 30 day clock starts the day of that meeting. Thus, it could be up to 60 days from the incident before I file. I was just examined and blessed.