If you submit a SAR for check fraud and during the 90 day review you see they made a deposit to the checking account of $600, do you update the SAR? Do you update the SAR loss or just note the reduced loss in the narrative?
If I filed a continuing SAR I would note the decreased loss and recovery amount. But if no new suspicious activity had taken place I would not be filing a continuing SAR in order to track for FinCen the outstanding loss to the bank. Usually those accounts are closed after the fraud.