Two weeks ago we reported reported our customer was a victim of check fraud. Now we have about ten other fraudulent checks for other customers that were drawn on the same account at another institution or have other reasons to believe they are related. Should we go ahead and update as continuing activity before 90 days have passed, amend the prior report or wait for 90 day review and add this information? The fraud totals about $75,000.

We would consider this to be the same fraud event, so we would either report the activity in the continuing activity SAR, amend the previous SAR, or both. Whether or not we amend would depend on whether any of the newly-identified activity happened during the review period of the first SAR.

You can always file earlier than 90-days if you believe the activity warrants an earlier report.

I don't think you'd be technically wrong by filing a new SAR though, you would just want to ensure the new SAR references the old SAR, and for completeness sake you could amend the old SAR to reference the new one so an investigator reading it knows where to look for more information. The biggest reason we wouldn't do this is it may muddy the 90-day review.

Related question:
We have a business customer who had multiple fraudulent checks clear their account over the course of a few days, the altered checks were made payable to different payees (aka 'subjects') but were each over the filing threshold.
Would you file a separate SAR for each "subject" or would you consider them to be "related events" and file on all subjects in one single SAR since they impacted the same customer account around the same time?

I'd file a single SAR.