tgray - I can tell you what we generally do, but it may not be appropriate for your shop. We have a 3T systems of alert, case, SAR/No SAR.
At the alert level, we look at thirty days of activity, at a minimum. We only extend past 30 days if we are unable to determine the source or ultimate usage of the funds. Meaning, if a cash deposit triggered the alert, the analyst must analyze the usage of the funds after the deposit (Assuming they did spend the funds). For outgoing flagged activity, the analyst must review the source of funding. We only bring in associated accounts if there is a transfer between the flagged account.
If the activity appears to be unusual, it is escalated to a case, and an investigator will review 120 days of activity to make a SAR/No SAR decision. Again, we only bring in associated accounts if there is a transfer between the flagged account.
We also conducted relationship reviews based on client risk, and those reviews are conducted periodically based on the current client risk. This is where we would include the 18 accounts in your example.
_________________________
"100 victories in 100 battles isnt the most skillful. Subduing the other's military w/o battle is the most skillful." Sun-Tzu