| 1. Alert Created | A monitoring system, employee referral, law-enforcement request, or other source flags activity. Record the alert date for deadline tracking. |
|---|
| 2. Initial Triage & Assignment | Confirm the alert is usable, remove duplicates, assess urgency, and assign a trained reviewer. |
|---|
| 3. Customer and Transaction Review | Compare activity with the customer profile, expected activity, account history, related accounts, and CDD information. |
|---|
| Decision: Reasonable Explanation? | Decide whether the facts explain the activity. A threshold hit alone does not automatically make activity suspicious. |
|---|
| 4. Document Decision & Close Alert | If concerns are resolved, record what was reviewed and why the alert was closed. |
|---|
| 5. Quality Check / Retain Records | Use risk-based secondary review and retain the alert, evidence, and approval trail under bank policy. |
|---|
| 6. Escalate to Case Investigation | Open a case when the alert cannot be resolved or presents higher risk, a pattern, or possible unlawful conduct. |
|---|
| 7. Gather Supporting Information | Collect transactions, statements, customer records, prior alerts or SARs, public information, and internal contacts without tipping off the customer. |
|---|
| 8. Investigator Recommendation | Summarize facts, red flags, amounts, dates, parties, and rationale; recommend whether to file. |
|---|
| Decision: SAR Filing Warranted? | Apply bank procedures and SAR rules to decide whether the bank knows, suspects, or has reason to suspect reportable activity. |
|---|
| 9. Document No-SAR Decision | If no SAR is filed, document the basis and approval clearly for independent review. |
|---|
| 10. Management/BSA Officer Approval | The designated authority confirms the decision and ensures urgent escalation is handled. |
|---|
| 11. Draft SAR & Narrative | Complete known fields accurately and write a chronological narrative covering who, what, when, where, why, and how. |
|---|
| 12. Quality Control Review | Check identifiers, dates, amounts, categories, narrative consistency, deadline, and approvals. |
|---|
| 13. E-file SAR with FinCEN | Submit through BSA E-Filing, generally within 30 calendar days of initial detection; up to 60 days may apply if no suspect is identified. Save confirmation. |
|---|
| 14. Preserve Confidentiality & Records | Restrict access, never disclose the SAR or its existence to the subject, and retain the SAR and support for five years from filing. |
|---|
| 15. Monitor Continuing Activity | Continue risk-based monitoring, consider relationship actions under policy, and assess whether later activity requires another SAR. |
|---|