The Reporting Lifecycle Behind the Conversation
Section 1020.320 is the regulatory machinery behind the bank–customer communication problem. This chapter focuses on how a suspicious transaction moves from detection through investigation, possible filing, and record retention, and why that sequence matters without proving what a bank has reported. A time-aware view helps the reader understand why a bank may ask questions or restrict a service while still being unable to confirm a SAR.
The lifecycle is not a single moment called “the SAR.” It is a set of related states. A bank notices facts that may matter, examines available information, decides whether the reporting rule applies, files when required, retains the report and supporting records, and may communicate with the customer about the underlying activity along the way. Some of those activities can overlap. The confidential reporting event remains a protected state within the larger process.
From suspicious facts to a reporting obligation
The regulation does not say that every unusual transaction must become a SAR. In the supplied text of 31 CFR § 1020.320, a bank must file a report of a suspicious transaction relevant to a possible violation when the conditions in the rule are met. The transaction must be conducted or attempted by, at, or through the bank. It must involve or aggregate at least $5,000 in funds or other assets. And the bank must know, suspect, or have reason to suspect one of the listed circumstances.
Those circumstances describe the kinds of concern the reporting system is designed to capture. The transaction may involve funds derived from illegal activity or be intended to hide or disguise such funds as part of a plan to violate or evade federal law or regulation. It may be designed to evade requirements under the Bank Secrecy Act. Or it may have no business or apparent lawful purpose, or be unlike the activity normally expected of the particular customer, with no reasonable explanation after the bank examines the available facts, including the background and possible purpose of the transaction.
The elements work together. A transaction’s size alone does not establish that the reporting rule applies. A bank’s suspicion alone, without the relevant transaction and regulatory conditions, does not let an outside reader determine that a SAR is required. Conversely, an ordinary-looking transaction may become significant when its pattern, parties, purpose, or source creates one of the concerns described in the rule. The regulation leaves the institution to examine the available facts; it does not give a customer, journalist, or casual observer enough information to make an individualized reporting determination from a service message alone.
Consider an altered-check deposit. The amount might reach the regulatory threshold, but that fact by itself does not answer the reporting question. The bank may need to examine the item, understand who issued it, ask the customer where it came from, and compare the transaction with the customer’s expected activity. The investigation may reveal a suspected fraud concern, a legitimate explanation, or an unresolved pattern. Customer questions and operational precautions can occur while that inquiry is still developing. None of those steps, standing alone, tells the customer whether the bank has filed a SAR.
This is the first important lifecycle distinction: detection is not the same as filing. Initial detection means the bank has identified facts that may constitute a basis for a report. Investigation is the work of examining those facts and their background. Filing is a later reporting action required when the rule’s conditions are met. The stages are related, but they should not be collapsed into one conclusion.
The distinction matters for communication. A bank may ask about the purpose of a transaction because it needs to understand the activity. It may ask for the source of funds or information about the parties. It may delay or reject an item while it addresses suspected fraud. These actions can be part of fact gathering or risk mitigation before a reporting decision is complete, or part of an institutional response after the bank has made one. The joint statement permits discussion of the underlying activity under the condition that the communication does not reveal a SAR’s existence.
The reporting threshold also should not be mistaken for a customer-facing explanation of why an account action occurred. The agencies’ communication examples focus on the transaction, the suspected fraud or suspicious activity, and the bank’s operational decision. They do not say that a bank must recite the monetary threshold, identify each reporting element, or disclose its internal analysis. Telling a customer that a deposit is being reviewed for suspected fraud is a different kind of statement from telling the customer that the deposit met the conditions for a SAR.
This separation protects both accuracy and confidentiality. It avoids treating a preliminary signal as a completed report, and it avoids using a customer notice to disclose the bank’s confidential conclusion. The bank can gather facts that may clarify a legitimate transaction or strengthen an investigation. The customer can respond to a specific question without being told what reporting decision the bank made.
Filing, urgency, retention, and communication across time
Once the reporting conditions are satisfied, the regulation specifies the reporting mechanism. A suspicious transaction is reported by completing a SAR and collecting and maintaining supporting documentation. The SAR is filed with FinCEN, the Financial Crimes Enforcement Network. The general deadline is no later than 30 calendar days after the bank initially detects facts that may constitute a basis for filing.
The timing rule recognizes that identification may take additional work. If no suspect was identified on the date of detection, the bank may delay filing for an additional 30 calendar days to identify one. The regulation sets an outer limit: reporting may not be delayed more than 60 calendar days after the date of initial detection of a reportable transaction. In a situation that requires immediate attention—for example, an ongoing money-laundering scheme—the bank must immediately notify an appropriate law-enforcement authority by telephone in addition to filing a timely SAR.
These timing rules create a sequence, but not a simple customer-facing clock. A customer may be contacted shortly after detection, during the investigation, or while an account action is being considered. The bank may request information before it has reached a filing decision. It may also need to communicate about a transaction after a filing while continuing to protect the report’s existence. The regulation’s deadlines tell the bank when to report; they do not create a rule that every customer communication at a particular point confirms that a report exists.
The diagram shows why the customer conversation should not be used as a shortcut for reconstructing the institution’s internal state. The communication branch can begin during investigation or after filing. It is constrained in both cases by the same no-revelation principle. The filing branch has its own timing and retention requirements. An urgent law-enforcement contact can occur alongside the filing obligation rather than replacing it.
The regulation also specifies what persists after filing. A bank must maintain a copy of any SAR and the original or business-record equivalent of supporting documentation for five years from the filing date. The supporting documentation must be identified and maintained as such, and it must be made available to FinCEN or specified law-enforcement and regulatory authorities upon request. This requirement gives the reporting system a durable record of the basis for the report.
Retention does not turn the supporting file into a customer disclosure. The rule separately identifies underlying facts, transactions, and documents as material that is not itself the SAR or information revealing its existence, provided the communication does not notify a person involved in a reported transaction that the transaction was reported. That means two ideas must be held together. Supporting records can be important to the bank’s reporting and can be available through authorized official channels. The existence of the SAR and information that reveals it remain confidential to the customer or subject.
The difference becomes clearer when the altered-check example is followed through time. At detection, the bank may see an unusual or potentially altered item. During investigation, the bank may ask the customer for the item’s source, the transaction’s purpose, or information about the parties. The bank may reject the deposit or limit a service as part of its response to suspected fraud. If the regulatory conditions are met, the bank may file a SAR and retain the report and supporting material. At none of those stages does the customer-facing communication automatically become a disclosure that a SAR was filed.
That conclusion does not mean the customer receives no explanation. The joint statement says the bank can discuss the transaction in question, its concerns, remediation efforts, and potential mitigation steps, so long as the communication does not reveal the existence of a SAR. A notice can therefore be specific about the observable event and the operational response. It can say what deposit or transfer is at issue, identify a suspected fraud concern, ask for information, or describe what service limitation is occurring. The institution must still avoid turning those facts into notification that the transaction was reported.
It is equally important not to read the lifecycle backward. A rejected deposit may reflect suspected fraud, but the supplied authorities do not establish that a SAR was filed in every such case. A request for source-of-funds information may be ordinary due diligence or part of an investigation, but it does not prove a report. An account closure may follow a bank’s policy or risk decision, but the communication clarification does not decide whether that closure is justified under a contract, consumer-protection rule, privacy obligation, or another law. These are separate factual and legal questions.
The no-notification condition is the guardrail at every transition. The regulation allows the underlying facts, transactions, and documents to remain distinct from the SAR, but it says that this provision cannot be construed to notify a person involved in a reported suspicious transaction that the transaction has been reported. A bank therefore cannot use the reporting lifecycle as a customer explanation. Saying “we are reviewing this transfer” and asking about its purpose addresses the activity. Saying “we reported this transfer” addresses the protected event.
A customer may still infer that reporting is possible. The agencies recognize that someone familiar with SAR requirements may deduce from the facts that a SAR was or may have been filed. That inference does not make the underlying information alone a disclosure of the SAR’s existence. The bank’s responsibility is to avoid communicating the protected conclusion, not to guarantee that the customer will never consider it.
This distinction gives the lifecycle its practical meaning. Detection explains why the bank may begin asking questions. Investigation explains why the facts may remain unsettled. Filing and retention explain why a protected reporting event and supporting record may exist. Customer communication remains possible across those stages, but it must stay on the side of facts, concerns, remediation, and operational consequences rather than confirming the report.
The reporting lifecycle is therefore context, not a disclosure formula. It helps explain what the institution may be doing and when, while preserving uncertainty about any particular customer’s status. The next task is to combine this timeline with the protected-object distinction and test a complete conversation: what it says about the transaction, what it implies about reporting, and what the recipient is allowed to learn.