Institutions filed a staggering number of Suspicious Activity Reports (SARs) last year. Banks, savings associations, and credit unions alone filed over 2.193 million in 2025, marking a 7.66% increase. Cyber-related filings surged by 30% over 2024. This growing volume highlights a critical issue often overlooked: the quality of each filing.
Quality matters because these reports are actively used. The IRS Criminal Investigation searched 94% of its 2025 cases against Bank Secrecy Act data. A thin or generic SAR doesn't just fail to help; it forces an analyst to return with questions you could've answered initially.
Why These Mistakes Keep Happening
Most SAR issues aren't about filing; they're upstream problems that surface during filing. Teams focus on timeliness, so the 30-day clock (extendable to 60 days when no suspect is identified) becomes the priority. Narrative quality, detection logic, and context gathering suffer.
Volume exacerbates the problem. When alert queues are full of false positives, analysts prioritize speed, leading to templated narratives that law enforcement can't act on. Each mistake below follows this pattern.
Mistake 1: Relying on Static Rules as Your Primary Detection Layer
Why it happens: Rules are easy to explain to examiners, document, and adjust after a model-risk review. Teams default to them because they're defensible, not because they're effective.
The consequence: Rule-only transaction monitoring catches obvious threshold violations but misses genuinely suspicious patterns. It generates many false positives, wasting analyst hours on alerts that don't lead to useful filings. Meanwhile, real activities like Structuring (Smurfing) spread across accounts or account takeovers that resemble normal login behavior slip through.
The fix: Use rules for known typologies and regulatory floors. Layer behavioral analysis on top, scoring activity against the customer's history rather than a global threshold. Combine behavioral, device, and network signals into a single real-time risk indicator instead of reviewing each in isolation. This is where the detection quality of your SAR is actually decided.
Mistake 2: Filing Narratives That Describe the "What" but Not the "Why"
Why it happens: The narrative field is the last step in a long investigation. By then, the analyst is tired, the deadline is near, and a summary of transactions feels sufficient.
The consequence: FinCEN Form 111 requires identifying the persons involved, the activity, when and where it occurred, and why it's suspicious. Vague descriptions undermine the filing for law enforcement analysts who search it later. A narrative listing amounts and dates without explaining why the pattern is anomalous for this customer offers nothing to correlate against other institutions' data.
The fix: Build a narrative standard with required elements: who, what, when, where, how, and the specific reason the activity deviates from expected behavior. State what you know about the customer's profile and why the activity doesn't fit it. Review a sample of filed narratives monthly against that standard, and address gaps in analyst training.
Mistake 3: Treating Cyber-Related Activity as a Fraud Problem, Not a SAR Problem
Why it happens: Account takeovers, credential stuffing, and synthetic identity activities often land in a fraud queue first. Fraud and BSA/AML teams operate in different reporting lines, and a loss event is handled as a loss event.
The consequence: With cyber-related SARs up 30%, digital fraud drives a large share of filings. If your fraud team resolves a case, refunds the customer, and closes it without a BSA review, you may miss a reporting obligation. Conversely, filings may go out without the device and session evidence your fraud team already holds.
The fix: Create a formal handoff between fraud operations and BSA/AML. Define which fraud outcomes automatically trigger a SAR review. Pass Indicators of Compromise (IoCs), device fingerprints, and session data into the case file so the filing reflects what your fraud team knows.
Mistake 4: Missing the Continuing-Activity Clock
Why it happens: The initial filing feels like the finish line. The case is closed in the case-management system, and nothing prompts a review.
The consequence: Ongoing suspicious activity that continues beyond the initial filing generally requires a continuing report at least every 90 days. Teams that close cases at filing can let that window lapse, leaving a gap in the record and an examination finding.
The fix: Set a system-generated review date at the time of filing, not a calendar reminder owned by one analyst. Tie it to automated monitoring of the subject accounts, so new activity reopens the case rather than relying on someone remembering to check.
Mistake 5: Letting Confidentiality Rules Shape Internal Communication Too Loosely or Too Tightly
Why it happens: The prohibition on telling a subject that a SAR was filed is absolute, so teams either overcorrect and silo everything or get casual and let details leak into customer-facing channels.
The consequence: Overcorrecting means investigators can't coordinate with fraud, customer support, or relationship managers who hold relevant context. Under-correcting risks tipping off a subject, which compromises the investigation. Sharing is permitted only in narrow cases, such as with affiliates and, in special circumstances, head offices and controlling companies.
The fix: Apply Least Privilege to SAR records through Role-Based Access Control (RBAC). Give front-line staff scripted responses for customer inquiries that neither confirm nor deny. Document precisely which roles may see SAR existence versus SAR content, and audit access logs on a schedule.
Prevention Checklist
- Layer behavioral, device, and network analysis over rule-based monitoring.
- Track false-positive rates and analyst time per alert as operating metrics, not just filing timeliness.
- Require a documented "why this is suspicious for this customer" element in every narrative.
- Sample and review filed narratives monthly against your narrative standard.
- Define automatic triggers for BSA review of cyber-related fraud cases.
- Pass IoCs and device evidence from fraud cases into SAR case files.
- Auto-schedule 90-day continuing-activity reviews at the moment of filing.
- Restrict SAR access with RBAC and audit it.
- Script customer-facing responses that protect SAR confidentiality.
- Confirm your 30-day and 60-day clocks start from the date of initial detection, and log that date.
Better detection upstream makes every step after it easier. If your SARs are thin, examine what flagged the activity before you look at the people who wrote them up.
