August 18, 2026

Continuing Activity Reports: When and How to File

Axle Team

Key takeaways

The 90-day review / 120-day filing cycle for continuing activity SARs comes from FinCEN guidance, not regulation — and the October 2025 interagency FAQs said so explicitly.
You are not required to run a separate review after filing a SAR to check whether activity continued. Risk-based monitoring policies, procedures, and controls can carry that load.
If you elect to follow FinCEN's timeline: initial SAR by day 30, the 90-day review period ends at day 120, and the continuing SAR is filed by day 150.
Mechanics matter on the form: check box 1c, keep Item 29 to the current period only, put the cumulative total in Item 31, and cover the full 90-day period in Item 30.
If you loosen your continuing-activity policy after the 2025 FAQs, document what replaced the fixed cycle. Examiners will ask what now triggers a follow-up filing.

A continuing activity report SAR is a follow-up SAR filed when suspicious activity persists after an initial filing. Under FinCEN guidance, institutions review activity for 90 days after each SAR and file the continuing report within 120 calendar days of the prior filing — but the October 2025 interagency FAQs confirmed this cycle is optional, not required.

That clarification is the biggest change to continuing-activity practice in a decade, and it deserves a careful read before anyone touches policy.

Where the continuing activity report SAR cycle comes from

The regulation itself is thin. The SAR rules (for banks, 31 CFR 1020.320) require an initial filing within 30 calendar days of detecting facts that may constitute a basis for a SAR, extendable to 60 days if no suspect is identified. They say nothing about a mandatory refiling cadence when the activity keeps going.

The cadence everyone follows is guidance. It first appeared in FinCEN's SAR Activity Review in October 2000:

"As a general rule of thumb, organizations should report continuing suspicious activity with a report being filed at least every 90 days."
— FinCEN, The SAR Activity Review: Trends, Tips & Issues, Vol. 1 (Oct. 2000), as reproduced in the October 2025 interagency SAR FAQs

A later SAR Activity Review (Issue 21, May 2012) refined the math: review for 90 days after each filing, then file the continuing SAR within 120 calendar days of the previously related SAR. Over twenty-plus years, that "rule of thumb" hardened into something institutions — and many examiners — treated as an obligation.

The 90/120-day timeline, step by step

For institutions that elect to follow FinCEN's continuing suspicious activity guidance, the timeline in the October 2025 FAQs runs:

Day 0 — detection of facts that may constitute a basis for filing a SAR.
Day 30 — filing of the initial SAR.
Day 120 — end of the 90-day review period.
Day 150 — filing of a SAR for continued suspicious activity.

Two wrinkles worth pinning to the wall. First, if no suspect was identified and you used the 60-day window for the initial filing, every subsequent date shifts 30 days (initial SAR day 60, review period ends day 150, continuing SAR by day 180). Second, the date range in Item 30 of the continuing SAR should cover the entire 90-day period starting the day after the initial filing (or the day after the end of the previous 90-day period) — not just the days on which new suspicious transactions occurred.

What the October 2025 FAQs actually changed

On October 9, 2025, FinCEN and the federal banking agencies (Federal Reserve, FDIC, NCUA, OCC) issued four SAR FAQs. Two go directly to continuing activity. The first kills the idea that a post-SAR lookback is mandatory:

"A financial institution is not required to conduct a separate review—manual or otherwise—of a customer or account following the filing of a SAR to determine whether suspicious activity has continued. Financial institutions instead may rely on risk-based internal policies, procedures, and controls to monitor and report suspicious activity as appropriate, provided those internal policies, procedures, and controls are reasonably designed to identify and report such activity."
— FinCEN, Federal Reserve, FDIC, NCUA, and OCC, SAR FAQs, Question 2 (Oct. 9, 2025)

The second confirms the 90/120-day timeline is elective: institutions "are not required to do so and may instead file SARs as appropriate in line with applicable timelines." A fourth FAQ, while we're here, confirms there is no requirement to document decisions not to file — though a short, concise statement of the decision will usually still be worth keeping for your own audit trail.

None of this touches the underlying obligation. If suspicious activity continues and your monitoring surfaces it, you still have to report it. What changed is the mechanism: a fixed calendar review is no longer the presumed control.

Filing mechanics that trip teams up

When you do file a continuing activity report SAR, the form has specific expectations:

Box 1c — check "continuing activity report" in Item 1.
Item 29 — current-period amounts only. FinCEN's SAR FAQs are blunt about this:

"If the FinCEN SAR is a continuing activity SAR, enter in Item 29 only the total of amounts that are involved during the time period of the FinCEN SAR. Do not include amounts from prior FinCEN SARs in Item 29. Prior FinCEN SAR amounts and the current FinCEN SAR total amount are aggregated in Item 31."
— FinCEN, SAR FAQs

Item 31 — cumulative amount across all related filings, used only when box 1c is checked.
Narrative — reference the prior BSA Identifier(s), summarize what was previously reported in a sentence or two, then spend the narrative on what happened this period. A continuing SAR whose narrative is 90% pasted from the prior filing tells law enforcement nothing and reads poorly in an exam.

Should you keep the 90-day cycle?

Here's the practitioner take: the fixed cycle is inefficient, but it was also a forcing function. In teams we've seen drop calendar-driven reviews without building a replacement trigger, continuing cases quietly go stale — the initial SAR gets filed, the account stays open, and nobody owns the follow-up until the next model validation surfaces it. If you move to a monitoring-driven approach, make the trigger explicit at initial filing time: tag the case with an expected disposition (activity likely to continue vs. one-off), route "likely to continue" subjects into elevated monitoring, and keep a hard checkpoint — 120 days is as good as any — for the exit decision on whether to keep the relationship at all.

The other reason to formalize this: the FAQs shift the burden from a bright-line rule to your judgment. That's more efficient and more defensible only if your policy says what you do instead, and your case records show you doing it.

This is also where alert-to-case plumbing pays off. Axle's SAR agent Sam drafts continuing SAR narratives from the case record — carrying prior-filing references forward and keeping Item 29/31 amounts straight — while Rose works the monitoring alerts that decide whether a continuing filing is warranted in the first place. If your continuing-SAR volume is a meaningful share of filings, the ROI calculator will show you what that cycle costs today.

FAQ

Do banks have to file a SAR every 90 days for ongoing activity?

No. The 90-day cadence is FinCEN guidance, and the October 2025 interagency FAQs state that institutions are not required to follow it. Institutions may rely on risk-based internal policies, procedures, and controls to identify and report continuing suspicious activity, subject to the standard 30/60-day deadlines once a reportable determination is made.

What date range goes on a continuing activity SAR?

Item 30 should cover the entire 90-day review period, beginning the day after the initial SAR was filed (or the day after the previous 90-day period ended) — not just the dates of the specific transactions being reported.

Do we have to document a decision not to file a SAR?

No. The October 2025 FAQs confirm there is no BSA requirement to document no-file decisions. If you choose to document them — and most institutions should, for internal consistency — a short, concise statement will suffice in most cases.

Continuing SARs are exactly the kind of repetitive, deadline-driven work an AI agent should carry. See how Sam, Axle's SAR agent, drafts complete, filing-ready SAR narratives with a compliance officer in the loop.

Continuing Activity Reports: When and How to File

More from the blog