August 14, 2026

Common SAR Filing Mistakes That Trigger Regulator Questions

Axle Team

Key takeaways on SAR filing mistakes

Most regulator questions trace back to the narrative, not the form fields. FinCEN's own guidance flags incomplete, incorrect, or disorganized narratives as the recurring failure.
The five essential elements — who, what, when, where, why — plus how are the examiner's checklist. Skip one and you invite a follow-up request.
Deadlines are mechanical: 30 calendar days from initial detection, up to 60 when no suspect is identified. Late filings are the easiest finding an examiner will ever write.
Continuing-activity reviews are where SAR programs quietly decay. Watch that queue before anything else.

The SAR filing mistakes that draw regulator questions are consistent across institutions: narratives missing the who, what, when, where, why, or how; aggregate totals with no individual dates and amounts; missed 30- and 60-day deadlines; skipped continuing-activity filings; and tables or attachments pasted where plain narrative text belongs. Every one of them maps to specific FinCEN guidance, which makes every one of them fixable.

Why SAR filing mistakes attract attention

Examiners read SARs the way law enforcement does: as the only account of what your institution saw and why it acted. FinCEN said this plainly in its narrative guidance, and the language has not softened since:

"Financial institutions are required to submit SAR forms that are complete, sufficient and timely filed. Unfortunately, some financial institutions file SAR forms that contain incomplete, incorrect, and/or disorganized narratives, making further analysis difficult, if not impossible. Some SAR forms are submitted with blank narratives. The failure to adequately describe the factors making the transaction or activity suspicious undermines the very purpose of the SAR and lessens its usefulness to law enforcement."
— FinCEN, Guidance on Preparing a Complete & Sufficient Suspicious Activity Report Narrative

A weak SAR doesn't just risk an exam finding. It burns analyst time on rework, invites law-enforcement callbacks, and — repeated often enough — thin or late filings become the pattern evidence in an enforcement action.

The seven mistakes examiners flag most

FinCEN's benchmark for a sufficient narrative is short enough to memorize:

"In general, a SAR narrative should identify the five essential elements of information – who? what? when? where? and why? – of the suspicious activity being reported. The method of operation (or how?) is also important and should be included in the narrative."
— FinCEN, Guidance on Preparing a Complete & Sufficient Suspicious Activity Report Narrative

Measured against that standard, the same seven failures come up again and again:

Thin, boilerplate, or blank narratives. FinCEN notes that some SARs arrive with blank narratives — the fastest way to make a filing useless. If the narrative could describe any customer, it describes none.
Missing one of the essential elements. Who was involved, what instruments were used, when and where the activity occurred, why it was unusual for this customer, and how it was carried out. Examiners use this as a literal checklist; so should your QA.
Reporting only aggregate amounts. The guidance asks for individual dates and amounts of transactions rather than just the total, because aggregates hide the pattern — the structuring rhythm, the burst of activity in a dormant account — that makes the behavior suspicious.
No flow of funds. The narrative should trace origination to beneficiary: where the money came from, where it went, and every account it touched — including accounts at other institutions when known.
Blown deadlines. The clock is 30 calendar days from initial detection of facts that may constitute a basis for filing, with up to 30 more to identify a suspect — and never more than 60 in total. Timeliness findings require no judgment from an examiner, which is why they always get written.
Missing continuing-activity filings. FinCEN's guidance lists the absence of supplementary SARs alongside late filings as a direct impairment to law enforcement. If activity continues, your case management system — not an analyst's memory — should own the review cadence.
Pasting tables and spreadsheets into the narrative. The guidance is explicit: do not insert objects, tables, or pre-formatted spreadsheets, because they may not convert properly in the SAR system. Keep the detail, but write it as text.

A narrative structure examiners can follow

FinCEN's guidance suggests dividing the narrative into an introduction, a body, and a conclusion. The structure holds up because it mirrors how an investigator reads:

Introduction: the purpose of the SAR, a summary of the red flags, prior SARs on the same subjects, any OFAC connection, and your internal case number so law enforcement can reference it.
Body: the parties and their relationships, the accounts involved, and the transactions in chronological order with individual dates and amounts, tracing the source of funds through to the destination.
Conclusion: follow-up actions such as account closures or ongoing monitoring, contact details, and any additional information available to law enforcement on request.

Where automation actually helps

Most SAR filing mistakes are assembly failures, not judgment failures: the facts exist in the case record but never make it into the narrative, or arrive as aggregates because pulling individual transactions is tedious. Assembly is exactly the work AI handles well — and regulators have addressed the fear that using it exposes your existing program:

"For example, when banks test or implement artificial intelligence-based transaction monitoring systems and identify suspicious activity that would not otherwise have been identified under existing processes, the Agencies will not automatically assume that the banks' existing processes are deficient."
— Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist Financing (December 2018)

The judgment — is this suspicious, do we file — stays with your team. Sam, Axle's SAR agent, drafts the narrative from the case record with every element sourced, so review time goes into the decision rather than the assembly. Paired with monitoring output from an agent like Rose, the individual transactions arrive structured instead of screenshotted.

The leading indicator most programs ignore

An observation from working with SAR teams: quality decay shows up in the continuing-activity queue weeks before it shows up in filed narratives. When review dates start slipping, caseloads have passed the point where analysts can do both assembly and judgment on time — and rushed narratives follow.

Track the age of your oldest overdue continuing-activity review as a program health metric, right next to filing timeliness. It moves earlier than QA sampling catches anything, and it costs nothing to instrument.

FAQ

How long do you have to file a SAR?

Thirty calendar days from the date of initial detection of facts that may constitute a basis for filing. If no suspect was identified on the date of detection, you may take an additional 30 days to identify one — but reporting may never be delayed more than 60 calendar days from initial detection.

What makes a SAR narrative sufficient?

It answers who, what, when, where, why, and how; lists individual transaction dates and amounts rather than aggregates; traces the flow of funds from origination to beneficiary; and does all of it in plain text without embedded tables or attachments. FinCEN's narrative guidance includes worked examples of sufficient and insufficient narratives by industry — they are worth putting in front of new analysts.

Do you have to file a SAR for continuing activity?

Yes. FinCEN's SAR guidance describes filing on continuing suspicious activity on a recurring review cycle — in practice, institutions review roughly every 90 days and file a continuing SAR that references the prior filing. The absence of supplementary SARs is one of the gaps FinCEN specifically calls out as impairing law enforcement.

Next step

If your SAR backlog is an assembly problem, see how Sam drafts complete, sourced narratives from the case record. To size what the rework and overtime are costing you, the ROI calculator is a five-minute exercise.

Common SAR Filing Mistakes That Trigger Regulator Questions

More from the blog