August 23, 2026

From Case to SAR: Building an Audit-Ready Filing Workflow

Axle Team

Key takeaways

The 30-day clock in 31 CFR 1020.320 starts at "initial detection" — and examiners test whether your workflow can prove when that clock started.
Audit-ready means every decision — file or no-file — traces back to the alert, the evidence reviewed, and the person who signed off.
Supporting documentation is legally deemed filed with the SAR itself. If you cannot produce it on request within days, the filing is not really done.
SAR workflow automation earns its keep in evidence assembly, narrative drafting, and deadline tracking — not in making the filing decision for you.

SAR workflow automation uses software — increasingly AI agents — to carry a case from alert disposition to filed SAR: assembling supporting documentation, drafting the narrative from case evidence, tracking the 30-day deadline, and logging every step so the decision trail survives examiner review. The filing decision itself stays with a qualified human.

That definition sounds obvious until an examiner asks you to reconstruct a filing from eight months ago: why the alert escalated, what the analyst reviewed, who approved the narrative, and why the detection date is what it is. Most SAR programs can produce the SAR. Far fewer can produce the workflow behind it.

What SAR workflow automation has to produce

The output of a SAR workflow is not the SAR. It is the SAR plus a defensible record of how you got there. The regulation sets the floor:

"A bank is required to file a SAR no later than 30 calendar days after the date of initial detection by the bank of facts that may constitute a basis for filing a SAR."
— 31 CFR § 1020.320(b)(3)

"Initial detection" is where workflows fail quietly. An alert firing is not detection; detection happens when review establishes facts that may constitute a basis for filing. But that position only holds if your case management shows the review actually happened promptly. A three-week alert backlog followed by a 30-day investigation reads very differently in a lookback than it does in your metrics dashboard.

Two other clock rules matter. If no suspect is identified at detection, the rule allows an additional 30 days to identify one — never more than 60 total. And for violations requiring immediate attention, such as ongoing money laundering schemes, the bank must notify law enforcement by phone in addition to filing.

The audit-ready standard: what examiners actually pull

The FFIEC BSA/AML examination manual directs examiners to sample filed SARs and test the program behind them, not just the forms. In practice that sample gets checked against four things:

Timeliness — filing date measured against a defensible detection date.
Narrative quality — complete, clear, and explains why the activity is suspicious.
Decision process — including how decisions not to file were reached and recorded.
Documentation — whether the underlying evidence is identified, retained, and retrievable on request.

On narratives, the interagency FAQs issued by FinCEN and the federal banking agencies in January 2021 are blunt about the standard:

"Filers must provide a clear, complete, and concise description of the suspicious activity that led to the decision to file the SAR."
— FinCEN and the federal banking agencies, Interagency SAR FAQs (January 19, 2021)

The same FAQs settle two practical questions: you do not need to repeat data-field information in the narrative unless it is needed for clarity, and tabular detail belongs in a single CSV attachment rather than crammed into the 20,000-character narrative. Narrative discipline is mostly an extraction problem — the facts should already exist in the case file.

From case to SAR: six steps that survive an exam

Fix the detection date in writing at alert disposition. Record why that date is the date, and apply the same standard every time. Inconsistent detection-date logic is the fastest way to turn one late filing into a systemic finding.
Freeze the evidence set. Transaction records, KYC file, prior SARs, screening results, negative news — snapshot them into the case. Links to live systems rot; a lookback three years later needs what the analyst saw, not what the system shows today.
Draft the narrative from the frozen evidence. Who, what, when, where, and why it is suspicious — and nothing in the narrative that is not in the file. Every factual claim should trace to a document in the case.
Record the decision with a named approver. File or no-file, the rationale and the sign-off belong in the case record. A no-file decision without a recorded rationale is indistinguishable from a missed SAR.
File and reconcile. Capture the BSA E-Filing acknowledgment and document control number back into the case so the record is closed-loop, not fire-and-forget.
Calendar the continuing-activity review. FinCEN's longstanding guidance contemplates a 90-day review cycle with continuing-activity filings due 120 days after the prior related SAR. Missed continuation filings are a common exam finding precisely because nobody owns the calendar.

"Supporting documentation shall be identified, and maintained by the bank as such, and shall be deemed to have been filed with the SAR."
— 31 CFR § 1020.320(d)

"Deemed to have been filed" is the phrase to take seriously. The documentation has the same legal status as the SAR, must be retained for five years, and must be produced to FinCEN, law enforcement, or your examiner on request. The practical test of an audit-ready workflow is retrieval time: if pulling the full evidence package for a two-year-old SAR takes weeks of hunting through email and shared drives, the workflow failed — it just failed quietly.

Where SAR workflow automation belongs — and where it doesn't

Look back at the six steps. Steps 2, 3, 5, and 6 are assembly, drafting, reconciliation, and calendaring — exactly the work SAR workflow automation should absorb. Steps 1 and 4 are judgment, and they should stay human. Automating the judgment steps is how programs end up defending a model instead of a decision.

This is the design principle behind Sam, Axle's SAR agent: the agent assembles the evidence package and drafts the narrative with every claim traceable to a source document in the case, and a human approves the filing. The same logging-first architecture runs across the Axle platform, because an AI-drafted narrative without lineage is just a faster way to create an audit problem.

One observation from working with filing teams: the failure that surfaces in lookbacks is rarely a late filing per se. It is that "detection date" silently became "case-opened date," while the alert sat in a queue for three weeks before anyone opened the case. If you instrument only one metric in your SAR workflow, make it alert-to-disposition lag — that is the part of the 30-day clock nobody is watching, and it is the number an examiner will reconstruct whether you track it or not.

FAQ

When does the 30-day SAR clock start?

At "initial detection" of facts that may constitute a basis for filing — generally when review of an alert or referral establishes those facts, not when the alert fires. If no suspect is identified at detection, filing may be delayed up to 30 additional days to identify one, but never more than 60 days total.

Do we have to document decisions not to file a SAR?

The regulation does not spell out a no-file documentation requirement, but the FFIEC manual directs examiners to review decisions not to file, and interagency SAR FAQs address documenting them. In practice, a recorded rationale with a named decision-maker is the only defensible answer when an examiner samples your declined escalations.

Can AI draft SAR narratives?

Yes — drafting is an extraction and summarization task over evidence that already lives in the case file, which is what AI agents do well. The conditions that make it defensible: every claim in the draft traces to a source document, the draft is logged, and a qualified human reviews and approves before filing.

If SAR preparation is consuming analyst hours that should go to investigation, see how Sam handles case-to-SAR drafting with a human sign-off on every filing — and put your own alert and filing volumes into the ROI calculator to see what the backlog is actually costing.

From Case to SAR: Building an Audit-Ready Filing Workflow

More from the blog