14.2 Building an Audit Trail for Suspicious Activity Reviews

CAFCA sub-topic 3.6 covers best practices in creating an audit trail, meaning documentation for all suspicious activity work. In compliance, a decision that is not documented cannot be shown to have been made properly. Examiners, internal auditors, partner banks and law enforcement all depend on the record.

Why the audit trail matters

• Regulatory examinations sample closed alerts and filed SARs to test whether decisions were reasonable and timely.
• Partner banks in BaaS programmes test the FinTech's closures as part of oversight.
• Law enforcement may request the supporting documents behind a SAR.
• Quality assurance and training need a record to review.
• Continuity: when an investigator leaves, the next one must be able to pick up the case.

What to record for every alert and case

Qualities of good documentation

1. Contemporaneous: written at the time, not rebuilt weeks later.
2. Complete and specific: enough for a stranger to follow. Write "Reviewed 42 transactions, 1 March to 30 April; inflows from 17 unrelated P2P senders; 3 senders filed scam reports", not "reviewed, ok".
3. Objective: separate facts ("funds left within 20 minutes"), inferences ("consistent with pass-through") and conclusions ("suspicious; escalate"). Avoid speculation about personal characteristics.
4. Consistent: use templates and required fields so that quality does not depend on the individual.
5. Tamper-evident: case systems should log edits with user IDs and timestamps, and keep version history.
6. Access-controlled: SAR drafts, filings and any record that reveals a SAR need restricted permissions, because disclosure is a crime.
7. Retained: keep records for the legal period and make them retrievable (Chapter 18).

SAR records and decisions not to file

• SARs and supporting documentation. US rules require keeping a copy of each SAR and its supporting documentation for five years from filing. Firms must give the supporting documentation to FinCEN or law enforcement on request, without a subpoena. Other regimes have similar retention rules.
• Decisions not to file. In October 2025, FinCEN and the federal banking agencies issued FAQs confirming that the BSA does not require a firm to document a decision not to file a SAR. FinCEN had encouraged it, not required it. Most firms still record closure rationales, because internal policy, QA, partner contracts and other regulators expect them, and because they protect the firm when a decision is questioned later.

System-level audit trails

Beyond case notes, the platform should log:

• Which rule or model version generated the alert, and the thresholds in force at the time.
• Which sanctions list version was screened, and when.
• Privileged actions, such as whitelist changes, overrides, manual releases and bulk closures, with user and approver.
• Data feed completeness, meaning evidence that every transaction stream was ingested.

These logs show that the system worked, not only that analysts did their jobs.

Writing for the reader who comes later

Write every note for a reader who has no context: an examiner two years from now, a new analyst, or a prosecutor reading the supporting file. Use plain language and full dates, and define any internal codes. Name the documents relied on. Explain how the decision follows from the evidence, for example: "Payslip and employer contract match the inflows; the declared occupation is consistent; therefore no further action." When the evidence is mixed, say so and explain the weighing. A note that admits uncertainty and then justifies the decision is stronger than one that sounds confident but gives no reasons.

Realistic exam scenario

An examiner samples 60 closed alerts. Thirty-one say only "No suspicious activity – closed." There are no attachments and no record of what was reviewed. Even if the decisions were correct, the firm cannot show it. The examiner will likely cite inadequate documentation and may question whether the alerts were reviewed at all. The remedy is to mandate structured closure templates, retrain analysts, apply QA to closures, and look back at the poorly documented closures to confirm whether any need re-review.

Common exam traps

• "Reviewed – OK" notes. These are not an audit trail.
• Storing SAR files in a shared drive with broad access.
• Back-dating notes to meet service levels. This is falsification and a serious breach.
• Assuming no documentation is ever needed if no SAR is filed. The BSA may not require it, but policy, partners and good practice usually do.