Escalation and Suspicious Activity Decisions
Key Takeaways
- U.S. SARs must be filed within 30 calendar days of initial detection, extendable to 60 days only when no suspect is yet identified.
- The U.S. SAR threshold is generally $5,000 in funds or assets where the institution knows, suspects, or has reason to suspect illicit activity.
- SAR confidentiality and the anti-tipping-off rule prohibit telling the customer a SAR was filed or is contemplated.
- Escalation runs to a designated decision-maker (often the MLRO/BSA Officer), who owns the file/no-file decision with a documented rationale.
From Suspicion to Decision
When an investigation produces articulable suspicion, the case escalates for a reporting decision. In the United States that report is the Suspicious Activity Report (SAR); many jurisdictions call it a Suspicious Transaction Report (STR) filed to a Financial Intelligence Unit (FIU) — in the U.S., the FIU is the Financial Crimes Enforcement Network (FinCEN). The CAMS exam expects precision on deadlines, thresholds, and confidentiality.
The Numbers You Must Know
| Rule | U.S. requirement |
|---|---|
| SAR filing deadline | 30 calendar days from initial detection of facts forming a basis to file |
| Extension | Up to 60 days total if no suspect identified within the first 30 |
| SAR dollar threshold | Generally $5,000 in funds/assets where suspicion exists (no minimum for insider abuse) |
| Currency Transaction Report (CTR) | Cash over $10,000 in a day by/for one person; filed within 15 days |
| Recordkeeping | Retain the SAR and supporting documentation 5 years |
The CTR threshold is a reporting obligation, not a suspicion trigger. Activity near $10,000 does not by itself require a SAR — but a pattern of deposits just under it (structuring) is itself suspicious and reportable.
Who Decides
Escalation runs to a designated decision-maker, commonly the Money Laundering Reporting Officer (MLRO) or BSA Officer, who owns the file / no-file decision. The decision must rest on the facts and be documented — whether the institution files or declines, a written rationale protects the program in examination. A SAR requires reasonable suspicion, not proof of a crime.
A Worked Decision Example
An analyst confirms a customer made nine cash deposits totaling $84,600 in five business days, each under $10,000, across three branches, with no business explanation. Aggregate exceeds the $5,000 SAR threshold and the pattern indicates structuring. The analyst escalates with a fact summary; the MLRO agrees and a SAR is filed on day 12 — well inside the 30-day window. The customer is not told. Critically, the institution may continue normal CTR filing and may even decide to close the relationship, but it must not reveal the SAR.
Confidentiality and Tipping Off
SAR confidentiality is absolute: the institution and its employees may not disclose to the customer (or any unauthorized party) that a SAR was filed or is being considered. Doing so is tipping off — a federal offense. Note the distinction the exam tests: CTRs are not confidential; a bank may tell a customer that cash over $10,000 triggers a CTR. The safe harbor protects institutions and employees from civil liability for filing a SAR in good faith.
SAR vs. CTR: The Distinction the Exam Tests
Candidates routinely confuse the two core U.S. reports. Keep them separate:
| Attribute | SAR | CTR |
|---|---|---|
| Trigger | Suspicion of illicit activity | Cash over $10,000 in a day |
| Threshold | Generally $5,000 (no minimum for insider abuse) | $10,000 (mechanical) |
| Judgment | Requires investigation and decision | No judgment — file if cash exceeds threshold |
| Confidential? | Yes — absolute | No — customer may be told |
| Deadline | 30 days (60 if no suspect) | 15 days |
A CTR is filed automatically on qualifying cash; a SAR is filed only after articulable suspicion. The two can coexist — large cash that is both over $10,000 and suspicious generates both reports.
Escalation Mechanics
A defensible escalation has structure. The analyst prepares a concise referral summarizing the facts, the suspected typology, the dollar amounts, and a recommendation. A decisioning body — often the MLRO or a financial-crime committee — reviews and records the outcome. The exam emphasizes that the decision and its rationale are documented whether the institution files or declines, because examiners test for consistent, evidence-based decisioning, not just filing volume.
Escalation may also trigger parallel actions: placing the customer under enhanced monitoring, restricting or exiting the relationship, or notifying senior management and the board where exposure is material. None of these may tip off the customer about the SAR.
Global Equivalents
Though CAMS is U.S.-anchored on terminology, it is an international credential, so know the analogues: in the United Kingdom the front-line employee files an internal Suspicious Activity Report to the Money Laundering Reporting Officer, who decides whether to submit a SAR to the National Crime Agency (NCA) and may request a Defence Against Money Laundering (DAML) consent. The Financial Action Task Force (FATF) frames these globally as Suspicious Transaction Reports to a national Financial Intelligence Unit.
The underlying logic — escalate articulable suspicion to a designated officer who reports to the national FIU and never tips off the customer — is universal.
Common Traps
- Confusing $5,000 (SAR) with $10,000 (CTR). Different reports, different purposes.
- Believing a SAR needs proof. Reasonable, articulable suspicion is the standard.
- Telling the customer. Even hinting that a report was filed violates the anti-tipping-off rule.
- Missing the clock. Aging cases must escalate before day 30; the 60-day extension applies only to identifying a suspect, not to general delay.
A U.S. institution detects facts forming a basis to file a SAR and has already identified the suspect. By when must it file?
After an institution files a SAR on a customer, the customer asks a teller whether a report was filed. What is the correct response?