A Detection-Date Definition That Moves the SAR Deadline
Delta Community Bank files about 380 SARs a year. Its procedure defines detection date as the date an alert is escalated to the investigations unit, and the 30-day clock starts there. In your sample of 70 SARs, 11 were filed more than 30 calendar days after escalation, with a range of 31 to 58 days, but management considers them timely because each was filed within 30 days of escalation plus investigation. Separately, 46 customers had SARs in the prior 12 months; policy requires a 90-day continuing activity review, and documentation exists for 19. Nineteen months ago the regulator issued a finding on SAR timeliness. The remediation plan lists annual training completed and a new case management workflow deployed as evidence of closure, with no post-implementation testing, and the board received a one-page update marked closed. SAR supporting documentation sits on a shared drive governed by an automatic three-year deletion rule.
1. Is management's definition of detection date defensible, and how does it affect your timeliness conclusion?
Read the worked answer
It is not defensible. The standard is filing within 30 calendar days of initial detection, where detection means the point at which the bank knows or has reason to suspect that a transaction or pattern may involve illicit funds. That is not the point at which an analyst chooses to escalate. Time spent deciding whether to escalate belongs to the bank, and an internal workflow definition cannot extend a regulatory deadline.
If an alert generated on day one and escalation took twelve days, the clock started on day one. The 11 filings at 31 to 58 days after escalation are therefore almost certainly late, and the count grows once escalation lag is added. Recompute timeliness from alert generation and report the recalculated rate, which is at least 16 percent, then identify whether delay concentrates in particular queues or shifts.
There is a narrow allowance to file within 60 days where no suspect is identified, but it must be documented at the time and cannot be applied retroactively to excuse a case.
Continuing activity is a second timeliness failure: documentation for 19 of 46 means 27 customers had no evidenced 90-day review, so reviews were missed or unreported.
2. What evidence would you require before accepting that the prior SAR-timeliness finding is closed?
Read the worked answer
Training attendance and a deployed workflow are inputs, not evidence that the control operates. Sustainable closure requires demonstrating outcomes.
I would require a post-implementation sample of at least 60 SARs drawn from three consecutive months, measuring days from alert generation to filing, with the exception rate and confidence interval stated. I would obtain system data showing median and 90th percentile cycle time by stage, proving the bottleneck actually moved rather than shifting downstream. I would look for knowledge or quality testing of investigations, since attendance records do not demonstrate competence. I would confirm that continuing activity reviews are calendared and tracked, and that the 27-case backlog is cleared with dated evidence. I would expect a quality control or second-line review function with documented sampling and escalation.
I would also test whether the new workflow enforces the deadline through hard stops and escalation alerts, because a control relying on memory will regress under volume.
Only then would I recommend closure, reporting tested condition, residual risk, and ongoing monitoring to the audit committee, replacing the one-page closed status. Absent this evidence, the finding remains open and the earlier closure was premature.
3. Design the recordkeeping testing for SARs and supporting documentation, and state the likely conclusion.
Read the worked answer
Identify the record types first: SARs and supporting documentation, CDD records, the risk assessment, and any funds transfer or monetary instrument records the bank is obliged to keep. Retention for SARs and supporting documentation generally runs five years from filing, with comparable five-year periods for other BSA records. An automatic three-year deletion rule is therefore a direct violation, not a housekeeping preference.
Testing: obtain the deletion policy and the drive's configuration, then pull deletion logs and compare deletion dates against SAR filing dates. Any SAR whose supporting documentation was deleted before the five-year mark is an exception, and the number of affected SARs and the period should be quantified. Interview IT about backup recoverability and test a restore of two or three files. Test access controls to confirm documentation has not been altered.
Sample 25 SARs and attempt to produce a complete file within a timeframe a regulator would allow, simulating an examination request.
Likely conclusion: a recordkeeping deficiency with an active, continuing cause. Recommend immediate suspension of the deletion rule, restoration where possible, a retention schedule mapped to each record type, and named records-management ownership. Report separately from the timeliness finding so remediation is not conflated.