Suspicious Activity Reporting and Recordkeeping Audits
This domain tests whether you can audit the reporting pipeline end to end: from detection and decisioning through filing, narrative quality and retention. The exam rewards precision on timing rules and on the decisions not to file, which are the ones most often left untested.
Filing mechanics
- A suspicious activity report is due within 30 calendar days after initial detection; where no suspect has been identified, the period may extend to 60 calendar days.
- Continuing activity on a relationship with prior filings should be reviewed at least every 90 days, with a continuing report filed within 120 days of the previous filing.
- Confidentiality: no tipping off the subject. Reports and supporting documentation are retained five years from filing.
- Adjacent recordkeeping: currency transaction reports above the threshold, funds transfer recordkeeping, monetary instrument logs, and 314(a) and 314(b) processes.
Narrative quality
A defensible narrative answers who, what, when, where, why and how. The why - the reason the activity is suspicious - is the most frequently deficient element; narratives that recite transactions without explaining the suspicion fail the standard.
Auditing the decisions not to file
Sample no-action closures alongside filed reports. Test whether the decision was documented, supported by the reviewed activity, and approved at the correct level.
Worked example
An auditor draws 30 filed reports and 30 no-file closures. Three reports were filed 41, 47 and 52 days after escalation; each involved an identified suspect, so the 60-day extension did not apply and all three breached the 30-day rule. Of the 30 no-file closures, nine carried no rationale beyond reviewed. She reports a timeliness deficiency and a documentation deficiency, and recommends a system-generated timer that starts at escalation rather than at filing.
Traps that cost marks
- Measuring the clock from the wrong trigger date.
- Reviewing only filed reports, leaving unfiled decisions unaudited.
- Accepting a narrative that describes activity without explaining suspicion.
- Missing continuing-activity reviews for relationships with repeat filings.