I would like to know what the industry's practice on SAR aggregation is. Do you see financial institutions aggregate with the prior SAR(s) under this situation: If the suspicious activity in question has not continued during the 90-day review period, but a new alert on related activity reoccurs at a later date, should a financial institution aggregate with the prior SAR(s)? What if the activity occurs a year after the 90-day review, should a financial institution aggregate the new SAR with the previous one?

The answer to the question can be found in The SAR Activity Review Trends, Tips & Issues, Issue 8, April 2005, pages 32 and 33.

In this guidance, FinCEN addresses the issue of continuing suspicious activity. When reading the FinCEN language we believe it can confidently be inferred that “ongoing” activity is defined as suspicious activity that occurs within 90 days of a previous SAR filing.

FinCEN specifically addresses instances where the suspicious activity originally reported changes. To quote from Issue 8,

“…for instances where the nature of the activity reported changes after the original SAR filing, the suspicious activity is no longer considered, ‘ongoing’ - e.g., the customer begins sending or receiving funds in addition to making structured withdrawals (the subject of the previous SAR). In such cases, the institution should consider the changed activity a new transaction and should file a new SAR, rather than updating a previous filing.”

While FinCEN does not specifically spell out the time frame where “continuing” activity ends or is severed from subsequent activity, our experience is that suspicious activity occurring after 90 days does not need to be aggregated with previous SARs or filed as a follow up SAR. If institutions want to be conservative we have seen the 90 day window expanded up to 120 days, but not beyond that.