I'm looking for some guidance in regards to initial detection and SAR filing. Would anyone be able to weigh in or point me in the direction of guidance regarding whether initial detection is considered the date in which an automated BSA/AML software creates an alert/case for activity, or the date in which a staff member starts reviewing said case/alert? (especially if there is no sort of timestamp to verify when the staff member actually "opened" the alert/case)

Follow up question:

If activity has been constantly appearing in alerts/cases reviewed by one member, and then another member reviews a newly created alert/case and deems it to be suspicious, is the activity period in which alerts/cases were waived for that activity able to be considered for the SAR? For example if it had been occurring for months amounting to a time outside the initial detection definition, and is only now considered to be suspicious, can the entire period be considered, or only the most recent activity included in that alert/case?

1. "The time to file a SAR starts when the organization, in the course of its review or on account of other factors, reaches the position in which it knows, or has reason to suspect, that the activity or transactions under review meets one or more of the definitions of suspicious activity."

http://www.fincen.gov/statutes_regs/bsa/bsa_faqs.html

Your 30 day clock starts ticking once someone decides the activity is reportable.

2. Include all activity that you are aware of that meets the definition of unusual or suspicious, after performing your research into the activity. However, if questioined by your auditor or a regulator, be prepared to explain why one employee thought the activity was not suspicious when another one believed it was. There could be many reasons why your colleagues came to different conclusions. Of course, if the reason for the discrepancy warrants its own action (retraining, revising employee duties, implementing a 4-eye alert review policy or QA sampling, etc...), be sure to take it.

Great, thank you for the clarification! It would be an easy explanation to an auditor/examiner as well, two different schools of thought on this one as well as some other underlying factors.

I second kw's post. I just attended the annual user group conference for Banker's Toolbox last week and they actually did address this very thing. Kw's response is nearly verbatim.