Do BSA paper files have to be under double lock and key?

Please describe what is in the paper files are you talking about just CTRs or SAR support? Double lock and key I would not think so unless it is specifically stated in your policy.

yes, SAR support, CTRs, Reports, due diligence etc.

BSA does not contain any specific direction for the level of physical security you must provide. Look to federal guidance on "information security."

Your other key phrase is "SAR confidentiality." FIN 2012-A002 contains a general discussion, but still does not mandate specific measures.

My biggest concerns with BSA records were confidentiality and retention. I generally kept my records and supporting documentation in an area with restricted access. Myself or someone in my department did the annual record purge to avoid having anyone destroy records prematurely, yet making sure that records were not kept far beyond the retention scope. Electronic records definitely made this easier.