Our policy as well as the BSA reg requires us to retain a copy of each SAR filed, and its supporting documentation, for 5 years from the date of filing.

I stick to that schedule precisely, as I believe it reduces risks of various types, for us to intentionally avoid hanging on to BSA information for longer than required by law and policy. (For instance I don't wait till year-end to delete 5-year-old CTRs; instead I do it once a month. When a subpoena asks for the past 7 years of CTRs, I can truly respond that record retention is 5 years, and anything older than that is unavailable because it has been destroyed and deleted. Likewise our exam risk is lowered by having a strictly-followed 5-year retention on BSA records including CTRs, SARs, monetary instrument records, etc. I'm sure many of you would disagree, but that isn't what I'm really asking about here; this is more of a "what does 5 years mean" question...)

Question: We filed a SAR 5 years ago. Clearly that SAR is outside of record retention. But then 4 years and 9 months ago, we performed a documented review to determine whether a continuing SAR would be required, and we determined no follow-up report would be made.

In your shop do you delete that SAR case once the SAR itself hits five years? Or would you hang onto it until the 90-day follow-up or follow-ups had hit a final negative decision (no SAR to be filed) and that decision ages to five years?

I shred my SAR files five years from the date I filed it, I check monthly to see if I have any. I do not do a review after 5 years.

OP here - to clarify, I don't mean I'm doing a review after 5 years, but that I'm having trouble pinpointing when a SAR file becomes 5 years old. Is it 5 years from a) the date we filed the SAR, or b) 5 years from the date we performed a 90-day follow-up after filing and documented that there was no further reportable activity?

I'd say the letter of the law is option a.

I use option A.- From date of Filing.

I also use the date of filing.

Op here - yeah thanks that feels right to me too.

Otherwise, we'd potentially have this kind of paradox:

A file that is 4 years and 11 months old says "There was no continued activity on case #99, so we aren't going to file another SAR on that."

Regulator: *Let me see the SAR file on case #99

Bank: We don't have it, it's over 5 years old.


So, going by date of filing would mean deleting the SAR that is 5 years old, plus any follow up decision that was documented about not filing another SAR on that over-5-year-old case.