You don't have to file if you don't believe it's suspicious, but you choose not to file, you need to clearly document why you're not filing for examiners.
We have procedures to clear one-time events in situations which are borderline but the analyst does not believe to be intentional, and when the customer has no history of similar activity. If it happens again, we'd go back and see if we should reconsider the first event. Our examiners have been fine with this.