If a criminal subpoena on a customer is received by the bank on the 1st of the month, and the subpoena requires account documents to be submitted to law enforcement by the 15th of the month, does the 30 day SAR clock start ticking on the 1st or 15th, or the day you actually detect activity on the account that does legitimately seem suspicious?

The subpoena automatically prompted an internal investigation for the account activity. We started gathering account documents and history on the 10th and submitted everything to law enforcement on the 15th. On the 10th, we detected activity on the account that warrants a SAR.

When does the SAR 30 day clock start ticking?

When you make a determination that there is suspicious activity, you have 30 calendar days to file.

From the Exam Manual:

Timing of a SAR Filing
The SAR rules require that a SAR be electronically filed through the BSA E-Filing System no later than 30 calendar days from the date of the initial detection of facts that may constitute a basis for filing a SAR. If no suspect can be identified, the time period for filing a SAR is extended to 60 days. Organizations may need to review transaction or account activity for a customer to determine whether to file a SAR. The need for a review of customer activity or transactions does not necessarily indicate a need to file a SAR. The time period for filing a SAR starts when the organization, during its review or because of other factors, knows or has reason to suspect that the activity or transactions under review meet one or more of the definitions of suspicious activity.

When your investigation reveals details that you (assuming you are BSA Officer or equivalent) determine are suspicious it starts the 30 day clock.

Based on your description of when you detected SAR-worthy activity, it sounds like the 10th is the day the clock starts ticking.

and perhaps this goes without saying, but please take a look internally at your review process that sounds like it would not have caught this activity without prompting by a subpoena, perhaps some tweaking is in order.