An examiner recently suggested that we begin filing SARs on one of our customer for ongoing activity that seems suspicious.
Is the activity suspicious or not?
If it is, you should be filing.
If it isn't, you should have documentation to support why it's not.