We have a customer that received a $2000 wire via Western Union. She then sent the funds on to her "online boyfriend." She is an elderly lady.

We also received a $14,000 wire to her account but it had the wrong name so we returned the wire.

It appears she is being used as a mule to transfer these funds under the romance scam. We've closed the account.

My question is do we file a SAR given the suspect is unknown and the total is less than $25,000 - or file a SAR and note her as the suspect?

do you think she is a suspect or a victim?

I think she is a victim - but see her as a "mule" for lack of a better word - she is taking money wired to her and sending it on the "boyfriend"

You CAN file for less than the FFIEC amount of $25,000 if you suspect suspicious activity. IMO its easier to explain why you're filing than to say, "well we think its suspicious but FFIEC guidance says only file if the amount is $25,000 or more" and not file. But that's just me.
Refer to bullet four on page 60 of the FFIEC manual:
"Transactions conducted or attempted by, at , or through the bank (or an affiliate) and aggregating $5000 or more if the bank or affiliate knows or has reason to suspect that the transaction:
- has no business or apparent lawful purpose or is not the type of transaction that the particular customer would normally be expected to engage in....."