I don't mean to sound knitpicky or condescending when I say this, but it's important to emphasize that the SAR form uses the term "Subject." Why is that important?
Because, in the context of a criminal investigation, suspect is an accusatory term while subject is not. When FinCEN revised the form close to a decade ago (at this point), they took out the word "suspect." Unfortunately they did not - to my knowledge - explain why. However, if you consider that revision along with their "give it if you got it" (as I call it) guidance, the implication is clear: FinCEN wants you to err on the side of including more rather than less.
To my knowledge, FinCEN has not defined the term "subject" nor clarified who qualifies, aside from specifically instructing filers NOT to include victims.
I mention this to preface what I've observed as an "unwritten" rule of thumb I have observed (secondhand) *some* examiners employing. Generally speaking, best practice is to include all of the counterparties and conductors of suspicious transactions as "Subjects." There are some obvious common sense exceptions (e.g. debit card fraud), but for the vast majority of cases it's a good guideline to follow.
From what you've described, listing both is most appropriate. Again, I can't emphasize enough, that these are *Subjects*.
_________________________
CFE, CAMS