The thirty day clock starts ticking from the date you discover the activity, not the date it actually happened.
The caveat here is that whenever anyone in the bank discovers suspicious activity, the clock starts, regardless of whether the person responsible for filing is aware of the situation. So it is critical that you have an effective mechanism for all staff the report suspicious activity to the appropriate person in a timely fashion.