How long SARs and supporting records must be retained

A SAR filing is not the end of the recordkeeping duty. The institution keeps the report and the records that supported the decision to file it. Those materials may later be needed by regulators or law enforcement. At the same time, the existence of a SAR is confidential; ordinary customer communications should not disclose that one was filed.

The five-year retention period

FinCEN guidance states that a financial institution must maintain a copy of the SAR and the original or business-record equivalent of supporting documentation for five years from the date the SAR was filed. The retention clock is tied to filing, not to the date the suspicious transaction occurred or the date an examiner later asks for the file.

What counts as supporting documentation

Supporting documentation includes records that helped the institution decide that activity required a SAR. Depending on the case, that can include account records, transaction records, instrument images, communications, investigative notes, and other relevant business records. The SAR narrative should reasonably describe the supporting materials, and the institution must be able to retrieve them in response to a proper request.

Confidentiality and disclosure are separate questions

The institution may need to give supporting documentation to FinCEN or an appropriate law-enforcement or supervisory agency. That does not mean it may disclose the SAR to the customer, borrower, or an unrelated third party. Staff should follow the institution's BSA/AML escalation and legal procedures, verify a requester's authority, and avoid confirming or denying whether a SAR exists.

How this applies to mortgage lending

A mortgage lender subject to BSA/AML SAR requirements should ensure the records are preserved in systems that authorized compliance staff can retrieve. A loan originator who notices suspicious activity should follow the institution's internal referral process and protect confidentiality. The originator should not promise the borrower that a report will or will not be filed and should not retain a private copy outside approved systems.

Exam traps

• Starting the five-year period from the suspicious transaction instead of the filing date.
• Keeping the SAR but discarding the underlying supporting documents.
• Assuming confidentiality prevents disclosure to regulators or law enforcement.
• Telling the borrower that a SAR has been filed.
• Sending records to a requester without confirming that the requester is authorized.

Key takeaway

Remember five years from filing for the SAR and its supporting records. Preserve the evidence, provide it to authorized agencies when required, and keep the report itself confidential.

The five-year period starts at filing

A loan or finance company must retain a copy of each SAR it files, including a joint report filed on its behalf, and the original or business-record equivalent of supporting documentation for five years from the filing date. Do not start the period from the suspicious transaction, account opening, investigation start, or loan payoff. The filing date is the anchor.

Supporting documentation includes records that help explain the activity, the investigation, and the basis for the SAR. It may include account records, transaction data, communications, images, and analysis. The narrative should describe the activity and relevant supporting materials, but the documents are retained separately and provided when an authorized agency requests them.

Preserve confidentiality

SAR confidentiality is separate from record retention. A financial institution generally must not disclose that a SAR was filed or share the SAR itself with the subject or unauthorized parties. Staff should not tell a borrower, real-estate agent, or referral source that an SAR was submitted. Even an indirect hint that a report exists can create a confidentiality problem.

A customer-facing explanation may describe ordinary account restrictions or a request for information without revealing the SAR. Staff should use approved language and route subpoenas, discovery demands, or media inquiries to counsel or the BSA officer. Supporting documents may also require careful handling; disclosure obligations depend on who requests them and under what authority.

Organization and access controls

Maintain the SAR and supporting records in a restricted, searchable repository linked to the case number and filing date. Limit access to authorized personnel, track retrievals, and preserve the originals or faithful business-record equivalents. Do not store reports in an ordinary loan file that is broadly accessible to sales staff or send them through general email.

Build retention into the case-management process so a filing does not disappear when an employee leaves or an account closes. If records are moved between systems, validate that attachments, metadata, and dates remain intact. Apply a legal hold if required, and follow the retention schedule for any related investigative records that fall outside the SAR-specific minimum.

Responding to an authorized request

FinCEN guidance says the institution must make supporting documentation available to FinCEN and appropriate law-enforcement or supervisory agencies on request. The SAR remains confidential; a request from a borrower or private litigant is not the same as an authorized agency request. Refer any demand for the report or the fact of filing to the designated BSA officer or legal team.

For SAFE exam questions, remember five years from the SAR filing date and the duty to maintain supporting documentation. Do not confuse SAR retention with Regulation B, RESPA, or general loan-file retention periods. The SAR rules exist under the Bank Secrecy Act and have their own confidentiality and access controls.

Practical review points

Create a retention record with the filing date, covered institution, case identifier, storage location, and scheduled destruction date. Restrict access and log retrievals, while maintaining an effective process for legal holds and agency requests. If records are stored in multiple systems, preserve a clear link between the SAR, transaction, and underlying evidence. A servicing transfer, sale of a loan, or employee departure should not break the company’s ability to retrieve supporting records for the full retention period.

Additional application detail

Retention does not authorize broad internal distribution. Share SAR-related material only with personnel who need it for their duties and follow the institution’s confidentiality policy. A request from a regulator or law-enforcement agency should be routed promptly to the BSA officer, who can confirm authority and preserve a response record without disclosing the SAR to the customer.