SAR Filing for RIAs: A Practical Guide to the Suspicious Activity Report Duty Arriving in 2028
What makes activity reportable, the 30 and 60 day clocks, how to write the narrative, confidentiality, joint filing with your administrator, and the records to keep.
Short Answer
From January 1, 2028, covered RIAs and exempt reporting advisers must file a suspicious activity report (SAR) with FinCEN for any transaction of at least $5,000 conducted or attempted by, at or through the adviser that they know, suspect or have reason to suspect involves illicit funds, is designed to evade BSA requirements, has no apparent lawful purpose, or uses the adviser to facilitate crime. The SAR is due within 30 calendar days of initial detection, or up to 60 days if no suspect has been identified. It is filed through the BSA E-Filing System, kept confidential, and retained with supporting documents for five years.
Key Takeaways
- The trigger is reason to suspect, not proof. Waiting for certainty is how deadlines are missed.
- The clock starts at initial detection of facts that may be a basis for filing, not when the investigation ends.
- Never tell the subject a SAR was filed or considered. Confidentiality is a legal obligation.
- The narrative is the part law enforcement reads. Write it so a stranger understands the case without the file.
- Decide now who files when the administrator, custodian and adviser all see the same activity.
Who must file SARs, and when does the obligation start?
FinCEN's final rule for the investment adviser sector, published in September 2024 and postponed by a December 2025 rule to an effective date of January 1, 2028, makes covered advisers financial institutions under the Bank Secrecy Act. Covered advisers are SEC-registered investment advisers and exempt reporting advisers. State-registered advisers, foreign private advisers and family offices are outside the rule.
The SAR duty arrives with the rest of the program. Advisers that already sit inside a broker-dealer or bank group may be filing SARs today at the group level; standalone advisers will be doing it for the first time. For the broader build, see why RIAs should build now for the 2028 rule.
What makes activity reportable?
Figure 1. A decision path for SAR filing. A yes at every question triggers the duty; a no at any question closes the case, ideally with a short written reason.
Three conditions must all be met:
- Amount. The transaction, or a pattern of related transactions, involves or aggregates at least $5,000 in funds or other assets.
- Channel. It is conducted or attempted by, at or through the adviser. Attempted matters: a subscription you refused can still be reportable.
- Suspicion. You know, suspect or have reason to suspect that the transaction involves funds from illegal activity or is intended to hide them, is designed to evade BSA requirements, has no business or apparent lawful purpose and you know of no reasonable explanation after examining the facts, or involves use of the adviser to facilitate criminal activity.
"Reason to suspect" is an objective standard. The question is whether a reasonable adviser with the same facts would have been suspicious, not whether you personally were.
What does reportable activity look like in a private fund?
| Situation | Likely outcome |
|---|---|
| LP pays a capital call from an unrelated offshore company and cannot explain why | Strong SAR candidate |
| Prospective investor withdraws when asked for source of wealth documents, after pressing for a fast close | Consider a SAR on the attempted transaction |
| Investor's beneficial owner is named in credible reports of a foreign bribery scheme | Investigate; SAR likely if the subscription money cannot be distinguished from the alleged proceeds |
| Payment comes from the investor's spouse's account, with a documented explanation | Usually no SAR; record the reason |
| Exact sanctions match on an existing LP | OFAC blocking and reporting first, within 10 business days; SAR assessment in parallel |
| Employee suspects a colleague altered investor records | Insider abuse is reportable; escalate outside the reporting line |
Sanctions and SARs run on separate tracks. A true match to a blocked person triggers OFAC blocking and reporting obligations regardless of the SAR analysis. Our guide to OFAC screening for U.S. funds covers that process.
What are the SAR filing deadlines?
Figure 2. The SAR clock. Day 30 is the standard deadline; day 60 applies only while you are trying to identify a suspect. The continuing activity points follow FinCEN guidance that is now optional.
- Day 0: initial detection. The day your team becomes aware of facts that may be a basis for filing. FinCEN has long said this is not necessarily the day an alert fires; a reasonable review period to determine whether activity is suspicious is acceptable. But the review must be prompt, and a backlog does not stop the clock in an examiner's eyes.
- Day 30: filing deadline. The SAR is due no later than 30 calendar days after initial detection.
- Day 60: outer limit. If no suspect is identified, you may take up to 30 more days to identify one, but in no case may filing be later than 60 days after initial detection.
- Continuing activity. FinCEN has historically suggested reviewing continuing activity every 90 days and filing a continuing SAR within 120 days of the previous one. The October 2025 FAQs from FinCEN and the federal banking agencies clarified that a separate continuing activity review is not required and that institutions may rely on their risk-based procedures; those following the older approach file by day 150, covering the full 90-day period.
Where activity requires immediate attention, such as ongoing terrorist financing, notify law enforcement by telephone in addition to filing.
How do you write a good SAR narrative?
The structured fields of the SAR form identify the subject, the amounts and the dates. The narrative is where you explain why it is suspicious. Investigators often read nothing else. Write it for someone who has never heard of your fund:
- Opening. One paragraph: who you are, who the subject is, the total amount, the date range and the type of suspicious activity.
- Background. The relationship: when the investor was onboarded, the fund, the commitment, the stated source of wealth and funds.
- What happened. Each transaction in date order with amounts, accounts and banks.
- Why it is suspicious. The specific facts that diverge from the profile or have no lawful explanation.
- What you did. Enhanced monitoring, refused calls, relationship exit, records kept, and where the supporting documentation is held.
Be factual, use plain language, avoid internal jargon and abbreviations, and do not speculate beyond the facts. An AI agent can draft this from a well-built case file, but the reviewer must check every fact and own the conclusion. See AI agents for investment adviser compliance for where that line sits.
What are the confidentiality rules?
A SAR, and any information that would reveal its existence, is confidential. You may not tell the subject, and you may not tell anyone else outside narrow permitted channels. That includes the investor's lawyer, the investor relations team, and, in most cases, the general partner's own investment professionals who do not need to know.
In return, the BSA gives filers a safe harbor from civil liability for making the report. It does not protect a firm that discloses the filing.
Practical consequences for funds:
- Do not explain a refused capital call or a frozen distribution by reference to an AML review. Use neutral language agreed with counsel.
- Keep SAR case files in a restricted location, not the shared investor folder.
- Report SAR activity to the board in aggregate or through the AML officer, without identifying subjects to people outside the need-to-know group.
Who files when several institutions see the same activity?
A subscription wire touches the investor's bank, the fund's bank, the administrator and the adviser. Each covered institution has its own obligation. The rule permits joint SARs, so one report can cover several filers if each is named and the report is complete for all of them.
Agree the arrangement in your administration agreement before you need it: who investigates, who drafts, who decides for the adviser and how the adviser gets a copy of any joint filing. Remember that an administrator outside the U.S. may file under its own local regime, which does not discharge the adviser's FinCEN obligation.
What records must you keep?
Keep a copy of each SAR and the original or business record equivalent of all supporting documentation for five years from the filing date. Supporting documentation is deemed filed with the SAR, and you must provide it to FinCEN or appropriate law enforcement on request. Build the case file so the documentation is identifiable as supporting a specific SAR, not scattered across email.
How should an adviser set up SAR governance?
- Named decision maker. The AML officer decides, with a deputy for absences. Investment staff can escalate but should not veto.
- Escalation route that bypasses the subject. If a principal is the subject, the route must go around them.
- Case log. Every escalation with dates, so you can show detection-to-filing times.
- Training. Investor relations and operations staff are your best detectors. Train them on red flags and on not tipping off.
- Independent testing. Include a sample of SAR decisions, filed and not filed, in the annual test.
Where Verifica fits
A SAR is only as good as the file behind it. Verifica builds and maintains that file for every investor: verified identity, ownership to natural persons, screening results and dispositions, and a timestamped history of every check and every reviewer decision. When a case opens, the analyst starts with a complete record rather than a search through inboxes, and the facts that go into the narrative trace back to their sources. Verifica does not file SARs or decide whether to file; that decision stays with your AML officer.
Frequently Asked Questions
When do RIAs have to start filing SARs?
Covered SEC-registered advisers and exempt reporting advisers must comply from January 1, 2028, when the Investment Adviser AML Rule takes effect.
What is the SAR filing threshold for investment advisers?
$5,000 in funds or other assets, for transactions conducted or attempted by, at or through the adviser.
How long does an investment adviser have to file a SAR?
30 calendar days after initial detection of facts that may be a basis for filing. If no suspect is identified, filing may be delayed by up to 30 more days, but never beyond 60 days.
Can an adviser tell an investor that a SAR was filed?
No. SAR confidentiality prohibits disclosing a SAR or information that would reveal its existence to the subject or other unauthorized persons.
Can the fund administrator file a SAR for the adviser?
A joint SAR can name several filers, and the administrator can do the investigative work. The adviser remains responsible for its own obligation and should receive a copy of anything filed on its behalf.
Do we have to document a decision not to file a SAR?
FinCEN's October 2025 FAQs confirmed there is no requirement to do so. Recording a brief reason is still good practice because examiners ask how closed cases were resolved.
Sources
- FinCEN, AML/CFT Program and SAR Filing Requirements for Registered Investment Advisers and Exempt Reporting Advisers, final rule, 89 Fed. Reg. 72156 (September 4, 2024), and postponement to January 1, 2028.
- FinCEN and federal banking agencies, Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements (October 9, 2025).
- 31 U.S.C. 5318(g), reporting of suspicious transactions, including the safe harbor at 5318(g)(3).
- OFAC, Reporting, Procedures and Penalties Regulations, 31 CFR Part 501.
- FinCEN, SAR Narrative Guidance Package.
Rodolfo Santos is a real estate compliance attorney with 10+ years of experience in cross-border transactions and the co-founder of Verifica, an AI-powered compliance platform for real estate professionals. He has closed over 150 property transactions worth more than €50 million.
