Why AML alert queues miss the SAR clock

AML alert backlogs put banks at risk of missing the 30-day deadline for suspicious activity reports and absorb most of the hours that financial crime teams spend. Leading compliance functions are managing each alert and investigation as an obligation with an owner, a deadline and a cost for every day it stays open.

Financial servicesSegeta Insights
Financial services
The number21 hrs

of work behind every suspicious activity report

What is at stake

A month of alert and investigation work can cost a regional bank about $$1.9 million.

Where days are lost
  1. Alert to case
  2. Case to decision
  3. Decision to filing and action

On a Thursday afternoon, a financial intelligence unit analyst at a regional bank opens an investigation that has been in her queue for 19 days. The case began with a transaction monitoring alert on a small business account that received a run of cash deposits just under the reporting threshold. She has requested know-your-customer records from the branch, account statements from the core system and a wire history from operations, and two of the three requests are still open in email. If the bank decides the activity is suspicious, the 30-day clock for filing a report started when it first detected the facts, and nobody on the team can see how many other cases are close to the same line.

Queues like this are now a structural feature of US anti-money laundering compliance. Financial institutions filed more than 4.1 million suspicious activity reports (SARs) with FinCEN in 2025, about 8 percent more than in 2024, including more than 2.19 million from banks, savings associations and credit unions.1 The total cost of financial crime compliance in the US and Canada reached $$61 billion, with labor the largest component, according to LexisNexis Risk Solutions.2 This article examines where alert and investigation time is lost, estimates what that time costs a composite bank, and sets out five actions for BSA and compliance leaders.

The SAR deadline is fixed while the work behind it keeps growing

Banks must file a SAR no later than 30 calendar days after initial detection of facts that may constitute a basis for filing, and may take up to 60 days only when no suspect has been identified.3 In October 2025, FinCEN clarified that institutions are not required to conduct a separate continuing activity review after a SAR and that there is no requirement or expectation to document a decision not to file, which may free some investigator time.3 In April 2026, FinCEN and the federal banking agencies proposed rules that would require AML/CFT programs to be reasonably designed, risk-based and effective, with comments due in June 2026.4

The effort behind each report is far larger than official estimates suggest. A Bank Policy Institute survey published in April 2024 found that banks spend 21.41 hours for every SAR filed, more than 10 times FinCEN's estimate of 1.98 hours.5 An earlier BPI study of large institutions found that participants reviewed about 16 million alerts and filed over 640,000 SARs in 2017, and that a median of 4 percent of SARs led to law enforcement follow-up.6 These are foundational figures, yet they show how much of the work goes into alerts and cases that never become reports.

Banks spend more than 10 times FinCEN's estimate on each suspicious activity report.

Exhibit 1Hours to file one suspicious activity reportHours per SAR, bank survey compared with FinCEN's paperwork estimate
Bank survey, 202421.41
FinCEN estimate1.98

Source: Bank Policy Institute, April 2024

Alerts and investigations lose days at three handoffs

Most of the time an alert spends open is waiting time between systems and teams. Monitoring systems generate the alert, but the evidence an analyst needs sits in core banking, know-your-customer files, wire systems, case notes and branch email, and each request for it can stall without anyone seeing the delay.

01Alert to case

An analyst triages the alert and decides whether to escalate it to an investigation. Delay starts when customer due diligence records are incomplete, when the same customer generates related alerts in several queues, or when alerts age before anyone looks at them.

02Case to decision

The investigator gathers statements, wire details and counterparties, writes a narrative and sends the case to quality review and, for complex matters, to the BSA officer. Each request for records depends on another team, and the case moves only as fast as its slowest response.

03Decision to filing and action

Once the bank decides to file, the SAR must be completed, reviewed and submitted inside the deadline, and the bank may need to restrict or exit the relationship. The consequences of weak follow-through can be severe: TD Bank pleaded guilty in October 2024 to Bank Secrecy Act violations after leaving 92 percent of its transaction volume, about $$18.3 trillion, unmonitored from 2018 to 2024, and paid more than $$3 billion in combined penalties.7

A connected operating model treats each alert as an obligation

Leading compliance functions are beginning to manage each alert, case and filing as an obligation with an owner, a deadline and a cost for every day it stays open. A live layer reads the systems already in use, including transaction monitoring, case management, core banking, know-your-customer records, email and chat, and runs a four-step loop:

  1. Detect

    aging alerts, open evidence requests and cases approaching the 30-day filing deadline as soon as they appear in any queue.

  2. Explain

    which evidence holds each case, which team owes it and how related alerts on the same customer connect.

  3. Recommend

    the next step and its owner, such as a records request to operations, a consolidation of related alerts or an escalation to the BSA officer.

  4. Execute and track

    every request, decision and filing to closure, measuring alert age, days to decision and filings made on time.

Artificial intelligence gathers evidence from source systems, summarizes account activity and drafts case narratives, while analysts, investigators and the BSA officer remain accountable for every decision to escalate, file or close. Every step can be logged with its source, which gives examiners and internal audit a complete trail.

AML alert backlogs can cost a regional bank about $$89,000 a day

The cost of a day in financial crime compliance is the analyst and investigator time consumed by alerts and cases for each working day they wait between systems and teams.

A month of alert and investigation work can cost a regional bank about $$1.9 million.

Exhibit 2. Estimated daily cost of alert review and SAR investigations for a composite regional bank

ComponentBasisEstimate per working day
SAR investigationsAssumes 250,000 alerts a year and a 4 percent alert-to-SAR rate 6, or 10,000 SARs, at 21.41 hours each 5 and $$70 an hour, over 250 working daysAbout $$60,000
Alerts closed without a SAR240,000 alerts a year; assumes 30 minutes of review each at $$60 an hourAbout $$29,000
Total per working daySum of the two componentsAbout $$89,000

Source: Segeta estimate based on BPI and FinCEN data; assumptions are illustrative.

On these assumptions, alert review and investigations cost about $$89,000 each working day, or about $$1.9 million over a 21-day working month. The estimate excludes the cost of lookback reviews, consent orders and remediation programs that follow when backlogs lead to late or missing filings, which in recent enforcement cases have run to billions of dollars.

What BSA and compliance leaders can do now

  1. 01Track every case against the filing deadline

    Show the age of each case from initial detection, and escalate cases that reach day 20 without a decision.

  2. 02Assemble evidence before the analyst opens the case

    Pull account statements, know-your-customer records and wire histories into the case automatically, so that investigators spend their time on judgment.

  3. 03Consolidate related alerts by customer

    Group alerts on the same customer and counterparties into one case, which reduces duplicate reviews and gives investigators a complete picture.

  4. 04Use the 2025 FinCEN FAQs to remove low-value work

    Review continuing activity and no-file documentation practices against the October 2025 guidance, and redirect the hours saved to higher-risk cases.

  5. 05Price the queue in hours and dollars per day

    Report alert age, investigator hours and filings on time to the board, in line with the effectiveness focus of the 2026 proposed program rule.

Banks cannot set the volume of suspicious activity they encounter, yet they control how quickly an alert becomes a complete case and a decision becomes a timely filing. Compliance functions that manage every alert and investigation as a live, priced obligation are likely to file on time, spend fewer hours on alerts that never become reports and show examiners an effective program with evidence in hand.

Questions leaders ask

What is the deadline for filing a suspicious activity report?

A bank must generally file a SAR no later than 30 calendar days after initial detection of facts that may constitute a basis for filing. If no suspect has been identified, it may take up to 30 more days to identify one, but filing must not be delayed beyond 60 days after initial detection.

How long does it take a bank to file a SAR?

A Bank Policy Institute survey published in April 2024 found that banks spend 21.41 hours on each SAR filed, more than 10 times FinCEN's estimate of 1.98 hours. Most of the time goes into gathering evidence, reviewing activity and writing the narrative.

What did FinCEN's October 2025 SAR FAQs change?

FinCEN clarified that institutions are not required to run a separate continuing activity review after filing and that there is no requirement or expectation to document a decision not to file. Institutions may still follow the earlier 90-day continuing activity practice if they choose.

How much do AML alert backlogs cost a bank?

On illustrative assumptions, a composite regional bank reviewing 250,000 alerts a year could spend about $$89,000 each working day on alert review and SAR investigations. The figure excludes lookbacks, consent orders and remediation costs that can follow late or missing filings.

Notes and sources
  1. Forvis Mazars, "Suspicious Activity Report (SAR) Filings Hit Record in 2025," March 2026, citing FinCEN SAR statistics, forvismazars.us.
  2. LexisNexis Risk Solutions, "True Cost of Financial Crime Compliance study, US and Canada," press release, February 2024, risk.lexisnexis.com.
  3. Financial Crimes Enforcement Network, "Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements," October 2025, fincen.gov.
  4. Venable LLP, "Federal Regulators Propose Major Reforms to AML Requirements," April 2026, venable.com.
  5. Bank Policy Institute, "BPI Survey Finds FinCEN Significantly Underestimates SAR Filing Demands," April 2024, bpi.com.
  6. Bank Policy Institute, "Getting to Effectiveness: Report on U.S. Financial Institution Resources Devoted to BSA/AML and Sanctions Compliance," October 2018, bpi.com.
  7. US Department of Justice, "TD Bank Pleads Guilty to Bank Secrecy Act and Money Laundering Conspiracy Violations in $$1.8B Resolution," October 2024, justice.gov; and Lowenstein Sandler, "TD Bank to Pay Historic $$3 Billion Over AML Compliance Violations," October 2024, lowenstein.com.