Compliance Records: SAR & MSB Forms Retention

Records of compliance are the documents and evidence showing that an organization has followed applicable legal, regulatory, policy, and control requirements. In a BSA or AML program, they can include policies, risk assessments, training records, customer due diligence files, transaction-monitoring alerts, investigation notes, SAR or CTR filings, approvals, and audit results. Strong records are complete, securely maintained, searchable, and available for examination.

Under FinCEN’s SAR requirements, a financial institution generally must maintain a copy of each filed SAR and the supporting documentation for five years from the filing date. Supporting documentation includes records underlying the reported activity and must be made available to FinCEN, law enforcement, federal functional regulators, and certain other authorized agencies upon request.

Retain the materials that substantiate the SAR decision and narrative, such as transaction records, account statements, alerts, investigator notes, customer information, communications, escalation records, and relevant screenshots or data extracts. The case file should demonstrate how the activity was identified, investigated, reviewed, and resolved. Maintain version control and clear links between the filing and underlying evidence.

Many Bank Secrecy Act recordkeeping obligations applicable to money services businesses require records to be retained for five years, although the specific trigger date and document type can differ. MSBs should map requirements for registration, transactions, funds transfers, customer identification, SARs, CTRs, and state obligations. A written retention schedule helps avoid premature destruction or inconsistent practices.

Yes. SARs, information that would reveal a SAR exists, and details identifying the person involved are subject to strict confidentiality restrictions. Access should be limited to personnel with a legitimate compliance or legal need to know. Organizations should use role-based access, secure storage, staff training, and escalation procedures to prevent improper disclosure to customers, subjects, or unauthorized third parties.

MSBs should retain documentation supporting their FinCEN registration and renewal obligations, along with related ownership information, submission confirmations, and internal approvals. The registration form itself is only one part of the recordkeeping picture. Supporting BSA program records, agent information where applicable, and evidence of ongoing compliance should also be organized for efficient retrieval during an examination.

Start with a documented retention schedule that assigns ownership, retention periods, storage locations, and access rules for each record category. Test whether your team can retrieve sample SAR case files, risk assessments, training logs, monitoring evidence, and filings quickly. Resolve missing documentation, preserve review trails, and align policy language with actual practice before an examiner requests records.

A third-party platform may store compliance records, but the regulated organization remains responsible for record availability, security, confidentiality, and retention. Conduct vendor due diligence covering access controls, encryption, backup and recovery, data location, audit logs, export capability, and contract terms. Ensure your team can retrieve complete records promptly if the vendor relationship changes or an examination occurs.