When must I file a SAR?

File when you detect activity meeting your institution’s suspicious-activity criteria or when required by the BSA; prepare documentation promptly and do not delay until conclusions are reached.

What information should be included?

Include precise identifiers, account numbers, transaction details, chronology, and a concise narrative explaining why the activity is suspicious; attach supporting records and transaction extracts.

Can I tell the subject about the SAR?

No. SARs and related information are confidential; unauthorized disclosure may violate law and internal policy and could expose the filer to sanctions.

How long must I keep SAR records?

Retain SARs and supporting records consistent with federal and internal policy—commonly at least five years; if PHI is included, retain per HIPAA (45 CFR §164.530(j)).

Is electronic filing acceptable?

Yes. Regulators accept secure electronic submissions; ensure the platform provides strong authentication, audit logs, and tamper-evident storage.

Who reviews and approves SARs internally?

Designated AML officers and legal counsel typically review SARs; implement a documented approval workflow to ensure consistency and defensible decision-making.

Business SAR Document

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

BUSINESS SAR SERVICE AGREEMENT

This Business SAR Service Agreement (the Agreement) is made and entered into as of Effective Date: by and between Client Name: with principal address at , and Service Provider Name: with principal address at .

RECITALS

WHEREAS, Client conducts business that requires monitoring and, where appropriate, reporting of suspicious transactions and activities in accordance with applicable law and internal policy; and

WHEREAS, Service Provider provides professional compliance, investigatory, and Suspicious Activity Report (SAR) preparation services and represents that it has the expertise, personnel, and systems necessary to assist Client with the identification, documentation, preparation, and delivery of SARs and related records; and

WHEREAS, the parties desire to set forth their respective rights and obligations regarding the engagement of Service Provider to perform SAR-related services for Client on the terms and conditions set forth herein.

1. SCOPE OF WORK

Services to Be Provided

Service Provider shall provide the services described above which may include: (a) intake and triage of potential suspicious activity; (b) investigation and documentation of facts and supporting records; (c) preparation of SAR narrative and required reporting forms; (d) secure transmission of reports to Client's designated compliance officer; and (e) training or consultation related to specific reported matters as agreed in writing. Service Provider shall perform services in a professional manner consistent with industry standards and applicable legal requirements.

2. PAYMENT TERMS

Total Fee Payment Schedule Late Fee

Unless otherwise agreed, invoices are due within the number of days specified in Payment Schedule. Any undisputed amount not paid when due shall accrue interest at the Late Fee rate indicated above until paid in full. Client shall timely reimburse Service Provider for reasonable out-of-pocket expenses incurred in connection with performance of the Services, provided such expenses are pre-approved by Client where required by the parties.

3. TERM AND TERMINATION

Term Commencement Date Term End Date (if any) Notice Period for Termination Without Cause

Either party may terminate this Agreement for material breach by the other party if the breaching party fails to cure such breach within thirty (30) days following written notice. Either party may terminate without cause upon the Notice Period specified above. Termination shall not relieve Client of its obligation to pay for Services performed and expenses incurred through the effective date of termination.

4. CONFIDENTIALITY

For purposes of this Agreement, Confidential Information means all non-public information disclosed by one party to the other, whether oral, written, electronic or otherwise, that is identified as confidential or that reasonably should be understood to be confidential under the circumstances. Service Provider shall maintain the confidentiality of Client's Confidential Information and shall use such information solely to perform the Services. Confidential Information does not include information that: (a) is or becomes generally known to the public without breach of this Agreement; (b) was in the receiving party's possession prior to receipt from the disclosing party; (c) is rightfully received from a third party without restriction; or (d) is independently developed without use of the disclosing party's Confidential Information.

Notwithstanding the foregoing, Service Provider may disclose Confidential Information to the extent required by applicable law or regulation; provided that Service Provider gives Client prompt written notice of such requirement to the extent legally permitted and cooperates with Client, at Client's expense, to seek a protective order or other appropriate remedy.

5. RECORD RETENTION & COOPERATION

Retention Period (years)

Service Provider shall maintain records related to investigations and SAR preparation for the Retention Period specified above and shall provide reasonable cooperation and access to such records to Client upon request. Client acknowledges and agrees that Service Provider may retain copies of reports and supporting records created in the course of performing the Services unless otherwise instructed in writing.

6. COMPLIANCE WITH LAW; REPRESENTATIONS

Each party represents and warrants that it has the authority to enter into this Agreement and that its performance will comply with all applicable laws, rules, and regulations. Service Provider represents that it shall perform Services in a manner consistent with applicable legal and regulatory obligations related to SAR preparation and reporting. Client shall provide truthful, complete and timely information to Service Provider and will cooperate to enable Service Provider to meet legal requirements.

7. LIMITATION OF LIABILITY; INDEMNIFICATION

Except for liability arising from willful misconduct or gross negligence, neither party shall be liable to the other for indirect, incidental, consequential or punitive damages. Each party agrees to indemnify, defend and hold harmless the other party from third-party claims arising out of the indemnifying party's breach of this Agreement or negligent or willful acts or omissions in connection with performance hereunder.

8. GOVERNING LAW

Governing State Law

This Agreement shall be governed by and construed in accordance with the laws of the state specified above, without regard to principles of conflicts of law. Venue for any dispute arising out of or relating to this Agreement shall lie in the courts of that state.

9. ENTIRE AGREEMENT

This Agreement constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, negotiations and understandings, whether written or oral. Any amendment or modification must be in writing and signed by both parties.

10. MISCELLANEOUS PROVISIONS

If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect. Neither party may assign this Agreement without the prior written consent of the other, except that Service Provider may assign to an affiliate or in connection with a sale of substantially all of its assets.

CONTACTS

Client Contact Name Client Contact Email / Phone Service Provider Contact Name Service Provider Contact Email / Phone

ADDITIONAL TERMS

Additional Provisions

Client:

By:

Date:

Service Provider:

By:

Date:

What the Business SAR Document Is and when it applies

A Business SAR Document (Suspicious Activity Report) records and transmits details of suspected money laundering, fraud, or other suspicious transactions related to a business account or customer relationship. Financial institutions, money services businesses, brokers, and certain regulated entities use this form to document who, what, when, where, and why an activity is suspicious and to preserve accompanying evidence and supporting records. The completed report is submitted to the appropriate government authority under applicable rules and retained in the filer’s compliance files for the legally required retention period.

Why a Business SAR Document matters for compliance

Filing accurate SARs is a legal obligation that helps institutions detect and report financial crime, limit legal exposure, and meet Bank Secrecy Act requirements (see 31 U.S.C. §5318(g)). Clear, documented reports support regulators’ investigations and protect the filing institution from enforcement actions for failure to report.

Who typically prepares and files a Business SAR Document

Institutions with BSA/AML responsibilities create SARs and compliance teams normally control the process and approvals.

Banks and credit unions with deposit, lending, or wire activity monitoring responsibilities.
Money services businesses, broker-dealers, and payment processors monitoring suspicious flows.
In-house compliance teams, AML officers, and external counsel reviewing significant or ambiguous cases.

Prepare reports using institutional templates, retain supporting documentation, and follow internal escalation procedures before submitting to the government.

Step-by-step: complete a Business SAR Document

Follow a clear sequence: identify, gather evidence, document, review, approve, and submit.

01

Identify: Flag transactions meeting internal suspicious activity thresholds.
02

Gather: Collect transaction logs, customer IDs, communications, and related records.
03

Document: Complete the SAR narrative and enter all required fields precisely.
04

Review: Obtain AML officer approval and legal review if required.

How electronic SAR preparation and submission typically flows

Modern workflows combine internal case management with secure eSubmission to the regulator and retention of source records.

Case Open: Investigation triggered by alerts or manual referral.
Evidence Pack: Assembler collects all attachments and transaction extracts.
Report Draft: Compliance drafts the SAR narrative and fills required fields.
Submit: Approved SARs are transmitted via secure channel to the regulator.

Typical system configuration for digitizing Business SAR Documents

Set up fields, authentication, routing, and retention before production use.

Field	Configuration
Authentication	Multi-factor \| Strong signer authentication required
Field Types	Signature, date, text, attachments \| Structured and free-text fields
Routing Order	Sequential \| Investigator → AML officer → Legal
Audit Trail	Retention \| Full action log with timestamps

Technical considerations for electronic SAR workflows

Choose an eSubmission platform that supports secure authentication, audit trails, and evidence attachments.

Integrations: CRM, transaction monitoring, and case management system connectors
Document Formats: PDF, DOCX, CSV supported for attachments
Security: Encryption in transit and at rest

Timing expectations and internal deadlines for SAR handling

SAR filing cadence varies by jurisdiction and internal policy; implement clear internal SLAs for detection, documentation, review, and submission.

Initial Review Deadline:

Begin documented investigation within 24–72 hours of detection

Draft Completion:

Prepare a complete draft within internal SLA, commonly 7–14 days

Compliance Approval:

AML officer or designated approver signs off per policy

Regulator Submission:

Submit to the regulator without unnecessary delay per statutory rules

Retention Start:

Retain supporting evidence from discovery date onward

Common mistakes to avoid when preparing a Business SAR Document

Incomplete narrative that omits chronology, amounts, channels, or who acted; missing detail forces regulator follow-up and weakens the report.
Using inconsistent identifiers across records (different name spellings, missing TIN/EIN or DOB), which impedes link analysis and matching.
Delaying documentation until after lengthy investigation; late drafting can omit contemporaneous observations and degrade evidentiary value.
Unauthorized disclosure of filing to the subject; SARs are confidential and improper notice may create criminal or civil exposure.

Security, encryption, and compliance checkpoints for SAR handling

Transport Encryption: TLS 1.2/1.3

Data at Rest: AES-256 encryption

Audit Standards: SOC 2 Type II

Healthcare Controls: HIPAA (BAA required)

Regulatory Auth: ESIGN and UETA compliance

International: GDPR and CCPA provisions

Key penalties and risks for failing to prepare or file SARs correctly

Regulatory fines: Civil fines under BSA

Criminal exposure: Possible criminal liability

Civil suits: Private litigation risk

Operational impact: License restrictions or suspension

Reputational harm: Loss of client and partner trust

Data breach risk: Improper handling exposes PII

Illustrative compliance examples when digitizing suspicious-activity reporting

Real organizations describe integration and process improvements when shifting compliance forms and signatures to secure digital workflows.

Xerox — Kodi-Marie Evans

Xerox used integrated e-signature workflows for compliance forms

Integration with NetSuite reduced manual steps
The solution improved routing and document consistency, enabling faster internal approvals and clearer audit trails for compliance reviewers.

Tech Data — Bob Dutkowsky

Tech Data centralized document handling for internal and external compliance

Consistent templates enforced standard fields
Centralized processing reduced review time and provided uniform evidence packages for regulatory requests.

Comparing common eSignature options for SAR workflows

Price and core capabilities vary by vendor; signNow is listed first for straightforward platform cost comparison.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently asked questions about Business SAR Documents

Answers to common questions about timing, scope, confidentiality, and retention when preparing SARs.

Need help? Contact support

When must I file a SAR?
File when you detect activity meeting your institution’s suspicious-activity criteria or when required by the BSA; prepare documentation promptly and do not delay until conclusions are reached.
What information should be included?
Include precise identifiers, account numbers, transaction details, chronology, and a concise narrative explaining why the activity is suspicious; attach supporting records and transaction extracts.
Can I tell the subject about the SAR?
No. SARs and related information are confidential; unauthorized disclosure may violate law and internal policy and could expose the filer to sanctions.
How long must I keep SAR records?
Retain SARs and supporting records consistent with federal and internal policy—commonly at least five years; if PHI is included, retain per HIPAA (45 CFR §164.530(j)).
Is electronic filing acceptable?
Yes. Regulators accept secure electronic submissions; ensure the platform provides strong authentication, audit logs, and tamper-evident storage.
Who reviews and approves SARs internally?
Designated AML officers and legal counsel typically review SARs; implement a documented approval workflow to ensure consistency and defensible decision-making.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now