Most compliance teams did not design their SAR alerting logic around a legal standard. They designed it around a number: $10,000. Transactions that creep close to that figure get flagged, scored, and queued for review, on the quiet assumption that proximity to the Currency Transaction Report threshold is itself a signal of suspicion. On 9 October 2025, FinCEN and the federal banking agencies (the Federal Reserve, FDIC, NCUA and OCC) published a joint Interagency FAQ that says, in plain terms, this assumption is wrong. The CTR threshold is not a suspicion proxy. If your alerting architecture treats it as one, you may be filing on the wrong transactions while missing the ones that actually matter.
What the law actually says
The SAR obligation does not come from a dollar figure. It comes from a state of mind. Under 31 U.S.C. §5318(g) and the implementing rule at 31 CFR §1020.320, a bank must file when it has "knowledge, suspicion, or reason to suspect" that a transaction involves funds from illegal activity, is designed to evade reporting requirements, has no apparent lawful purpose, or uses the institution to facilitate criminal activity. None of that language references $10,000. The CTR threshold exists to generate a currency transaction record, a separate and unrelated reporting mechanism. SAR filing has its own dollar floors for banks, $5,000 generally and $25,000 when no suspect can be identified, and even those figures are triggers for the filing obligation once suspicion exists, not the source of the suspicion itself.
The October 2025 FAQ was the first time the agencies jointly and explicitly reaffirmed this distinction in writing, which tells you something about how widespread the confusion has become in practice. Years of informal industry habit, vendor defaults, and rule libraries inherited from one institution to the next have quietly blurred a legal test into a dollar line.
The pattern this creates in real alerting systems
Walk through almost any legacy transaction monitoring ruleset built for a growing EMI or PSP and you will find scoring logic that assigns elevated risk weight to transactions sitting just under $10,000, on the theory that the customer is avoiding the CTR trigger. That theory can be right in a specific fact pattern. It is a poor universal rule. A customer moving $9,200 for entirely ordinary reasons gets the same elevated score as a customer structuring deposits to dodge reporting, while a transaction at $40,000 with a genuinely implausible business rationale, an unexplained source of funds, or a pattern that matches a known fraud typology can clear the same rules engine with no flag at all, simply because it sits far from the CTR line.
As transaction volume scales, this misalignment compounds. A threshold-anchored rule either floods investigators with low-value, proximity-based alerts that waste the 30-calendar-day window available to file (extendable to 60 days only when no suspect has been identified), or it desensitizes the team to volume and allows real suspicion signals, unusual counterparty patterns, inconsistent stated purpose, rapid layering, to pass through unexamined. Both failure modes are visible to an examiner, and both are now harder to defend given that the agencies have put the correct standard in writing.
Where AI fits, and where it does not yet have an answer
A growing number of EMIs and PSPs are piloting AI-assisted tools for alert triage and SAR narrative drafting. That is not itself a regulatory problem. US regulators affirmed as far back as a 2018 joint statement that AI and machine learning can be piloted within BSA/AML programs, and non-adoption of AI is not penalized. The open question is governance, not permission.
One widely cited figure in this space claims up to 61% investigator time savings from an agentic SAR-drafting architecture, drawn from a PayPal-affiliated preprint. Treat that number carefully. It is self-reported, has not been independently replicated, and has not cleared peer review. A defensible internal planning range looks more like 20 to 45% depending on how much of the drafting workflow is actually decomposed into agentic steps, and any institution relying on AI-assisted drafting should run its own replication study against its historical case population before putting a number like that into a business case.
On the EU side, the picture is still unsettled rather than simply strict. The EU AI Act excludes pure fraud-detection AI from its high-risk Annex III list, but AML and CFT monitoring tools sit in a contested zone under Annex III point 6 that the regulation itself has not fully resolved, even as general high-risk obligations became enforceable in August 2026. The AML Regulation, directly applicable from 10 July 2027, will harmonize suspicious transaction reporting obligations across the bloc under Article 70, running on its own separate clock from the AI Act. Any EU EMI or PSP building AI-assisted AML tooling now is effectively building for two compliance deadlines with two different triggers, and the only sane architecture is one built once to the stricter standard, documentation and human oversight included, rather than two parallel builds.
What to check before an examiner checks for you
A few concrete places to look, before this becomes someone else's finding rather than your own:
- Pull your current alert scoring logic and identify every rule that weights a transaction by its distance from $10,000, rather than by an independent indicator of suspicious intent.
- Confirm your SAR filing dollar thresholds for banks, $5,000 and $25,000 under 31 CFR §1020.320, are correctly implemented as filing floors once suspicion exists, not conflated with the CTR trigger itself.
- If you use AI-assisted drafting, confirm the architecture is retrieval-grounded and schema-constrained against source case data, not open-ended generation, and that a human sign-off gate exists before any drafted narrative reaches filing, with actual override and edit rates tracked to prove the control is real rather than theater.
- Track your own historical override rate on CTR-proximity alerts versus genuinely suspicion-driven alerts. If proximity-based alerts dominate your queue and rarely convert to filings, that ratio is itself evidence worth bringing to your next internal audit.
A rules engine built around a dollar line is easy to build and easy to explain to a board. It is also, as of October 2025, explicitly not what the law requires. The institutions that fix this now, quietly, in a code review rather than in response to an examination finding, are the ones that keep the advantage.