Institutions must report transactions they know, suspect or have reason to suspect involve funds from illegal activity, are designed to evade reporting requirements, have no apparent lawful purpose, or involve the use of the institution to facilitate criminal activity.

Thresholds and timing. Dollar thresholds vary by institution type and by whether a suspect is identified. The filing deadline runs from initial detection of facts that may constitute a basis for filing, with a limited extension where no suspect has been identified. Detection means when the review is complete enough to conclude, not when an alert first generates — but institutions cannot extend the clock by letting reviews sit.

Continuing activity. Where suspicious activity continues, periodic follow-up filings are expected at defined intervals.

The narrative is the part with value. It should state who, what, when, where, why suspicious, and how, in plain language, so that a reader outside the institution can act on it.

Confidentiality is absolute. No person may disclose the existence of a filing, including to the customer. This extends to civil discovery, and courts consistently prohibit production. Internal handling must reflect that.

Safe harbor. Statutory immunity protects institutions and employees from liability for filing, including for filings that turn out unfounded. That protection is broad and is the answer to concern about over-filing.