Representative capture · 10 Jul 2026

Regulatory change analysis

Cadre pack · Marginalia

Turns a supplied rule change into candidate obligations, control mappings, gaps, and proposed actions for review.

One frozen, sanitized execution on representative data. It shows an observed path and retained decision—not repeatability, production fitness, legal instruction, or regulatory compliance.

Recorded decision

Decision record

Coverage

10 obligations · 8 gaps

Assessment Recorded — 31 CFR § 1020.320

The assessment has been committed. Here is the executive summary for your compliance file.

Obligation Inventory (10 obligations)

ID	Obligation	Citation	Coverage
OBL-01	Detect suspicious transactions ≥ $5,000 meeting enumerated triggers	(a)(1)–(2)	Covered
OBL-02	File SAR with FinCEN on prescribed form	(a)(1), (b)(1)–(2)	Covered
OBL-03	File within 30 calendar days of initial detection	(b)(3)	Partial
OBL-04	Extend to 60-day maximum if no suspect identified; never exceed 60 days	(b)(3)	Partial
OBL-05	Immediate telephone notification to law enforcement for urgent violations	(b)(3)	Gap
OBL-06	Collect and label supporting documentation for every SAR	(b)(1), (d)	Partial
OBL-07	Retain SAR copies + supporting docs for 5 years from filing date	(d)	Gap
OBL-08	Produce SAR records to FinCEN/law enforcement/regulators upon request	(d)	Gap
OBL-09	SAR confidentiality — prohibition on disclosure by all bank personnel	(e)(1)(i)	Gap
OBL-10	Decline subpoenas for SARs; cite statute; notify FinCEN	(e)(1)(i)	Gap

Control Mapping Summary

Control	OBLs Addressed	Max Coverage
CTRL-SAR-01 Suspicious Activity Monitoring & Reporting	OBL-01, 02, 03, 04, 06	Partial on 03, 04, 06
CTRL-AML-01 AML Program & BSA Officer	OBL-01	Covered (supporting)
CTRL-CIP-03 / CTRL-CTR-01 / CTRL-CIP-01 / CTRL-CIP-02	—	Out of scope — not credited

Gaps & Remediation Actions (7 actions)

#	Action	Owner	Priority
ACTION-1	Enhance CTRL-SAR-01 to explicitly codify 30-day deadline (OBL-03)	BSA Officer	alert HIGH
ACTION-2	Enhance CTRL-SAR-01 to document 60-day cap + suspect-extension protocol (OBL-04)	BSA Officer	alert HIGH
ACTION-3	Enhance CTRL-SAR-01 to require explicit collection & labeling of supporting docs (OBL-06)	BSA Officer	alert HIGH
ACTION-4	New control — SAR Record Retention (5 yrs from filing; distinct from CIP retention) (OBL-07)	Records Mgmt	alert HIGH
ACTION-5	New control — SAR Records Access & Production to authorities on request (OBL-08)	BSA Officer / Compliance	alert HIGH
ACTION-6	New control — SAR Confidentiality & Tipping-Off Prohibition + staff training (OBL-09)	BSA Officer / Legal	alert HIGH
ACTION-7	New control — Urgent telephonic law enforcement notification procedure (OBL-05)	Financial Crime	caution MEDIUM
ACTION-8	New control — SAR subpoena-decline playbook + FinCEN notification log (OBL-10)	Legal / BSA Officer	caution MEDIUM

Key Auditor Notes

Scope is confirmed — § 1020.320 is in Part 1020, which governs banks specifically. All 10 obligations apply to the bank.
CTRL-CIP-03 was expressly not credited for OBL-07. CIP record retention (5 years after account closure) and SAR record retention (5 years from filing date) are different obligations with different clocks, triggers, and record types.
CTRL-SAR-01's "regulatory timelines" language is the primary risk surface following this clarification — it must be updated to enumerate the 30/60-day rules explicitly before the bank can assert demonstrable procedural compliance.
The five pure gaps (OBL-05, 07, 08, 09, 10) represent structural control absences, not documentation gaps in existing controls. New controls need to be designed, approved, and operationalized.

Decision record retained · contract-validated

regId: "cfr-31-1020",

citation: "31 CFR § 1020.320 – Reports by banks of suspicious transactions",

id: "OBL-01",

text: "Detect and identify suspicious transactions conducted or attempted by, at, or through the bank that involve or aggregate at least $5,000 in funds or other assets and meet any of the three enumerated triggers: (i) funds derived from or used to hide illegal activity, (ii) designed to evade BSA requirements, or (iii) no apparent lawful purpose and no reasonable explanation after examining available facts.",

type: "detection",

citation: "§ 1020.320(a)(1)–(a)(2)(i)-(iii)"

id: "OBL-02",

text: "File a Suspicious Activity Report (SAR) with FinCEN by completing the prescribed SAR form and submitting it to the FinCEN-designated central filing location for each qualifying suspicious transaction.",

type: "reporting",

citation: "§ 1020.320(a)(1), (b)(1), (b)(2)"

id: "OBL-03",

text: "File the SAR no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing.",

type: "reporting / timeliness",

citation: "§ 1020.320(b)(3)"

id: "OBL-04",

text: "When no suspect is identified on the date of initial detection, the bank may delay filing for an additional 30 calendar days to identify a suspect; in no case may reporting be delayed more than 60 calendar days from the date of initial detection.",

type: "reporting / timeliness",

citation: "§ 1020.320(b)(3)"

id: "OBL-05",

text: "In situations involving violations requiring immediate attention (e.g., ongoing money laundering schemes), immediately notify an appropriate law enforcement authority by telephone, in addition to filing the SAR within the required timeframe.",

type: "notification",

citation: "§ 1020.320(b)(3)"

id: "OBL-06",

text: "Collect and maintain supporting documentation for each SAR filed; such documentation shall be identified and maintained as SAR supporting documentation and is deemed filed with the SAR.",

type: "recordkeeping",

citation: "§ 1020.320(b)(1), (d)"

id: "OBL-07",

text: "Retain a copy of every SAR filed and the original or business-record equivalent of all supporting documentation for a period of five years from the date of filing the SAR.",

type: "recordkeeping / retention",

citation: "§ 1020.320(d)"

id: "OBL-08",

text: "Make all SAR copies and supporting documentation available upon request to FinCEN, any Federal/State/local law enforcement agency, any Federal regulatory authority examining the bank for BSA compliance, or any State regulatory authority with BSA oversight authority.",

type: "records access",

citation: "§ 1020.320(d)"

id: "OBL-09",

text: "Maintain strict confidentiality of every SAR and any information that would reveal the existence of a SAR. No bank, director, officer, employee, or agent may disclose a SAR or reveal its existence, except as expressly authorized (e.g., to FinCEN, law enforcement, regulators, within corporate structure for BSA purposes, or in joint-SAR preparation).",

type: "confidentiality",

citation: "§ 1020.320(e)(1)(i)"

id: "OBL-10",

text: "If subpoenaed or otherwise requested to disclose a SAR or information revealing its existence, the bank must decline to produce it, citing § 1020.320 and 31 U.S.C. 5318(g)(2)(A)(i), and must notify FinCEN of the request and the bank's response.",

type: "confidentiality / legal response",

citation: "§ 1020.320(e)(1)(i)"

}

obligation: "OBL-01",

status: "covered",

note: "CTRL-SAR-01 explicitly covers detection and review of suspicious activity. CTRL-AML-01's board-approved internal controls and independent testing program provide the governance framework that supports systematic detection. Together these controls address the $5,000 threshold monitoring and all three triggering conditions."

obligation: "OBL-02",

status: "covered",

note: "CTRL-SAR-01 explicitly covers filing SARs. Its described scope includes reporting suspicious activity to the appropriate authority, which encompasses completing the FinCEN SAR form and submitting to the designated central location."

obligation: "OBL-03",

status: "partial",

note: "CTRL-SAR-01 states it files SARs 'within regulatory timelines,' but the control description does not explicitly enumerate the 30-calendar-day deadline from initial detection. Given this section was recently clarified, the bank cannot rely on a generic reference to 'regulatory timelines' to demonstrate calibrated compliance with the specific 30-day rule. The control procedure needs to be updated to explicitly codify the 30-day standard."

obligation: "OBL-04",

status: "partial",

note: "CTRL-SAR-01 references regulatory timelines generally but does not document the specific protocol for extending the filing deadline by up to 30 additional days when no suspect is identified, nor the absolute 60-calendar-day cap. The absence of explicit procedure creates risk that the extension is misapplied (used when a suspect is known) or that the 60-day hard ceiling is breached."

obligation: "OBL-05",

controls: [],

status: "gap",

note: "No existing control addresses the obligation to immediately notify law enforcement by telephone when a violation requires urgent attention (e.g., an ongoing money laundering scheme). CTRL-SAR-01 covers SAR filing; CTRL-AML-01 covers the AML program structure. Neither describes a telephonic emergency escalation protocol to law enforcement as a parallel track to SAR submission."

obligation: "OBL-06",

status: "partial",

note: "CTRL-SAR-01 covers detection and review of suspicious activity, which implies some documentation is assembled during case review. However, the control description does not explicitly state that supporting documentation is collected, labeled as SAR supporting documentation, and maintained as deemed-filed with the SAR per § 1020.320(d). The explicit collection and labeling obligation is not demonstrably covered."

obligation: "OBL-07",

controls: [],

status: "gap",

note: "No control covers SAR record retention. CTRL-CIP-03 covers CIP identity record retention (5 years from account closure) — a materially different scope, trigger, and record type. Its scope does not extend to SAR copies or SAR supporting documentation. CTRL-SAR-01 describes SAR filing but says nothing about a 5-year retention obligation measured from the date of filing. This is a genuine gap."

obligation: "OBL-08",

controls: [],

status: "gap",

note: "No control explicitly governs the obligation to produce SAR records to FinCEN, law enforcement, or Federal/State regulatory authorities upon request. CTRL-AML-01 covers examination readiness at a program level but does not describe a records-access process for SAR-specific production requests. This requires a documented, operationalized procedure."

obligation: "OBL-09",

controls: [],

status: "gap",

note: "No control covers SAR confidentiality. The prohibition on tipping off — extending to every director, officer, employee, and agent — is a distinct, far-reaching obligation that requires its own policy, staff training, and enforcement mechanism. Neither CTRL-SAR-01 nor CTRL-AML-01 describes a SAR confidentiality regime or tipping-off prohibition."

obligation: "OBL-10",

controls: [],

status: "gap",

note: "No control addresses the bank's legal response obligation when served with a subpoena or other demand for a SAR. The required actions — declining production, citing § 1020.320 and 31 U.S.C. 5318(g)(2)(A)(i), and notifying FinCEN — are specific legal procedures that require a documented playbook involving Legal, Compliance, and BSA Officer coordination. No existing control covers this."

}

"OBL-03 (partial): CTRL-SAR-01 references 'regulatory timelines' but does not explicitly codify the 30-calendar-day filing deadline from initial detection. Control procedures must be updated to reflect the clarified standard.",

"OBL-04 (partial): CTRL-SAR-01 does not document the protocol for the suspect-identification extension (additional 30 days) or the absolute 60-calendar-day cap. Procedures must define when the extension is permissible and how the clock is tracked.",

"OBL-05 (gap): No control exists for the immediate telephonic law enforcement notification obligation triggered by urgent violations (e.g., ongoing money laundering). A separate escalation procedure and control are needed.",

"OBL-06 (partial): CTRL-SAR-01 does not explicitly require collection, labeling, and maintenance of supporting documentation as 'deemed filed' with the SAR under § 1020.320(d). The control must be enhanced to make this explicit.",

"OBL-07 (gap): No control covers the 5-year retention of SAR copies and supporting documentation measured from the date of filing. CTRL-CIP-03 covers CIP records only and must not be credited here. A SAR record retention control is required.",

"OBL-08 (gap): No control covers the obligation to make SAR records available to FinCEN, law enforcement, and regulatory authorities upon request. A documented production/access procedure is required.",

"OBL-09 (gap): No control covers the SAR confidentiality and tipping-off prohibition applicable to all bank personnel (directors, officers, employees, agents). A confidentiality policy and training program are required.",

"OBL-10 (gap): No control addresses the legal response procedure when the bank receives a subpoena or demand to produce a SAR — specifically the obligation to decline, cite the statute, and notify FinCEN. A documented legal response playbook is required."

summary: "31 CFR § 1020.320 imposes 10 discrete obligations on the bank relating to SAR detection, filing, timeliness, recordkeeping, records access, confidentiality, and legal response. Two obligations are fully covered (detection via CTRL-SAR-01/AML-01; SAR form filing via CTRL-SAR-01). Three obligations are partially covered — all related to CTRL-SAR-01's generic 'regulatory timelines' language, which must be updated to explicitly codify the 30-day and 60-day deadlines, and to mandate collection/labeling of supporting documentation. Five obligations have no coverage at all: urgent law enforcement telephone notification (OBL-05), SAR record retention for 5 years from filing (OBL-07), on-request record production to authorities (OBL-08), SAR confidentiality and tipping-off prohibition (OBL-09), and the subpoena-decline/FinCEN-notification procedure (OBL-10). Given that the published change specifically clarifies SAR filing thresholds and timelines, CTRL-SAR-01's procedure documentation must be treated as a priority update item. The five gap areas require new or substantially enhanced controls before the bank can assert full compliance.",

"ACTION-1 [CTRL-SAR-01 enhancement — Owner: BSA Officer | Priority: HIGH]: Update CTRL-SAR-01 written procedures to explicitly codify the 30-calendar-day filing deadline from initial detection (OBL-03) and the 60-calendar-day absolute maximum, including the protocol for invoking the 30-day suspect-identification extension and documenting when and why it was applied (OBL-04). This is the primary control gap flagged by the regulatory clarification.",

"ACTION-2 [CTRL-SAR-01 enhancement — Owner: BSA Officer | Priority: HIGH]: Amend CTRL-SAR-01 to explicitly require that supporting documentation for each SAR be collected, labeled as 'SAR supporting documentation,' and maintained as deemed filed with the SAR per § 1020.320(b)(1) and (d) (OBL-06).",

"ACTION-3 [New control: SAR Record Retention — Owner: Records Mgmt | Priority: HIGH]: Create a dedicated SAR Records Retention control requiring: (a) retention of a copy of every SAR filed for 5 years from the filing date, (b) retention of the original or business-record equivalent of all supporting documentation for the same period, and (c) a retention schedule clearly distinct from CIP records (CTRL-CIP-03) to prevent scope confusion (OBL-07).",

"ACTION-4 [New control: SAR Records Access & Production — Owner: BSA Officer / Compliance | Priority: HIGH]: Create a control documenting the procedure for responding to record production requests from FinCEN, Federal/State law enforcement, and regulatory examiners, including who owns the response, turnaround standards, and documentation of requests received and fulfilled (OBL-08).",

"ACTION-5 [New control: SAR Confidentiality & Tipping-Off Prohibition — Owner: BSA Officer / Legal | Priority: HIGH]: Create a SAR Confidentiality control that: (a) establishes a written policy prohibiting disclosure of SARs or SAR existence by any director, officer, employee, or agent; (b) enumerates the permitted disclosure exceptions (FinCEN, law enforcement, regulators, within corporate structure, joint SARs); (c) mandates annual training for all covered personnel; and (d) establishes a breach escalation process (OBL-09).",

"ACTION-6 [New control: Urgent Law Enforcement Notification — Owner: BSA Officer / Financial Crime | Priority: MEDIUM]: Create a control and supporting procedure requiring immediate telephonic notification to appropriate law enforcement in situations requiring immediate attention (e.g., active money laundering schemes), including: criteria for 'immediate attention' classification, designated law enforcement contacts by jurisdiction, documentation of calls made, and linkage to the parallel SAR filing process (OBL-05).",

"ACTION-7 [New control / Legal playbook: SAR Subpoena Response — Owner: Legal / BSA Officer | Priority: MEDIUM]: Create a documented legal response playbook for SAR subpoenas and demands that: (a) directs the bank to decline production and cite § 1020.320 and 31 U.S.C. 5318(g)(2)(A)(i); (b) requires immediate notification to FinCEN of the request and the bank's response; (c) assigns ownership to Legal with BSA Officer notification; and (d) establishes a log of all such requests (OBL-10)."

]

}

Inspect the observed pathOpen the sanitized reasoning, actions, and ordered event record behind this decision.

This is the retained public trace from one frozen representative execution. It is not a live run, a repeatability claim, or a complete production audit record.

Marginalia

Briefed on the case

I'll kick off both fetches in parallel — the regulation section and the control inventory are independent.

I have the regulatory text and the full control inventory. Now I'll work through the text systematically — extracting every atomic obligation, scoping each one, and mapping to controls — before recording the assessment.

Parsing § 1020.320 → 10 discrete obligations:

#	Obligation	Citation
OBL-01	Detect suspicious transactions ≥$5,000 meeting the three enumerated triggers	(a)(1)-(2)
OBL-02	File a SAR with FinCEN using the prescribed form	(a)(1), (b)(1), (b)(2)
OBL-03	File within 30 calendar days of initial detection	(b)(3)
OBL-04	When no suspect identified at detection, may extend up to 60 days total; never exceed 60 days	(b)(3)
OBL-05	Immediately notify law enforcement by telephone for urgent violations (e.g., ongoing ML), in addition to SAR	(b)(3)
OBL-06	Collect and maintain supporting documentation for every SAR	(b)(1), (d)
OBL-07	Retain SAR copy + supporting documentation for 5 years from filing date	(d)
OBL-08	Make SAR records available to FinCEN/law enforcement/regulators upon request	(d)
OBL-09	Keep SARs and their existence strictly confidential; prohibit disclosure by all bank personnel	(e)(1)(i)
OBL-10	Decline any subpoena/request to produce SAR, cite statute, and notify FinCEN of request and response	(e)(1)(i)

Control scope check: CTRL-CIP-03 covers CIP identity record retention (5 years after account closure) — its scope does NOT reach SAR record retention, which has a different trigger (filing date) and purpose. These will not be cross-credited.

Decision record

Assessment Recorded — 31 CFR § 1020.320

Obligation Inventory (10 obligations)

Control Mapping Summary

Gaps & Remediation Actions (7 actions)

Key Auditor Notes

Observed path