Investigation Timelines and Continuing Activity Reviews

1. Why This Topic Matters
Anti-financial crime (AFC) programs are judged not only on whether they detect suspicious activity but on how quickly they investigate it, decide on it, and report it. Regulators, examiners, and law enforcement all depend on timely suspicious activity reporting because stale intelligence has little value in disrupting money laundering, terrorist financing, fraud, or sanctions evasion. Late filings, unmanaged alert backlogs, and failure to monitor ongoing suspicious activity are among the most common findings in enforcement actions against banks, money services businesses, broker-dealers, and casinos. For the CAMS exam, this topic sits inside the Controls, Investigations and the AFC Organization domain and is tested through scenario questions that ask you to pick the correct deadline, the correct trigger for the clock, or the correct next step when suspicious activity continues after a report has been filed.

2. What Investigation Timelines Are
An investigation timeline is the sequence of controlled, documented steps from the moment an institution detects potentially suspicious activity until it either files a suspicious transaction or activity report (STR/SAR) with the relevant financial intelligence unit (FIU) or documents a reasoned decision not to file. A sound timeline typically includes:
- Alert generation from transaction monitoring, sanctions screening, referrals from staff, subpoenas, 314(a)-type requests, or negative news.
- Triage and alert disposition, where analysts clear false positives and escalate genuine concerns within internal service level agreements (SLAs).
- Case investigation, including KYC/CDD review, transaction analysis, open-source research, and internal inquiries.
- Decision and documentation, where a filing decision is made and the rationale is recorded whether or not a report is filed.
- Filing and post-filing actions, such as enhanced monitoring, account restrictions, relationship exit reviews, and law-enforcement liaison.

3. Key Regulatory Deadlines You Must Know
United States (FinCEN rules, the most frequently tested):
- A SAR must be filed no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing.
- If no suspect can be identified on the date of detection, the institution may delay filing up to 60 calendar days in order to identify a suspect, but it must still file by day 60.
- Initial detection is not the date the transaction occurred and not necessarily the date the alert fired; it is the point at which the institution, through reasonable review, determines the activity is suspicious enough to warrant a filing. Institutions must nonetheless review alerts within a reasonable period, so they cannot indefinitely delay the start of the clock by leaving alerts unworked.
- Situations requiring immediate attention (for example, ongoing terrorist financing or active money laundering schemes) require the institution to notify law enforcement by telephone in addition to filing the SAR.
- SAR records and supporting documentation must be retained for 5 years from the filing date.
Other jurisdictions often referenced in CAMS material:
- United Kingdom: SARs must be submitted as soon as practicable; where consent (a Defence Against Money Laundering) is requested, the National Crime Agency has 7 working days to respond, followed by a possible 31-day moratorium period.
- Canada: STRs are filed with FINTRAC as soon as practicable once reasonable grounds to suspect are established.
- Australia: Suspicious matter reports go to AUSTRAC within 3 business days for most matters and within 24 hours where terrorism financing is suspected.
- FATF Recommendation 20 requires reporting promptly to the FIU when a financial institution suspects or has reasonable grounds to suspect that funds are proceeds of crime or related to terrorist financing. The exam is international; when a question does not name a country, apply the general principle of prompt filing and sound documentation rather than a specific numeric deadline.

4. What Continuing Activity Reviews Are
Filing a SAR does not end the institution's obligation. If the suspicious activity continues, the institution must keep monitoring the customer and file continuing activity reports (often called continuing SARs). Under US guidance:
- After an initial SAR, the institution reviews the account for a 90-day review period.
- At the end of that 90-day period, if the activity has continued, the institution has 30 days to file a continuing activity SAR. This means a continuing SAR is generally filed within 120 days of the previous related SAR filing date.
- The continuing SAR narrative should reference the prior SAR, summarize the activity in the new review period, and include the cumulative amount of suspicious activity to date.
- The institution should also reassess whether the relationship should continue; many programs require a documented senior-level or committee decision after a set number of continuing filings (for example, a third consecutive SAR triggers an exit review).
In jurisdictions without a formal 90/120-day rule, the same principle applies: ongoing suspicion must be re-evaluated and re-reported as new reportable activity arises, and the customer should be placed on enhanced monitoring.

5. How a Well-Run Program Manages Timelines
- Written procedures that define internal SLAs for alert review (often much shorter than the regulatory limit) and escalation paths.
- Case management systems that date-stamp each step, track aging, and generate backlog and overdue reports for management.
- Clear ownership of the decision to file, typically the BSA/AML officer or an equivalent designated reporting officer, with authority to file without business-line approval.
- Quality assurance that samples closed alerts and no-file decisions to confirm the rationale is documented and defensible.
- Management information to the board and senior management on filing timeliness, volume of continuing SARs, and backlog remediation.
- Resource planning so that staffing scales with alert volume; an unworked backlog is itself a regulatory red flag because it can suggest the institution is avoiding knowledge.
- Confidentiality controls so that the investigation and its timeline never result in tipping off the customer.

6. Common Pitfalls Tested on the Exam
- Confusing the transaction date or alert date with the date of initial detection.
- Believing the 60-day extension applies whenever more research is wanted; it applies only when no suspect has been identified.
- Forgetting that a filing decision must still be made and documented when the activity turns out not to be suspicious.
- Assuming the obligation ends after one SAR; continuing activity requires continued review and reporting.
- Miscalculating the continuing SAR window: it is 90 days of review plus 30 days to file, so roughly 120 days from the prior filing, not 90 days.
- Thinking that closing the account removes the duty to file on activity that already occurred.
- Overlooking the immediate telephone notification requirement for urgent matters.

7. Exam Tips: Answering Questions on Investigation Timelines and Continuing Activity Reviews
Tip 1 - Find the trigger before you count days. Read the scenario for the moment the institution formed a reasonable basis for suspicion. That is the start of the clock, not when the wire was sent or the alert populated.
Tip 2 - Memorize the core US numbers: 30, 60, 90, 120, 5. Thirty days to file; sixty if no suspect is identified; a ninety-day continuing review period; continuing SAR due about one hundred twenty days after the prior filing; five years of record retention.
Tip 3 - Watch for the phrase no suspect identified. It is the only condition that unlocks the 60-day window. If a name, account, or identifiable party is present, the answer is 30 days.
Tip 4 - When the question is jurisdiction-neutral, choose the answer that reflects prompt filing, documented rationale, and escalation to the designated AML officer. ACAMS favors principle-based answers over country-specific numbers unless the country is named.
Tip 5 - For continuing activity scenarios, look for the answer that includes three elements: keep monitoring, file a continuing report referencing the earlier one, and reassess the relationship. Answers that say the obligation ended with the first SAR are wrong.
Tip 6 - Urgency changes the answer. If the scenario describes terrorist financing, imminent harm, or an active scheme, the best response includes immediate contact with law enforcement in addition to the written report.
Tip 7 - Backlogs are never acceptable as an excuse. If a question asks what to do about aging alerts, the correct response involves escalating to management, documenting a remediation plan, and prioritizing by risk, never simply waiting for the deadline.
Tip 8 - Distinguish decision not to file from no action. The exam rewards answers that document the reasoning behind every disposition, including closures.
Tip 9 - Never choose an answer that involves informing the customer or the relationship manager of a filing. Tipping off prohibitions apply throughout the investigation and after filing.
Tip 10 - Eliminate extremes. Options that say file immediately on every alert, or that say wait until the investigation is complete regardless of time, are usually distractors. The best answer balances thoroughness with the regulatory deadline.

8. Quick Review Summary
Investigation timelines convert detection into timely, usable intelligence for the FIU. The clock starts at initial detection; US filers have 30 days (60 if no suspect is known); urgent matters also require a phone call to law enforcement; every disposition is documented; records are kept five years. Continuing activity reviews run on a 90-day cycle with a continuing SAR due within 30 days after that period, and repeated filings should prompt a documented relationship-exit decision. Master the triggers, the numbers, and the principle of prompt, documented, confidential reporting, and you will handle every CAMS question in this area with confidence.