Retain confidential review access before returning the exact encrypted legal basis

Confidential BSA legal-clock workflow, dedicated existing compliance:filings staff authority and recent step-up for controls/export. Candidate alerts and actual packet sources do not establish reportability or a legal trigger. CTR uses actual source date plus 15 calendar days; SAR requires an explicitly reviewed initial-detection date plus 30, with a supported initially-unknown-suspect extension at most 60. A SAR determination may instead reference an actual continuing-activity candidate: its trigger is the prior accepted filing date, the source must fall inside the candidate's 90-day review period and the deadline is the candidate's 120 calendar days (fincen-sar-continuing-activity-clocks-2026-09-14.v1). Independent exact review is required for legal determinations and corrections. Linked packets must have matching actual form/source and report lineage (a continuing clock links only its candidate's continuing report) and production authenticated acceptance; acknowledgment date never supplies the legal trigger. Complete form-filtered cursor queue retains overdue, rejected, unfiled, source-change and late-acceptance evidence. Legal basis remains encrypted and excluded from general discovery; no external transmission.