Law enforcement should obtain documentation from an institution when suspicious activity was identified by either requesting copies of the relevant documents from the accountable institution or acquiring a search warrant to obtain the documents. These are the legal and proper ways to access the supporting documentation that the institution is required to maintain for five years after filing a suspicious activity report (SAR). The institution must provide the documentation upon request by FinCEN or an appropriate law enforcement or supervisory agency, and should verify the identity and authority of the requestor. Law enforcement can also obtain a search warrant from a court if they have probable cause to believe that the documents contain evidence of a crime.
Reference:
Suspicious Activity Report Supporting Documentation
Answers to Frequently Asked Questions Regarding Suspicious Activity Reporting and Other Anti-Money Laundering Considerations, Question 1.
Obtaining Documentation from an Institution: Law Enforcement Procedures