the ability to generate, review, and file SAR reports. Disruption impact: medium regulatory (failed SARs are a compliance risk, not immediate customer harm).