The latter is required; the former is also “required” but more nebulous (it’s only a problem if there is some incident and then during an investigation, look back and it turns out the bank didn’t file the report, creating a convenient scapegoat in an otherwise difficult case).