On-chain transaction monitoring & SARs for new crypto exchanges

Running compliance for a new, small crypto exchange here in Europe. We're using a third-party for transaction monitoring, which is great for flagging suspicious activity, but the SAR submission process still feels… clunky. Specifically, when does everyone feel confident enough in a 'series of small, frequent transactions' to actually pull the trigger on a SAR? It's easy to over-report out of caution, but under-reporting is obviously worse. Is there a generally accepted threshold or internal methodology you've found effective for crypto-specific patterns before escalating to a full SAR?