Suspicious Activity Reports: When and How They Are Filed

A suspicious activity report, or SAR, is a confidential report that a regulated financial firm files with the relevant financial intelligence unit when it knows, suspects or has reasonable grounds to suspect money laundering, terrorist financing, fraud or another financial crime. A financial intelligence unit, often called an FIU, is the government body that receives, analyzes and shares financial intelligence with law enforcement and other authorized agencies.

SARs are an information-reporting mechanism, not an accusation or proof that a crime occurred. They allow authorities to identify patterns across institutions, accounts, jurisdictions and time periods. Filing duties, deadlines and legal thresholds vary by country and by regulated sector, so firms should apply the rules that govern their own activities and seek legal or compliance advice where needed.

What triggers a suspicious activity report?

Suspicion may arise from a transaction, a customer relationship or a pattern of behavior. Common indicators include activity that does not fit the customer’s known business, rapid movement of funds through multiple accounts, attempted use of false identity documents, unusual cash activity, payments linked to high-risk fraud typologies, or efforts to evade screening and reporting controls. No single red flag automatically requires a SAR. Firms assess the available facts, their customer knowledge and the applicable legal standard.

US rule: Banks and other covered financial institutions have SAR obligations under Bank Secrecy Act regulations. For banks, a SAR is generally required for a suspicious transaction involving at least $5,000 when a suspect can be identified. Other thresholds and categories can apply, including suspected crimes involving insiders and transactions where no suspect has been identified. The requirement is based on suspicion and the relevant regulatory criteria, not simply on an unusual transaction.

UK rule: Firms in the regulated sector must make a disclosure where they know or suspect, or have reasonable grounds for knowing or suspecting, that a person is engaged in money laundering. The UK regime does not use a general minimum transaction value as the test for making a SAR. The facts and the statutory suspicion standard are central.

Where SARs go and how they are filed

US rule: SARs are filed with the Financial Crimes Enforcement Network, or FinCEN, the United States Treasury Department’s financial intelligence unit. Covered institutions typically submit filings through FinCEN’s electronic reporting system, using internal investigation and escalation processes to collect the relevant information.

UK rule: SARs are submitted to the National Crime Agency, or NCA, which performs the UK’s financial intelligence function. In many organizations, employees escalate concerns internally to the firm’s money laundering reporting officer, often shortened to MLRO. The MLRO assesses the information and, where appropriate, submits a SAR to the NCA. Internal escalation does not remove the need for firms to maintain effective controls and make disclosures when required.

Timing and confidentiality

US rule: Banks generally must file a SAR within 30 calendar days of the initial detection of facts that may form a basis for filing. If no suspect is identified, the filing period may be extended to 60 calendar days. The clock is tied to detecting facts that warrant filing, rather than to the date a transaction was first processed. Firms should preserve relevant records and may need to continue monitoring and file follow-up SARs when significant new activity appears.

UK rule: The law requires disclosure as soon as practicable after the relevant knowledge or suspicion arises. Where a firm needs a defense against money laundering before proceeding with a transaction or other act, it may need to seek appropriate consent from the NCA through the SAR process and observe the applicable notice procedures. This is a specialized area and requires jurisdiction-specific legal and compliance assessment.

Do not tip off the customer

US rule: Financial institutions and their directors, officers, employees and agents generally may not notify a person involved in a transaction that a SAR has been filed or reveal information that would disclose the existence of a SAR. This confidentiality obligation is commonly called the SAR confidentiality rule.

UK rule: Tipping off can be a criminal offense. A person must not disclose information likely to prejudice an investigation when the relevant legal conditions are met, including circumstances connected with a SAR or money-laundering investigation. Customer-facing staff should use approved, neutral communications and promptly involve the MLRO or legal team when a customer asks about delayed or restricted activity.

What makes a SAR useful?

A useful SAR gives investigators a coherent account of what happened and why it matters. It should distinguish verified facts from the firm’s analysis, avoid speculation, and use plain, specific language. The narrative is especially important because it connects transaction data with customer due diligence, device or identity evidence, communications and linked accounts.

• Who: Identify customers, beneficial owners, counterparties, account holders and known associates, using available identifiers such as dates of birth, addresses, account numbers and business details.
• What: Describe the transactions, attempted transactions or behavior, including amounts, payment methods, instruments, account activity and relevant transaction references.
• When and where: Provide dates, times, locations, channels and jurisdictions. State the period reviewed and whether the activity is continuing.
• Why: Explain the indicators of suspicion and why the activity is inconsistent with the customer profile or appears designed to conceal funds, evade controls or facilitate crime.
• What the firm did: Record relevant steps, such as account restrictions, internal review, contact with law enforcement where permitted, or a decision to continue monitoring. Do not include information that would improperly disclose a SAR to the customer.

SARs versus currency transaction reports

SARs are suspicion-based: the key question is whether the facts meet the applicable suspicion standard, even if the amount is small. Currency transaction reports, or CTRs, are generally threshold-based reports triggered by qualifying cash activity, regardless of whether the institution suspects wrongdoing.

US rule: A CTR generally reports cash transactions exceeding $10,000 in a single business day, including multiple related transactions. A reportable cash transaction can be entirely legitimate, while a suspicious transaction below that threshold can still require a SAR. The two reports serve different purposes, and the same activity can, in some circumstances, lead to both filings.

A compliance process, not legal advice

SAR decisions should be supported by documented policies, trained staff, escalation routes, quality review and secure recordkeeping. Identity verification, transaction monitoring and sanctions screening can supply useful evidence, but no technology alone determines whether a legal reporting duty exists. This explainer is general information, not legal advice. Firms should consult qualified counsel and their compliance teams for requirements in each applicable jurisdiction.