Suspicious Activity Report (SAR)
A suspicious activity report is a confidential filing made to FinCEN when a US financial institution knows, suspects, or has reason to suspect that a transaction above a set dollar floor involves illicit funds, has no apparent lawful purpose, or is designed to evade reporting rules. It is filed without telling the customer.
Also called: SAR filing · FinCEN SAR
A suspicious activity report is the mechanism by which a regulated firm tells the government that something looks wrong. In the United States it is filed with FinCEN by the institutions covered by the Bank Secrecy Act — banks, most money services businesses, broker-dealers, casinos and others. The duty arises when the firm knows, suspects, or has reason to suspect that funds come from illegal activity, that a transaction has no apparent lawful purpose, that it is designed to evade reporting requirements, or that the institution is being used to facilitate criminal activity. A dollar floor applies as well as the suspicion test, and it is not the same for everyone: at least USD 5,000 for a bank and at least USD 2,000 for a money services business, rising to USD 5,000 where an issuer of money orders or traveler’s checks identifies the activity from clearance records. Which firms are caught is worth checking rather than assuming — the money services business rule does not reach check cashers.
Suspicion, not proof
The test sits well below certainty, and “has reason to suspect” sits below suspicion again. A firm is not expected to prove a crime and is not expected to investigate one; it is expected to describe what it saw clearly enough that an investigator can act on it. Most filings begin as an alert from transaction monitoring or as a report from a member of staff, which is reviewed and then either written up or documented as closed. The clock is 30 calendar days from the date the firm first detects facts that may form a basis for filing; a bank that cannot identify a suspect may take a further 30 days, to 60 in all, while a money services business has no equivalent extension. Where the activity continues, further reports follow rather than one filing standing in for everything afterwards.
Confidentiality
The existence of a filing is confidential. The customer cannot be told, and nor can anyone outside the permitted channels — the prohibition is usually called the bar on tipping off. In exchange, the statute gives firms a safe harbor from civil liability for having made the report, which is why a well-documented filing on a customer who turns out to be entirely legitimate is not, by itself, a problem.
Other countries use the same phrase for their own version, filed with their own financial intelligence unit rather than with FinCEN, while some use “suspicious transaction report” instead. The obligations look similar from a distance and the filing rules are not interchangeable.
In practice
Once the suspicion test and the dollar floor are both met, filing is mandatory rather than discretionary, and the report is due within 30 calendar days of the firm first detecting the facts behind it — a bank with no suspect identified gets 30 more, a money services business does not. Telling the customer that a report has been made, or is being considered, is separately prohibited.
Example
An alert shows a money services business customer receiving funds from twelve unrelated senders and forwarding them abroad the same day. The analyst finds no commercial explanation for the pattern and a report is filed. When the firm later closes the account, it tells the customer only that it can no longer provide service — saying why would be tipping off.
Commonly confused with
| Term | How it differs |
|---|---|
| Currency Transaction Report | A CTR is filed because a cash transaction crossed a set size, with no judgment involved; a SAR is filed because someone formed a suspicion, and there is no threshold to hide behind. |
| SAR (Saudi riyal) | Elsewhere on this site SAR is the ISO currency code for the Saudi riyal; in a compliance context the same three letters mean the suspicious activity report. |
See also
- Bank Secrecy ActThe Bank Secrecy Act is the 1970 United States statute, heavily amended since, that requires banks, money services businesses and other financial institutions to keep records, register where applicable, report large cash transactions and suspicious activity, and maintain an anti-money-laundering program.
- Currency Transaction ReportA Currency Transaction Report, or CTR, is a report a United States financial institution files with FinCEN when currency transactions by or on behalf of one person exceed USD 10,000 in a single business day. It is triggered by an amount of cash, not by anything suspicious.
- FinCENThe bureau of the US Treasury that administers the Bank Secrecy Act. FinCEN writes the anti-money-laundering rules applying to financial institutions, receives suspicious activity and currency transaction reports, and maintains the federal register of money services businesses.
- Transaction MonitoringTransaction monitoring is the ongoing review of customer activity — automated rules and models plus human investigation — against what the firm expected that customer to do and against known laundering patterns. Activity that does not fit produces an alert for someone to work.