Suspicious Activity Reports: Identification of Suspicious Activity and Filing SARs

Suspicious Activity Reports

Suspicious Activity Reports or SARs alert law enforcement to potential instances of money laundering or terrorist financing. SARs are made by financial institutions and other professionals such as solicitors, accountants, and estate agents. They are a vital source of intelligence on economic crime and a wide range of criminal activity. They provide information and intelligence from the private sector that would otherwise not be visible to law enforcement. SARs can also be submitted by private individuals who have suspicion or knowledge of money laundering or terrorist financing. 

A process must be in place to identify the kinds of transactions and accounts that may exhibit indicia of suspicious activity to comply with the suspicious activity reporting regulation. Otherwise, a bank cannot ensure that it is reporting suspicious transactions as required by the Bank Secrecy Act.

Suspicious Activity Reports

Suspicious Activity Reports

The extent to which financial institutions must establish programs to review currency transactions to detect and report “structuring” when the conduct does not require the filing of a currency transaction report. The extent and parameters under which multiple-day monitoring for the potentially suspicious activity should be positively initiated.

Banks are generally required to file a SAR if a transaction involves or aggregates at least 5,000 US dollars in funds or other assets. Similarly, when the bank knows, suspects, or has reason to suspect that the transaction is designed to evade any requirements of the Bank Secrecy Act, such as structuring, a SAR should be filed. SAR must be reported merely on suspicion in some countries, so it depends from country to country. Relevant laws and regulations of the country should be considered and referred to.


Structuring is the breaking up of transactions to evade the Bank Secrecy Act reporting and recordkeeping requirements and, if appropriate thresholds are met, should be reported as a suspicious transaction. 

Forms of Structuring

Structuring can take two basic forms. First, a customer might deposit currency on multiple days in amounts under 10,000 US dollars, such as 9,990.00 US dollars, to circumvent a financial institution’s obligation to report any cash deposit over 10,000 US dollars on a currency transaction report. Although such deposits do not require aggregation for currency transaction reporting, since they occur on different business days, they nonetheless meet the definition of structuring under the Bank Secrecy Act, implementing regulations, and relevant case law. 

In another variation on basic structuring, a customer or customers may engage in multiple transactions during one day or over several days or more, in one or more branches of a bank, in a manner intended to circumvent either the currency transaction reporting requirement or some other Bank Secrecy Act requirement, such as the recordkeeping requirements for funds transfers of 3,000 US dollars or more. 

Structuring may indicate underlying illegal activity; further, structuring itself is unlawful under the Bank Secrecy Act. A financial institution’s anti-money laundering program should be designed to detect and report both categories of structuring to guard against the institution’s use for money laundering and ensure the institution complies with the suspicious activity reporting requirements of the Bank Secrecy Act. 

The extent and specific parameters under which a financial institution must monitor accounts and transactions for suspicious activity. It should be commensurate with the level of money laundering and terrorist financing risk of the specific institution, considering the type of products and services it offers, the locations it serves, and the nature of its customers. 

In other words, suspicious activity monitoring and reporting systems cannot be “one size fits all.”

The bank is responsible for establishing and implementing risk-based policies, procedures, and processes to comply with the Bank Secrecy Act and safeguard its operations from money laundering and terrorist financing. 

Certain financial institutions operating in the United States must file with the Financial Crimes Enforcement Network or FinCEN a report of any suspicious transaction relevant to a possible violation of law or regulation. 

Suspicious Activity Reports

The following financial institutions are required to file a FinCEN SAR: 

  • Banks, including bank and financial holding companies
  • Casinos and card clubs 
  • Money services businesses
  • Brokers or dealers in securities 
  • Mutual funds 
  • Insurance companies
  • Futures Commission Merchants and Introducing Brokers in Commodities
  • Residential Mortgage Lenders and Originators 

A SAR may be required to be filed no later than 30 calendar days after the date of the initial detection by the reporting financial institution of facts that may constitute a basis for filing a report. Suppose no suspect is identified on the date of such initial detection. In that case, a financial institution may delay filing a FinCEN SAR for an additional 30 calendar days to identify a suspect, but in no case shall reporting be delayed more than 60 calendar days after the date of such initial detection. 

General Filing Requirements for Financial Institutions

A financial institution must report any transaction conducted or attempted by, at, or through the financial institution and involves or aggregates at least 5,000 US dollars or 2,000 US dollars for money services businesses. The financial institution knows, suspects, or has reason to suspect that the transaction or pattern of transactions of which the transaction is a part of exhibits the following: 

  • Involves funds derived from illegal activity or is intended or conducted to hide or disguise funds or assets derived from illegal activity 
  • Is designed, whether through structuring or other means, to evade any relevant requirement of the Bank Secrecy Act
  • Has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage, and the financial institution knows of no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction
  • Involves the use of the financial institution to facilitate criminal activity

The statute forbids any filing institution or its personnel from notifying anyone involved in the transaction that it has been reported to protect the report’s confidentiality. A prohibition also extends to any government employee or officer unless the notification is necessary to fulfill the official duties of the employee or officer. In addition, the statute contains a “safe harbor,” which protects any financial institution and its personnel voluntarily or involuntarily filing a SAR from liability for failing to give notice of the report to any person identified in the report.

Suspicious Activity Reports

Final Thoughts

Suspicious Activity Reports (SARs) are used by financial institutions and other businesses to report suspected criminal activity or transactions to regulatory authorities. SARs are important tools for preventing and combating money laundering, terrorist financing, and other financial crimes. The identification of suspicious activity can vary depending on the type of business and the products or services offered.

Filing a SAR typically involves providing details about the suspected activity, such as the parties involved, the nature of the transactions, and any other relevant information. SARs are usually filed electronically, and businesses may be required to keep records of their SAR filings for a certain period of time.

It’s important to note that filing a SAR does not necessarily mean that a crime has been committed, but it does trigger an investigation by regulatory authorities. In some cases, businesses may be prohibited from informing customers or other parties about the filing of a SAR due to anti-tipping-off regulations.