Suspicious Activity Report (SAR)

The cornerstone of the SAR regime is strict confidentiality. Financial institutions and their employees are prohibited from notifying any person involved in the transaction that a SAR has been filed. This is paired with a safe harbor provision under the Annunzio-Wylie Anti-Money Laundering Act, which provides complete civil liability protection to institutions and employees who report suspicious activity, shielding them from lawsuits by the reported subjects.

• Prohibition: Tipping off a subject is a federal criminal offense.
• Protection: Absolute immunity from civil suits for reporting known or suspected criminal violations.
• Scope: Covers the filing institution, its directors, officers, and employees.

A complete SAR filing is structured around five critical narrative and data components that allow law enforcement to assess and act upon the intelligence:

• Subject Information: Full legal name, aliases, addresses, tax identification numbers, and government-issued ID details.
• Suspicious Activity Characterization: A classification of the suspected crime from over 80 standardized categories (e.g., structuring, money laundering, terrorist financing, identity theft).
• Financial Instrument Details: Specific accounts, wire transfers, monetary instruments, and virtual currency wallet addresses involved.
• Transaction Narrative: A chronological, factual, and concise description of why the activity is suspicious, answering the who, what, when, where, and why.
• Filing Institution Data: The filer's contact information, charter number, and primary federal regulator.

The Bank Secrecy Act (BSA) imposes strict, non-negotiable deadlines for SAR submission, triggered by the date of detection of the suspicious activity:

• 30-Day Rule: A SAR must be filed no later than 30 calendar days from the date the financial institution initially detects facts that may constitute a basis for filing.
• 60-Day Extension: If no suspect can be identified on the date of detection, the institution may defer filing for an additional 30 calendar days (totaling 60 days) to positively identify a subject.
• Immediate Threat: In cases involving potential terrorist financing or ongoing major crimes, immediate notification via a SAR and direct contact with law enforcement is required, bypassing standard timelines.

The written narrative is the most scrutinized section of a SAR. It must transform raw transaction data into a coherent, actionable intelligence product. Effective narratives are:

• Factual and Objective: Avoid speculation, conclusory statements, or unsubstantiated adjectives. Describe what happened, not what you suspect.
• Chronological: Present events in the order they occurred to establish a logical flow of activity.
• Complete: Explain why the activity is unusual for that specific customer or business type, referencing expected vs. actual behavior.
• Clear: Use plain language accessible to agents and prosecutors who may lack specialized financial expertise. Define all acronyms on first use.

When suspicious conduct persists after an initial filing, a continuing activity SAR is required. This is not a simple update but a comprehensive review of the ongoing scheme.

• Filing Cadence: Must be filed at least every 120 calendar days from the date of the previous SAR on the same subject.
• Cumulative Narrative: The narrative should summarize the initial suspicious activity and detail all new activity that occurred during the 120-day review period.
• Threshold: A continuing SAR is only required if the aggregate suspicious activity during the review period meets or exceeds the mandatory filing threshold (if any) or continues to warrant law enforcement attention.

While the SAR form itself is the primary filing, the institution must maintain a supporting documentation file for five years from the date of filing. This file is not submitted with the SAR but must be made available to regulators and law enforcement upon request.

• Contents: Copies of transaction records, account statements, customer identification documents, internal investigation notes, and any other business records used to support the filing.
• Identification: The file must be clearly identified as the supporting documentation for a specific SAR and be retrievable by the SAR's unique Document Control Number (DCN).
• Prohibition: The supporting file must not contain any document that would reveal the existence of the SAR to the subject, such as a copy of the SAR narrative itself.