Suspicious Activity Report

Financial institutions must file a SAR when they detect a known or suspected violation of federal law or a suspicious transaction relevant to a possible violation of law or regulation. A transaction is reportable if it involves or aggregates to $5,000 or more in funds or other assets (or $2,000 for money services businesses). The trigger is not solely based on the dollar amount but on the institution's suspicion, derived from transaction monitoring rules, employee referrals, or law enforcement inquiries.

Every SAR narrative must address the Five Essential Elements of a violation to provide law enforcement with actionable intelligence:

• Who: Identifying information on the subject(s) conducting the suspicious activity.
• What: The specific financial instruments, accounts, and mechanisms involved.
• When: The precise timeline, including the date of first activity and the date the suspicious activity was detected.
• Where: The physical location, branch, or digital channel where the activity occurred.
• Why: A detailed description of why the activity is suspicious, connecting the behavior to a specific typology (e.g., structuring, layering).

SARs are strictly confidential. Federal law (31 U.S.C. 5318(g)(2)) prohibits financial institutions from notifying any person involved in the transaction that a SAR has been filed. This prohibition is absolute. The same statute provides a Safe Harbor provision, protecting financial institutions and their employees from civil liability for reporting suspicious activities, provided the report is made in good faith. This legal shield is critical for encouraging robust compliance.

The Bank Secrecy Act mandates strict timelines for SAR submission. A financial institution must file a SAR no later than 30 calendar days from the date of initial detection of the suspicious activity. If no suspect can be identified on the date of detection, the institution may delay filing for an additional 30 calendar days (totaling 60 days) to attempt identification. These deadlines are non-negotiable and are a key metric in regulatory examinations.

The narrative section is the most critical part of a SAR. It must be a chronological, factual, and objective account of the activity. The narrative should:

• Begin with an executive summary of the suspicious activity.
• Detail the transactional sequence with specific dates, amounts, and account numbers.
• Explain the method of operation (e.g., micro-structuring, rapid movement of funds).
• Conclude by explicitly stating the suspected violation (e.g., 18 U.S.C. § 1956 - Money Laundering). A well-written narrative transforms raw transaction data into a coherent story for investigators.

When suspicious activity continues after an initial SAR is filed, a Continuing Activity SAR is required. These reports must be filed at intervals of 120 days from the previous filing. They serve to update law enforcement on the ongoing nature of the scheme, providing new transaction details and any additional identifying information discovered. This mechanism ensures that investigations have a rolling, up-to-date intelligence feed on persistent criminal behavior.

A mandatory FinCEN filing for cash transactions exceeding $10,000 in a single business day. Unlike a SAR, a CTR is transactional and threshold-based rather than judgment-based.

• Filed on FinCEN Form 112 within 15 days
• Multiple transactions under $10,000 aggregated if they appear connected
• Structuring — deliberately breaking up deposits to avoid CTR triggers — is itself a SAR-reportable offense
• CTR data feeds into FinCEN's Bank Secrecy Act database used by law enforcement

The institutional framework of policies, procedures, and internal controls that financial institutions must maintain to detect and report suspicious activity. A compliant AML program is the operational engine that generates SAR filings.

• Four pillars: internal controls, independent testing, designated BSA officer, ongoing training
• Must be risk-based — calibrated to the institution's products, geographies, and customer base
• Failure to maintain an adequate program is itself a violation of the Bank Secrecy Act
• SAR filing is a direct output of transaction monitoring systems within the AML program

The automated software platform that ingests transaction data and applies rules, scenarios, and machine learning models to flag potentially suspicious activity for investigator review. These systems are the primary alert generation engine upstream of SAR filing.

• Typical scenarios include structuring detection, velocity checks, and peer-group deviation
• Modern systems incorporate unsupervised anomaly detection to identify novel typologies
• Alert-to-SAR conversion rates are a key performance metric for tuning false positive thresholds
• Must be periodically validated under model risk management frameworks

The statutory protection under 31 U.S.C. § 5318(g)(3) that shields financial institutions and their employees from civil liability for disclosing suspicious activity to the government. This provision is the legal backbone enabling candid SAR narratives.

• Protects against defamation, breach of contract, and privacy claims
• Covers disclosures to law enforcement and FinCEN, not public disclosure
• Prohibition on tipping off — institutions cannot notify the subject that a SAR has been filed
• Safe harbor does not protect against criminal liability for the underlying conduct

The strict legal prohibition against disclosing the existence or contents of a SAR to any person involved in the reported transaction. 31 CFR § 1020.320(e) mandates that SARs and any information revealing their existence are confidential.

• Cannot be disclosed in civil discovery or subpoena responses
• Violations carry criminal penalties including imprisonment
• Creates operational challenges for information sharing between affiliated institutions
• Exceptions exist for law enforcement requests and certain regulatory examinations