SAR (Suspicious Activity Report)

What Is a Suspicious Activity Report?

A suspicious activity report (SAR) is a confidential report that a regulated business submits to its national Financial Intelligence Unit (FIU) when it knows, suspects or has reasonable grounds to suspect that a customer's activity is connected to money laundering, terrorist financing or other criminal conduct. Many jurisdictions use the term suspicious transaction report (STR) for the same concept.

A SAR is not an accusation and does not require proof. It records that the firm has seen something it cannot reasonably explain, describes it, and passes it to the authority best placed to assess it alongside reports from other institutions and law enforcement data.

Why SARs Matter

SARs are the main way the private sector contributes intelligence to the fight against financial crime. FIUs analyze them to identify networks, support investigations, trace and recover assets, and produce typologies that help the whole sector.

For the reporting firm, SARs also carry legal significance:

• Failure to report where the legal threshold is met can expose the firm and, in some jurisdictions, individual employees to criminal or regulatory sanctions.
• Legal protection. Most regimes protect institutions and staff from civil liability for reports made in good faith.
• Confidentiality. Disclosing that a SAR has been filed, or is being considered, to the subject or anyone not entitled to know is generally prohibited.

When to File a SAR

Suspicion does not come from a single data point. It usually builds from a combination of factors that the firm cannot reconcile with what it knows about the customer. Common grounds include:

1. Transactions with no apparent economic or lawful purpose
2. Activity inconsistent with the customer's profile, income or stated business
3. Structuring of deposits or transfers to avoid reporting or monitoring thresholds
4. Rapid movement of funds in and out of an account with little balance retained
5. Use of third parties, nominees or newly formed companies without clear reason
6. Links to sanctioned persons, high-risk jurisdictions or adverse media about serious crime
7. Reluctance to provide information, or provision of false or inconsistent documents

Monitoring alerts and screening matches are inputs to that judgment, not substitutes for it. An analyst investigates, gathers context and decides whether the threshold for suspicion is met.

How SARs Work in Major Jurisdictions

United States

Under the Bank Secrecy Act, banks and other covered institutions must file SARs with FinCEN for suspicious transactions that meet dollar thresholds set in FinCEN's rules, which differ by type of institution. For banks, the thresholds include $5,000 where a suspect can be identified and $25,000 regardless of whether a suspect can be identified, with insider abuse reportable at any amount. For money services businesses, the threshold is generally $2,000. A SAR is generally due within 30 calendar days of initial detection of facts that may constitute a basis for filing; if no suspect is identified, the period may be extended by up to another 30 days. SARs and supporting documentation must be retained for five years.

United Kingdom

Under the Proceeds of Crime Act 2002 and the Terrorism Act 2000, firms in the regulated sector report to the UK Financial Intelligence Unit within the National Crime Agency. Staff report internally to the firm's nominated officer, usually the MLRO, who decides whether to submit an external SAR. Where a firm needs to proceed with a transaction it suspects involves criminal property, it can request a defence against money laundering (DAML) through an authorised disclosure.

European Union

Obliged entities report suspicious transactions to the national FIU under the AML Directives, and this framework is now carried forward in the AML Regulation (EU) 2024/1624. Firms are generally expected to refrain from carrying out transactions they suspect until they have reported, where that is possible.

Regulatory Expectations

FATF Recommendation 20 requires prompt reporting of suspicion to the FIU, and Recommendation 21 sets out protection for good faith reporting and the prohibition on tipping off. Supervisors generally expect firms to have clear internal escalation routes, trained staff, a properly resourced nominated officer or SAR team, documented decisions on alerts that were investigated but not reported, and quality assurance over report content.

Writing an Effective SAR

The narrative is the most valuable part of the report. A useful narrative:

• States clearly why the activity is suspicious, not only what happened
• Identifies all subjects with the identifiers the firm holds
• Describes the transactions with dates, amounts, accounts and counterparties
• Explains the customer's expected activity and how the actual activity differs
• Notes any relevant screening hits, adverse media or prior reports
• Uses plain language and avoids internal codes and jargon

Common Challenges

• Defensive filing. Reporting everything that triggers an alert, without real analysis, floods the FIU with low-value reports.
• Missed deadlines. Investigations that stall can push reports past legal deadlines.
• Weak narratives. Reports that list transactions without explaining suspicion are hard for FIUs to use.
• Inconsistent decisions. Similar cases handled differently by different analysts point to unclear guidance.

How on8.ai Helps

Screening evidence often forms part of a SAR. SmartSanction returns the reasoning behind every sanctions, PEP and risk match, and its ownership graph shows how a customer connects to listed persons, which helps analysts document why a link is relevant.

Related Terms

• Regulatory Reporting
• Financial Intelligence Unit (FIU)
• Transaction Monitoring System (TMS)
• AML Compliance Officer
• Smurfing
• Whistleblower