Suspicious Activity Reporting: How to File a SAR or STR

In most practical respects, nothing: Both are confidential reports that a regulated business files with its national financial intelligence unit when it suspects money laundering, terrorist financing, fraud, or other financial crime. The difference is mainly terminology. SAR, or suspicious activity report, is the term used in the United States and the United Kingdom. STR, or suspicious transaction report, is the term used in many other jurisdictions, including much of the EU, the Middle East, and Asia, and it reflects the FATF Recommendations' original language about reporting suspicious transactions.

Some jurisdictions draw a real distinction between the two. The UAE, for example, uses STR for a report about a specific suspicious transaction and SAR for suspicious behavior or activity that does not involve a transaction, such as a prospective customer who abandons onboarding when asked about the source of funds. The draft EU reporting format that the Anti-Money Laundering Authority published for consultation in July 2026 follows a similar logic, allowing filers to mark a report as an STR, a SAR, or both, though it remains a draft with a phased rollout ahead of it.

What matters more than the label is the local rule set behind it. Thresholds, deadlines, portals, mandatory fields, and the treatment of attempted transactions all differ by jurisdiction. A US SAR has a 30-day deadline and dollar floors; a UK SAR has no fixed deadline but must be made as soon as is practicable and may require a defence against money laundering before a transaction proceeds; an EU STR must be made promptly, and from July 2027 the AML Regulation sets a common rule on refraining from transactions. A firm operating across several markets should map each one separately rather than assume a single process will satisfy all of them. Whatever it is called, the report has the same purpose: Giving the FIU a clear, timely account of why the activity looks suspicious.

It depends on the jurisdiction, and the rules are less uniform than many teams assume. In the United States, a SAR must be filed no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing. If no suspect has been identified at that point, the deadline can be extended by up to 30 more days to identify one, but in no case can reporting be delayed beyond 60 calendar days after initial detection. In situations requiring immediate attention, such as suspected terrorist financing or ongoing schemes, the institution must also notify law enforcement by telephone at once, in addition to filing.

The key interpretive point in the US is what counts as initial detection. The clock does not start when a monitoring system generates an alert. It starts when the institution, after reviewing the activity, knows or has reason to suspect that it meets the reporting criteria. That gives investigators time to do the work, but it does not permit alerts to sit indefinitely, because reviews must be completed within a reasonable period under documented procedures.

In the United Kingdom there is no fixed number of days. Staff must report internally to the nominated officer as soon as practicable, and the nominated officer must then make an external disclosure to the UKFIU as soon as practicable. Where a firm needs to carry out a transaction it suspects involves criminal property, it must seek a defence against money laundering first, and the UKFIU has seven working days to respond.

In the EU, obliged entities must report promptly, and from July 2027 the AML Regulation requires them to refrain from carrying out a suspected transaction until it has been reported, after which they may proceed if the FIU gives no contrary instruction within three working days.

A currency transaction report is a threshold report; a suspicious activity report is a judgment report. In the United States, a CTR must be filed whenever a person conducts cash transactions exceeding $10,000 in a single business day, whether in one transaction or several that aggregate above the threshold. It requires no suspicion at all, is due within 15 days, and covers entirely legitimate customers as a matter of course. Businesses that routinely handle large amounts of cash may qualify for exemptions.

A SAR is filed when the institution knows or suspects that a transaction involves funds from illegal activity, is designed to evade reporting requirements, has no apparent lawful purpose, or involves the institution in criminal activity. It applies to any instrument, not just cash, carries its own dollar thresholds, depends on analysis rather than arithmetic, and is strictly confidential. The volumes reflect the difference in design: In fiscal year 2025 US institutions filed about 21.5 million CTRs and 4.8 million SARs.

The two meet at structuring, which is the deliberate splitting of cash transactions to stay below the $10,000 CTR threshold. Structuring is itself a federal crime and a classic SAR trigger. FinCEN's October 2025 FAQs clarified that deposits near the threshold do not require a SAR on their own, unless there is reason to suspect they were arranged to evade reporting. A single transaction can require both reports: A $15,000 cash deposit always needs a CTR, and if the explanation for it does not hold together it may also need a SAR.

Both thresholds may change. Bills pending in Congress would raise the CTR threshold to $30,000 and the main SAR threshold from $5,000 to $10,000, with inflation adjustments, but until a law passes the current figures apply.

No. Disclosing that a SAR has been filed, or that one is being considered, is prohibited in every major regime. In the United States, the institution and its staff may not notify any person involved in the transaction that it has been reported, and the SAR itself, along with any information that would reveal its existence, is confidential. In the United Kingdom, disclosure is a criminal offense under two separate provisions, one covering tipping off and the other covering disclosures that are likely to prejudice an investigation. EU rules carry the same prohibition.

The reason is practical. A subject who learns that a report has been filed can move funds, destroy records, coordinate with associates, or disappear, and staff who make the disclosure may put themselves at risk. Confidentiality also protects the reporting system as a whole, because institutions are more willing to report when they know the report will not be revealed.

What staff can say is broader than many teams assume, and US regulators clarified it in a joint statement on 2 September 2026. The confidentiality rule protects the SAR, not the underlying facts. Staff may ask a customer about the purpose of a transaction or the source of funds, request due diligence documents, explain that an account restriction or closure may be related to suspected fraud, tell a customer that a deposit was rejected because of suspected check fraud, and warn customers about money mule schemes. What they may not do is confirm, deny, or hint that a SAR exists. The statement also made clear that a customer's ability to infer a SAR from the facts disclosed is not itself a prohibited disclosure.

The practical approach is to train customer-facing staff on scripted, fact-based language for account restrictions and exits, and to route any question about reporting to the compliance function.

A good narrative tells a reader who has never seen the case file exactly what happened and why it is suspicious, in plain language and in the order it happened. The reader may be an analyst at another agency opening the report months or years later, so the narrative has to stand on its own.

FinCEN's guidance organizes the content around five questions plus a sixth. Who was involved, with every identifier available, including names, dates of birth, account numbers, and identification numbers. What instruments, accounts, and products were used. When the activity happened, with exact dates. Where it happened, including branches, countries, and IP addresses where relevant. Why it is unusual for this customer, compared with their profile, similar customers, and normal use of the product. And how the activity worked, step by step. The why and the how carry the analysis; the other four carry the facts.

Structure helps the reader. Open with a short summary of the activity, the total amounts, the time frame, and the reason for filing. Then tell the story chronologically, listing individual transactions rather than a lump total. Close with what the institution did, such as restricting or closing the account, and note any prior reports or additional records held. In the UK, the portal asks for a one- or two-sentence summary and caps the reason for suspicion at 8,000 characters.

Clarity is the main quality control. Define every acronym, explain any product an outsider would not know, and separate facts from conclusions by describing what the customer did rather than labeling them. Avoid the common failures: Narratives that restate the form's fixed fields, placeholders such as "N/A" instead of the form's "unknown" option, categories the story never supports, and "see attached." A second reviewer before filing and periodic sampling of filed reports keep quality consistent.

The trigger is suspicion, not proof. A report is required when an institution knows, suspects, or has reasonable grounds to suspect that funds are the proceeds of crime or are related to terrorist financing, or, in the US formulation, that a transaction is designed to evade reporting requirements, has no apparent business or lawful purpose, or involves the use of the institution to facilitate criminal activity. The filer does not have to identify the underlying crime or prove it. In the UK, the courts have described suspicion as a possibility that is more than fanciful, which is a low bar but not a vague feeling of unease.

In practice, the triggers fall into recognizable patterns. Activity that does not fit what the institution knows about the customer is the most common: Volumes, counterparties, geographies, or products that are out of line with the stated business or income. Structuring, where cash is split to avoid reporting thresholds, is a classic trigger. So is a customer who becomes evasive or stalls when asked for due diligence information, or who abandons a transaction once questions begin. Links to sanctioned parties or high-risk jurisdictions, credible adverse media about the customer or their associates, and patterns matching published typologies or regulator advisories all raise suspicion. Fraud indicators, such as account takeovers, mule activity, and scam payments, increasingly drive filings as well.

Some events are prompts for review rather than triggers in themselves. A subpoena, a law enforcement inquiry, or a news report should lead to a fresh look at the customer, but it does not by itself require a report, and UK guidance stresses that suspicion has to be the firm's own rather than inherited from an outside request.

In the United States, dollar thresholds also apply: $5,000 for most bank SARs where a suspect can be identified, $25,000 where none can, any amount for insider abuse, and $2,000 for money services businesses.

Defensive filing is the practice of submitting reports where there is no genuine suspicion, to protect the institution against later criticism rather than to report something the filer actually believes is suspicious. It usually grows out of a culture where a missed report is punished but an unnecessary one costs nothing, so analysts learn to file whenever in doubt. The result is high SAR volumes with low intelligence value, longer queues for FIU analysts, and genuine leads buried among reports that should never have been filed.

Regulators have increasingly pushed back against it. In the United States, FinCEN's October 2025 FAQs clarified several points that had driven defensive behavior. Activity near the $10,000 cash threshold does not require a SAR unless there is reason to suspect it was structured to evade reporting. There is no regulatory requirement to document a decision not to file, though a short note is sufficient if a firm chooses to keep one. And a fixed periodic review of continuing activity after a SAR is not mandatory. The FFIEC examination manual has also long instructed examiners not to criticize a reasoned decision not to file unless the failure is significant or accompanied by evidence of bad faith.

The UK FIU has made similar points about the quality of reports, emphasizing that a smaller number of well-reasoned SARs is more useful than a large number of poorly explained ones.

The fix is not to file less for its own sake but to file on suspicion. That means a clear internal standard for what suspicion means, decision-makers who are trained and empowered to decide not to file, concise documentation of the reasoning either way, and a quality assurance process that looks at whether filed reports contain real analysis. A program that does this well will often see volumes fall and usefulness rise.

Access is tightly controlled, and the circle is smaller than many filers assume. In the United States, SARs are held by FinCEN in its database, where they are available to authorized users at federal, state, and local law enforcement agencies, financial regulators, and certain other government bodies, subject to access agreements and audit. The filing institution's own regulator can review SARs and the supporting documentation during an examination. FinCEN can also share information with foreign FIUs through the Egmont Group. The subject of the report has no right to see it.

In the United Kingdom, SARs go to the UKFIU at the National Crime Agency and are made available to law enforcement agencies through a secure database, where they remain searchable for six years in most cases. Law enforcement uses them both to start investigations and to enrich existing ones. In the EU, reports go to the national FIU, which can share them with other member state FIUs and, under the new framework, with the Anti-Money Laundering Authority's coordination mechanisms.

Inside the filing institution, access should be limited to the people who need it: The compliance and investigation staff handling the case, the decision-maker, and those responsible for oversight and audit. US banks may share a SAR with a head office or controlling company, including one abroad, and with US affiliates that are themselves subject to SAR rules. The underlying facts can travel more widely, including under the Section 314(b) safe harbor, but the SAR itself does not.

If a SAR is requested through a subpoena or in civil litigation, the institution should decline to produce it and notify FinCEN and its regulator. Courts generally uphold the confidentiality of SARs, because the system depends on filers being confident that their reports will not reach the subject.

In the United States, an institution must retain a copy of every SAR it files, along with the original or a business record equivalent of all supporting documentation, for five years from the date of filing. Supporting documentation is treated as part of the report, so it must be produced to FinCEN, law enforcement, or the institution's regulator on request without the need for a subpoena. Many institutions keep related case files, alert records, and investigation notes for the same period so that the decision can be reconstructed during an examination.

In the United Kingdom, the Money Laundering Regulations require records of customer due diligence and transactions to be kept for five years after the end of the business relationship or the occasional transaction, and firms keep internal reports and nominated officer decisions under similar policies. Because the SAR Portal does not allow a filer to view or print a report after submission, UK reporters should save a copy before they submit it.

In the EU, the AML Regulation, which applies from July 2027, sets a common retention period of five years for records relating to customer due diligence and transactions, with the possibility of extension in some circumstances, and national laws currently set similar periods.

Retention rules interact with data protection law, which generally requires personal data to be deleted once it is no longer needed. The practical answer is a written retention policy that sets the period for each record type, ties it to the relevant legal requirement, provides for secure storage with restricted access given the confidentiality of SAR material, and builds in a deletion step at the end of the period unless a legal hold applies. Examiners will test whether that policy exists and whether it is followed.

AI can produce a useful first draft, but it cannot take responsibility for the report, and the institution remains accountable for every word that is filed. US rules neither expressly permit nor prohibit AI-generated narratives. A generative model with access to verified case data can assemble the structure FinCEN's guidance asks for, covering who, what, when, where, why, and how, and can lay out the timeline and transaction summary far faster than an analyst typing from scratch. That frees investigators to test the reasoning rather than format the document.

The risks are specific. Models can invent a date, an amount, or a link between parties that sounds plausible, so every fact in a draft must be traced back to evidence in the file. They tend toward boilerplate, which produces narratives that describe activity without explaining why it is suspicious for this particular customer. And they raise data-handling concerns: SAR information is confidential by regulation, so case data should only reach tools with strict access controls, full audit logging, and contractual limits on how vendors store and use inputs.

Regulatory signals are cautiously open. FinCEN's April 2026 proposed program rule names machine learning and generative AI as examples of innovative approaches and would allow the agency to treat their effective use as a mitigating factor, but it gives no specific guidance on reviewing AI-drafted narratives.

The practical approach is a documented workflow. Draft only from verified case data rather than from the model's general knowledge. Require a named, trained reviewer to approve every narrative before filing. Keep a record of what the model produced and what the reviewer changed. Test outputs against the six narrative questions and a quality checklist before relying on the tool at scale, and keep sampling filed reports afterwards. Used that way, AI improves speed and consistency without moving the decision away from the people accountable for it.