Three dates frame the US report:
- 28 October 1992: Congress let the Treasury require financial institutions to "report any suspicious transaction relevant to a possible violation of law or regulation" (31 U.S.C. 5318(g)).
- 1 April 2013: electronic filing became mandatory for SARs (OCC).
- Fiscal year 2025: FinCEN received 4.8 million suspicious activity reports (FinCEN Year in Review FY 2025, p. 10).
What is a suspicious activity report (SAR), and why are SARs used?
The full form of SAR is suspicious activity report. Under 31 CFR 1020.320, a US bank reports a transaction "conducted or attempted" through it that "involves or aggregates at least $5,000" once it "knows, suspects, or has reason to suspect" one of three things: the funds come from or hide illegal activity, the transaction is designed to evade the Bank Secrecy Act (BSA), or it has "no business or apparent lawful purpose" the bank can explain.
SARs carry the findings of a transaction monitoring program to investigators. In fiscal year 2025, 89.3 percent of the IRS Criminal Investigation cases opened from a BSA filing started with a SAR (Year in Review, p. 9). The UKFIU sends the most sensitive SARs to investigators and makes the rest available to UK law enforcement (NCA).
Under the FATF standard, a firm that suspects criminal proceeds or terrorist financing should report "promptly" to the financial intelligence unit (FIU) (FATF Recommendations, R.20). FATF calls the same filing a suspicious transaction report (STR).
Outside compliance, SAR is the Saudi riyal (code 682 in the ISO 4217 list SIX published on 17 September 2026).
Who is required to file a SAR?
US floors differ by filer: banks, casinos, broker dealers, mutual funds, insurers and futures firms report from at least $5,000, money services businesses (MSBs) from $2,000.
The UK ties the duty to the work. POCA s330 covers anyone whose suspicion arises "in the course of a business in the regulated sector", and the NCA lists solicitors, accountants and estate agents among the reporters.
UK staff disclose to their nominated officer, often the MLRO, who decides whether a report goes on; in smaller firms the AML compliance officer may hold that role.
When should a SAR be filed?
Picture a money transmitter (illustrative): three unexplained $800 transfers in one day to a beneficiary added that morning. 31 CFR 1022.320 covers a transaction that "involves or aggregates" at least $2,000, and the suspicion can rest on "a pattern of transactions". Together they make $2,400. Unless the MSB has a reasonable explanation, the pattern is reportable.
An MSB files "no later than 30 calendar days after the date of the initial detection"; a bank with no suspect yet may take 30 more days, never past 60 (1020.320(b)(3)).
"The same suspicion runs on different clocks: a US bank files within 30 calendar days of initial detection (31 CFR 1020.320), an Indian reporting entity within seven working days of being satisfied the transaction is suspicious (FIU India), and staff in a UK regulated business disclose as soon as is practicable (POCA s330), so a group policy that copies the US 30 days into its Indian entity is late from the eighth working day," Ufuk Gürdaş, this entry's reviewer, notes.
Which examples set off a SAR?
Common triggers and what each can mean:
- cash kept just under a reporting line, which can be structuring meant to evade the BSA;
- transfers abroad with no stated reason, which can have no apparent lawful purpose;
- money in and straight out again, the pattern of a possible money mule account.
What needs to be in a SAR?
What a complete SAR carries:
- Customer information. Names, addresses, identifiers and accounts, with what KYC found at account opening and in due diligence (FinCEN narrative guidance).
- The activity. Dates, amounts and accounts, so investigators can follow the pattern.
- The narrative. The only free text area, where the filer describes the activity through FinCEN's five W's (who, what, when, where and why) plus how.
- Supporting documentation. Kept five years by the institution, yet "deemed to have been filed with the SAR" (1020.320(d)).
A SAR, and anything that would reveal it, is confidential (1020.320(e)); FATF R.21 asks for a legal ban on this tipping off.
Which laws require a SAR, and where is it submitted?
Table 1. One suspicion, four rulebooks: suspicious activity reporting in the USA, the UK, Canada and India.
| Country | Report | Received by | AML and CFT law | Amount floor | Filing deadline | Filed online through |
|---|---|---|---|---|---|---|
| USA | Suspicious activity report (SAR) | FinCEN | 31 U.S.C. 5318(g); 31 CFR 1020.320 and the sector rules | At least $5,000; MSBs $2,000 | 30 calendar days from detection; 60 at most for a bank with no suspect yet | BSA E-Filing System |
| UK | SAR | UKFIU, part of the NCA | POCA s330 | None in s330 | As soon as is practicable | SAR Portal |
| Canada | Suspicious transaction report (STR) | FINTRAC | Proceeds of Crime (Money Laundering) and Terrorist Financing Act | "There is no monetary threshold" (FINTRAC) | As soon as practicable | FINTRAC Web Reporting System or API |
| India | STR | FIU India | PMLA, 2002 and PMLA Rules, 2005 | "Regardless of the value involved" | Seven working days from being satisfied | FINnet |
The UK, Canadian and Indian reports also cover terrorist financing (the Terrorism Act 2000, FINTRAC's guidance, India's definition). In the European Union, Article 69 of Regulation (EU) 2024/1624 requires reports to the FIU "regardless of the amount involved" from 10 July 2027.
What is a SAR called in Indian banking?
In Indian banking the SAR is an STR, sent to FIU India by the reporting entity's principal officer. The FIU's FAQ covers any transaction, "including an attempted transaction, whether or not made in cash", that raises reasonable suspicion "regardless of the value involved". One cash deposit can need both an STR and a cash transaction report.
Where can I find the SAR report form?
Filers submit through the portals in Table 1's last column, and Singapore's STRO uses SONAR. In the UK, 848,036 of the 866,616 SARs submitted from April 2024 to March 2025 (97.86 percent) came through the SAR Portal (UKFIU SARs Annual Report 2025, p. 6).
Where does a SAR sit in transaction monitoring?
A SAR closes the suspicious activity reporting process:
- Alert. A rule or model flags a transaction or a pattern.
- Review. An analyst checks the customer's profile, history and counterparties.
- Decision. The officer decides whether the suspicion is met and writes down why.
- Filing. The SAR goes to the FIU before the deadline.
In the transaction monitoring software of complead, formerly Sanction Scanner, the alert at step 1 shows which rule fired and which signals matched, and the record of step 3 names who decided.
What keeps SAR compliance working?
Four habits keep SAR decisions defensible in an audit: training on real red flags, one case owner from alert to filing, a written reason for every decision, and internal audit sampling of closed cases.
What are the penalties for not filing a SAR?
Brink's Global Services USA, an unregistered money services business moving bulk cash from Mexican entities, "did not file any SARs" from 7 October 2018 to 22 October 2020. In a 2025 consent order, FinCEN identified "hundreds of suspicious transactions" Brink's failed to report and imposed a $37 million civil penalty, crediting $20 million paid to the DOJ.
A willful BSA violation is also a crime. The basic penalty is a fine of up to $250,000, five years in prison, or both (31 U.S.C. 5322). In the UK, failing to disclose under s330 carries up to five years, a fine or both on indictment (POCA s334).
Related terms
- Currency transaction report (CTR). Cash above a set amount, suspicious or not.
- Structuring. Splitting transactions to stay under a reporting line.
- Know your transaction (KYT). Testing each payment against the customer's expected activity.
- AML compliance officer. Runs the AML program.
- Money mule. Moves criminal money for someone else.
- Transaction laundering. A hidden business paid through another merchant's account.
